Feat/certinextv2

.gitignore

@@ -36,4 +36,10 @@ terraform/terraform.tfvars
 
 # Analysis / scratch — never commit
 analysis/
-
+issues/
+.claude/
+.codex/
+CLAUDE.md
+AGENTS.md
+/logs*/
+*.log

CERTInext.IntegrationTests/CERTInext.IntegrationTests.csproj

@@ -6,24 +6,27 @@
     <LangVersion>12.0</LangVersion>
     <IsPackable>false</IsPackable>
     <IsTestProject>true</IsTestProject>
-    <!-- Mirror the main project's DcvSupport flag. Default false → DCV test files are excluded
-         (matches the GA no-DCV build); -p:DcvSupport=true compiles them in with SUPPORTS_DCV. -->
-    <DcvSupport Condition="'$(DcvSupport)' == ''">false</DcvSupport>
+    <!-- Mirror the main project's DcvSupport flag. Default true → DCV test files are included
+         (matches the DCV-enabled default build); -p:DcvSupport=false excludes them. -->
+    <DcvSupport Condition="'$(DcvSupport)' == ''">true</DcvSupport>
     <DefineConstants Condition="'$(DcvSupport)' == 'true'">$(DefineConstants);SUPPORTS_DCV</DefineConstants>
   </PropertyGroup>
 
   <ItemGroup>
     <ProjectReference Include="..\CERTInext\CERTInext.csproj" />
   </ItemGroup>
 
-  <!-- DCV integration tests + the DNS validator implementations use the v3.3-only
-       IDomainValidator / IDomainValidatorFactory and the factory constructor. On the
-       IAnyCAPlugin 3.2.0 (no-DCV) build those don't exist, so exclude these files unless
-       SUPPORTS_DCV is defined. See issue 0003. -->
+  <!-- DCV integration tests + the DNS validator implementations (real and recording/spy)
+       use the v3.3-only IDomainValidator / IDomainValidatorFactory and the factory
+       constructor. On the IAnyCAPlugin 3.2.0 (no-DCV) build those don't exist, so exclude
+       these files unless SUPPORTS_DCV is defined. See issue 0003. -->
   <ItemGroup Condition="!$(DefineConstants.Contains('SUPPORTS_DCV'))">
     <Compile Remove="DcvLifecycleTests.cs" />
+    <Compile Remove="V2DcvLifecycleTests.cs" />
+    <Compile Remove="V2FreshDomainDcvLifecycleTests.cs" />
     <Compile Remove="CloudflareDomainValidator.cs" />
     <Compile Remove="StubDomainValidator.cs" />
+    <Compile Remove="RecordingDomainValidator.cs" />
   </ItemGroup>
 
   <ItemGroup>

CERTInext.IntegrationTests/CloudflareDomainValidator.cs

@@ -23,7 +23,7 @@ namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests
     /// Credentials are read from the <see cref="IntegrationTestFixture"/>:
     /// <c>CERTINEXT_CF_API_TOKEN</c> and <c>CERTINEXT_CF_ZONE_ID</c>.
     /// </summary>
-    internal sealed class CloudflareDomainValidator : IDomainValidator
+    internal sealed class CloudflareDomainValidator : IDomainValidator, IDisposable
     {
         private const string CfApiBase = "https://api.cloudflare.com/client/v4";
 
@@ -113,17 +113,21 @@ public async Task<DomainValidationResult> CleanupValidation(string key, Cancella
         public Task ValidateConfiguration(Dictionary<string, object> configuration) => Task.CompletedTask;
         public Dictionary<string, Keyfactor.AnyGateway.Extensions.PropertyConfigInfo> GetDomainValidatorAnnotations() => new();
         public string GetValidationType() => "dns-01";
+
+        public void Dispose() => _http.Dispose();
     }
 
-    internal sealed class CloudflareDomainValidatorFactory : IDomainValidatorFactory
+    internal sealed class CloudflareDomainValidatorFactory : IDomainValidatorFactory, IDisposable
     {
-        private readonly IDomainValidator _validator;
+        private readonly CloudflareDomainValidator _validator;
 
         public CloudflareDomainValidatorFactory(string apiToken, string zoneId)
         {
             _validator = new CloudflareDomainValidator(apiToken, zoneId);
         }
 
         public IDomainValidator ResolveDomainValidator(string domain, string validationType) => _validator;
+
+        public void Dispose() => _validator.Dispose();
     }
 }

CERTInext.IntegrationTests/DcvLifecycleTests.cs

@@ -40,17 +40,25 @@ namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests
     /// CERTINEXT_DCV_DOMAIN=<subdomain to use, e.g. dcv-test.example.com>
     /// </code>
     /// </summary>
-    public class DcvLifecycleTests : IClassFixture<IntegrationTestFixture>
+    public class DcvLifecycleTests : IClassFixture<IntegrationTestFixture>, IDisposable
     {
         private readonly IntegrationTestFixture _fixture;
         private readonly ITestOutputHelper _output;
+        private readonly List<IDisposable> _toDispose = new List<IDisposable>();
 
         public DcvLifecycleTests(IntegrationTestFixture fixture, ITestOutputHelper output)
         {
             _fixture = fixture;
             _output = output;
         }
 
+        public void Dispose()
+        {
+            foreach (var d in _toDispose)
+                d.Dispose();
+            _toDispose.Clear();
+        }
+
         // ---------------------------------------------------------------------------
         // Helpers
         // ---------------------------------------------------------------------------
@@ -69,11 +77,17 @@ private static string GenerateCsrPem(string commonName)
                 + "\n-----END CERTIFICATE REQUEST-----";
         }
 
