github.com/caddyserver/certmagic v0.23.0: LooksLikeHTTPChallenge

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/caddyserver/certmagic.LooksLikeHTTPChallenge in pkg:golang/github.com/caddyserver/certmagic@v0.23.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/caddyserver/certmagic@v0.23.0
Demonstrate these symbols/APIs:
  - github.com/caddyserver/certmagic.LooksLikeHTTPChallenge

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:815eaac52e6c93491ba9aa18d8c9241b0f95e6af36b736b7aa3de9c98f1cc151","contract":["LooksLikeHTTPChallenge returns true for HTTP GET requests targeting /.well-known/acme-challenge paths","LooksLikeHTTPChallenge returns false for non-GET HTTP methods targeting challenge paths","LooksLikeHTTPChallenge returns false for standard application paths outside /.well-known/acme-challenge","SolveHTTPChallenge serves ACME key authorization and sets Close true for matching challenge requests","SolveHTTPChallenge returns false when request host or challenge path does not match","LooksLikeZeroSSLHTTPValidation distinguishes ZeroSSL PKI validation requests from ACME HTTP challenges"],"goal":"verify github.com/caddyserver/certmagic.LooksLikeHTTPChallenge in pkg:golang/github.com/caddyserver/certmagic@v0.23.0","kind":"HOW","packages":["pkg:golang/github.com/caddyserver/certmagic@v0.23.0"],"schemaVersion":1,"symbols":["github.com/caddyserver/certmagic.LooksLikeHTTPChallenge"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/caddyserver/certmagic@v0.23.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/caddyserver/certmagic@v0.23.0","symbols":["github.com/caddyserver/certmagic.LooksLikeHTTPChallenge"],"verifierAdapter":"golang@1"}

module sample-certmagic-challenge

go 1.26.6

require (
	github.com/caddyserver/certmagic v0.23.0
	github.com/mholt/acmez/v3 v3.1.2
	go.uber.org/zap v1.27.0
)

require (
	github.com/caddyserver/zerossl v0.1.3 // indirect
	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
	github.com/libdns/libdns v1.0.0-beta.1 // indirect
	github.com/miekg/dns v1.1.63 // indirect
	github.com/zeebo/blake3 v0.2.4 // indirect
	go.uber.org/multierr v1.11.0 // indirect
	go.uber.org/zap/exp v0.3.0 // indirect
	golang.org/x/crypto v0.36.0 // indirect
	golang.org/x/mod v0.24.0 // indirect
	golang.org/x/net v0.37.0 // indirect
	golang.org/x/sync v0.12.0 // indirect
	golang.org/x/sys v0.31.0 // indirect
	golang.org/x/text v0.23.0 // indirect
	golang.org/x/tools v0.31.0 // indirect
)

github.com/caddyserver/certmagic v0.23.0 h1:CfpZ/50jMfG4+1J/u2LV6piJq4HOfO6ppOnOf7DkFEU=
github.com/caddyserver/certmagic v0.23.0/go.mod h1:9mEZIWqqWoI+Gf+4Trh04MOVPD0tGSxtqsxg87hAIH4=
github.com/caddyserver/zerossl v0.1.3 h1:onS+pxp3M8HnHpN5MMbOMyNjmTheJyWRaZYwn+YTAyA=
github.com/caddyserver/zerossl v0.1.3/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
github.com/libdns/libdns v1.0.0-beta.1 h1:KIf4wLfsrEpXpZ3vmc/poM8zCATXT2klbdPe6hyOBjQ=
github.com/libdns/libdns v1.0.0-beta.1/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
github.com/miekg/dns v1.1.63 h1:8M5aAw6OMZfFXTT7K5V0Eu5YiiL8l7nUAkyN6C9YwaY=
github.com/miekg/dns v1.1.63/go.mod h1:6NGHfjhpmr5lt3XPLuyfDJi5AXbNIPM9PY6H6sF1Nfs=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/zeebo/assert v1.1.0 h1:hU1L1vLTHsnO8x8c9KAR5GmM5QscxHg5RNU5z5qbUWY=
github.com/zeebo/assert v1.1.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
github.com/zeebo/blake3 v0.2.4/go.mod h1:7eeQ6d2iXWRGF6npfaxl2CU+xy2Fjo2gxeyZGCRUjcE=
github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
go.uber.org/zap/exp v0.3.0 h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
go.uber.org/zap/exp v0.3.0/go.mod h1:5I384qq7XGxYyByIhHm6jg5CHkGY0nsTfbDLgDDlgJQ=
golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

package main

import (
	"fmt"
	"net/http"
	"net/http/httptest"

