From 28842e0284ad4c085c203768bb9a739dace38861 Mon Sep 17 00:00:00 2001
From: Shon Thomas <shon@oneiriq.com>
Date: Sat, 9 May 2026 12:04:18 -0800
Subject: [PATCH] fix(namecheap): extract leaf + chain by scanning PEM armor

rota's `get_info` was looking for `<CertificateReturned>` element
text and `<CACertificate>` element text. Neither matches Namecheap's
actual `ssl.getInfo&Returncertificate=true` response, which carries
`CertificateReturned` as an ATTRIBUTE on `<Certificates>` and packs
PEMs in nested `<Certificate>` elements:

  <Certificates CertificateReturned="true" ReturnType="INDIVIDUAL">
    <Certificate><![CDATA[LEAF_PEM]]></Certificate>
    <CaCertificates>
      <Certificate Type="INTERMEDIATE">
        <Certificate><![CDATA[INTERMEDIATE_1_PEM]]></Certificate>
      </Certificate>
      ...
    </CaCertificates>
  </Certificates>

Result: cert_pem and chain_pem both empty, `is_issued()` false,
polling never terminates even when status==active. So PR #40's
chain-follow lands on the right SSL ID but `await_issuance` still
hangs at the extraction step. Found by extracting the cert manually
out of band when `getInfo` returned status=active for oneiric.dev's
in-flight order: rota's parser yielded empty strings even though
the PEMs were sitting right there in the response.

Fix: new `ApiResponse::pem_blocks(label)` method scans the raw
response for `-----BEGIN <label>-----`...`-----END <label>-----`
armor and returns each block in document order. `get_info` calls
`pem_blocks("CERTIFICATE")`; first block is the leaf, rest are the
chain (concatenated with newlines). The CSR present in the same
response is safely skipped because its label is "CERTIFICATE
REQUEST" and `BEGIN CERTIFICATE-----` doesn't substring-match
`BEGIN CERTIFICATE REQUEST-----`.

This is the 6th and (hopefully) final layer in the rota+Namecheap
end-to-end renewal pipeline, after PRs #36 (reverted), #37 (CDATA
unwrap), #38 (DnsCname variant), #39 (lowercase HostName), #40
(ReplacedBy chain + Status XML path). Tests: 3 new in xml::tests
covering the leaf+chain extraction, the CSR-skip rule, and the
empty-input edge case. Total daemon test count 111 (was 108).
---
 .../rota-daemon/src/backends/namecheap/ca.rs  |  17 ++-
 .../rota-daemon/src/backends/namecheap/xml.rs | 102 ++++++++++++++++++
 2 files changed, 117 insertions(+), 2 deletions(-)

diff --git a/crates/rota-daemon/src/backends/namecheap/ca.rs b/crates/rota-daemon/src/backends/namecheap/ca.rs
index 30022be..2241251 100644
--- a/crates/rota-daemon/src/backends/namecheap/ca.rs
+++ b/crates/rota-daemon/src/backends/namecheap/ca.rs
@@ -81,8 +81,21 @@ impl NamecheapCa {
     let replaced_by = resp
       .first_attribute("SSLGetInfoResult", "ReplacedBy")
       .and_then(|s| s.parse::<u64>().ok());
-    let cert_pem = resp.first_text("CertificateReturned").unwrap_or_default();
-    let chain_pem = resp.first_text("CACertificate").unwrap_or_default();
+    // `Returncertificate=true&Returntype=Individual` packs the leaf
+    // and chain inside nested `<Certificate>` elements that no naive
+    // element-name lookup can disambiguate. The actual PEM armor is
+    // unique enough to scan for directly. Document order: the first
+    // CERTIFICATE block is the leaf, subsequent ones are the chain
+    // (issuer-up); the CSR present in the same response carries the
+    // `CERTIFICATE REQUEST` label and is skipped automatically.
+    let pem_blocks = resp.pem_blocks("CERTIFICATE");
+    let cert_pem = pem_blocks.first().cloned().unwrap_or_default();
+    let chain_pem = pem_blocks
+      .iter()
+      .skip(1)
+      .cloned()
+      .collect::<Vec<_>>()
+      .join("\n");
 
     Ok(NamecheapCertInfo {
       status,
diff --git a/crates/rota-daemon/src/backends/namecheap/xml.rs b/crates/rota-daemon/src/backends/namecheap/xml.rs
index 1ae6dfd..4c5c94c 100644
--- a/crates/rota-daemon/src/backends/namecheap/xml.rs
+++ b/crates/rota-daemon/src/backends/namecheap/xml.rs
@@ -84,6 +84,38 @@ impl ApiResponse {
     }
   }
 
