v1.0.1: synchronous certificate pickup (Sectigo parity)

CERTInext.IntegrationTests/CERTInext.IntegrationTests.csproj

@@ -16,14 +16,16 @@
     <ProjectReference Include="..\CERTInext\CERTInext.csproj" />
   </ItemGroup>
 
-  <!-- DCV integration tests + the DNS validator implementations use the v3.3-only
-       IDomainValidator / IDomainValidatorFactory and the factory constructor. On the
-       IAnyCAPlugin 3.2.0 (no-DCV) build those don't exist, so exclude these files unless
-       SUPPORTS_DCV is defined. See issue 0003. -->
+  <!-- DCV integration tests + the DNS validator implementations (real and recording/spy)
+       use the v3.3-only IDomainValidator / IDomainValidatorFactory and the factory
+       constructor. On the IAnyCAPlugin 3.2.0 (no-DCV) build those don't exist, so exclude
+       these files unless SUPPORTS_DCV is defined. See issue 0003. -->
   <ItemGroup Condition="!$(DefineConstants.Contains('SUPPORTS_DCV'))">
     <Compile Remove="DcvLifecycleTests.cs" />
+    <Compile Remove="V2DcvLifecycleTests.cs" />
     <Compile Remove="CloudflareDomainValidator.cs" />
     <Compile Remove="StubDomainValidator.cs" />
+    <Compile Remove="RecordingDomainValidator.cs" />
   </ItemGroup>
 
   <ItemGroup>

CERTInext.IntegrationTests/CloudflareDomainValidator.cs

@@ -23,7 +23,7 @@ namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests
     /// Credentials are read from the <see cref="IntegrationTestFixture"/>:
     /// <c>CERTINEXT_CF_API_TOKEN</c> and <c>CERTINEXT_CF_ZONE_ID</c>.
     /// </summary>
-    internal sealed class CloudflareDomainValidator : IDomainValidator
+    internal sealed class CloudflareDomainValidator : IDomainValidator, IDisposable
     {
         private const string CfApiBase = "https://api.cloudflare.com/client/v4";
 
@@ -113,17 +113,21 @@ public async Task<DomainValidationResult> CleanupValidation(string key, Cancella
         public Task ValidateConfiguration(Dictionary<string, object> configuration) => Task.CompletedTask;
         public Dictionary<string, Keyfactor.AnyGateway.Extensions.PropertyConfigInfo> GetDomainValidatorAnnotations() => new();
         public string GetValidationType() => "dns-01";
+
+        public void Dispose() => _http.Dispose();
     }
 
-    internal sealed class CloudflareDomainValidatorFactory : IDomainValidatorFactory
+    internal sealed class CloudflareDomainValidatorFactory : IDomainValidatorFactory, IDisposable
     {
-        private readonly IDomainValidator _validator;
+        private readonly CloudflareDomainValidator _validator;
 
         public CloudflareDomainValidatorFactory(string apiToken, string zoneId)
         {
             _validator = new CloudflareDomainValidator(apiToken, zoneId);
         }
 
         public IDomainValidator ResolveDomainValidator(string domain, string validationType) => _validator;
+
+        public void Dispose() => _validator.Dispose();
     }
 }

CERTInext.IntegrationTests/DcvLifecycleTests.cs

@@ -40,17 +40,25 @@ namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests
     /// CERTINEXT_DCV_DOMAIN=<subdomain to use, e.g. dcv-test.example.com>
     /// </code>
     /// </summary>
-    public class DcvLifecycleTests : IClassFixture<IntegrationTestFixture>
+    public class DcvLifecycleTests : IClassFixture<IntegrationTestFixture>, IDisposable
     {
         private readonly IntegrationTestFixture _fixture;
         private readonly ITestOutputHelper _output;
+        private readonly List<IDisposable> _toDispose = new List<IDisposable>();
 
         public DcvLifecycleTests(IntegrationTestFixture fixture, ITestOutputHelper output)
         {
             _fixture = fixture;
             _output = output;
         }
 
