test: Wave 17 - insta snapshot tests for all key-type crates (#41)

EffortlessSteven · Copilot · web-flow · commit c804af9cb5ee · 2026-03-01T18:14:59.000-05:00
* test: add insta snapshot tests for key-type crates

Co-authored-by: Copilot &lt;223556219+Copilot@users.noreply.github.com&gt;

* fix: redact volatile x509 snapshot fields (timestamps vary across runs)

Co-authored-by: Copilot &lt;223556219+Copilot@users.noreply.github.com&gt;

* ci: trigger CI re-run

Co-authored-by: Copilot &lt;223556219+Copilot@users.noreply.github.com&gt;

---------

Co-authored-by: Copilot &lt;223556219+Copilot@users.noreply.github.com&gt;
diff --git a/crates/uselesskey-ecdsa/tests/snapshots/snapshots_ecdsa__ecdsa_der_lengths.snap b/crates/uselesskey-ecdsa/tests/snapshots/snapshots_ecdsa__ecdsa_der_lengths.snap
@@ -0,0 +1,12 @@
+---
+source: crates/uselesskey-ecdsa/tests/snapshots_ecdsa.rs
+expression: cases
+---
+- algorithm: ES256
+  curve: P-256
+  private_key_der_len: 138
+  public_key_der_len: 91
+- algorithm: ES384
+  curve: P-384
+  private_key_der_len: 185
+  public_key_der_len: 120
diff --git a/crates/uselesskey-ecdsa/tests/snapshots/snapshots_ecdsa__ecdsa_p256_private_pem_shape.snap b/crates/uselesskey-ecdsa/tests/snapshots/snapshots_ecdsa__ecdsa_p256_private_pem_shape.snap
@@ -0,0 +1,8 @@
+---
+source: crates/uselesskey-ecdsa/tests/snapshots_ecdsa.rs
+expression: shape
+---
+first_line: "-----BEGIN PRIVATE KEY-----"
+last_line: "-----END PRIVATE KEY-----"
+line_count: 5
+total_len: 241
diff --git a/crates/uselesskey-ecdsa/tests/snapshots/snapshots_ecdsa__ecdsa_p384_private_pem_shape.snap b/crates/uselesskey-ecdsa/tests/snapshots/snapshots_ecdsa__ecdsa_p384_private_pem_shape.snap
@@ -0,0 +1,8 @@
+---
+source: crates/uselesskey-ecdsa/tests/snapshots_ecdsa.rs
+expression: shape
+---
+first_line: "-----BEGIN PRIVATE KEY-----"
+last_line: "-----END PRIVATE KEY-----"
+line_count: 6
+total_len: 306
diff --git a/crates/uselesskey-ecdsa/tests/snapshots/snapshots_ecdsa__jwk_snapshots__ecdsa_kid_format.snap b/crates/uselesskey-ecdsa/tests/snapshots/snapshots_ecdsa__jwk_snapshots__ecdsa_kid_format.snap
@@ -0,0 +1,6 @@
+---
+source: crates/uselesskey-ecdsa/tests/snapshots_ecdsa.rs
+expression: info
+---
+len: 16
+is_base64url_chars: true
diff --git a/crates/uselesskey-ecdsa/tests/snapshots/snapshots_ecdsa__jwk_snapshots__ecdsa_p256_public_jwk.snap b/crates/uselesskey-ecdsa/tests/snapshots/snapshots_ecdsa__jwk_snapshots__ecdsa_p256_public_jwk.snap
@@ -0,0 +1,11 @@
+---
+source: crates/uselesskey-ecdsa/tests/snapshots_ecdsa.rs
+expression: shape
+---
+kty: EC
+crv: P-256
+alg: ES256
+use_: sig
+kid: "[REDACTED]"
+x: "[REDACTED]"
+y: "[REDACTED]"
