Phase 3: full unit and integration test suite with CI

- Unit tests for Base64, KeyType, RenewalWindow, StoredCertificate, JWK, JWS, KeyId, InMemoryStorage, FilesystemStorage
- Integration tests against Pebble (skipped unless PEBBLE_URL is set)
- NoOpHttp01Handler for Pebble's PEBBLE_VA_ALWAYS_VALID=1 mode
- GitHub Actions workflow running Pebble as a service container
- Fix remainingDays() to return 0 for expired certificates
- Use pre-generated EC key PEMs in tests to avoid openssl_pkey_new() env issues

Author: bashgeek

.github/workflows/tests.yml

@@ -12,10 +12,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php: ["8.3", "8.4", "8.5"]
+        php: ["8.3", "8.4"]
+
+    services:
+      pebble:
+        image: letsencrypt/pebble:latest
+        ports:
+          - 14000:14000
+          - 15000:15000
+        env:
+          PEBBLE_VA_NOSLEEP: "1"
+          PEBBLE_VA_ALWAYS_VALID: "1"
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
 
       - name: Set up PHP ${{ matrix.php }}
         uses: shivammathur/setup-php@v2
@@ -27,5 +37,12 @@ jobs:
       - name: Install dependencies
         run: composer install --prefer-dist --no-interaction --no-progress
 
+      - name: Wait for Pebble
+        run: |
+          timeout 30 bash -c \
+            'until curl -sk https://localhost:14000/dir > /dev/null 2>&1; do sleep 1; done'
+
       - name: Run tests
+        env:
+          PEBBLE_URL: https://localhost:14000/dir
         run: vendor/bin/pest --parallel --no-output

src/Storage/StoredCertificate.php

@@ -43,6 +43,8 @@ public static function fromArray(array $data): self
 
     public function remainingDays(): int
     {
-        return (int) (new \DateTimeImmutable())->diff($this->expiresAt)->days;
+        $diff = (new \DateTimeImmutable())->diff($this->expiresAt);
+
+        return $diff->invert ? 0 : (int) $diff->days;
     }
 }

tests/Integration/CoyoteCertIssueTest.php

@@ -0,0 +1,97 @@
+<?php
+
+use CoyoteCert\CoyoteCert;
+use CoyoteCert\Enums\KeyType;
+use CoyoteCert\Provider\Pebble;
+use CoyoteCert\Storage\InMemoryStorage;
+use CoyoteCert\Storage\StoredCertificate;
+use Tests\Integration\Helpers\NoOpHttp01Handler;
+
+$pebbleUrl = getenv('PEBBLE_URL') ?: 'https://localhost:14000/dir';
+
+function pebble(): Pebble
+{
+    return new Pebble(url: getenv('PEBBLE_URL') ?: 'https://localhost:14000/dir', verifyTls: false);
+}
+
+it('issues a certificate with default key types (RSA account, EC_P256 cert)', function () use ($pebbleUrl) {
+    $cert = CoyoteCert::with(pebble())
+        ->storage(new InMemoryStorage())
+        ->domains('test.example.com')
+        ->challenge(new NoOpHttp01Handler())
+        ->skipLocalTest()
+        ->issue();
+
+    expect($cert)->toBeInstanceOf(StoredCertificate::class);
+    expect($cert->certificate)->toContain('-----BEGIN CERTIFICATE-----');
+    expect($cert->privateKey)->toContain('-----BEGIN');
+    expect($cert->fullchain)->toContain('-----BEGIN CERTIFICATE-----');
+    expect($cert->domains)->toBe(['test.example.com']);
+    expect(openssl_x509_parse($cert->certificate))->toBeArray();
+})->skip(!getenv('PEBBLE_URL'), 'Set PEBBLE_URL to run Pebble integration tests');
+
+it('issues a certificate with an EC P-256 account key', function () {
+    $cert = CoyoteCert::with(pebble())
+        ->storage(new InMemoryStorage())
+        ->domains('ec-account.example.com')
+        ->accountKeyType(KeyType::EC_P256)
+        ->challenge(new NoOpHttp01Handler())
+        ->skipLocalTest()
+        ->issue();
+
+    expect($cert->certificate)->toContain('-----BEGIN CERTIFICATE-----');
+})->skip(!getenv('PEBBLE_URL'), 'Set PEBBLE_URL to run Pebble integration tests');
+
+it('reuses an existing account on a second issue', function () {
+    $storage = new InMemoryStorage();
+
+    $first = CoyoteCert::with(pebble())
+        ->storage($storage)
+        ->domains('reuse.example.com')
+        ->challenge(new NoOpHttp01Handler())
+        ->skipLocalTest()
+        ->issue();
+
+    // Second call reuses the account key already in $storage
+    $second = CoyoteCert::with(pebble())
+        ->storage($storage)
+        ->domains('reuse.example.com')
+        ->challenge(new NoOpHttp01Handler())
+        ->skipLocalTest()
+        ->issue();
+
+    expect($first->certificate)->not->toBe($second->certificate);
+    expect($second->certificate)->toContain('-----BEGIN CERTIFICATE-----');
+})->skip(!getenv('PEBBLE_URL'), 'Set PEBBLE_URL to run Pebble integration tests');
+
+it('issueOrRenew returns the cached cert when still valid', function () {
+    $storage = new InMemoryStorage();
+
+    $issued = CoyoteCert::with(pebble())
+        ->storage($storage)
+        ->domains('cached.example.com')
+        ->challenge(new NoOpHttp01Handler())
+        ->skipLocalTest()
+        ->issue();
+
+    $returned = CoyoteCert::with(pebble())
+        ->storage($storage)
+        ->domains('cached.example.com')
+        ->challenge(new NoOpHttp01Handler())
+        ->skipLocalTest()
+        ->issueOrRenew(daysBeforeExpiry: 1); // very low threshold — cert won't expire this soon
+
+    expect($returned->certificate)->toBe($issued->certificate);
+})->skip(!getenv('PEBBLE_URL'), 'Set PEBBLE_URL to run Pebble integration tests');
+
+it('issues a certificate with the shortlived profile', function () {
+    $cert = CoyoteCert::with(pebble())
+        ->storage(new InMemoryStorage())
+        ->domains('profile.example.com')
+        ->profile('shortlived')
+        ->challenge(new NoOpHttp01Handler())
+        ->skipLocalTest()
+        ->issue();
+
+    expect($cert->certificate)->toContain('-----BEGIN CERTIFICATE-----');
+})->skip(!getenv('PEBBLE_URL'), 'Set PEBBLE_URL to run Pebble integration tests');

