Add more testcases to increase CI coverage

lib/vey-build-env/src/basic.rs

@@ -1,6 +1,7 @@
 /*
  * SPDX-License-Identifier: Apache-2.0
  * SPDX-FileCopyrightText: 2024-2025 ByteDance and/or its affiliates.
+ * SPDX-FileCopyrightText: 2026 VEY-OSS Developers.
  */
 
 use std::env;
@@ -41,3 +42,23 @@ pub fn check_basic() {
         println!("cargo:rustc-env=VEY_PACKAGE_VERSION={v}");
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn rustc_version_meta_is_populated() {
+        let meta = rustc_version::version_meta().unwrap();
+        assert!(!meta.short_version_string.is_empty());
+    }
+
+    #[test]
+    fn check_basic_requires_cargo_build_env() {
+        // check_basic() reads HOST/TARGET/PROFILE/etc. set by Cargo during build scripts.
+        if std::env::var("HOST").is_err() {
+            return;
+        }
+        check_basic();
+    }
+}

lib/vey-build-env/src/openssl.rs

@@ -6,18 +6,38 @@
 
 use std::env;
 
-pub fn check_openssl() {
+/// Resolve the OpenSSL variant from build-time dependency flags.
+pub fn openssl_variant() -> &'static str {
     if env::var("DEP_OPENSSL_LIBRESSL").is_ok() {
-        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=LibreSSL");
+        "LibreSSL"
     } else if env::var("DEP_OPENSSL_TONGSUO").is_ok() {
-        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=Tongsuo");
+        "Tongsuo"
     } else if env::var("DEP_OPENSSL_BORINGSSL").is_ok() {
-        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=BoringSSL");
+        "BoringSSL"
     } else if env::var("DEP_OPENSSL_AWSLC_FIPS").is_ok() {
-        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=AWS-LC-FIPS");
+        "AWS-LC-FIPS"
     } else if env::var("DEP_OPENSSL_AWSLC").is_ok() {
-        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=AWS-LC");
+        "AWS-LC"
     } else {
-        println!("cargo:rustc-env=VEY_OPENSSL_VARIANT=OpenSSL");
+        "OpenSSL"
+    }
+}
+
+pub fn check_openssl() {
+    println!("cargo:rustc-env=VEY_OPENSSL_VARIANT={}", openssl_variant());
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn check_openssl_smoke() {
+        check_openssl();
+    }
+
+    #[test]
+    fn openssl_variant_defaults_to_openssl_without_flags() {
+        assert_eq!(openssl_variant(), "OpenSSL");
     }
 }

lib/vey-cert-agent/Cargo.toml

@@ -18,6 +18,9 @@ vey-socket.workspace = true
 vey-io-ext.workspace = true
 vey-yaml = { workspace = true, optional = true }
 
+[dev-dependencies]
+tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time", "net"] }
+
 [features]
 default = []
 tongsuo = ["openssl/tongsuo"]

lib/vey-cert-agent/src/config/mod.rs

@@ -122,3 +122,43 @@ impl CertAgentConfig {
         ))
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::net::{IpAddr, Ipv4Addr, SocketAddr};
+    use std::num::NonZeroUsize;
+    use std::time::Duration;
+
+    use super::CertAgentConfig;
+
+    #[test]
+    fn default_and_setters() {
+        let mut config = CertAgentConfig::default();
+        assert_eq!(config.cache_request_batch_count.get(), 10);
+        assert_eq!(config.cache_request_timeout, Duration::from_secs(4));
+        assert_eq!(config.cache_vanish_wait, Duration::from_secs(300));
+        assert_eq!(
+            config.query_peer_addr,
+            SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 2999)
+        );
+        assert_eq!(config.query_wait_timeout, Duration::from_secs(4));
+        assert_eq!(config.protective_cache_ttl, 10);
+        assert_eq!(config.maximum_cache_ttl, 300);
+
+        config.set_cache_request_batch_count(NonZeroUsize::new(3).unwrap());
+        config.set_cache_request_timeout(Duration::from_secs(1));
+        config.set_cache_vanish_wait(Duration::from_secs(2));
+        config.set_query_peer_addr("10.0.0.1:4000".parse().unwrap());
+        config.set_query_wait_timeout(Duration::from_millis(500));
+        config.set_protective_cache_ttl(5);
+        config.set_maximum_cache_ttl(60);
+
+        assert_eq!(config.cache_request_batch_count.get(), 3);
+        assert_eq!(config.cache_request_timeout, Duration::from_secs(1));
+        assert_eq!(config.cache_vanish_wait, Duration::from_secs(2));
+        assert_eq!(config.query_peer_addr, "10.0.0.1:4000".parse().unwrap());
+        assert_eq!(config.query_wait_timeout, Duration::from_millis(500));
+        assert_eq!(config.protective_cache_ttl, 5);
+        assert_eq!(config.maximum_cache_ttl, 60);
+    }
+}

