test: facade and adapter snapshot tests

Adds insta snapshot tests for uselesskey facade, rustls adapter,
and tonic adapter crates.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: EffortlessSteven

Cargo.lock

@@ -43,3 +43,5 @@ rustls-aws-lc-rs = ["rustls?/aws_lc_rs"]
 uselesskey-core = { path = "../uselesskey-core", version = "0.3.0" }
 uselesskey-x509 = { path = "../uselesskey-x509", version = "0.3.0" }
 rustls = { version = "0.23", features = ["ring"] }
+serde.workspace = true
+insta.workspace = true

crates/uselesskey-rustls/Cargo.toml

@@ -0,0 +1,8 @@
+---
+source: crates/uselesskey-rustls/tests/snapshots_rustls.rs
+expression: result
+---
+leaf_cert_der_len: 803
+intermediate_cert_der_len: 802
+root_cert_der_len: 794
+chain_count: 2

crates/uselesskey-rustls/tests/snapshots/snapshots_rustls__rustls_chain_cert_der_lengths.snap

@@ -0,0 +1,7 @@
+---
+source: crates/uselesskey-rustls/tests/snapshots_rustls.rs
+expression: result
+---
+label: chain-leaf
+key_type: PKCS8
+key_der_len: "[REDACTED]"

crates/uselesskey-rustls/tests/snapshots/snapshots_rustls__rustls_chain_private_key_type.snap

@@ -0,0 +1,6 @@
+---
+source: crates/uselesskey-rustls/tests/snapshots_rustls.rs
+expression: result
+---
+label: self-signed
+cert_der_len: 758

crates/uselesskey-rustls/tests/snapshots/snapshots_rustls__rustls_self_signed_cert_der_len.snap

@@ -0,0 +1,7 @@
+---
+source: crates/uselesskey-rustls/tests/snapshots_rustls.rs
+expression: result
+---
+label: self-signed
+key_type: PKCS8
+key_der_len: "[REDACTED]"

crates/uselesskey-rustls/tests/snapshots/snapshots_rustls__rustls_self_signed_private_key_type.snap