diff --git a/crates/uselesskey-ecdsa/tests/snapshots/snapshots_ecdsa__jwk_snapshots__ecdsa_p384_public_jwk.snap b/crates/uselesskey-ecdsa/tests/snapshots/snapshots_ecdsa__jwk_snapshots__ecdsa_p384_public_jwk.snap
@@ -0,0 +1,11 @@
+---
+source: crates/uselesskey-ecdsa/tests/snapshots_ecdsa.rs
+expression: shape
+---
+kty: EC
+crv: P-384
+alg: ES384
+use_: sig
+kid: "[REDACTED]"
+x: "[REDACTED]"
+y: "[REDACTED]"
diff --git a/crates/uselesskey-ed25519/tests/snapshots/snapshots_ed25519__ed25519_der_lengths.snap b/crates/uselesskey-ed25519/tests/snapshots/snapshots_ed25519__ed25519_der_lengths.snap
@@ -0,0 +1,7 @@
+---
+source: crates/uselesskey-ed25519/tests/snapshots_ed25519.rs
+expression: result
+---
+algorithm: Ed25519
+private_key_der_len: 83
+public_key_der_len: 44
diff --git a/crates/uselesskey-ed25519/tests/snapshots/snapshots_ed25519__ed25519_private_pem_shape.snap b/crates/uselesskey-ed25519/tests/snapshots/snapshots_ed25519__ed25519_private_pem_shape.snap
@@ -0,0 +1,8 @@
+---
+source: crates/uselesskey-ed25519/tests/snapshots_ed25519.rs
+expression: shape
+---
+first_line: "-----BEGIN PRIVATE KEY-----"
+last_line: "-----END PRIVATE KEY-----"
+line_count: 4
+total_len: 168
diff --git a/crates/uselesskey-ed25519/tests/snapshots/snapshots_ed25519__ed25519_public_pem_shape.snap b/crates/uselesskey-ed25519/tests/snapshots/snapshots_ed25519__ed25519_public_pem_shape.snap
@@ -0,0 +1,8 @@
+---
+source: crates/uselesskey-ed25519/tests/snapshots_ed25519.rs
+expression: shape
+---
+first_line: "-----BEGIN PUBLIC KEY-----"
+last_line: "-----END PUBLIC KEY-----"
+line_count: 3
+total_len: 113
diff --git a/crates/uselesskey-ed25519/tests/snapshots/snapshots_ed25519__jwk_snapshots__ed25519_kid_format.snap b/crates/uselesskey-ed25519/tests/snapshots/snapshots_ed25519__jwk_snapshots__ed25519_kid_format.snap
@@ -0,0 +1,6 @@
+---
+source: crates/uselesskey-ed25519/tests/snapshots_ed25519.rs
+expression: info
+---
+len: 16
+is_base64url_chars: true
diff --git a/crates/uselesskey-ed25519/tests/snapshots/snapshots_ed25519__jwk_snapshots__ed25519_public_jwk.snap b/crates/uselesskey-ed25519/tests/snapshots/snapshots_ed25519__jwk_snapshots__ed25519_public_jwk.snap
@@ -0,0 +1,10 @@
+---
+source: crates/uselesskey-ed25519/tests/snapshots_ed25519.rs
+expression: shape
+---
+kty: OKP
+crv: Ed25519
+alg: EdDSA
+use_: sig
+kid: "[REDACTED]"
+x: "[REDACTED]"
diff --git a/crates/uselesskey-hmac/tests/snapshots/snapshots_hmac__hmac_secret_lengths.snap b/crates/uselesskey-hmac/tests/snapshots/snapshots_hmac__hmac_secret_lengths.snap
@@ -0,0 +1,10 @@
+---
+source: crates/uselesskey-hmac/tests/snapshots_hmac.rs
+expression: cases
+---
+- algorithm: HS256
+  secret_len: 32
+- algorithm: HS384
+  secret_len: 48
+- algorithm: HS512
+  secret_len: 64
diff --git a/crates/uselesskey-hmac/tests/snapshots/snapshots_hmac__jwk_snapshots__hmac_hs256_jwk.snap b/crates/uselesskey-hmac/tests/snapshots/snapshots_hmac__jwk_snapshots__hmac_hs256_jwk.snap