lib/vey-cert-agent/src/config/yaml.rs

@@ -145,6 +145,19 @@ mod tests {
         let config = CertAgentConfig::parse_yaml(&yaml).unwrap();
         assert_eq!(config.query_peer_addr, "192.168.0.1:5353".parse().unwrap());
         assert_eq!(config.cache_request_batch_count.get(), 10); // Default
+
+        // Alias vanish_after_expire + query_wait_timeout
+        let yaml = yaml_doc!(
+            r#"
+            vanish_after_expire: 1m
+            query_wait_timeout: 2s
+            query_peer_addr: "[::1]:2999"
+            "#
+        );
+        let config = CertAgentConfig::parse_yaml(&yaml).unwrap();
+        assert_eq!(config.cache_vanish_wait, Duration::from_secs(60));
+        assert_eq!(config.query_wait_timeout, Duration::from_secs(2));
+        assert_eq!(config.query_peer_addr, "[::1]:2999".parse().unwrap());
     }
 
     #[test]

lib/vey-cert-agent/src/handle.rs

@@ -58,3 +58,61 @@ impl CertAgentHandle {
             .and_then(|r| r.inner().cloned())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::str::FromStr;
+    use std::time::Duration;
+
+    use tokio::net::UdpSocket;
+
+    use vey_types::net::{Host, TlsCertUsage, TlsServiceType};
+
+    use super::super::{CertAgentConfig, Request};
+    use crate::test_util;
+
+    #[tokio::test]
+    async fn fetch_from_mock_udp_generator() {
+        let peer = UdpSocket::bind("127.0.0.1:0").await.unwrap();
+        let peer_addr = peer.local_addr().unwrap();
+        let (_, _, pem, der_key) = test_util::self_signed_cert_key();
+        let (mimic_cert, _, _, _) = test_util::self_signed_cert_key();
+
+        tokio::spawn(async move {
+            let mut buf = [0u8; 16384];
+            let (n, from) = peer.recv_from(&mut buf).await.unwrap();
+            let req = Request::parse_req(&buf[..n]).unwrap();
+            assert_eq!(req.host(), &Host::from_str("fetch.example").unwrap());
+            assert!(req.cert().is_some());
+            let rsp = req.encode_rsp(&pem, &der_key, 90).unwrap();
+            peer.send_to(&rsp, from).await.unwrap();
+        });
+
+        let mut config = CertAgentConfig::default();
+        config.set_query_peer_addr(peer_addr);
+        config.set_cache_request_timeout(Duration::from_secs(2));
+        config.set_query_wait_timeout(Duration::from_secs(2));
+        let handle = config.spawn_cert_agent().unwrap();
+
+        let pair = handle
+            .fetch(
+                TlsServiceType::Http,
+                TlsCertUsage::TlsServer,
+                Host::from_str("fetch.example").unwrap(),
+                mimic_cert,
+            )
+            .await;
+        assert!(pair.is_some());
+        assert_eq!(pair.unwrap().certs.len(), 1);
+
+        // Cache hit without querying again
+        let cached = handle
+            .pre_fetch(
+                TlsServiceType::Http,
+                TlsCertUsage::TlsServer,
+                Host::from_str("fetch.example").unwrap(),
+            )
+            .await;
+        assert!(cached.is_some());
+    }
+}

