From 287ce91e67ce736804656819401f9ba474406e63 Mon Sep 17 00:00:00 2001
From: mptyl <mp@tylconsulting.it>
Date: Wed, 26 Aug 2026 00:56:30 +0200
Subject: [PATCH] fix(deploy): seed session CA in local smoke

---
 scripts/test-task13-runtime-fixtures.sh |  1 +
 scripts/unified-deployment-smoke.sh     | 24 +++++++++++++++++-------
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/scripts/test-task13-runtime-fixtures.sh b/scripts/test-task13-runtime-fixtures.sh
index ff5b66e1..582fe272 100755
--- a/scripts/test-task13-runtime-fixtures.sh
+++ b/scripts/test-task13-runtime-fixtures.sh
@@ -40,6 +40,7 @@ TASK13_OIDC_CLIENT_SECRET="fixture-oidc-client-$profile"
 TASK13_AUTHENTIK_API_TOKEN="fixture-authentik-token-$profile"
 TASK13_FRONTEND_PORT=18080
 TASK13_SESSION_RUNTIME_PASSWORD="$fixture/runtime-password"
+TASK13_SESSION_CA="$fixture/session-ca.pem"
 TASK13_PI_MODELS="$fixture/models.json"
 TASK13_PI_SETTINGS="$fixture/settings.json"
 TASK13_LLM_SERVER="$fixture/fake-llm.mjs"
diff --git a/scripts/unified-deployment-smoke.sh b/scripts/unified-deployment-smoke.sh
index 9e42c1f3..5e5b52b3 100755
--- a/scripts/unified-deployment-smoke.sh
+++ b/scripts/unified-deployment-smoke.sh
@@ -387,11 +387,21 @@ task13_write_environment() {
   chmod 0600 "$TASK13_ENV_FILE"
 }
 
+task13_write_session_ca_fixture() {
+  cat >"$TASK13_SESSION_CA" <<'EOF'
+-----BEGIN CERTIFICATE-----
+VEFTSzEzLURJU1BPU0FCTEUtU0VTU0lPTi1DQQ==
+-----END CERTIFICATE-----
+EOF
+  chmod 0600 "$TASK13_SESSION_CA"
+}
+
 task13_write_fixture_files() {
   printf '{}\n' >"$TASK13_PI_AUTH"
   printf 'THT_MODEL_API_KEY=%s\n' "$TASK13_SECRET_VALUE" >"$TASK13_SECRETS"
   printf '%s' "task13-runtime-password-$TASK13_RUN_ID" >"$TASK13_SESSION_RUNTIME_PASSWORD"
   printf '%s' "$TASK13_AUTH_PASSWORD" >"$TASK13_AUTH_PASSWORD_FILE"
+  task13_write_session_ca_fixture
   mkdir -p "$TASK13_AUTH_ROOT"
   chmod 0600 "$TASK13_PI_AUTH"
   chmod 0700 "$TASK13_AUTH_ROOT"
@@ -598,12 +608,8 @@ task13_write_server_fixture_files() {
     "$TASK13_SECRET_VALUE" "$TASK13_OIDC_CLIENT_SECRET" "$TASK13_AUTHENTIK_API_TOKEN" >"$TASK13_SECRETS"
   printf '%s' "$TASK13_SESSION_PASSWORD" >"$TASK13_SESSION_RUNTIME_PASSWORD"
   printf '%s' "$TASK13_SESSION_MIGRATOR_PASSWORD" >"$TASK13_SESSION_MIGRATOR_PASSWORD_FILE"
-  cat >"$TASK13_SESSION_CA" <<'EOF'
------BEGIN CERTIFICATE-----
-VEFTSzEzLURJU1BPU0FCTEUtU0VTU0lPTi1DQQ==
------END CERTIFICATE-----
-EOF
-  chmod 0600 "$TASK13_PI_AUTH" "$TASK13_SESSION_CA"
+  task13_write_session_ca_fixture
+  chmod 0600 "$TASK13_PI_AUTH"
   chmod 0600 "$TASK13_SECRETS" "$TASK13_SESSION_RUNTIME_PASSWORD" \
     "$TASK13_SESSION_MIGRATOR_PASSWORD_FILE"
 
@@ -2518,7 +2524,7 @@ task13_self_test_source_contract() {
   local auth_runtime_mount auth_root_mount auth_projection auth_runtime_owner
   local pi_auth_bind pi_projection registry_runtime_mount registry_root_mount registry_projection
   local application_secret_bind application_secret_mount application_secret_projection
-  local application_session_ca_source application_session_password_projection
+  local application_session_ca_fixture application_session_ca_source application_session_password_projection
   local application_secret_parent_owner application_secret_file_owner
   local image_evidence_environment image_evidence_initialization
   local server_auth_projection_override server_auth_projection_descriptor
@@ -2542,6 +2548,7 @@ task13_self_test_source_contract() {
   application_secret_bind='$TASK13_''SECRETS:/run/secrets/thothii.secrets:ro'
   application_secret_mount='application-secrets:/run/''secrets:ro'
   application_secret_projection='task13_prepare_local_application_''secrets'
+  application_session_ca_fixture='task13_write_session_ca_''fixture'
   application_secret_parent_owner='chown 0:''0 /target'
   application_session_ca_source='$TASK13_SESSION_''CA:/source/session_ca.pem:ro'
   application_session_password_projection='cp /source/task13-runtime-password /target/session_''runtime_password'
@@ -2593,6 +2600,9 @@ task13_self_test_source_contract() {
   [[ "$(grep -Ec "^${application_secret_projection}\\(\\)|^[[:space:]]+${application_secret_projection}$" \
     "$root/scripts/unified-deployment-smoke.sh")" -eq 2 ]] \
     || task13_fail "the local application-secret projection must be defined and invoked once"
+  [[ "$(grep -Ec "^${application_session_ca_fixture}\\(\\)|^[[:space:]]+${application_session_ca_fixture}$" \
+    "$root/scripts/unified-deployment-smoke.sh")" -eq 3 ]] \
+    || task13_fail "the session CA fixture must be defined and written for local and server smokes"
   grep -Fq -- "$application_secret_parent_owner" "$root/scripts/unified-deployment-smoke.sh" \
     || task13_fail "the local application-secret mount root must remain root-owned"
   grep -Fq -- "$application_session_ca_source" "$root/scripts/unified-deployment-smoke.sh" \