all repos — dot @ master

Shell, editor and terminal configuration, and the tools that go with them

secrets/test/local.sh (view raw)

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
 100
 101
 102
 103
 104
 105
 106
 107
 108
 109
 110
 111
 112
 113
 114
 115
 116
 117
 118
 119
 120
 121
 122
 123
 124
 125
 126
 127
 128
 129
 130
 131
 132
 
#!/bin/bash
# Tests for put-local and get-local commands

this_dir="$(cd "$(dirname "$0")" && pwd)"
source "${this_dir}/common.sh"

test_put_local_and_get_local() {
    local target_dir="${TEST_DIR}/secrets"
    szecret create-local "test-store" "${target_dir}"

    local secret_value="local-secret-value-456"
    local encrypted_file="${target_dir}/secret.age"

    echo "${secret_value}" | szecret put-local "${encrypted_file}"

    assert_file_exists "${encrypted_file}" "encrypted file"

    local retrieved
    retrieved="$(szecret get-local "${encrypted_file}")"
    assert_equals "${secret_value}" "${retrieved}" "local secret value"
    pass "put-local and get-local"
}

test_put_local_no_metadata_fails() {
    local target_dir="${TEST_DIR}/no-metadata"
    mkdir -p "${target_dir}"

    assert_failure bash -c "echo 'value' | szecret put-local '${target_dir}/secret.age'"
    pass "put-local fails without metadata"
}

test_get_local_no_metadata_fails() {
    local target_dir="${TEST_DIR}/no-metadata-get"
    mkdir -p "${target_dir}"
    touch "${target_dir}/fake.age"

    assert_failure szecret get-local "${target_dir}/fake.age"
    pass "get-local fails without metadata"
}

test_get_local_legacy_syntax_warns() {
    local target_dir="${TEST_DIR}/legacy-test"
    szecret create-local "legacy-store" "${target_dir}"

    local secret_value="legacy-value"
    echo "${secret_value}" | szecret put-local "${target_dir}/secret.age"

    # Use legacy 2-arg syntax - should warn even with metadata present
    local stderr_output
    stderr_output="$(szecret get-local "legacy-store" "${target_dir}/secret.age" 2>&1 >/dev/null)"

    assert_contains "${stderr_output}" "WARN" "deprecation warning"
    assert_contains "${stderr_output}" "deprecated" "deprecation message"

    # Should still work despite warning
    local retrieved
    retrieved="$(szecret get-local "legacy-store" "${target_dir}/secret.age" 2>/dev/null)"
    assert_equals "${secret_value}" "${retrieved}" "legacy syntax result"
    pass "get-local legacy syntax warns but works"
}

test_get_local_nonexistent_file_fails() {
    local target_dir="${TEST_DIR}/nonexistent-file"
    szecret create-local "file-test-store" "${target_dir}"

    assert_failure szecret get-local "${target_dir}/nonexistent.age"
    pass "get-local fails for nonexistent file"
}

test_put_local_requires_arg() {
    assert_failure szecret put-local
    pass "put-local requires file path"
}

test_get_local_requires_arg() {
    assert_failure szecret get-local
    pass "get-local requires file path"
}

test_put_local_pubkey_mismatch_fails() {
    local target_dir="${TEST_DIR}/pubkey-mismatch-put"
    szecret create-local "mismatch-put-store" "${target_dir}"

    # Corrupt the pubkey in metadata
    sed -i.bak 's/pubkey=.*/pubkey=age1invalid000000000000000000000000000000000000000000000000000/' "${target_dir}/.szecret"

    # Should fail on put-local
    assert_failure bash -c "echo 'value' | szecret put-local '${target_dir}/secret.age'"
    pass "put-local fails on pubkey mismatch"
}

test_get_local_pubkey_mismatch_fails() {
    local target_dir="${TEST_DIR}/pubkey-mismatch-get"
    szecret create-local "mismatch-get-store" "${target_dir}"

    # Encrypt a secret first
    echo "secret-value" | szecret put-local "${target_dir}/secret.age"

    # Corrupt the pubkey in metadata
    sed -i.bak 's/pubkey=.*/pubkey=age1invalid000000000000000000000000000000000000000000000000000/' "${target_dir}/.szecret"

    # Should fail on get-local (new syntax)
    assert_failure szecret get-local "${target_dir}/secret.age"
    pass "get-local fails on pubkey mismatch"
}

test_invalid_metadata_fails() {
    local target_dir="${TEST_DIR}/invalid-metadata"
    mkdir -p "${target_dir}"

    # Create invalid metadata (old format without pubkey)
    echo "just-store-name" > "${target_dir}/.szecret"
    touch "${target_dir}/secret.age"

    assert_failure szecret get-local "${target_dir}/secret.age"
    pass "invalid metadata format fails"
}

run_tests() {
    test_put_local_and_get_local
    test_put_local_no_metadata_fails
    test_get_local_no_metadata_fails
    test_get_local_legacy_syntax_warns
    test_get_local_nonexistent_file_fails
    test_put_local_requires_arg
    test_get_local_requires_arg
    test_put_local_pubkey_mismatch_fails
    test_get_local_pubkey_mismatch_fails
    test_invalid_metadata_fails
}

[[ "${BASH_SOURCE[0]}" == "${0}" ]] && run_tests