20260624 修复future notBefore PP缓存并固化231发布

src/validation/tree_runner/tests.rs

@@ -4,7 +4,8 @@ use crate::data_model::roa::RoaAfi;
 use crate::fetch::rsync::LocalDirRsyncFetcher;
 use crate::fetch::rsync::{RsyncFetchError, RsyncFetcher};
 use crate::storage::{
-    PackFile, PackTime, PublicationPointCacheProjection, RawByHashEntry, RepositoryViewEntry,
+    PackFile, PackTime, PublicationPointCacheProjection,
+    PublicationPointCacheProjectionWriteAction, RawByHashEntry, RepositoryViewEntry,
     RepositoryViewState, RocksStore, ValidatedCaInstanceResult, ValidatedManifestMeta,
     VcirArtifactKind, VcirArtifactRole, VcirArtifactValidationStatus, VcirAuditSummary,
     VcirChildEntry, VcirInstanceGate, VcirLocalOutput, VcirLocalOutputPayload, VcirOutputType,
@@ -1914,6 +1915,89 @@ fn seed_publication_point_cache_projection(
     vcir
 }
 
+#[test]
+fn publication_point_cache_future_notbefore_guard_detects_future_roa_notbefore_only() {
+    let uri = "rsync://example.test/repo/issuer/future.roa";
+    let bytes = std::fs::read(
+        std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("tests/fixtures/repository/rpki.cernet.net/repo/cernet/0/AS4538.roa"),
+    )
+    .expect("read ROA fixture");
+    let roa = RoaObject::decode_der(&bytes).expect("decode ROA fixture");
+    let ee = &roa.signed_object.signed_data.certificates[0].resource_cert;
+    let file = PackFile::from_bytes_compute_sha256(uri, bytes);
+    let pack = dummy_pack_with_files(vec![file]);
+    let objects = crate::validation::objects::ObjectsOutput {
+        vrps: Vec::new(),
+        aspas: Vec::new(),
+        router_keys: Vec::new(),
+        local_outputs_cache: Vec::new(),
+        warnings: Vec::new(),
+        stats: Default::default(),
+        audit: vec![ObjectAuditEntry {
+            rsync_uri: uri.to_string(),
+            sha256_hex: sha256_hex_from_32(&pack.files[0].sha256),
+            kind: AuditObjectKind::Roa,
+            result: AuditObjectResult::Error,
+            detail: Some(
+                "EE certificate path validation failed: certificate not valid at validation_time"
+                    .to_string(),
+            ),
+        }],
+        roa_cache_stats: Default::default(),
+        roa_cache_object_meta: Vec::new(),
+    };
+
+    assert!(publication_point_cache_has_future_not_before_risk(
+        &pack,
+        &objects,
+        &[],
+        ee.tbs.validity_not_before - time::Duration::seconds(1),
+        &Policy::default(),
+    ));
+    assert!(!publication_point_cache_has_future_not_before_risk(
+        &pack,
+        &objects,
+        &[],
+        ee.tbs.validity_not_after + time::Duration::seconds(1),
+        &Policy::default(),
+    ));
+}
+
+#[test]
+fn publication_point_cache_delete_action_removes_existing_projection() {
+    let store_dir = tempfile::tempdir().expect("store dir");
+    let store = RocksStore::open(store_dir.path()).expect("open rocksdb");
+    let policy = Policy::default();
+    let validation_time = time::OffsetDateTime::UNIX_EPOCH + time::Duration::minutes(1);
+    let ca = publication_point_cache_fixture_ca();
+    let vcir = seed_publication_point_cache_projection(&store, &policy, &ca, validation_time);
+
+    assert!(
+        store
+            .get_publication_point_cache_projection_cached(&ca.manifest_rsync_uri)
+            .expect("load projection")
+            .is_some()
+    );
+
+    store
+        .replace_vcir_manifest_replay_meta_and_projection_action(
+            &vcir,
+            None,
+            PublicationPointCacheProjectionWriteAction::Delete {
+                manifest_rsync_uri: &vcir.manifest_rsync_uri,
+            },
+        )
+        .expect("delete projection");
+
+    assert!(
+        store
+            .get_publication_point_cache_projection_cached(&ca.manifest_rsync_uri)
+            .expect("load projection after delete")
+            .is_none()
+    );
+}
+
 fn publication_point_cache_fixture_ca() -> CaInstanceHandle {
     CaInstanceHandle {
         depth: 1,