+  /// Find every PEM block of the given label (e.g. `"CERTIFICATE"`)
+  /// in the raw response and return them in document order.
+  ///
+  /// Cuts through Namecheap's nested-element wrapping for cert
+  /// payloads: `namecheap.ssl.getInfo&Returncertificate=true` packs
+  /// the leaf as `<Certificates><Certificate><![CDATA[PEM]]></Certificate>`
+  /// and EACH chain cert under
+  /// `<Certificates><CaCertificates><Certificate Type="INTERMEDIATE">
+  ///    <Certificate><![CDATA[PEM]]></Certificate></Certificate></CaCertificates>`,
+  /// which `first_text` can't disambiguate by element name alone.
+  /// Scanning for the literal PEM armor avoids walking that mess.
+  ///
+  /// `BEGIN CERTIFICATE-----` does NOT match `BEGIN CERTIFICATE REQUEST-----`
+  /// (the trailing `-----` differs), so a CSR present in the same
+  /// response is safely skipped when querying for `"CERTIFICATE"`.
+  pub fn pem_blocks(&self, label: &str) -> Vec<String> {
+    let begin = format!("-----BEGIN {label}-----");
+    let end = format!("-----END {label}-----");
+    let mut out = Vec::new();
+    let mut rest = self.raw.as_str();
+    while let Some(b) = rest.find(&begin) {
+      let after_begin = &rest[b..];
+      let Some(e) = after_begin.find(&end) else {
+        break;
+      };
+      let block_end = e + end.len();
+      out.push(after_begin[..block_end].to_owned());
+      rest = &after_begin[block_end..];
+    }
+    out
+  }
+
   /// Find the first occurrence of an element by name and return one
   /// of its attribute values.
   pub fn first_attribute(&self, element: &str, attr: &str) -> Option<String> {
@@ -223,6 +255,76 @@ mod tests {
     );
   }
 
+  #[test]
+  fn pem_blocks_extracts_leaf_plus_chain_in_document_order() {
+    let body = r#"<?xml version="1.0"?>
+<ApiResponse Status="OK">
+ <CommandResponse>
+  <SSLGetInfoResult Status="active">
+   <CertificateDetails>
+    <CSR><![CDATA[-----BEGIN CERTIFICATE REQUEST-----
+CSR_BODY
+-----END CERTIFICATE REQUEST-----]]></CSR>
+    <Certificates CertificateReturned="true" ReturnType="INDIVIDUAL">
+     <Certificate><![CDATA[-----BEGIN CERTIFICATE-----
+LEAF_BODY
+-----END CERTIFICATE-----]]></Certificate>
+     <CaCertificates>
+      <Certificate Type="INTERMEDIATE">
+       <Certificate><![CDATA[-----BEGIN CERTIFICATE-----
+INT1_BODY
+-----END CERTIFICATE-----]]></Certificate>
+      </Certificate>
+      <Certificate Type="INTERMEDIATE">
+       <Certificate><![CDATA[-----BEGIN CERTIFICATE-----
+INT2_BODY
+-----END CERTIFICATE-----]]></Certificate>
+      </Certificate>
+     </CaCertificates>
+    </Certificates>
+   </CertificateDetails>
+  </SSLGetInfoResult>
+ </CommandResponse>
+</ApiResponse>"#;
+    let resp = parse_response(body).unwrap();
+    let blocks = resp.pem_blocks("CERTIFICATE");
+    assert_eq!(blocks.len(), 3, "leaf + 2 intermediates, CSR skipped");
+    assert!(blocks[0].contains("LEAF_BODY"), "first block is the leaf");
+    assert!(
+      blocks[1].contains("INT1_BODY"),
+      "second block is intermediate 1"
+    );
+    assert!(
+      blocks[2].contains("INT2_BODY"),
+      "third block is intermediate 2"
+    );
+    // CSR has the CERTIFICATE REQUEST label and must NOT be picked up
+    // when querying for the CERTIFICATE label.
+    assert!(!blocks.iter().any(|b| b.contains("CSR_BODY")));
+  }
+
+  #[test]
+  fn pem_blocks_does_not_match_csr_label() {
+    let body = r#"<?xml version="1.0"?>
+<root>
+  <CSR><![CDATA[-----BEGIN CERTIFICATE REQUEST-----
+ABCD
+-----END CERTIFICATE REQUEST-----]]></CSR>
+</root>"#;
+    let resp = parse_response(body).unwrap();
+    let blocks = resp.pem_blocks("CERTIFICATE");
+    assert!(
+      blocks.is_empty(),
+      "BEGIN CERTIFICATE----- has trailing dashes immediately after CERTIFICATE; BEGIN CERTIFICATE REQUEST----- does not match"
+    );
+  }
+
+  #[test]
+  fn pem_blocks_returns_empty_when_no_match() {
+    let resp = parse_response("<root></root>").unwrap();
+    assert!(resp.pem_blocks("CERTIFICATE").is_empty());
+  }
+
   #[test]
   fn parses_error_envelope() {
     let body = r#"<?xml version="1.0" encoding="utf-8"?>