@@ -0,0 +1,113 @@
+//! Insta snapshot tests for uselesskey-rustls adapter.
+//!
+//! These tests snapshot certificate and key shapes produced by the rustls adapter
+//! to detect unintended changes in adapter output.
+
+mod testutil;
+
+use serde::Serialize;
+use testutil::fx;
+use uselesskey_rustls::{RustlsCertExt, RustlsChainExt, RustlsPrivateKeyExt};
+use uselesskey_x509::{ChainSpec, X509FactoryExt, X509Spec};
+
+#[derive(Serialize)]
+struct CertDerSnapshot {
+    label: &'static str,
+    cert_der_len: usize,
+}
+
+#[derive(Serialize)]
+struct PrivateKeySnapshot {
+    label: &'static str,
+    key_type: &'static str,
+    key_der_len: usize,
+}
+
+#[test]
+fn snapshot_rustls_self_signed_cert_der_len() {
+    let fx = fx();
+    let cert = fx.x509_self_signed("snapshot-ss", X509Spec::self_signed("test.example.com"));
+
+    let cert_der = cert.certificate_der_rustls();
+
+    let result = CertDerSnapshot {
+        label: "self-signed",
+        cert_der_len: cert_der.as_ref().len(),
+    };
+
+    insta::assert_yaml_snapshot!("rustls_self_signed_cert_der_len", result);
+}
+
+#[test]
+fn snapshot_rustls_chain_cert_der_lengths() {
+    let fx = fx();
+    let chain = fx.x509_chain("snapshot-chain", ChainSpec::new("test.example.com"));
+
+    let chain_certs = chain.chain_der_rustls();
+    let root = chain.root_certificate_der_rustls();
+
+    #[derive(Serialize)]
+    struct ChainDerLengths {
+        leaf_cert_der_len: usize,
+        intermediate_cert_der_len: usize,
+        root_cert_der_len: usize,
+        chain_count: usize,
+    }
+
+    let result = ChainDerLengths {
+        leaf_cert_der_len: chain_certs[0].as_ref().len(),
+        intermediate_cert_der_len: chain_certs[1].as_ref().len(),
+        root_cert_der_len: root.as_ref().len(),
+        chain_count: chain_certs.len(),
+    };
+
+    insta::assert_yaml_snapshot!("rustls_chain_cert_der_lengths", result);
+}
+
+#[test]
+fn snapshot_rustls_self_signed_private_key_type() {
+    let fx = fx();
+    let cert = fx.x509_self_signed("snapshot-ss-key", X509Spec::self_signed("test.example.com"));
+
+    let key = cert.private_key_der_rustls();
+    let key_type = match &key {
+        rustls_pki_types::PrivateKeyDer::Pkcs1(_) => "PKCS1",
+        rustls_pki_types::PrivateKeyDer::Pkcs8(_) => "PKCS8",
+        rustls_pki_types::PrivateKeyDer::Sec1(_) => "SEC1",
+        _ => "Unknown",
+    };
+
+    let result = PrivateKeySnapshot {
+        label: "self-signed",
+        key_type,
+        key_der_len: key.secret_der().len(),
+    };
+
+    insta::assert_yaml_snapshot!("rustls_self_signed_private_key_type", result, {
+        ".key_der_len" => "[REDACTED]",
+    });
+}
+
+#[test]
+fn snapshot_rustls_chain_private_key_type() {
+    let fx = fx();
+    let chain = fx.x509_chain("snapshot-chain-key", ChainSpec::new("test.example.com"));
+
+    let key = chain.private_key_der_rustls();
+    let key_type = match &key {
+        rustls_pki_types::PrivateKeyDer::Pkcs1(_) => "PKCS1",
+        rustls_pki_types::PrivateKeyDer::Pkcs8(_) => "PKCS8",
+        rustls_pki_types::PrivateKeyDer::Sec1(_) => "SEC1",
+        _ => "Unknown",
+    };
+
+    let result = PrivateKeySnapshot {
+        label: "chain-leaf",
+        key_type,
+        key_der_len: key.secret_der().len(),
+    };
+
+    insta::assert_yaml_snapshot!("rustls_chain_private_key_type", result, {
+        ".key_der_len" => "[REDACTED]",
+    });
+}

crates/uselesskey-rustls/tests/snapshots_rustls.rs

@@ -0,0 +1,16 @@
+#![allow(unused)]
+
+use std::sync::OnceLock;
+
+use uselesskey_core::{Factory, Seed};
+
+static FX: OnceLock<Factory> = OnceLock::new();
+
+pub(crate) fn fx() -> Factory {
+    FX.get_or_init(|| {
+        let seed = Seed::from_env_value("uselesskey-rustls-snapshot-seed-v1")
+            .expect("test seed should always parse");
+        Factory::deterministic(seed)
+    })
+    .clone()
+}

crates/uselesskey-rustls/tests/testutil.rs

@@ -28,3 +28,5 @@ x509 = ["dep:uselesskey-x509"]
 uselesskey-core = { path = "../uselesskey-core", version = "0.3.0" }
 uselesskey-x509 = { path = "../uselesskey-x509", version = "0.3.0" }
 proptest.workspace = true
+serde.workspace = true
+insta.workspace = true

crates/uselesskey-tonic/Cargo.toml

@@ -0,0 +1,12 @@
+---
+source: crates/uselesskey-tonic/tests/snapshots_tonic.rs
+expression: result
+---
+identity_from_self_signed: true
+identity_from_chain: true
+server_tls_from_self_signed: true
+server_tls_from_chain: true
+client_tls_from_self_signed: true
+client_tls_from_chain: true
+mtls_server_from_chain: true
+mtls_client_from_chain: true