1 files changed, 132 insertions, 0 deletions
diff --git a/secrets/test/local.sh b/secrets/test/local.sh
new file mode 100755
index 0000000..e8d174b
--- /dev/null
+++ b/secrets/test/local.sh
@@ -0,0 +1,132 @@
+#!/bin/bash
+# Tests for put-local and get-local commands
+
+this_dir="$(cd "$(dirname "$0")" && pwd)"
+source "${this_dir}/common.sh"
+
+test_put_local_and_get_local() {
+    local target_dir="${TEST_DIR}/secrets"
+    szecret create-local "test-store" "${target_dir}"
+
+    local secret_value="local-secret-value-456"
+    local encrypted_file="${target_dir}/secret.age"
+
+    echo "${secret_value}" | szecret put-local "${encrypted_file}"
+
+    assert_file_exists "${encrypted_file}" "encrypted file"
+
+    local retrieved
+    retrieved="$(szecret get-local "${encrypted_file}")"
+    assert_equals "${secret_value}" "${retrieved}" "local secret value"
+    pass "put-local and get-local"
+}
+
+test_put_local_no_metadata_fails() {
+    local target_dir="${TEST_DIR}/no-metadata"
+    mkdir -p "${target_dir}"
+
+    assert_failure bash -c "echo 'value' | szecret put-local '${target_dir}/secret.age'"
+    pass "put-local fails without metadata"
+}
+
+test_get_local_no_metadata_fails() {
+    local target_dir="${TEST_DIR}/no-metadata-get"
+    mkdir -p "${target_dir}"
+    touch "${target_dir}/fake.age"
+
+    assert_failure szecret get-local "${target_dir}/fake.age"
+    pass "get-local fails without metadata"
+}
+
+test_get_local_legacy_syntax_warns() {
+    local target_dir="${TEST_DIR}/legacy-test"
+    szecret create-local "legacy-store" "${target_dir}"
+
+    local secret_value="legacy-value"
+    echo "${secret_value}" | szecret put-local "${target_dir}/secret.age"
+
+    # Use legacy 2-arg syntax - should warn even with metadata present
+    local stderr_output
+    stderr_output="$(szecret get-local "legacy-store" "${target_dir}/secret.age" 2>&1 >/dev/null)"
+
+    assert_contains "${stderr_output}" "WARN" "deprecation warning"
+    assert_contains "${stderr_output}" "deprecated" "deprecation message"
+
+    # Should still work despite warning
+    local retrieved
+    retrieved="$(szecret get-local "legacy-store" "${target_dir}/secret.age" 2>/dev/null)"
+    assert_equals "${secret_value}" "${retrieved}" "legacy syntax result"
+    pass "get-local legacy syntax warns but works"
+}
+
+test_get_local_nonexistent_file_fails() {
+    local target_dir="${TEST_DIR}/nonexistent-file"
+    szecret create-local "file-test-store" "${target_dir}"
+
+    assert_failure szecret get-local "${target_dir}/nonexistent.age"
+    pass "get-local fails for nonexistent file"
+}
+
+test_put_local_requires_arg() {
+    assert_failure szecret put-local
+    pass "put-local requires file path"
+}
+
+test_get_local_requires_arg() {
+    assert_failure szecret get-local
+    pass "get-local requires file path"
+}
+
+test_put_local_pubkey_mismatch_fails() {
+    local target_dir="${TEST_DIR}/pubkey-mismatch-put"
+    szecret create-local "mismatch-put-store" "${target_dir}"
+
+    # Corrupt the pubkey in metadata
+    sed -i.bak 's/pubkey=.*/pubkey=age1invalid000000000000000000000000000000000000000000000000000/' "${target_dir}/.szecret"
+
+    # Should fail on put-local
+    assert_failure bash -c "echo 'value' | szecret put-local '${target_dir}/secret.age'"
+    pass "put-local fails on pubkey mismatch"
+}
+
+test_get_local_pubkey_mismatch_fails() {
+    local target_dir="${TEST_DIR}/pubkey-mismatch-get"
+    szecret create-local "mismatch-get-store" "${target_dir}"
+
+    # Encrypt a secret first
+    echo "secret-value" | szecret put-local "${target_dir}/secret.age"
+
+    # Corrupt the pubkey in metadata
+    sed -i.bak 's/pubkey=.*/pubkey=age1invalid000000000000000000000000000000000000000000000000000/' "${target_dir}/.szecret"
+
+    # Should fail on get-local (new syntax)
+    assert_failure szecret get-local "${target_dir}/secret.age"
+    pass "get-local fails on pubkey mismatch"
+}
+
+test_invalid_metadata_fails() {
+    local target_dir="${TEST_DIR}/invalid-metadata"
+    mkdir -p "${target_dir}"
+
+    # Create invalid metadata (old format without pubkey)
+    echo "just-store-name" > "${target_dir}/.szecret"
+    touch "${target_dir}/secret.age"
+
+    assert_failure szecret get-local "${target_dir}/secret.age"
+    pass "invalid metadata format fails"
+}
+
+run_tests() {
+    test_put_local_and_get_local
+    test_put_local_no_metadata_fails
+    test_get_local_no_metadata_fails
+    test_get_local_legacy_syntax_warns
+    test_get_local_nonexistent_file_fails
+    test_put_local_requires_arg
+    test_get_local_requires_arg
+    test_put_local_pubkey_mismatch_fails
+    test_get_local_pubkey_mismatch_fails
+    test_invalid_metadata_fails
+}
+
+[[ "${BASH_SOURCE[0]}" == "${0}" ]] && run_tests