+        public void Dispose()
+        {
+            foreach (var d in _toDispose)
+                d.Dispose();
+            _toDispose.Clear();
+        }
+
         // ---------------------------------------------------------------------------
         // Helpers
         // ---------------------------------------------------------------------------
@@ -69,11 +77,17 @@ private static string GenerateCsrPem(string commonName)
                 + "\n-----END CERTIFICATE REQUEST-----";
         }
 
-        private IDomainValidatorFactory BuildDnsFactory() =>
-            _fixture.IsCloudflareConfigured
-                ? (IDomainValidatorFactory)new CloudflareDomainValidatorFactory(
-                    _fixture.CloudflareApiToken, _fixture.CloudflareZoneId)
-                : new StubDomainValidatorFactory();
+        private IDomainValidatorFactory BuildDnsFactory()
+        {
+            if (_fixture.IsCloudflareConfigured)
+            {
+                var factory = new CloudflareDomainValidatorFactory(
+                    _fixture.CloudflareApiToken, _fixture.CloudflareZoneId);
+                _toDispose.Add(factory);
+                return factory;
+            }
+            return new StubDomainValidatorFactory();
+        }
 
         /// <summary>
         /// Runs <c>plugin.Synchronize</c> and returns every record that came out of the
@@ -88,6 +102,7 @@ private static async Task<List<AnyCAPluginCertificate>> RunSyncAsync(CERTInextCA
             var syncTask = Task.Run(async () =>
             {
                 await plugin.Synchronize(buffer, lastSync: null, fullSync: true, cancelToken: System.Threading.CancellationToken.None);
+                // Synchronize calls CompleteAdding() in its finally block; guard against double-call.
                 if (!buffer.IsAddingCompleted)
                     buffer.CompleteAdding();
             });
@@ -655,7 +670,6 @@ public async Task BulkDvEnrollment_AllOrdersIssue_AndPaginationWorks()
             List<AnyCAPluginCertificate> synced = null;
             System.Diagnostics.Stopwatch syncPhaseSw = System.Diagnostics.Stopwatch.StartNew();
             int passesUsed = 0;
-            int finalNotIssued = -1;
 
             for (int pass = 1; pass <= maxSyncPasses; pass++)
             {
@@ -664,13 +678,27 @@ public async Task BulkDvEnrollment_AllOrdersIssue_AndPaginationWorks()
                 synced = await RunSyncAsync(plugin);
                 passSw.Stop();
 
+                // Classify enrolled orders by their current status so that FAILED orders
+                // are not silently counted as still-pending, which would burn the full
+                // pass budget before producing a misleading "expected 0" assertion.
                 int generated = synced.Count(r => enrolledIds.Contains(r.CARequestID) && r.Status == (int)EndEntityStatus.GENERATED);
-                int pending   = enrolledIds.Count - generated;
-                finalNotIssued = pending;
+                int failed    = synced.Count(r => enrolledIds.Contains(r.CARequestID) && r.Status == (int)EndEntityStatus.FAILED);
+                int pending   = enrolledIds.Count - generated - failed;
 
                 _output.WriteLine(
                     $"--- Sync pass #{pass}: returned {synced.Count} records, {generated}/{enrolledIds.Count} GENERATED, " +
-                    $"{pending} still pending, elapsed={passSw.Elapsed:mm\\:ss} ---");
+                    $"{failed} FAILED, {pending} still pending, elapsed={passSw.Elapsed:mm\\:ss} ---");
+
+                if (failed > 0)
+                {
+                    var failedIds = synced
+                        .Where(r => enrolledIds.Contains(r.CARequestID) && r.Status == (int)EndEntityStatus.FAILED)
+                        .Select(r => r.CARequestID)
+                        .Take(5);
+                    Assert.Fail(
+                        $"Pass #{pass}: {failed} order(s) reached FAILED status and will never issue: " +
+                        string.Join(", ", failedIds));
+                }
 
                 if (pending == 0)
                     break;
@@ -696,10 +724,14 @@ public async Task BulkDvEnrollment_AllOrdersIssue_AndPaginationWorks()
                 $"{string.Join(", ", missing.Take(5))}{(missing.Count > 5 ? ", ..." : "")}");
 
