BUG/MEDIUM: crt-store: do not write empty crt-base and key-base

SerializeCrtStore always set crt-base and key-base, so a store without
them rendered bare keywords that HAProxy rejects with "'crt-base'
requires a <path> argument", and no crt-store without both bases could
be deployed. Set the attribute only when the value is non-empty and
remove it otherwise.

As a safety net, simple.Word no longer renders an empty value: Parse
refuses a bare keyword, so Result now skips it as well instead of
writing a line that cannot be read back.

Author: mjuraga

config-parser/parsers/simple/simple-word.go

@@ -45,7 +45,8 @@ func (s *Word) Parse(line string, parts []string, comment string) (string, error
 }
 
 func (s *Word) Result() ([]common.ReturnResultLine, error) {
-	if s.data == nil {
+	// a bare keyword is never parsed, so it is never written either
+	if s.data == nil || s.data.Value == "" {
 		return nil, errors.ErrFetch
 	}
 	return []common.ReturnResultLine{

config-parser/tests/simple-word_test.go

@@ -0,0 +1,51 @@
+/*
+Copyright 2026 HAProxy Technologies
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package tests
+
+import (
+	"errors"
+	"testing"
+
+	parsererrors "github.com/haproxytech/client-native/v6/config-parser/errors"
+	"github.com/haproxytech/client-native/v6/config-parser/parsers/simple"
+	"github.com/haproxytech/client-native/v6/config-parser/types"
+)
+
+// A Word never parses a bare keyword, so it must not write one either: an
+// empty value renders nothing instead of a line HAProxy rejects.
+func TestWordEmptyValueIsNotWritten(t *testing.T) {
+	parser := &simple.Word{Name: "crt-base"}
+	parser.Init()
+
+	if err := parser.Set(types.StringC{Value: ""}, -1); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := parser.Result(); !errors.Is(err, parsererrors.ErrFetch) {
+		t.Errorf("empty value: got %v, want ErrFetch", err)
+	}
+
+	if err := parser.Set(types.StringC{Value: "/certs"}, -1); err != nil {
+		t.Fatal(err)
+	}
+	result, err := parser.Result()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(result) != 1 || result[0].Data != "crt-base /certs" {
+		t.Errorf("got %+v, want [crt-base /certs]", result)
+	}
+}

configuration/crt_store.go

@@ -216,15 +216,16 @@ func SerializeCrtStore(p parser.Parser, store *models.CrtStore) error {
 		}
 	}
 
-	crtBase := types.StringC{Value: store.CrtBase}
-	if err := p.Set(parser.CrtStore, store.Name, "crt-base", crtBase); err != nil {
-		return err
+	// crt-base and key-base take a mandatory path: an empty value removes
+	// the line instead of writing a bare keyword HAProxy rejects
+	setBase := func(attribute, value string) error {
+		if value == "" {
+			return p.Set(parser.CrtStore, store.Name, attribute, nil)
+		}
+		return p.Set(parser.CrtStore, store.Name, attribute, types.StringC{Value: value})
 	}
-
-	keyBase := types.StringC{Value: store.KeyBase}
-	if err := p.Set(parser.CrtStore, store.Name, "key-base", keyBase); err != nil {
+	if err := setBase("crt-base", store.CrtBase); err != nil {
 		return err
 	}
-
-	return nil
+	return setBase("key-base", store.KeyBase)
 }

configuration/crt_store_test.go

@@ -0,0 +1,60 @@
+// Copyright 2026 HAProxy Technologies
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package configuration
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	parser "github.com/haproxytech/client-native/v6/config-parser"
+	"github.com/haproxytech/client-native/v6/config-parser/options"
+	"github.com/haproxytech/client-native/v6/models"
+)
+
+func renderCrtStore(t *testing.T, config string, store *models.CrtStore) string {
+	t.Helper()
+	p, err := parser.New(options.String(config))
+	require.NoError(t, err)
+	require.NoError(t, SerializeCrtStore(p, store))
+	return strings.TrimSpace(p.String())
+}
+
+// crt-base and key-base take a mandatory path: a store without them must
+// render a bare section, not empty keywords that HAProxy rejects.
+func TestSerializeCrtStoreWithoutBases(t *testing.T) {
+	store := &models.CrtStore{CrtStoreBase: models.CrtStoreBase{Name: "cs"}}
+	require.Equal(t, "crt-store cs", renderCrtStore(t, "crt-store cs\n", store))
+}
+
+// Clearing a base on edit removes its line instead of leaving the keyword.
+func TestSerializeCrtStoreClearsBases(t *testing.T) {
+	store := &models.CrtStore{CrtStoreBase: models.CrtStoreBase{Name: "cs", CrtBase: "/certs"}}
+	out := renderCrtStore(t, "crt-store cs\n  crt-base /old\n  key-base /keys\n", store)
+	require.Equal(t, "crt-store cs\n  crt-base /certs", out)
+}
+
+func TestSerializeCrtStoreRoundTrip(t *testing.T) {
+	store := &models.CrtStore{CrtStoreBase: models.CrtStoreBase{Name: "cs", CrtBase: "/certs", KeyBase: "/keys"}}
+	out := renderCrtStore(t, "crt-store cs\n", store)
+
+	p, err := parser.New(options.String(out))
+	require.NoError(t, err)
+	got := &models.CrtStore{CrtStoreBase: models.CrtStoreBase{Name: "cs"}}
+	require.NoError(t, ParseCrtStore(p, got))
+	require.True(t, got.CrtStoreBase.Equal(store.CrtStoreBase))
+}

test/crt_store_test.go

@@ -301,3 +301,33 @@ func TestCreateEditDeleteCrtLoads(t *testing.T) {
 		t.Fatal("DeleteCrtLoad() did not work correctly")
 	}
 }
+
+// crt-base and key-base are optional: a store created without them must be
+// readable back as is, and clearing a base on edit must drop its line.
+func TestCreateEditCrtStoreWithoutBases(t *testing.T) {
+	name := fmt.Sprintf("test-store-nobase-%d", version)
+	store := &models.CrtStore{CrtStoreBase: models.CrtStoreBase{Name: name}}
+
+	require.NoError(t, clientTest.CreateCrtStore(store, "", version))
+	version++
+
+	_, created, err := clientTest.GetCrtStore(name, "")
+	require.NoError(t, err)
+	require.True(t, created.Equal(*store), "diff %v", cmp.Diff(*created, *store))
+
+	store.CrtBase = "/secure/certs"
+	require.NoError(t, clientTest.EditCrtStore(name, store, "", version))
+	version++
+
+	store.CrtBase = ""
+	store.KeyBase = "/secure/keys"
+	require.NoError(t, clientTest.EditCrtStore(name, store, "", version))
+	version++
+
+	_, edited, err := clientTest.GetCrtStore(name, "")
+	require.NoError(t, err)
+	require.True(t, edited.Equal(*store), "diff %v", cmp.Diff(*edited, *store))
+
+	require.NoError(t, clientTest.DeleteCrtStore(name, "", version))
+	version++
+}