all repos — dot @ master

Shell, editor and terminal configuration, and the tools that go with them

secrets/test/create-local.sh (view raw)

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
 100
 101
 102
 103
 104
 105
 106
 107
 108
 109
 110
 111
 112
 113
 114
 115
 116
 117
 118
 119
 120
 121
 122
 
#!/bin/bash
# Tests for create-local command

this_dir="$(cd "$(dirname "$0")" && pwd)"
source "${this_dir}/common.sh"

test_create_local() {
    local target_dir="${TEST_DIR}/local-store-dir"
    szecret create-local "test-local-store" "${target_dir}"

    assert_file_exists "${SZECRET_STORE}/local-key-test-local-store.age" "local key file"
    assert_file_exists "${target_dir}/.szecret" "metadata file"

    # Check metadata format
    assert_contains "$(cat "${target_dir}/.szecret")" "store=test-local-store" "store in metadata"
    assert_contains "$(cat "${target_dir}/.szecret")" "pubkey=age1" "pubkey in metadata"
    pass "create-local creates local key and metadata"
}

test_create_local_creates_directory() {
    local target_dir="${TEST_DIR}/nested/new/directory"
    szecret create-local "nested-store" "${target_dir}"

    assert_file_exists "${target_dir}/.szecret" "metadata file in created directory"
    pass "create-local creates target directory"
}

test_create_local_migration() {
    # Simulate existing store without metadata (old-style)
    local dir1="${TEST_DIR}/dir1"
    local dir2="${TEST_DIR}/dir2"

    # Create store with first directory
    szecret create-local "migration-store" "${dir1}"

    # Now "migrate" to a second directory - should just add metadata
    szecret create-local "migration-store" "${dir2}"

    assert_file_exists "${dir2}/.szecret" "metadata in second directory"

    # Check metadata format and that pubkey is same in both dirs
    assert_contains "$(cat "${dir2}/.szecret")" "store=migration-store" "store in metadata"

    local pubkey1 pubkey2
    pubkey1="$(grep pubkey "${dir1}/.szecret" | cut -d= -f2)"
    pubkey2="$(grep pubkey "${dir2}/.szecret" | cut -d= -f2)"
    assert_equals "${pubkey1}" "${pubkey2}" "pubkey matches across directories"
    pass "create-local adds metadata for existing key (migration)"
}

test_create_local_migration_preserves_key() {
    local target_dir="${TEST_DIR}/preserve-key"
    szecret create-local "preserve-store" "${target_dir}"

    # Encrypt a secret
    local secret_value="test-secret-value"
    echo "${secret_value}" | szecret put-local "${target_dir}/secret.age"

    # Remove metadata to simulate old-style store
    rm "${target_dir}/.szecret"

    # Run create-local again - should add metadata without regenerating key
    szecret create-local "preserve-store" "${target_dir}"

    # Verify we can still decrypt - proves key wasn't overwritten
    local retrieved
    retrieved="$(szecret get-local "${target_dir}/secret.age")"
    assert_equals "${secret_value}" "${retrieved}" "decrypted value after migration"
    pass "create-local migration preserves existing key"
}

test_create_local_reuses_key_across_directories() {
    local dir1="${TEST_DIR}/multi-dir-1"
    local dir2="${TEST_DIR}/multi-dir-2"

    # Create store with first directory and encrypt a secret
    szecret create-local "shared-store" "${dir1}"
    local secret_value="shared-secret"
    echo "${secret_value}" | szecret put-local "${dir1}/secret.age"

    # Add same store to second directory
    szecret create-local "shared-store" "${dir2}"

    # Verify secret in dir1 still decrypts - proves key was reused not overwritten
    local retrieved
    retrieved="$(szecret get-local "${dir1}/secret.age")"
    assert_equals "${secret_value}" "${retrieved}" "secret from first directory"

    # Verify we can also encrypt/decrypt in dir2 with same key
    echo "dir2-secret" | szecret put-local "${dir2}/secret.age"
    retrieved="$(szecret get-local "${dir2}/secret.age")"
    assert_equals "dir2-secret" "${retrieved}" "secret from second directory"

    pass "create-local reuses key across directories"
}

test_create_local_existing_metadata_fails() {
    local target_dir="${TEST_DIR}/existing-metadata"
    mkdir -p "${target_dir}"
    echo "other-store" > "${target_dir}/.szecret"

    assert_failure szecret create-local "new-store" "${target_dir}"
    pass "create-local fails if metadata exists"
}

test_create_local_requires_args() {
    assert_failure szecret create-local
    assert_failure szecret create-local "store-only"
    pass "create-local requires store name and directory"
}

run_tests() {
    test_create_local
    test_create_local_creates_directory
    test_create_local_migration
    test_create_local_migration_preserves_key
    test_create_local_reuses_key_across_directories
    test_create_local_existing_metadata_fails
    test_create_local_requires_args
}

[[ "${BASH_SOURCE[0]}" == "${0}" ]] && run_tests