tests/Integration/Helpers/NoOpHttp01Handler.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace Tests\Integration\Helpers;
+
+use CoyoteCert\Enums\AuthorizationChallengeEnum;
+use CoyoteCert\Interfaces\ChallengeHandlerInterface;
+
+/**
+ * Challenge handler used in integration tests.
+ * Does nothing — Pebble runs with PEBBLE_VA_ALWAYS_VALID=1 so no real file is needed.
+ */
+class NoOpHttp01Handler implements ChallengeHandlerInterface
+{
+    public function supports(AuthorizationChallengeEnum $type): bool
+    {
+        return $type === AuthorizationChallengeEnum::HTTP;
+    }
+
+    public function deploy(string $domain, string $token, string $keyAuth): void {}
+
+    public function cleanup(string $domain, string $token): void {}
+}

tests/Pest.php

@@ -2,4 +2,4 @@
 
 use Tests\TestCase;
 
-pest()->extend(TestCase::class)->in('Feature');
+pest()->extend(TestCase::class)->in('Unit', 'Integration');

tests/Unit/DTO/RenewalWindowTest.php

@@ -0,0 +1,49 @@
+<?php
+
+use CoyoteCert\DTO\RenewalWindow;
+
+it('isOpen returns true when now is inside the window', function () {
+    $window = new RenewalWindow(
+        start: new DateTimeImmutable('-1 hour'),
+        end:   new DateTimeImmutable('+1 hour'),
+    );
+
+    expect($window->isOpen())->toBeTrue();
+});
+
+it('isOpen returns false when now is before the window', function () {
+    $window = new RenewalWindow(
+        start: new DateTimeImmutable('+1 day'),
+        end:   new DateTimeImmutable('+2 days'),
+    );
+
+    expect($window->isOpen())->toBeFalse();
+});
+
+it('isOpen returns false when now is after the window', function () {
+    $window = new RenewalWindow(
+        start: new DateTimeImmutable('-2 days'),
+        end:   new DateTimeImmutable('-1 day'),
+    );
+
+    expect($window->isOpen())->toBeFalse();
+});
+
+it('exposes start, end, and explanationUrl', function () {
+    $start  = new DateTimeImmutable('2026-01-01T00:00:00Z');
+    $end    = new DateTimeImmutable('2026-01-07T00:00:00Z');
+    $window = new RenewalWindow(start: $start, end: $end, explanationUrl: 'https://example.com');
+
+    expect($window->start)->toBe($start);
+    expect($window->end)->toBe($end);
+    expect($window->explanationUrl)->toBe('https://example.com');
+});
+
+it('explanationUrl defaults to null', function () {
+    $window = new RenewalWindow(
+        start: new DateTimeImmutable(),
+        end:   new DateTimeImmutable('+1 hour'),
+    );
+
+    expect($window->explanationUrl)->toBeNull();
+});

