blob: e8d174b2d79edc793e40e67f4105025db7a30b92 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
|
#!/bin/bash
# Tests for put-local and get-local commands
this_dir="$(cd "$(dirname "$0")" && pwd)"
source "${this_dir}/common.sh"
test_put_local_and_get_local() {
local target_dir="${TEST_DIR}/secrets"
szecret create-local "test-store" "${target_dir}"
local secret_value="local-secret-value-456"
local encrypted_file="${target_dir}/secret.age"
echo "${secret_value}" | szecret put-local "${encrypted_file}"
assert_file_exists "${encrypted_file}" "encrypted file"
local retrieved
retrieved="$(szecret get-local "${encrypted_file}")"
assert_equals "${secret_value}" "${retrieved}" "local secret value"
pass "put-local and get-local"
}
test_put_local_no_metadata_fails() {
local target_dir="${TEST_DIR}/no-metadata"
mkdir -p "${target_dir}"
assert_failure bash -c "echo 'value' | szecret put-local '${target_dir}/secret.age'"
pass "put-local fails without metadata"
}
test_get_local_no_metadata_fails() {
local target_dir="${TEST_DIR}/no-metadata-get"
mkdir -p "${target_dir}"
touch "${target_dir}/fake.age"
assert_failure szecret get-local "${target_dir}/fake.age"
pass "get-local fails without metadata"
}
test_get_local_legacy_syntax_warns() {
local target_dir="${TEST_DIR}/legacy-test"
szecret create-local "legacy-store" "${target_dir}"
local secret_value="legacy-value"
echo "${secret_value}" | szecret put-local "${target_dir}/secret.age"
# Use legacy 2-arg syntax - should warn even with metadata present
local stderr_output
stderr_output="$(szecret get-local "legacy-store" "${target_dir}/secret.age" 2>&1 >/dev/null)"
assert_contains "${stderr_output}" "WARN" "deprecation warning"
assert_contains "${stderr_output}" "deprecated" "deprecation message"
# Should still work despite warning
local retrieved
retrieved="$(szecret get-local "legacy-store" "${target_dir}/secret.age" 2>/dev/null)"
assert_equals "${secret_value}" "${retrieved}" "legacy syntax result"
pass "get-local legacy syntax warns but works"
}
test_get_local_nonexistent_file_fails() {
local target_dir="${TEST_DIR}/nonexistent-file"
szecret create-local "file-test-store" "${target_dir}"
assert_failure szecret get-local "${target_dir}/nonexistent.age"
pass "get-local fails for nonexistent file"
}
test_put_local_requires_arg() {
assert_failure szecret put-local
pass "put-local requires file path"
}
test_get_local_requires_arg() {
assert_failure szecret get-local
pass "get-local requires file path"
}
test_put_local_pubkey_mismatch_fails() {
local target_dir="${TEST_DIR}/pubkey-mismatch-put"
szecret create-local "mismatch-put-store" "${target_dir}"
# Corrupt the pubkey in metadata
sed -i.bak 's/pubkey=.*/pubkey=age1invalid000000000000000000000000000000000000000000000000000/' "${target_dir}/.szecret"
# Should fail on put-local
assert_failure bash -c "echo 'value' | szecret put-local '${target_dir}/secret.age'"
pass "put-local fails on pubkey mismatch"
}
test_get_local_pubkey_mismatch_fails() {
local target_dir="${TEST_DIR}/pubkey-mismatch-get"
szecret create-local "mismatch-get-store" "${target_dir}"
# Encrypt a secret first
echo "secret-value" | szecret put-local "${target_dir}/secret.age"
# Corrupt the pubkey in metadata
sed -i.bak 's/pubkey=.*/pubkey=age1invalid000000000000000000000000000000000000000000000000000/' "${target_dir}/.szecret"
# Should fail on get-local (new syntax)
assert_failure szecret get-local "${target_dir}/secret.age"
pass "get-local fails on pubkey mismatch"
}
test_invalid_metadata_fails() {
local target_dir="${TEST_DIR}/invalid-metadata"
mkdir -p "${target_dir}"
# Create invalid metadata (old format without pubkey)
echo "just-store-name" > "${target_dir}/.szecret"
touch "${target_dir}/secret.age"
assert_failure szecret get-local "${target_dir}/secret.age"
pass "invalid metadata format fails"
}
run_tests() {
test_put_local_and_get_local
test_put_local_no_metadata_fails
test_get_local_no_metadata_fails
test_get_local_legacy_syntax_warns
test_get_local_nonexistent_file_fails
test_put_local_requires_arg
test_get_local_requires_arg
test_put_local_pubkey_mismatch_fails
test_get_local_pubkey_mismatch_fails
test_invalid_metadata_fails
}
[[ "${BASH_SOURCE[0]}" == "${0}" ]] && run_tests
|