	"github.com/caddyserver/certmagic"
)

func main() {
	challengeReq := httptest.NewRequest(http.MethodGet, "/.well-known/acme-challenge/example-token-123", nil)
	challengeReq.Host = "example.com"

	regularReq := httptest.NewRequest(http.MethodGet, "/api/v1/health", nil)
	regularReq.Host = "example.com"

	postReq := httptest.NewRequest(http.MethodPost, "/.well-known/acme-challenge/example-token-123", nil)
	postReq.Host = "example.com"

	fmt.Printf("GET ACME challenge: %t\n", certmagic.LooksLikeHTTPChallenge(challengeReq))
	fmt.Printf("GET regular path: %t\n", certmagic.LooksLikeHTTPChallenge(regularReq))
	fmt.Printf("POST ACME challenge: %t\n", certmagic.LooksLikeHTTPChallenge(postReq))
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/caddyserver/certmagic.LooksLikeHTTPChallenge in pkg:golang/github.com/caddyserver/certmagic@v0.23.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/caddyserver/certmagic@v0.23.0"
  ],
  "symbols": [
    "github.com/caddyserver/certmagic.LooksLikeHTTPChallenge"
  ]
}

package main

import (
	"fmt"
	"net/http"
	"net/http/httptest"
	"os"
	"strings"

	"github.com/caddyserver/certmagic"
	"github.com/mholt/acmez/v3/acme"
	"go.uber.org/zap"
)

func main() {
	// Assertion 1: certmagic.LooksLikeHTTPChallenge returns true for HTTP GET requests matching /.well-known/acme-challenge prefix
	validPaths := []string{
		"/.well-known/acme-challenge/token-abc-123",
		"/.well-known/acme-challenge/",
		"/.well-known/acme-challenge",
		"/.well-known/acme-challenge/nested/token",
		"/.well-known/acme-challenge/token?query=val",
	}
	for _, p := range validPaths {
		req := httptest.NewRequest(http.MethodGet, p, nil)
		if !certmagic.LooksLikeHTTPChallenge(req) {
			fmt.Fprintf(os.Stderr, "FAIL: expected LooksLikeHTTPChallenge true for GET %s\n", p)
			os.Exit(1)
		}
	}

	// Assertion 2: certmagic.LooksLikeHTTPChallenge returns false for non-GET HTTP methods targeting challenge paths
	nonGetMethods := []string{
		http.MethodPost,
		http.MethodPut,
		http.MethodDelete,
		http.MethodHead,
		http.MethodOptions,
		http.MethodPatch,
	}
	for _, method := range nonGetMethods {
		req := httptest.NewRequest(method, "/.well-known/acme-challenge/token-abc-123", nil)
		if certmagic.LooksLikeHTTPChallenge(req) {
			fmt.Fprintf(os.Stderr, "FAIL: expected LooksLikeHTTPChallenge false for method %s\n", method)
			os.Exit(1)
		}
	}

	// Assertion 3: certmagic.LooksLikeHTTPChallenge returns false for standard application paths outside /.well-known/acme-challenge
	nonChallengePaths := []string{
		"/",
		"/index.html",
		"/api/v1/resource",
		"/.well-known/security.txt",
		"/.well-known/pki-validation/fileauth.txt",
		"/acme-challenge/token",
	}
	for _, p := range nonChallengePaths {
		req := httptest.NewRequest(http.MethodGet, p, nil)
		if certmagic.LooksLikeHTTPChallenge(req) {
			fmt.Fprintf(os.Stderr, "FAIL: expected LooksLikeHTTPChallenge false for path %s\n", p)
			os.Exit(1)
		}
	}

