79 lines
2.0 KiB
Go
79 lines
2.0 KiB
Go
package secrets
|
|
|
|
import (
|
|
"errors"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
secretcontracts "git.cin.su/m/Assistant/contracts/secrets"
|
|
)
|
|
|
|
func TestFileResolverResolvesSecretInsideRoot(t *testing.T) {
|
|
root := t.TempDir()
|
|
path := filepath.Join(root, "interaction_db_password")
|
|
if err := os.WriteFile(path, []byte("strong-secret\n"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
resolver, err := NewFileResolver(root)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
got, err := resolver.ResolveFile(secretcontracts.SecretFileRef{
|
|
CredentialRef: "credential://domovoy/interaction/db-password/v1",
|
|
Purpose: secretcontracts.SecretPurposeDatabasePassword,
|
|
Consumer: secretcontracts.RuntimeConsumerCore,
|
|
Path: path,
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got != "strong-secret" {
|
|
t.Fatalf("unexpected secret value")
|
|
}
|
|
}
|
|
|
|
func TestFileResolverRejectsPathOutsideRoot(t *testing.T) {
|
|
root := t.TempDir()
|
|
outside := filepath.Join(t.TempDir(), "secret")
|
|
if err := os.WriteFile(outside, []byte("secret"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
resolver, err := NewFileResolver(root)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
_, err = resolver.ResolveFile(secretcontracts.SecretFileRef{
|
|
CredentialRef: "credential://domovoy/interaction/db-password/v1",
|
|
Purpose: secretcontracts.SecretPurposeDatabasePassword,
|
|
Consumer: secretcontracts.RuntimeConsumerCore,
|
|
Path: outside,
|
|
})
|
|
if !errors.Is(err, ErrPathOutsideRoot) {
|
|
t.Fatalf("expected ErrPathOutsideRoot, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestFileResolverRejectsEmptyCredentialRef(t *testing.T) {
|
|
root := t.TempDir()
|
|
path := filepath.Join(root, "secret")
|
|
if err := os.WriteFile(path, []byte("secret"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
resolver, err := NewFileResolver(root)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
_, err = resolver.ResolveFile(secretcontracts.SecretFileRef{
|
|
Purpose: secretcontracts.SecretPurposeDatabasePassword,
|
|
Consumer: secretcontracts.RuntimeConsumerCore,
|
|
Path: path,
|
|
})
|
|
if !errors.Is(err, ErrEmptyCredentialRef) {
|
|
t.Fatalf("expected ErrEmptyCredentialRef, got %v", err)
|
|
}
|
|
}
|