-        private IDomainValidatorFactory BuildDnsFactory() =>
-            _fixture.IsCloudflareConfigured
-                ? (IDomainValidatorFactory)new CloudflareDomainValidatorFactory(
-                    _fixture.CloudflareApiToken, _fixture.CloudflareZoneId)
-                : new StubDomainValidatorFactory();
+        private IDomainValidatorFactory BuildDnsFactory()
+        {
+            if (_fixture.IsCloudflareConfigured)
+            {
+                var factory = new CloudflareDomainValidatorFactory(
+                    _fixture.CloudflareApiToken, _fixture.CloudflareZoneId);
+                _toDispose.Add(factory);
+                return factory;
+            }
+            return new StubDomainValidatorFactory();
+        }
 
         /// <summary>
         /// Runs <c>plugin.Synchronize</c> and returns every record that came out of the
@@ -88,6 +102,7 @@ private static async Task<List<AnyCAPluginCertificate>> RunSyncAsync(CERTInextCA
             var syncTask = Task.Run(async () =>
             {
                 await plugin.Synchronize(buffer, lastSync: null, fullSync: true, cancelToken: System.Threading.CancellationToken.None);
+                // Synchronize calls CompleteAdding() in its finally block; guard against double-call.
                 if (!buffer.IsAddingCompleted)
                     buffer.CompleteAdding();
             });
@@ -655,7 +670,6 @@ public async Task BulkDvEnrollment_AllOrdersIssue_AndPaginationWorks()
             List<AnyCAPluginCertificate> synced = null;
             System.Diagnostics.Stopwatch syncPhaseSw = System.Diagnostics.Stopwatch.StartNew();
             int passesUsed = 0;
-            int finalNotIssued = -1;
 
             for (int pass = 1; pass <= maxSyncPasses; pass++)
             {
@@ -664,13 +678,27 @@ public async Task BulkDvEnrollment_AllOrdersIssue_AndPaginationWorks()
                 synced = await RunSyncAsync(plugin);
                 passSw.Stop();
 
+                // Classify enrolled orders by their current status so that FAILED orders
+                // are not silently counted as still-pending, which would burn the full
+                // pass budget before producing a misleading "expected 0" assertion.
                 int generated = synced.Count(r => enrolledIds.Contains(r.CARequestID) && r.Status == (int)EndEntityStatus.GENERATED);
-                int pending   = enrolledIds.Count - generated;
-                finalNotIssued = pending;
+                int failed    = synced.Count(r => enrolledIds.Contains(r.CARequestID) && r.Status == (int)EndEntityStatus.FAILED);
+                int pending   = enrolledIds.Count - generated - failed;
 
                 _output.WriteLine(
                     $"--- Sync pass #{pass}: returned {synced.Count} records, {generated}/{enrolledIds.Count} GENERATED, " +
-                    $"{pending} still pending, elapsed={passSw.Elapsed:mm\\:ss} ---");
+                    $"{failed} FAILED, {pending} still pending, elapsed={passSw.Elapsed:mm\\:ss} ---");
+
+                if (failed > 0)
+                {
+                    var failedIds = synced
+                        .Where(r => enrolledIds.Contains(r.CARequestID) && r.Status == (int)EndEntityStatus.FAILED)
+                        .Select(r => r.CARequestID)
+                        .Take(5);
+                    Assert.Fail(
+                        $"Pass #{pass}: {failed} order(s) reached FAILED status and will never issue: " +
+                        string.Join(", ", failedIds));
+                }
 
                 if (pending == 0)
                     break;
@@ -696,10 +724,14 @@ public async Task BulkDvEnrollment_AllOrdersIssue_AndPaginationWorks()
                 $"{string.Join(", ", missing.Take(5))}{(missing.Count > 5 ? ", ..." : "")}");
 
             // Final assertion — every enrolled order must be GENERATED after the polling window.
-            var lookup = synced.ToDictionary(r => r.CARequestID, r => r);
+            // Filter null CARequestIDs before building the lookup (guards against any CA response
+            // that omits the ID, which would otherwise throw ArgumentNullException in ToDictionary).
+            var lookup = synced
+                .Where(r => r.CARequestID != null)
+                .ToDictionary(r => r.CARequestID, r => r);
             var notIssued = enrolledIds
+                .Where(id => lookup.TryGetValue(id, out var rec) && rec.Status != (int)EndEntityStatus.GENERATED)
                 .Select(id => lookup[id])
-                .Where(r => r.Status != (int)EndEntityStatus.GENERATED)
                 .ToList();
 
             if (notIssued.Count > 0)
@@ -711,7 +743,7 @@ public async Task BulkDvEnrollment_AllOrdersIssue_AndPaginationWorks()
 
             notIssued.Should().BeEmpty(
                 $"every enrolled DV order should auto-issue on the new sandbox after {maxSyncPasses} sync passes; " +
-                $"{notIssued.Count} did not (last pass: {finalNotIssued} pending).");
+                $"{notIssued.Count} did not.");
 
             _output.WriteLine($"--- SUCCESS: {count}/{count} DV orders enrolled, synced, and issued in {passesUsed} sync pass(es). " +
                               $"Enroll={sw.Elapsed:mm\\:ss}  SyncPhase={syncPhaseSw.Elapsed:mm\\:ss}  Total={(sw.Elapsed + syncPhaseSw.Elapsed):mm\\:ss} ---");