	// Assertion 4: certmagic.SolveHTTPChallenge serves ACME key authorization for matching challenge requests
	challenge := acme.Challenge{
		Type:             acme.ChallengeTypeHTTP01,
		Token:            "test-token-123",
		KeyAuthorization: "test-token-123.test-thumbprint-456",
		Identifier: acme.Identifier{
			Type:  "dns",
			Value: "example.com",
		},
	}
	req := httptest.NewRequest(http.MethodGet, "/.well-known/acme-challenge/test-token-123", nil)
	req.Host = "example.com:80" // host with port should be handled via hostOnly
	rec := httptest.NewRecorder()

	handled := certmagic.SolveHTTPChallenge(zap.NewNop(), rec, req, challenge)
	if !handled {
		fmt.Fprintf(os.Stderr, "FAIL: SolveHTTPChallenge returned false for valid challenge request\n")
		os.Exit(1)
	}
	if rec.Code != http.StatusOK {
		fmt.Fprintf(os.Stderr, "FAIL: SolveHTTPChallenge status code %d, expected 200\n", rec.Code)
		os.Exit(1)
	}
	if ct := rec.Header().Get("Content-Type"); ct != "text/plain" {
		fmt.Fprintf(os.Stderr, "FAIL: SolveHTTPChallenge Content-Type %q, expected text/plain\n", ct)
		os.Exit(1)
	}
	if strings.TrimSpace(rec.Body.String()) != "test-token-123.test-thumbprint-456" {
		fmt.Fprintf(os.Stderr, "FAIL: SolveHTTPChallenge body %q, expected key authorization\n", rec.Body.String())
		os.Exit(1)
	}
	if !req.Close {
		fmt.Fprintf(os.Stderr, "FAIL: SolveHTTPChallenge did not set req.Close = true\n")
		os.Exit(1)
	}

	// Assertion 5: certmagic.SolveHTTPChallenge rejects requests with mismatched host or path
	mismatchedHostReq := httptest.NewRequest(http.MethodGet, "/.well-known/acme-challenge/test-token-123", nil)
	mismatchedHostReq.Host = "other.example.org"
	mismatchedHostRec := httptest.NewRecorder()
	if certmagic.SolveHTTPChallenge(zap.NewNop(), mismatchedHostRec, mismatchedHostReq, challenge) {
		fmt.Fprintf(os.Stderr, "FAIL: SolveHTTPChallenge should return false for host mismatch\n")
		os.Exit(1)
	}

	mismatchedPathReq := httptest.NewRequest(http.MethodGet, "/.well-known/acme-challenge/wrong-token", nil)
	mismatchedPathReq.Host = "example.com"
	mismatchedPathRec := httptest.NewRecorder()
	if certmagic.SolveHTTPChallenge(zap.NewNop(), mismatchedPathRec, mismatchedPathReq, challenge) {
		fmt.Fprintf(os.Stderr, "FAIL: SolveHTTPChallenge should return false for path mismatch\n")
		os.Exit(1)
	}

	// Assertion 6: certmagic.LooksLikeZeroSSLHTTPValidation distinguishes ZeroSSL PKI validation requests from ACME challenges
	zeroSSLReq := httptest.NewRequest(http.MethodGet, "/.well-known/pki-validation/BAADF00D.txt", nil)
	if !certmagic.LooksLikeZeroSSLHTTPValidation(zeroSSLReq) {
		fmt.Fprintf(os.Stderr, "FAIL: expected LooksLikeZeroSSLHTTPValidation true for ZeroSSL validation path\n")
		os.Exit(1)
	}
	if certmagic.LooksLikeHTTPChallenge(zeroSSLReq) {
		fmt.Fprintf(os.Stderr, "FAIL: LooksLikeHTTPChallenge must return false for ZeroSSL validation path\n")
		os.Exit(1)
	}

	fmt.Println("All contract assertions passed successfully.")
}