1 files changed, 69 insertions, 0 deletions
diff --git a/secrets/test/rotate.sh b/secrets/test/rotate.sh
new file mode 100755
index 0000000..02abe39
--- /dev/null
+++ b/secrets/test/rotate.sh
@@ -0,0 +1,69 @@
+#!/bin/bash
+# Tests for rotate command
+
+this_dir="$(cd "$(dirname "$0")" && pwd)"
+source "${this_dir}/common.sh"
+
+setup_key_dir_layout() {
+    local keys_dir="${TEST_DIR}/keys"
+    mkdir -p "${keys_dir}" "${SZECRET_STORE}"
+    rm -f "${SZECRET_STORE}"/*.age
+    unset SZECRET_PRIVATE_KEY
+    export SZECRET_PRIVATE_KEY_DIR="${keys_dir}"
+
+    local temp_key="${TEST_DIR}/initial-key"
+    age-keygen -o "${temp_key}" 2>/dev/null
+    local pub
+    pub="$(age-keygen -y "${temp_key}")"
+    echo "${pub}" > "${SZECRET_PUBLIC_KEY}"
+    mv "${temp_key}" "${keys_dir}/${pub}"
+    chmod 600 "${keys_dir}/${pub}"
+    SETUP_PUB="${pub}"
+}
+
+test_rotate_reencrypts_secrets() {
+    setup_key_dir_layout
+    local old_pub="${SETUP_PUB}"
+
+    echo "rotate-me" | szecret put "rotate-test"
+    echo "other" | szecret put "rotate-other"
+
+    szecret rotate --yes
+
+    local new_pub
+    new_pub="$(cat "${SZECRET_PUBLIC_KEY}")"
+    if [[ "${new_pub}" == "${old_pub}" ]]; then
+        fail "public key should change after rotate"
+    fi
+
+    assert_equals "rotate-me" "$(szecret get "rotate-test")" "rotated secret"
+    assert_equals "other" "$(szecret get "rotate-other")" "other rotated secret"
+    assert_file_exists "${SZECRET_PRIVATE_KEY_DIR}/${new_pub}" "new private key file"
+    pass "rotate re-encrypts secrets and updates keys"
+}
+
+test_rotate_empty_store() {
+    setup_key_dir_layout >/dev/null
+
+    szecret rotate --yes
+
+    local new_pub
+    new_pub="$(cat "${SZECRET_PUBLIC_KEY}")"
+    assert_file_exists "${SZECRET_PRIVATE_KEY_DIR}/${new_pub}" "new private key with empty store"
+    pass "rotate succeeds with empty store"
+}
+
+test_rotate_requires_confirmation() {
+    setup_key_dir_layout >/dev/null
+
+    assert_failure szecret rotate
+    pass "rotate fails without confirmation"
+}
+
+run_tests() {
+    test_rotate_reencrypts_secrets
+    test_rotate_empty_store
+    test_rotate_requires_confirmation
+}
+
+[[ "${BASH_SOURCE[0]}" == "${0}" ]] && run_tests