             // Final assertion — every enrolled order must be GENERATED after the polling window.
-            var lookup = synced.ToDictionary(r => r.CARequestID, r => r);
+            // Filter null CARequestIDs before building the lookup (guards against any CA response
+            // that omits the ID, which would otherwise throw ArgumentNullException in ToDictionary).
+            var lookup = synced
+                .Where(r => r.CARequestID != null)
+                .ToDictionary(r => r.CARequestID, r => r);
             var notIssued = enrolledIds
+                .Where(id => lookup.TryGetValue(id, out var rec) && rec.Status != (int)EndEntityStatus.GENERATED)
                 .Select(id => lookup[id])
-                .Where(r => r.Status != (int)EndEntityStatus.GENERATED)
                 .ToList();
 
             if (notIssued.Count > 0)
@@ -711,7 +743,7 @@ public async Task BulkDvEnrollment_AllOrdersIssue_AndPaginationWorks()
 
             notIssued.Should().BeEmpty(
                 $"every enrolled DV order should auto-issue on the new sandbox after {maxSyncPasses} sync passes; " +
-                $"{notIssued.Count} did not (last pass: {finalNotIssued} pending).");
+                $"{notIssued.Count} did not.");
 
             _output.WriteLine($"--- SUCCESS: {count}/{count} DV orders enrolled, synced, and issued in {passesUsed} sync pass(es). " +
                               $"Enroll={sw.Elapsed:mm\\:ss}  SyncPhase={syncPhaseSw.Elapsed:mm\\:ss}  Total={(sw.Elapsed + syncPhaseSw.Elapsed):mm\\:ss} ---");

CERTInext.IntegrationTests/IntegrationTestFixture.cs

@@ -20,6 +20,23 @@ namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests
     /// </summary>
     public sealed class IntegrationTestFixture : IDisposable
     {
+        // ---------------------------------------------------------------------------
+        // Opt-in guard
+        // ---------------------------------------------------------------------------
+
+        /// <summary>
+        /// Env-var keys that must be set explicitly in the shell and must NOT be
+        /// auto-promoted from the env file.  These gate destructive or mutating tests
+        /// so a developer cannot accidentally arm them by leaving flags in ~/.env_certinext.
+        /// </summary>
+        private static readonly System.Collections.Generic.HashSet<string> _optInOnlyFlags =
+            new System.Collections.Generic.HashSet<string>(StringComparer.OrdinalIgnoreCase)
+            {
+                "CERTINEXT_COMPLETE_PENDING",
+                "CERTINEXT_RUN_BULK_TEST",
+                "CERTINEXT_V2_RUN_BULK_TEST",
+            };
+
         // ---------------------------------------------------------------------------
         // Credential properties
         // ---------------------------------------------------------------------------
@@ -85,8 +102,12 @@ public IntegrationTestFixture()
 
             // Promote env-file values into the process environment so that any code
             // calling System.Environment.GetEnvironmentVariable() picks them up.
+            // Opt-in destructive-test flags are deliberately excluded: they must be
+            // set explicitly in the shell so a developer who leaves them in the file
+            // does not accidentally arm bulk/mutating tests on every bare `dotnet test`.
             foreach (var kv in env)
-                if (System.Environment.GetEnvironmentVariable(kv.Key) == null)
+                if (System.Environment.GetEnvironmentVariable(kv.Key) == null
+                    && !_optInOnlyFlags.Contains(kv.Key))
                     System.Environment.SetEnvironmentVariable(kv.Key, kv.Value);
 
             ApiUrl        = GetEnvValue(env, "CERTINEXT_API_URL");

