dotfiles

Shell, editor and terminal configuration, the tools that go with them, and
szecret, an age-based secret manager whose store lives elsewhere.

History restarts here. What came before was not written to be read by
anyone else, and carried machine names, addresses and an encrypted secret
store; it is kept privately instead. What is left is meant to be safe on
any machine, including one whose owner is not me: see CLAUDE.md for the
rule it is written to.

1 files changed, 69 insertions, 0 deletions

diff --git a/secrets/test/rotate.sh b/secrets/test/rotate.sh
new file mode 100755
index 0000000..02abe39
--- /dev/null
+++ b/secrets/test/rotate.sh
@@ -0,0 +1,69 @@
+#!/bin/bash
+# Tests for rotate command
+
+this_dir="$(cd "$(dirname "$0")" && pwd)"
+source "${this_dir}/common.sh"
+
+setup_key_dir_layout() {
+    local keys_dir="${TEST_DIR}/keys"
+    mkdir -p "${keys_dir}" "${SZECRET_STORE}"
+    rm -f "${SZECRET_STORE}"/*.age
+    unset SZECRET_PRIVATE_KEY
+    export SZECRET_PRIVATE_KEY_DIR="${keys_dir}"
+
+    local temp_key="${TEST_DIR}/initial-key"
+    age-keygen -o "${temp_key}" 2>/dev/null
+    local pub
+    pub="$(age-keygen -y "${temp_key}")"
+    echo "${pub}" > "${SZECRET_PUBLIC_KEY}"
+    mv "${temp_key}" "${keys_dir}/${pub}"
+    chmod 600 "${keys_dir}/${pub}"
+    SETUP_PUB="${pub}"
+}
+
+test_rotate_reencrypts_secrets() {
+    setup_key_dir_layout
+    local old_pub="${SETUP_PUB}"
+
+    echo "rotate-me" | szecret put "rotate-test"
+    echo "other" | szecret put "rotate-other"
+
+    szecret rotate --yes
+
+    local new_pub
+    new_pub="$(cat "${SZECRET_PUBLIC_KEY}")"
+    if [[ "${new_pub}" == "${old_pub}" ]]; then
+        fail "public key should change after rotate"
+    fi
+
+    assert_equals "rotate-me" "$(szecret get "rotate-test")" "rotated secret"
+    assert_equals "other" "$(szecret get "rotate-other")" "other rotated secret"
+    assert_file_exists "${SZECRET_PRIVATE_KEY_DIR}/${new_pub}" "new private key file"
+    pass "rotate re-encrypts secrets and updates keys"
+}
+
+test_rotate_empty_store() {
+    setup_key_dir_layout >/dev/null
+
+    szecret rotate --yes
+
+    local new_pub
+    new_pub="$(cat "${SZECRET_PUBLIC_KEY}")"
+    assert_file_exists "${SZECRET_PRIVATE_KEY_DIR}/${new_pub}" "new private key with empty store"
+    pass "rotate succeeds with empty store"
+}
+
+test_rotate_requires_confirmation() {
+    setup_key_dir_layout >/dev/null
+
+    assert_failure szecret rotate
+    pass "rotate fails without confirmation"
+}
+
+run_tests() {
+    test_rotate_reencrypts_secrets
+    test_rotate_empty_store
+    test_rotate_requires_confirmation
+}
+
+[[ "${BASH_SOURCE[0]}" == "${0}" ]] && run_tests