@@ -0,0 +1,9 @@
+---
+source: crates/uselesskey-hmac/tests/snapshots_hmac.rs
+expression: shape
+---
+kty: oct
+alg: HS256
+use_: sig
+kid: "[REDACTED]"
+k: "[REDACTED]"
diff --git a/crates/uselesskey-hmac/tests/snapshots/snapshots_hmac__jwk_snapshots__hmac_kid_format.snap b/crates/uselesskey-hmac/tests/snapshots/snapshots_hmac__jwk_snapshots__hmac_kid_format.snap
@@ -0,0 +1,13 @@
+---
+source: crates/uselesskey-hmac/tests/snapshots_hmac.rs
+expression: cases
+---
+- algorithm: HS256
+  kid_len: 16
+  is_base64url_chars: true
+- algorithm: HS384
+  kid_len: 16
+  is_base64url_chars: true
+- algorithm: HS512
+  kid_len: 16
+  is_base64url_chars: true
diff --git a/crates/uselesskey-rsa/tests/snapshots/snapshots_rsa__jwk_snapshots__rsa_2048_public_jwk.snap b/crates/uselesskey-rsa/tests/snapshots/snapshots_rsa__jwk_snapshots__rsa_2048_public_jwk.snap
@@ -0,0 +1,10 @@
+---
+source: crates/uselesskey-rsa/tests/snapshots_rsa.rs
+expression: shape
+---
+kty: RSA
+alg: RS256
+use_: sig
+kid: "[REDACTED]"
+n: "[REDACTED]"
+e: "[REDACTED]"
diff --git a/crates/uselesskey-rsa/tests/snapshots/snapshots_rsa__jwk_snapshots__rsa_kid_format.snap b/crates/uselesskey-rsa/tests/snapshots/snapshots_rsa__jwk_snapshots__rsa_kid_format.snap
@@ -0,0 +1,6 @@
+---
+source: crates/uselesskey-rsa/tests/snapshots_rsa.rs
+expression: info
+---
+len: 16
+is_base64url_chars: true
diff --git a/crates/uselesskey-rsa/tests/snapshots/snapshots_rsa__rsa_2048_private_pem_shape.snap b/crates/uselesskey-rsa/tests/snapshots/snapshots_rsa__rsa_2048_private_pem_shape.snap
@@ -0,0 +1,8 @@
+---
+source: crates/uselesskey-rsa/tests/snapshots_rsa.rs
+expression: shape
+---
+first_line: "-----BEGIN PRIVATE KEY-----"
+last_line: "-----END PRIVATE KEY-----"
+line_count: 28
+total_len: 1704
diff --git a/crates/uselesskey-rsa/tests/snapshots/snapshots_rsa__rsa_2048_public_pem_shape.snap b/crates/uselesskey-rsa/tests/snapshots/snapshots_rsa__rsa_2048_public_pem_shape.snap
@@ -0,0 +1,8 @@
+---
+source: crates/uselesskey-rsa/tests/snapshots_rsa.rs
+expression: shape
+---
+first_line: "-----BEGIN PUBLIC KEY-----"
+last_line: "-----END PUBLIC KEY-----"
+line_count: 9
+total_len: 451
diff --git a/crates/uselesskey-rsa/tests/snapshots/snapshots_rsa__rsa_der_lengths.snap b/crates/uselesskey-rsa/tests/snapshots/snapshots_rsa__rsa_der_lengths.snap
@@ -0,0 +1,10 @@
+---
+source: crates/uselesskey-rsa/tests/snapshots_rsa.rs
+expression: cases
+---
+- algorithm: RSA-2048
+  private_key_der_len: 1217
+  public_key_der_len: 294
+- algorithm: RSA-4096
+  private_key_der_len: 2375
+  public_key_der_len: 550
