1 files changed, 122 insertions, 0 deletions
diff --git a/secrets/test/create-local.sh b/secrets/test/create-local.sh
new file mode 100755
index 0000000..310ba23
--- /dev/null
+++ b/secrets/test/create-local.sh
@@ -0,0 +1,122 @@
+#!/bin/bash
+# Tests for create-local command
+
+this_dir="$(cd "$(dirname "$0")" && pwd)"
+source "${this_dir}/common.sh"
+
+test_create_local() {
+    local target_dir="${TEST_DIR}/local-store-dir"
+    szecret create-local "test-local-store" "${target_dir}"
+
+    assert_file_exists "${SZECRET_STORE}/local-key-test-local-store.age" "local key file"
+    assert_file_exists "${target_dir}/.szecret" "metadata file"
+
+    # Check metadata format
+    assert_contains "$(cat "${target_dir}/.szecret")" "store=test-local-store" "store in metadata"
+    assert_contains "$(cat "${target_dir}/.szecret")" "pubkey=age1" "pubkey in metadata"
+    pass "create-local creates local key and metadata"
+}
+
+test_create_local_creates_directory() {
+    local target_dir="${TEST_DIR}/nested/new/directory"
+    szecret create-local "nested-store" "${target_dir}"
+
+    assert_file_exists "${target_dir}/.szecret" "metadata file in created directory"
+    pass "create-local creates target directory"
+}
+
+test_create_local_migration() {
+    # Simulate existing store without metadata (old-style)
+    local dir1="${TEST_DIR}/dir1"
+    local dir2="${TEST_DIR}/dir2"
+
+    # Create store with first directory
+    szecret create-local "migration-store" "${dir1}"
+
+    # Now "migrate" to a second directory - should just add metadata
+    szecret create-local "migration-store" "${dir2}"
+
+    assert_file_exists "${dir2}/.szecret" "metadata in second directory"
+
+    # Check metadata format and that pubkey is same in both dirs
+    assert_contains "$(cat "${dir2}/.szecret")" "store=migration-store" "store in metadata"
+
+    local pubkey1 pubkey2
+    pubkey1="$(grep pubkey "${dir1}/.szecret" | cut -d= -f2)"
+    pubkey2="$(grep pubkey "${dir2}/.szecret" | cut -d= -f2)"
+    assert_equals "${pubkey1}" "${pubkey2}" "pubkey matches across directories"
+    pass "create-local adds metadata for existing key (migration)"
+}
+
+test_create_local_migration_preserves_key() {
+    local target_dir="${TEST_DIR}/preserve-key"
+    szecret create-local "preserve-store" "${target_dir}"
+
+    # Encrypt a secret
+    local secret_value="test-secret-value"
+    echo "${secret_value}" | szecret put-local "${target_dir}/secret.age"
+
+    # Remove metadata to simulate old-style store
+    rm "${target_dir}/.szecret"
+
+    # Run create-local again - should add metadata without regenerating key
+    szecret create-local "preserve-store" "${target_dir}"
+
+    # Verify we can still decrypt - proves key wasn't overwritten
+    local retrieved
+    retrieved="$(szecret get-local "${target_dir}/secret.age")"
+    assert_equals "${secret_value}" "${retrieved}" "decrypted value after migration"
+    pass "create-local migration preserves existing key"
+}
+
+test_create_local_reuses_key_across_directories() {
+    local dir1="${TEST_DIR}/multi-dir-1"
+    local dir2="${TEST_DIR}/multi-dir-2"
+
+    # Create store with first directory and encrypt a secret
+    szecret create-local "shared-store" "${dir1}"
+    local secret_value="shared-secret"
+    echo "${secret_value}" | szecret put-local "${dir1}/secret.age"
+
+    # Add same store to second directory
+    szecret create-local "shared-store" "${dir2}"
+
+    # Verify secret in dir1 still decrypts - proves key was reused not overwritten
+    local retrieved
+    retrieved="$(szecret get-local "${dir1}/secret.age")"
+    assert_equals "${secret_value}" "${retrieved}" "secret from first directory"
+
+    # Verify we can also encrypt/decrypt in dir2 with same key
+    echo "dir2-secret" | szecret put-local "${dir2}/secret.age"
+    retrieved="$(szecret get-local "${dir2}/secret.age")"
+    assert_equals "dir2-secret" "${retrieved}" "secret from second directory"
+
+    pass "create-local reuses key across directories"
+}
+
+test_create_local_existing_metadata_fails() {
+    local target_dir="${TEST_DIR}/existing-metadata"
+    mkdir -p "${target_dir}"
+    echo "other-store" > "${target_dir}/.szecret"
+
+    assert_failure szecret create-local "new-store" "${target_dir}"
+    pass "create-local fails if metadata exists"
+}
+
+test_create_local_requires_args() {
+    assert_failure szecret create-local
+    assert_failure szecret create-local "store-only"
+    pass "create-local requires store name and directory"
+}
+
+run_tests() {
+    test_create_local
+    test_create_local_creates_directory
+    test_create_local_migration
+    test_create_local_migration_preserves_key
+    test_create_local_reuses_key_across_directories
+    test_create_local_existing_metadata_fails
+    test_create_local_requires_args
+}
+
+[[ "${BASH_SOURCE[0]}" == "${0}" ]] && run_tests