20260711 补充P1缓存与证书profile回归

src/validation/objects.rs

@@ -4346,6 +4346,58 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn roa_validation_cache_view_blocks_before_safe_reuse_time() {
+        let validation_time = fixed_time("2026-06-05T00:00:00Z");
+        let issuer_der = b"issuer-ca";
+        let crl_bytes = b"current-crl".to_vec();
+        let crl_hash = sha256_32(&crl_bytes);
+        let roa_hash = [0x11; 32];
+        let vcir = sample_roa_cache_vcir(
+            issuer_der,
+            crl_hash,
+            roa_hash,
+            fixed_time("2026-06-07T00:00:00Z"),
+            fixed_time("2026-06-08T00:00:00Z"),
+        );
+        let mut projection = sample_roa_cache_projection(&vcir, roa_hash);
+        projection.entries[0].earliest_safe_reuse_time_unix =
+            Some(fixed_time("2026-06-06T00:00:00Z").unix_timestamp());
+        let view = RoaValidationCacheView::from_projection(&projection, validation_time);
+        let file = PackFile::from_bytes_with_sha256(TEST_ROA_URI, vec![0x01], roa_hash);
+        let mut crl_cache = sample_crl_cache(crl_bytes);
+
+        assert!(matches!(
+            view.lookup(&file, &mut crl_cache, issuer_der, validation_time),
+            RoaCacheLookupResult::ExpiredBlocked
+        ));
+    }
+
+    #[test]
+    fn roa_validation_cache_view_treats_legacy_entry_without_lower_bound_as_miss() {
+        let validation_time = fixed_time("2026-06-05T00:00:00Z");
+        let issuer_der = b"issuer-ca";
+        let crl_hash = sha256_32(b"current-crl");
+        let roa_hash = [0x11; 32];
+        let vcir = sample_roa_cache_vcir(
+            issuer_der,
+            crl_hash,
+            roa_hash,
+            fixed_time("2026-06-07T00:00:00Z"),
+            fixed_time("2026-06-08T00:00:00Z"),
+        );
+        let mut projection = sample_roa_cache_projection(&vcir, roa_hash);
+        projection.entries[0].earliest_safe_reuse_time_unix = None;
+        let view = RoaValidationCacheView::from_projection(&projection, validation_time);
+        let file = PackFile::from_bytes_with_sha256(TEST_ROA_URI, vec![0x01], roa_hash);
+        let mut crl_cache = sample_crl_cache(b"current-crl".to_vec());
+
+        assert!(matches!(
+            view.lookup(&file, &mut crl_cache, issuer_der, validation_time),
+            RoaCacheLookupResult::Miss
+        ));
+    }
+
     #[test]
     fn roa_validation_cache_stats_records_vcir_miss_to_timing() {
         let stats = RoaValidationCacheStats::for_input(RoaValidationCacheInput::enabled(None), 3);