Revize 94f8d5cf

Re #8700 - Implemented certificate revalidation check and fixed affected tests

src/services/certificate_service.py

@@ -4 +4 @@
 
 from src.config.configuration import Configuration
 from src.constants import ROOT_CA_ID, INTERMEDIATE_CA_ID, CA_ID, CERTIFICATE_ID, CERTIFICATE_STATES, \
-    CERTIFICATE_REVOCATION_REASONS, SSL_ID, SIGNATURE_ID, AUTHENTICATION_ID
+    CERTIFICATE_REVOCATION_REASONS, SSL_ID, SIGNATURE_ID, AUTHENTICATION_ID, CERTIFICATE_REVOCATION_REASON_HOLD
 from src.dao.certificate_repository import CertificateRepository
 from src.exceptions.certificate_not_found_exception import CertificateNotFoundException
 from src.exceptions.database_exception import DatabaseException
@@ -326 +326 @@
         :param reason: reason for revocation
         :param id: identifier of the certificate whose status is to be changed
         :param status: new status of the certificate
+        :raises CertificateStatusInvalidException: if status is not valid
+        :raises RevocationReasonInvalidException: if reason is not valid
+        :raises CertificateNotFoundException: if certificate with given id cannot be found
+        :raises CertificateCannotBeSetToValid: if certificate was already revoked and not on hold,
+                it cannot be set revalidated
+        :raises CertificateAlreadyRevokedException: if caller tries to revoke a certificate that is already revoked
+        :raises UnknownException: if the database is corrupted
         """
         if status not in CERTIFICATE_STATES:
             raise CertificateStatusInvalidException(status)
@@ -339 +346 @@
 
         updated = False
         if status == STATUS_VALID:
+            # if the certificate is revoked but the reason is not certificateHold, it cannot be re-validated
+            #    -> throw an exception
+            if certificate.revocation_reason != "" and \
+               certificate.revocation_reason != CERTIFICATE_REVOCATION_REASON_HOLD:
+                raise CertificateCannotBeSetToValid(certificate.revocation_reason)
             updated = self.certificate_repository.clear_certificate_revocation(id)
         elif status == STATUS_REVOKED:
             # check if the certificate is not revoked already
@@ -430 +442 @@
 
     def __str__(self):
         return f"Certificate id '{self.id}' is already revoked."
+
+
+class CertificateCannotBeSetToValid(Exception):
+    """
+    Exception that denotes that the caller was trying to
+    set certificate to valid if the certificate was already
+    revoked but not certificateHold.
+    """
+
+    def __init__(self, old_reason):
+        self.old_state = old_reason
+
+    def __str__(self):
+        return "Cannot set revoked certificate back to valid when the certificate revocation reason is not " \
+               "certificateHold. " \
+               f"The revocation reason of the certificate is {self.old_state}"