blob: 310ba238f3a244eaee64833402eee59b139d9739 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
#!/bin/bash
# Tests for create-local command
this_dir="$(cd "$(dirname "$0")" && pwd)"
source "${this_dir}/common.sh"
test_create_local() {
local target_dir="${TEST_DIR}/local-store-dir"
szecret create-local "test-local-store" "${target_dir}"
assert_file_exists "${SZECRET_STORE}/local-key-test-local-store.age" "local key file"
assert_file_exists "${target_dir}/.szecret" "metadata file"
# Check metadata format
assert_contains "$(cat "${target_dir}/.szecret")" "store=test-local-store" "store in metadata"
assert_contains "$(cat "${target_dir}/.szecret")" "pubkey=age1" "pubkey in metadata"
pass "create-local creates local key and metadata"
}
test_create_local_creates_directory() {
local target_dir="${TEST_DIR}/nested/new/directory"
szecret create-local "nested-store" "${target_dir}"
assert_file_exists "${target_dir}/.szecret" "metadata file in created directory"
pass "create-local creates target directory"
}
test_create_local_migration() {
# Simulate existing store without metadata (old-style)
local dir1="${TEST_DIR}/dir1"
local dir2="${TEST_DIR}/dir2"
# Create store with first directory
szecret create-local "migration-store" "${dir1}"
# Now "migrate" to a second directory - should just add metadata
szecret create-local "migration-store" "${dir2}"
assert_file_exists "${dir2}/.szecret" "metadata in second directory"
# Check metadata format and that pubkey is same in both dirs
assert_contains "$(cat "${dir2}/.szecret")" "store=migration-store" "store in metadata"
local pubkey1 pubkey2
pubkey1="$(grep pubkey "${dir1}/.szecret" | cut -d= -f2)"
pubkey2="$(grep pubkey "${dir2}/.szecret" | cut -d= -f2)"
assert_equals "${pubkey1}" "${pubkey2}" "pubkey matches across directories"
pass "create-local adds metadata for existing key (migration)"
}
test_create_local_migration_preserves_key() {
local target_dir="${TEST_DIR}/preserve-key"
szecret create-local "preserve-store" "${target_dir}"
# Encrypt a secret
local secret_value="test-secret-value"
echo "${secret_value}" | szecret put-local "${target_dir}/secret.age"
# Remove metadata to simulate old-style store
rm "${target_dir}/.szecret"
# Run create-local again - should add metadata without regenerating key
szecret create-local "preserve-store" "${target_dir}"
# Verify we can still decrypt - proves key wasn't overwritten
local retrieved
retrieved="$(szecret get-local "${target_dir}/secret.age")"
assert_equals "${secret_value}" "${retrieved}" "decrypted value after migration"
pass "create-local migration preserves existing key"
}
test_create_local_reuses_key_across_directories() {
local dir1="${TEST_DIR}/multi-dir-1"
local dir2="${TEST_DIR}/multi-dir-2"
# Create store with first directory and encrypt a secret
szecret create-local "shared-store" "${dir1}"
local secret_value="shared-secret"
echo "${secret_value}" | szecret put-local "${dir1}/secret.age"
# Add same store to second directory
szecret create-local "shared-store" "${dir2}"
# Verify secret in dir1 still decrypts - proves key was reused not overwritten
local retrieved
retrieved="$(szecret get-local "${dir1}/secret.age")"
assert_equals "${secret_value}" "${retrieved}" "secret from first directory"
# Verify we can also encrypt/decrypt in dir2 with same key
echo "dir2-secret" | szecret put-local "${dir2}/secret.age"
retrieved="$(szecret get-local "${dir2}/secret.age")"
assert_equals "dir2-secret" "${retrieved}" "secret from second directory"
pass "create-local reuses key across directories"
}
test_create_local_existing_metadata_fails() {
local target_dir="${TEST_DIR}/existing-metadata"
mkdir -p "${target_dir}"
echo "other-store" > "${target_dir}/.szecret"
assert_failure szecret create-local "new-store" "${target_dir}"
pass "create-local fails if metadata exists"
}
test_create_local_requires_args() {
assert_failure szecret create-local
assert_failure szecret create-local "store-only"
pass "create-local requires store name and directory"
}
run_tests() {
test_create_local
test_create_local_creates_directory
test_create_local_migration
test_create_local_migration_preserves_key
test_create_local_reuses_key_across_directories
test_create_local_existing_metadata_fails
test_create_local_requires_args
}
[[ "${BASH_SOURCE[0]}" == "${0}" ]] && run_tests
|