lib/vey-cert-agent/src/lib.rs

@@ -171,3 +171,114 @@ impl FakeCertPair {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod test_util {
+    use openssl::asn1::Asn1Time;
+    use openssl::bn::BigNum;
+    use openssl::hash::MessageDigest;
+    use openssl::nid::Nid;
+    use openssl::pkey::{PKey, Private};
+    use openssl::rsa::Rsa;
+    use openssl::x509::{X509, X509NameBuilder};
+
+    /// Self-signed RSA leaf used by unit tests.
+    pub(crate) fn self_signed_cert_key() -> (X509, PKey<Private>, String, Vec<u8>) {
+        let rsa = Rsa::generate(2048).unwrap();
+        let pkey = PKey::from_rsa(rsa).unwrap();
+
+        let mut name = X509NameBuilder::new().unwrap();
+        name.append_entry_by_nid(Nid::COMMONNAME, "test.example")
+            .unwrap();
+        let name = name.build();
+
+        let mut builder = X509::builder().unwrap();
+        builder.set_version(2).unwrap();
+        let serial = BigNum::from_u32(1).unwrap().to_asn1_integer().unwrap();
+        builder.set_serial_number(&serial).unwrap();
+        builder.set_subject_name(&name).unwrap();
+        builder.set_issuer_name(&name).unwrap();
+        builder.set_pubkey(&pkey).unwrap();
+        builder
+            .set_not_before(&Asn1Time::days_from_now(0).unwrap())
+            .unwrap();
+        builder
+            .set_not_after(&Asn1Time::days_from_now(365).unwrap())
+            .unwrap();
+        builder.sign(&pkey, MessageDigest::sha256()).unwrap();
+        let cert = builder.build();
+
+        let pem = String::from_utf8(cert.to_pem().unwrap()).unwrap();
+        let der_key = pkey.private_key_to_der().unwrap();
+        (cert, pkey, pem, der_key)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::hash_map::DefaultHasher;
+    use std::hash::{Hash, Hasher};
+    use std::str::FromStr;
+
+    use openssl::ssl::{Ssl, SslContext, SslMethod};
+
+    use vey_types::net::{Host, TlsCertUsage, TlsServiceType};
+
+    use super::{CacheQueryKey, FakeCertPair, test_util};
+
+    fn hash_of(key: &CacheQueryKey) -> u64 {
+        let mut hasher = DefaultHasher::new();
+        key.hash(&mut hasher);
+        hasher.finish()
+    }
+
+    #[test]
+    fn cache_query_key_eq_and_hash_ignore_mimic_cert() {
+        let host = Host::from_str("a.example").unwrap();
+        let mut a = CacheQueryKey::new(TlsServiceType::Http, TlsCertUsage::TlsServer, host.clone());
+        let b = CacheQueryKey::new(TlsServiceType::Http, TlsCertUsage::TlsServer, host);
+        assert_eq!(a, b);
+        assert_eq!(hash_of(&a), hash_of(&b));
+
+        let (cert, _, _, _) = test_util::self_signed_cert_key();
+        a.set_mimic_cert(cert);
+        assert_eq!(a, b);
+        assert_eq!(hash_of(&a), hash_of(&b));
+    }
+
+    #[test]
+    fn cache_query_key_encode_with_and_without_mimic() {
+        let host = Host::from_str("encode.example").unwrap();
+        let key = CacheQueryKey::new(TlsServiceType::Http, TlsCertUsage::TlsServer, host.clone());
+        let buf = key.encode().unwrap();
+        assert!(!buf.is_empty());
+
+        let mut with_mimic =
+            CacheQueryKey::new(TlsServiceType::Http, TlsCertUsage::TlsServer, host);
+        let (cert, _, _, _) = test_util::self_signed_cert_key();
+        with_mimic.set_mimic_cert(cert);
+        let buf_mimic = with_mimic.encode().unwrap();
+        assert!(buf_mimic.len() > buf.len());
+    }
+
+    #[test]
+    fn fake_cert_pair_add_to_ssl() {
+        let (cert, key, _, _) = test_util::self_signed_cert_key();
+        let pair = FakeCertPair {
+            certs: vec![cert],
+            key,
+        };
+        let ctx = SslContext::builder(SslMethod::tls_server())
+            .unwrap()
+            .build();
+        let mut ssl = Ssl::new(&ctx).unwrap();
+        pair.add_to_ssl(&mut ssl).unwrap();
+
+        let empty = FakeCertPair {
+            certs: Vec::new(),
+            key: test_util::self_signed_cert_key().1,
+        };
+        let mut ssl = Ssl::new(&ctx).unwrap();
+        assert!(empty.add_to_ssl(&mut ssl).is_err());
+    }
+}