gleep fixes mtls and stuff

app/apps/servers/tests/test_ca_file_recovery.py

@@ -0,0 +1,55 @@
+from __future__ import annotations
+
+import os
+import tempfile
+
+from django.test import TestCase, override_settings
+
+from apps.core.secret_files import parse_secret_ref
+from apps.keys.models import SSHCertificateAuthority
+from apps.servers.models import AgentCertificateAuthority
+
+
+class CASecretFileRecoveryTests(TestCase):
+    def test_user_ca_recovers_when_private_key_file_is_missing(self) -> None:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            missing_path = os.path.join(tmpdir, "missing-user-ca-key.pem")
+            with override_settings(KEYWARDEN_CA_KEY_DIR=tmpdir):
+                ca = SSHCertificateAuthority.objects.create(
+                    name="User CA Recovery",
+                    public_key="ssh-ed25519 AAAAinvalid",
+                    private_key=f"file://{missing_path}",
+                    is_active=True,
+                )
+
+                ca.ensure_material()
+                ca.save()
+
+                self.assertTrue(ca.public_key.startswith("ssh-ed25519 "))
+                self.assertTrue(ca.fingerprint.startswith("SHA256:"))
+                key_path = parse_secret_ref(ca.private_key)
+                self.assertTrue(key_path)
+                self.assertTrue(os.path.exists(key_path))
+                self.assertIn("BEGIN OPENSSH PRIVATE KEY", ca.get_private_key())
+
+    def test_agent_ca_recovers_when_private_key_file_is_missing(self) -> None:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            missing_path = os.path.join(tmpdir, "missing-agent-ca-key.pem")
+            with override_settings(KEYWARDEN_CA_KEY_DIR=tmpdir):
+                ca = AgentCertificateAuthority.objects.create(
+                    name="Agent CA Recovery",
+                    cert_pem="",
+                    key_pem=f"file://{missing_path}",
+                    is_active=True,
+                )
+
+                ca.ensure_material()
+                ca.save()
+
+                self.assertIn("BEGIN CERTIFICATE", ca.cert_pem)
+                self.assertTrue(ca.fingerprint)
+                self.assertTrue(ca.serial)
+                key_path = parse_secret_ref(ca.key_pem)
+                self.assertTrue(key_path)
+                self.assertTrue(os.path.exists(key_path))
+                self.assertIn("BEGIN RSA PRIVATE KEY", ca.get_key_pem())