tests/Unit/DTO/StoredCertificateTest.php

@@ -0,0 +1,51 @@
+<?php
+
+use CoyoteCert\Storage\StoredCertificate;
+
+function makeCert(array $overrides = []): StoredCertificate
+{
+    return new StoredCertificate(
+        certificate: $overrides['certificate'] ?? 'cert-pem',
+        privateKey:  $overrides['privateKey']  ?? 'key-pem',
+        fullchain:   $overrides['fullchain']   ?? 'fullchain-pem',
+        caBundle:    $overrides['caBundle']    ?? 'ca-bundle-pem',
+        issuedAt:    $overrides['issuedAt']    ?? new DateTimeImmutable('2026-01-01T00:00:00+00:00'),
+        expiresAt:   $overrides['expiresAt']   ?? new DateTimeImmutable('2026-04-01T00:00:00+00:00'),
+        domains:     $overrides['domains']     ?? ['example.com'],
+    );
+}
+
+it('roundtrips through toArray/fromArray', function () {
+    $cert = makeCert();
+
+    expect(StoredCertificate::fromArray($cert->toArray())->toArray())->toBe($cert->toArray());
+});
+
+it('toArray contains all expected keys', function () {
+    $data = makeCert()->toArray();
+
+    expect($data)->toHaveKeys(['certificate', 'private_key', 'fullchain', 'ca_bundle', 'issued_at', 'expires_at', 'domains']);
+});
+
+it('remainingDays returns approximate days until expiry', function () {
+    $cert = makeCert([
+        'expiresAt' => new DateTimeImmutable('+30 days'),
+    ]);
+
+    expect($cert->remainingDays())->toBeBetween(29, 31);
+});
+
+it('remainingDays returns zero for an expired certificate', function () {
+    $cert = makeCert([
+        'expiresAt' => new DateTimeImmutable('-1 day'),
+    ]);
+
+    expect($cert->remainingDays())->toBe(0);
+});
+
+it('preserves all domain entries', function () {
+    $cert = makeCert(['domains' => ['example.com', 'www.example.com', '*.example.com']]);
+
+    expect(StoredCertificate::fromArray($cert->toArray())->domains)
+        ->toBe(['example.com', 'www.example.com', '*.example.com']);
+});

tests/Unit/Enums/KeyTypeTest.php

@@ -0,0 +1,53 @@
+<?php
+
+use CoyoteCert\Enums\KeyType;
+
+it('returns the correct JWS algorithm', function (KeyType $type, string $alg) {
+    expect($type->jwsAlgorithm())->toBe($alg);
+})->with([
+    [KeyType::RSA_2048, 'RS256'],
+    [KeyType::RSA_4096, 'RS256'],
+    [KeyType::EC_P256,  'ES256'],
+    [KeyType::EC_P384,  'ES384'],
+]);
+
+it('returns the correct bit count for RSA', function (KeyType $type, int $bits) {
+    expect($type->bits())->toBe($bits);
+})->with([
+    [KeyType::RSA_2048, 2048],
+    [KeyType::RSA_4096, 4096],
+]);
+
+it('returns null bits for EC types', function (KeyType $type) {
+    expect($type->bits())->toBeNull();
+})->with([[KeyType::EC_P256], [KeyType::EC_P384]]);
+
+it('returns the correct curve name', function (KeyType $type, string $curve) {
+    expect($type->curveName())->toBe($curve);
+})->with([
+    [KeyType::EC_P256, 'prime256v1'],
+    [KeyType::EC_P384, 'secp384r1'],
+]);
+
+it('returns null curve name for RSA', function (KeyType $type) {
+    expect($type->curveName())->toBeNull();
+})->with([[KeyType::RSA_2048], [KeyType::RSA_4096]]);
+
+it('correctly identifies RSA vs EC', function (KeyType $type, bool $isRsa, bool $isEc) {
+    expect($type->isRsa())->toBe($isRsa);
+    expect($type->isEc())->toBe($isEc);
+})->with([
+    [KeyType::RSA_2048, true,  false],
+    [KeyType::RSA_4096, true,  false],
+    [KeyType::EC_P256,  false, true],
+    [KeyType::EC_P384,  false, true],
+]);
+
+it('returns the correct openssl key type constant', function (KeyType $type, int $const) {
+    expect($type->openSslType())->toBe($const);
+})->with([
+    [KeyType::RSA_2048, OPENSSL_KEYTYPE_RSA],
+    [KeyType::RSA_4096, OPENSSL_KEYTYPE_RSA],
+    [KeyType::EC_P256,  OPENSSL_KEYTYPE_EC],
+    [KeyType::EC_P384,  OPENSSL_KEYTYPE_EC],
+]);