test(tls): drop five tests that re-prove already-covered behavior

Each dropped test was a second layer over a code path another test already pins;
keeping both is the two-layers-that-sort-of-do smell. None of the five guarded a
behavior the surviving suite doesn't.

- test_rotate_peer_ca_sets_current: first-set + old-ca-None. Covered by
  no_rotation_when_unchanged's first call (sets current, leaves old None) and the
  else-branch remove_secret in clears_stale_old_ca_on_reenable. The rotation state
  machine stays fully covered (rotate, no-op, clear, re-enable-clear).
- test_get_client_tls_files_none_when_absent: the absent getter path. Covered by
  test_certificate_available_pushes_on_empty, which asserts get_client_tls_files
  == (None, None, None) on an empty requirer.
- test_client_and_peer_requesters_have_distinct_common_names: the CN values live in
  test_tls_state.py (three tests); requester construction is in test_handler_is_wired.
- test_peer_certificate_available_defers_when_internal_ca_absent and
  test_peer_certificate_available_defers_on_workload_file_error: the defer guards live
  in the shared _push_tls_files. The client variant proves each guard; the peer handler's
  routing through _push_tls_files is proven by test_peer_certificate_available_rotates_ca_and_pushes.

The two surviving defer tests now note they cover the peer path too (shared guard).
Suite: 58 -> 48 TLS tests on both substrates.

Signed-off-by: Marcelo Henrique Neppel <marcelo.neppel@canonical.com>

Author: marceloneppel

tests/unit/test_tls_events.py

@@ -152,43 +152,6 @@ def test_relation_broken_peer_wired(harness):
     assert charm.state.peer.old_ca == "PCA"
 
 
-def _set_unit_db(harness, key, value):
-    rel_id = harness.model.get_relation("database-peers").id
-    harness.update_relation_data(rel_id, harness.charm.unit.name, {key: value})
-
-
-def test_client_and_peer_requesters_have_distinct_common_names(substrate, harness):
-    """Client and peer requesters use distinct CNs drawn from different databag keys.
-
-    certificate_requests are baked at init time (before the test updates the databag), so
-    we verify distinctness via the live state properties (which read directly from the
-    databag) and confirm both requester objects were constructed.
-
-    On VM the CNs are host-derived (database-address / database-peers-address). On K8s
-    both CNs collapse to the endpoints FQDN (original charm parity) — still distinct from
-    each other is not required there, only that both are the endpoints FQDN.
-    """
-    _set_unit_db(harness, "database-address", "10.1.2.3")
-    _set_unit_db(harness, "database-peers-address", "10.4.5.6")
-
-    state = harness.charm.state
-    if substrate == "vm":
-        # VM: client CN reads database-address, peer CN reads database-peers-address.
-        assert state.client_common_name == "10.1.2.3"
-        assert state.peer_common_name == "10.4.5.6"
-        assert state.client_common_name != state.peer_common_name
-    else:
-        # K8s: both CNs are the unit endpoints FQDN (operator-cert parity).
-        app = state.model.app.name
-        expected = f"{app}-0.{app}-endpoints"
-        assert state.client_common_name == expected
-        assert state.peer_common_name == expected
-
-    tls = harness.charm.tls
-    assert tls.client_certificate is not None
-    assert tls.peer_certificate is not None
-
-
 def test_peer_relation_changed_emits_refresh(harness):
     """Peer relation_changed emits refresh_tls_certificates_event to re-request certs with updated SANs."""
     from single_kernel_postgresql.events.tls import TLS
@@ -205,6 +168,8 @@ def test_certificate_available_defers_when_internal_ca_absent(harness):
 
     The handler must not attempt file writes before the CA is present (K8s Pebble
     may not be ready), matching the pre-port charm's defer-before-CA-present guard.
+    The defer guard lives in the shared _push_tls_files, so this also covers the peer
+    handler's path (both route through it).
     """
     tls = harness.charm.tls
     tls.client_certificate.get_assigned_certificates = MagicMock(
@@ -221,27 +186,12 @@ def test_certificate_available_defers_when_internal_ca_absent(harness):
     harness.charm.tls_manager.push_tls_files.assert_not_called()
 
 
-def test_peer_certificate_available_defers_when_internal_ca_absent(harness):
-    """When internal-ca is not yet set, _on_peer_certificate_available defers and skips push."""
-    tls = harness.charm.tls
-    tls.peer_certificate.get_assigned_certificates = MagicMock(
-        return_value=fake_assigned("PC", "PCA", "PK")
-    )
-    harness.charm.tls_manager.push_tls_files = MagicMock()
-
-    event = MagicMock()
-    assert harness.charm.state.application.internal_ca is None
-    tls._on_peer_certificate_available(event)
-
-    event.defer.assert_called_once()
-    harness.charm.tls_manager.push_tls_files.assert_not_called()
-
-
 def test_certificate_available_defers_on_workload_file_error(harness, patch_crypto):
     """When push_tls_files raises PostgreSQLFileOperationError, the handler defers.
 
     Workload file-write failures (e.g. Pebble not yet ready on K8s) must defer
     rather than crash the hook, matching the pre-port charm's defer-on-write-failure guard.
+    The guard lives in the shared _push_tls_files, so this also covers the peer handler's path.
     """
     charm = harness.charm
     with (
@@ -262,26 +212,3 @@ def test_certificate_available_defers_on_workload_file_error(harness, patch_cryp
     tls._on_certificate_available(event)
 
     event.defer.assert_called_once()
-
-
-def test_peer_certificate_available_defers_on_workload_file_error(harness, patch_crypto):
-    """When push_tls_files raises PostgreSQLFileOperationError, the peer handler defers."""
-    charm = harness.charm
-    with (
-        patch.object(charm.cluster_manager, "configure_system_passwords"),
-        patch.object(charm.config_manager, "update_config"),
-    ):
-        harness.set_leader(True)
-
-    tls = charm.tls
-    tls.peer_certificate.get_assigned_certificates = MagicMock(
-        return_value=fake_assigned("PC", "PCA", "PK")
-    )
-    charm.tls_manager.push_tls_files = MagicMock(
-        side_effect=PostgreSQLFileOperationError("pebble not ready")
-    )
-
-    event = MagicMock()
-    tls._on_peer_certificate_available(event)
-
-    event.defer.assert_called_once()

tests/unit/test_tls_manager.py

@@ -28,15 +28,6 @@ def _set_empty(requirer):
 # --- CA rotation (current-ca / old-ca are tracked in state for rotation; cert/key are NOT stored) ---
 
 
-def test_rotate_peer_ca_sets_current(harness):
-    mgr = harness.charm.tls_manager
-    mgr.rotate_peer_ca("CA1")
-
-    peer = harness.charm.state.peer
-    assert peer.current_ca == "CA1"
-    assert peer.old_ca is None
-
-
 def test_rotate_peer_ca_rotates_on_change(harness):
     mgr = harness.charm.tls_manager
     mgr.rotate_peer_ca("CA1")
@@ -85,12 +76,6 @@ def test_rotate_peer_ca_clears_stale_old_ca_on_reenable(harness):
 # --- operator cert/key are fetched LIVE from the requirer, never persisted ---
 
 
-def test_get_client_tls_files_none_when_absent(harness):
-    mgr = harness.charm.tls_manager
-    _set_empty(mgr.client_certificate)
-    assert mgr.get_client_tls_files() == (None, None, None)
-
-
 def test_get_client_tls_files_returns_live(harness):
     mgr = harness.charm.tls_manager
     _set_client(mgr, cert="C", ca="A", key="K")