CERTInext.IntegrationTests/RecordingDomainValidator.cs

@@ -0,0 +1,94 @@
+// Copyright 2026 Keyfactor
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Keyfactor.AnyGateway.Extensions;
+
+namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests
+{
+    /// <summary>
+    /// <see cref="IDomainValidator"/> spy that wraps a real (Cloudflare or stub) validator
+    /// and records every <c>StageValidation</c>/<c>CleanupValidation</c> call, including the
+    /// FQDN and staged value, so DCV-on tests can assert whether the plugin actually staged
+    /// a TXT record rather than just asserting that Enroll did not throw (gap G5, issues/0020).
+    /// </summary>
+    internal sealed class RecordingDomainValidator : IDomainValidator
+    {
+        private readonly IDomainValidator _inner;
+        private readonly ConcurrentQueue<(string Fqdn, string Value)> _staged = new();
+        private readonly ConcurrentQueue<string> _cleanedUp = new();
+
+        public RecordingDomainValidator(IDomainValidator inner)
+        {
+            _inner = inner;
+        }
+
+        public IReadOnlyList<(string Fqdn, string Value)> StagedCalls => _staged.ToList();
+        public IReadOnlyList<string> CleanedUpFqdns => _cleanedUp.ToList();
+
+        public void Initialize(IDomainValidatorConfigProvider configProvider) => _inner.Initialize(configProvider);
+
+        public async Task<DomainValidationResult> StageValidation(string key, string value, CancellationToken cancellationToken)
+        {
+            _staged.Enqueue((key, value));
+            return await _inner.StageValidation(key, value, cancellationToken);
+        }
+
+        public async Task<DomainValidationResult> CleanupValidation(string key, CancellationToken cancellationToken)
+        {
+            _cleanedUp.Enqueue(key);
+            return await _inner.CleanupValidation(key, cancellationToken);
+        }
+
+        public Task ValidateConfiguration(Dictionary<string, object> configuration) => _inner.ValidateConfiguration(configuration);
+        public Dictionary<string, PropertyConfigInfo> GetDomainValidatorAnnotations() => _inner.GetDomainValidatorAnnotations();
+        public string GetValidationType() => _inner.GetValidationType();
+    }
+
+    /// <summary>
+    /// <see cref="IDomainValidatorFactory"/> that wraps another factory and hands out
+    /// <see cref="RecordingDomainValidator"/> spies so tests can inspect what the plugin
+    /// actually did with the DNS provider, keyed by (domain, validationType). Does not own
+    /// disposal of the wrapped factory — callers that build a disposable inner factory
+    /// (e.g. <c>CloudflareDomainValidatorFactory</c>) remain responsible for disposing it.
+    /// </summary>
+    internal sealed class RecordingDomainValidatorFactory : IDomainValidatorFactory
+    {
+        private readonly IDomainValidatorFactory _inner;
+        private readonly ConcurrentDictionary<string, RecordingDomainValidator> _wrapped = new();
+
+        public RecordingDomainValidatorFactory(IDomainValidatorFactory inner)
+        {
+            _inner = inner;
+        }
+
+        public IDomainValidator ResolveDomainValidator(string domain, string validationType)
+        {
+            string cacheKey = $"{domain}|{validationType}";
+            return _wrapped.GetOrAdd(cacheKey, _ => new RecordingDomainValidator(_inner.ResolveDomainValidator(domain, validationType)));
+        }
+
+        /// <summary>All StageValidation calls recorded across every domain resolved so far.</summary>
+        public IReadOnlyList<(string Fqdn, string Value)> StagedCalls =>
+            _wrapped.Values.SelectMany(v => v.StagedCalls).ToList();
+
+        /// <summary>All CleanupValidation calls recorded across every domain resolved so far.</summary>
+        public IReadOnlyList<string> CleanedUpFqdns =>
+            _wrapped.Values.SelectMany(v => v.CleanedUpFqdns).ToList();
+    }
+}