#!/bin/bash
# Tests for rotate command

this_dir="$(cd "$(dirname "$0")" && pwd)"
source "${this_dir}/common.sh"

setup_key_dir_layout() {
    local keys_dir="${TEST_DIR}/keys"
    mkdir -p "${keys_dir}" "${SZECRET_STORE}"
    rm -f "${SZECRET_STORE}"/*.age
    unset SZECRET_PRIVATE_KEY
    export SZECRET_PRIVATE_KEY_DIR="${keys_dir}"

    local temp_key="${TEST_DIR}/initial-key"
    age-keygen -o "${temp_key}" 2>/dev/null
    local pub
    pub="$(age-keygen -y "${temp_key}")"
    echo "${pub}" > "${SZECRET_PUBLIC_KEY}"
    mv "${temp_key}" "${keys_dir}/${pub}"
    chmod 600 "${keys_dir}/${pub}"
    SETUP_PUB="${pub}"
}

test_rotate_reencrypts_secrets() {
    setup_key_dir_layout
    local old_pub="${SETUP_PUB}"

    echo "rotate-me" | szecret put "rotate-test"
    echo "other" | szecret put "rotate-other"

    szecret rotate --yes

    local new_pub
    new_pub="$(cat "${SZECRET_PUBLIC_KEY}")"
    if [[ "${new_pub}" == "${old_pub}" ]]; then
        fail "public key should change after rotate"
    fi

    assert_equals "rotate-me" "$(szecret get "rotate-test")" "rotated secret"
    assert_equals "other" "$(szecret get "rotate-other")" "other rotated secret"
    assert_file_exists "${SZECRET_PRIVATE_KEY_DIR}/${new_pub}" "new private key file"
    pass "rotate re-encrypts secrets and updates keys"
}

test_rotate_empty_store() {
    setup_key_dir_layout >/dev/null

    szecret rotate --yes

    local new_pub
    new_pub="$(cat "${SZECRET_PUBLIC_KEY}")"
    assert_file_exists "${SZECRET_PRIVATE_KEY_DIR}/${new_pub}" "new private key with empty store"
    pass "rotate succeeds with empty store"
}

test_rotate_requires_confirmation() {
    setup_key_dir_layout >/dev/null

    assert_failure szecret rotate
    pass "rotate fails without confirmation"
}

run_tests() {
    test_rotate_reencrypts_secrets
    test_rotate_empty_store
    test_rotate_requires_confirmation
}

[[ "${BASH_SOURCE[0]}" == "${0}" ]] && run_tests