Add certificate replacement lifecycle

dns_sync/plugins/adapters/npm.py

@@ -11,6 +11,7 @@ from ...adapters import (
     ObjectReference,
     PlanAction,
     PlanOperation,
+    RetireRequest,
 )
 from ...certificates.material import CertificateMaterial
 from ...npm_client import NpmClient
@@ -602,6 +603,12 @@ class Plugin:
         ):
             return self._create_certificate(desired)
 
+        if (
+            desired.object_type == CERTIFICATES
+            and action.operation == PlanOperation.REPLACE
+        ):
+            return self._replace_certificate(action)
+
         if (
             desired.object_type == PROXY_HOSTS
             and action.operation == PlanOperation.CREATE
@@ -619,6 +626,65 @@ class Plugin:
             f"{action.operation} for {desired.object_type}"
         )
 
+    def _replace_certificate(
+        self,
+        action: PlanAction,
+    ) -> ApplyResult:
+        desired = action.desired
+        current = action.current
+
+        if desired is None or desired.object_type != CERTIFICATES:
+            raise RuntimeError(
+                "NPM certificate replace requires desired certificate"
+            )
+
+        if current is None or current.object_type != CERTIFICATES:
+            raise RuntimeError(
+                "NPM certificate replace requires current certificate"
+            )
+
+        if current.local_key is None:
+            raise RuntimeError(
+                "NPM certificate replace requires current local id"
+            )
+
+        if current.logical_key != desired.logical_key:
+            raise RuntimeError(
+                "NPM certificate replace identity mismatch"
+            )
+
+        result = self._create_certificate(desired)
+
+        return ApplyResult(
+            object=result.object,
+            detail="replaced certificate",
+            retirements=(
+                RetireRequest(
+                    object=current,
+                ),
+            ),
+        )
+
+    def retire(
+        self,
+        request: RetireRequest,
+    ) -> None:
+        retired = request.object
+
+        if retired.object_type != CERTIFICATES:
+            raise RuntimeError(
+                "NPM deferred retirement only supports certificates"
+            )
+
+        if retired.local_key is None:
+            raise RuntimeError(
+                "NPM certificate retirement requires local id"
+            )
+
+        self.client.delete_certificate(
+            retired.local_key
+        )
+
     def _create_certificate(
         self,
         desired: NormalizedObject,