Consolidate duplicate code in delegate tests

Move common delegate test functions and constants to test/utils/certs.sh:
- generate_delegate_cert() function
- OID_PERMIT_* constants (REDIRECT, ONBOARD_NEW_CRED, ONBOARD_REUSE_CRED)

Remove duplications from individual test files:
- test-delegate-onboarding.sh: Remove local generate_delegate_cert and OID
- test-delegate-invalid-chain.sh: Remove duplicate OID constant
- test-delegate-permissions.sh: Remove duplicate OID constant

All tests now source certs.sh (directly or transitively) for these utilities.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: runcom

test/ci/test-delegate-invalid-chain.sh

@@ -8,9 +8,6 @@ set -euo pipefail
 
 source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)/test-delegate-onboarding.sh"
 
-# FDO delegate permission OIDs (re-declare for clarity)
-OID_PERMIT_ONBOARD_NEW_CRED="1.3.6.1.4.1.45724.3.1.2"
-
 # Paths for the "wrong" key that will sign the delegate cert
 wrong_signer_key="${certs_dir}/wrong_signer.key"
 wrong_signer_crt="${certs_dir}/wrong_signer.crt"

test/ci/test-delegate-onboarding.sh

@@ -7,60 +7,16 @@ set -euo pipefail
 
 source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)/utils.sh"
 source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)/../utils/mgmt-api-v1.sh"
-
-# FDO delegate permission OIDs
-OID_PERMIT_ONBOARD_NEW_CRED="1.3.6.1.4.1.45724.3.1.2"
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)/../utils/certs.sh"
 
 # Delegate and config paths
 delegate_key="${certs_dir}/delegate.key"
 delegate_crt="${certs_dir}/delegate.crt"
-delegate_cnf="${certs_dir}/delegate.cnf"
-delegate_csr="${certs_dir}/delegate.csr"
 configs_dir="${base_dir}/configs"
 owner_config_file="${configs_dir}/owner.yaml"
 
 directories+=("${configs_dir}")
 
-generate_delegate_cert() {
-  local owner_key_path=$1
-  local owner_crt_path=$2
-  local delegate_key_path=$3
-  local delegate_crt_path=$4
-  local permissions_oid=$5
-
-  local delegate_cnf_path="${delegate_key_path%.key}.cnf"
-  local delegate_csr_path="${delegate_key_path%.key}.csr"
-
-  log_info "Generating delegate EC key in DER format (same as other service keys)"
-  openssl ecparam -name prime256v1 -genkey -outform der -out "${delegate_key_path}" 2>/dev/null
-
-  log_info "Creating delegate openssl config with FDO permission OID ${permissions_oid}"
-  cat >"${delegate_cnf_path}" <<EOF
-[ext]
-basicConstraints = critical, CA:FALSE
-keyUsage = critical, digitalSignature
-extendedKeyUsage = ${permissions_oid}
-EOF
-
-  log_info "Generating delegate CSR"
-  openssl req -new -key "${delegate_key_path}" -keyform der -out "${delegate_csr_path}" -subj "/CN=FDO Delegate" 2>/dev/null
-
-  log_info "Signing delegate cert with owner key"
-  openssl x509 -req \
-    -in "${delegate_csr_path}" \
-    -CA "${owner_crt_path}" \
-    -CAkey "${owner_key_path}" \
-    -CAkeyform der \
-    -CAcreateserial \
-    -out "${delegate_crt_path}" \
-    -days 30 \
-    -extfile "${delegate_cnf_path}" \
-    -extensions ext 2>/dev/null
-
-  log_info "Delegate certificate generated:"
-  openssl x509 -in "${delegate_crt_path}" -noout -subject -issuer -dates >&2
-}
-
 start_service_owner() {
   log_info "Writing owner config with delegate settings"
   cat >"${owner_config_file}" <<EOF

test/ci/test-delegate-permissions.sh

@@ -8,9 +8,6 @@ set -euo pipefail
 
 source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)/test-delegate-onboarding.sh"
 
-# OIDPermitRedirect only (no onboard permission)
-OID_PERMIT_REDIRECT="1.3.6.1.4.1.45724.3.1.1"
-
 run_test() {
 
   log_info "Setting the error trap handler"

test/utils/certs.sh

@@ -1,5 +1,10 @@
 #! /usr/bin/env bash
 
+# FDO delegate permission OIDs
+readonly OID_PERMIT_REDIRECT="1.3.6.1.4.1.45724.3.1.1"
+readonly OID_PERMIT_ONBOARD_NEW_CRED="1.3.6.1.4.1.45724.3.1.2"
+readonly OID_PERMIT_ONBOARD_REUSE_CRED="1.3.6.1.4.1.45724.3.1.3"
+
 generate_cert() {
   local key=$1
   local crt=$2
@@ -21,3 +26,45 @@ extract_pubkey_from_cert() {
     openssl x509 -in "${crt}" -pubkey -noout -out "${pub}"
   fi
 }
+
+# Generate a delegate certificate signed by the owner key
+# Usage: generate_delegate_cert owner_key owner_crt delegate_key delegate_crt permissions_oid
+generate_delegate_cert() {
+  local owner_key_path=$1
+  local owner_crt_path=$2
+  local delegate_key_path=$3
+  local delegate_crt_path=$4
+  local permissions_oid=$5
+
+  local delegate_cnf_path="${delegate_key_path%.key}.cnf"
+  local delegate_csr_path="${delegate_key_path%.key}.csr"
+
+  log_info "Generating delegate EC key in DER format (same as other service keys)"
+  openssl ecparam -name prime256v1 -genkey -outform der -out "${delegate_key_path}" 2>/dev/null
+
+  log_info "Creating delegate openssl config with FDO permission OID ${permissions_oid}"
+  cat >"${delegate_cnf_path}" <<EOF
+[ext]
+basicConstraints = critical, CA:FALSE
+keyUsage = critical, digitalSignature
+extendedKeyUsage = ${permissions_oid}
+EOF
+
+  log_info "Generating delegate CSR"
+  openssl req -new -key "${delegate_key_path}" -keyform der -out "${delegate_csr_path}" -subj "/CN=FDO Delegate" 2>/dev/null
+
+  log_info "Signing delegate cert with owner key"
+  openssl x509 -req \
+    -in "${delegate_csr_path}" \
+    -CA "${owner_crt_path}" \
+    -CAkey "${owner_key_path}" \
+    -CAkeyform der \
+    -CAcreateserial \
+    -out "${delegate_crt_path}" \
+    -days 30 \
+    -extfile "${delegate_cnf_path}" \
+    -extensions ext 2>/dev/null
+
+  log_info "Delegate certificate generated:"
+  openssl x509 -in "${delegate_crt_path}" -noout -subject -issuer -dates >&2
+}