diff --git a/crates/uselesskey-token/tests/snapshots/snapshots_token__token_authorization_headers.snap b/crates/uselesskey-token/tests/snapshots/snapshots_token__token_authorization_headers.snap
@@ -0,0 +1,13 @@
+---
+source: crates/uselesskey-token/tests/snapshots_token.rs
+expression: cases
+---
+- kind: api_key
+  scheme: ApiKey
+  header_len: 47
+- kind: bearer
+  scheme: Bearer
+  header_len: 50
+- kind: oauth
+  scheme: Bearer
+  header_len: 260
diff --git a/crates/uselesskey-token/tests/snapshots/snapshots_token__token_oauth_shape.snap b/crates/uselesskey-token/tests/snapshots/snapshots_token__token_oauth_shape.snap
@@ -0,0 +1,8 @@
+---
+source: crates/uselesskey-token/tests/snapshots_token.rs
+expression: shape
+---
+kind: oauth_access_token
+len: 247
+segment_count: 3
+value: "[REDACTED]"
diff --git a/crates/uselesskey-x509/Cargo.toml b/crates/uselesskey-x509/Cargo.toml
@@ -36,3 +36,5 @@ jwk = ["dep:uselesskey-jwk", "uselesskey-rsa/jwk"]
 proptest.workspace = true
 rstest.workspace = true
 rand_chacha.workspace = true
+insta.workspace = true
+serde = { workspace = true, features = ["derive"] }
diff --git a/crates/uselesskey-x509/tests/snapshots/snapshots_x509__x509_cert_metadata.snap b/crates/uselesskey-x509/tests/snapshots/snapshots_x509__x509_cert_metadata.snap
@@ -0,0 +1,9 @@
+---
+source: crates/uselesskey-x509/tests/snapshots_x509.rs
+expression: meta
+---
+subject_cn: snap.example.com
+issuer_cn: snap.example.com
+is_self_signed: true
+version: 2
+serial_number: "[REDACTED]"
diff --git a/crates/uselesskey-x509/tests/snapshots/snapshots_x509__x509_cert_pem_shape.snap b/crates/uselesskey-x509/tests/snapshots/snapshots_x509__x509_cert_pem_shape.snap
@@ -0,0 +1,8 @@
+---
+source: crates/uselesskey-x509/tests/snapshots_x509.rs
+expression: shape
+---
+first_line: "-----BEGIN CERTIFICATE-----"
+last_line: "-----END CERTIFICATE-----"
+line_count: "[VOLATILE]"
+total_len: "[VOLATILE]"
diff --git a/crates/uselesskey-x509/tests/snapshots/snapshots_x509__x509_der_lengths.snap b/crates/uselesskey-x509/tests/snapshots/snapshots_x509__x509_der_lengths.snap
@@ -0,0 +1,6 @@
+---
+source: crates/uselesskey-x509/tests/snapshots_x509.rs
+expression: result
+---
+cert_der_len: "[VOLATILE]"
+private_key_der_len: "[VOLATILE]"
diff --git a/crates/uselesskey-x509/tests/snapshots/snapshots_x509__x509_private_key_pem_shape.snap b/crates/uselesskey-x509/tests/snapshots/snapshots_x509__x509_private_key_pem_shape.snap
@@ -0,0 +1,8 @@
+---
+source: crates/uselesskey-x509/tests/snapshots_x509.rs
+expression: shape
+---
+first_line: "-----BEGIN PRIVATE KEY-----"
+last_line: "-----END PRIVATE KEY-----"
+line_count: "[VOLATILE]"
+total_len: "[VOLATILE]"
diff --git a/crates/uselesskey-x509/tests/snapshots_x509.rs b/crates/uselesskey-x509/tests/snapshots_x509.rs
@@ -0,0 +1,115 @@
+//! Insta snapshot tests for uselesskey-x509.
+//!
