# =============================================================================
# L2 BEHAVIORAL SCAFFOLD — Trusted TLS  (R-TLS-01, R-TLS-03)
# Catalog: docs/14 "Trusted TLS (R-TLS-01/02)"
#
# GIVEN any exposed endpoint (including `internal`),
# WHEN  its certificate is inspected from a probe,
# THEN  it is valid, non-self-signed, unexpired, chains to a trusted root.
# (R-TLS-03: issuance also works for internal-only services.)
# Renewal-before-expiry (R-TLS-02) is a separate time/fault scenario — see the
# hands-off / cert-renewal coverage; not asserted here.
#
# STATUS: scaffold — needs T-2.4 (cert-manager + LE DNS-01 wildcard).
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: trusted-tls
  labels:
    conformance.home.k3s/R-TLS-01: "true"
    conformance.home.k3s/R-TLS-03: "true"
  annotations:
    conformance.home.k3s/requirements: "R-TLS-01, R-TLS-03"
    conformance.home.k3s/layer: "L2"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/intent: >-
      Exposed endpoints (incl. internal) present a valid, trusted, unexpired cert.
spec:
  steps:
    - name: given-exposed-endpoint
      try:
        - script:
            content: 'echo "TODO(T-2.4/T-2.5): a service with a Gateway TLS listener"'
    - name: then-cert-is-trusted-and-valid
      try:
        - script:
            # Inspect from an ephemeral probe using the system trust store (no -k):
            # a self-signed / expired / untrusted cert fails the handshake => rc!=0.
            content: |
              set -euo pipefail
              host="<service>.home.keithjackson.dev"   # TODO: real host
              echo | openssl s_client -connect "${host}:443" -servername "${host}" \
                   -verify_return_error 2>/dev/null \
                | openssl x509 -noout -issuer -enddate -checkend 0 \
                && echo TLS_VALID
              # checkend 0 => rc!=0 if already expired; -verify_return_error => trusted chain.
            check: { ($stdout =~ 'TLS_VALID'): true }
    - name: then-internal-only-service-also-has-cert
      try:
        - script:
            content: 'echo "TODO(R-TLS-03): repeat against an internal-only host"'