+//! These tests snapshot certificate metadata (lengths, headers, subjects)
+//! to detect unintended changes. Key material is always redacted.
+
+mod testutil;
+
+use serde::Serialize;
+use testutil::fx;
+use uselesskey_x509::{X509FactoryExt, X509Spec};
+
+#[derive(Serialize)]
+struct PemShape {
+    first_line: String,
+    last_line: String,
+    line_count: usize,
+    total_len: usize,
+}
+
+fn pem_shape(pem: &str) -> PemShape {
+    let lines: Vec<&str> = pem.lines().collect();
+    PemShape {
+        first_line: lines.first().unwrap_or(&"").to_string(),
+        last_line: lines.last().unwrap_or(&"").to_string(),
+        line_count: lines.len(),
+        total_len: pem.len(),
+    }
+}
+
+#[test]
+fn snapshot_x509_cert_pem_shape() {
+    let fx = fx();
+    let spec = X509Spec::self_signed("snap.example.com");
+    let cert = fx.x509_self_signed("snap-cert", spec);
+    let shape = pem_shape(cert.cert_pem());
+    insta::assert_yaml_snapshot!("x509_cert_pem_shape", shape, {
+        ".total_len" => "[VOLATILE]",
+        ".line_count" => "[VOLATILE]",
+    });
+}
+
+#[test]
+fn snapshot_x509_private_key_pem_shape() {
+    let fx = fx();
+    let spec = X509Spec::self_signed("snap.example.com");
+    let cert = fx.x509_self_signed("snap-cert", spec);
+    let shape = pem_shape(cert.private_key_pkcs8_pem());
+    insta::assert_yaml_snapshot!("x509_private_key_pem_shape", shape, {
+        ".total_len" => "[VOLATILE]",
+        ".line_count" => "[VOLATILE]",
+    });
+}
+
+#[derive(Serialize)]
+struct CertDerLengths {
+    cert_der_len: usize,
+    private_key_der_len: usize,
+}
+
+#[test]
+fn snapshot_x509_der_lengths() {
+    let fx = fx();
+    let spec = X509Spec::self_signed("snap.example.com");
+    let cert = fx.x509_self_signed("snap-cert", spec);
+
+    let result = CertDerLengths {
+        cert_der_len: cert.cert_der().len(),
+        private_key_der_len: cert.private_key_pkcs8_der().len(),
+    };
+
+    insta::assert_yaml_snapshot!("x509_der_lengths", result, {
+        ".cert_der_len" => "[VOLATILE]",
+        ".private_key_der_len" => "[VOLATILE]",
+    });
+}
+
+#[test]
+fn snapshot_x509_cert_metadata() {
+    let fx = fx();
+    let spec = X509Spec::self_signed("snap.example.com");
+    let cert = fx.x509_self_signed("snap-cert", spec);
+
+    // Parse the certificate to extract metadata
+    let (_, parsed) =
+        x509_parser::parse_x509_certificate(cert.cert_der()).expect("valid DER certificate");
+
+    #[derive(Serialize)]
+    struct CertMetadata {
+        subject_cn: String,
+        issuer_cn: String,
+        is_self_signed: bool,
+        version: u32,
+        serial_number: String,
+    }
+
+    fn extract_cn(name: &x509_parser::prelude::X509Name<'_>) -> String {
+        name.iter_common_name()
+            .next()
+            .and_then(|cn| cn.as_str().ok())
+            .unwrap_or("")
+            .to_string()
+    }
+
+    let meta = CertMetadata {
+        subject_cn: extract_cn(parsed.subject()),
+        issuer_cn: extract_cn(parsed.issuer()),
+        is_self_signed: parsed.subject() == parsed.issuer(),
+        version: parsed.version().0,
+        serial_number: parsed.raw_serial_as_string(),
+    };
+
+    insta::assert_yaml_snapshot!("x509_cert_metadata", meta, {
+        ".serial_number" => "[REDACTED]",
+    });
+}
