1package cli
2
3import (
4 "testing"
5
6 "github.com/bnema/zerowrap"
7 "github.com/spf13/viper"
8 "github.com/stretchr/testify/require"
9
10 "github.com/bnema/gordon/internal/adapters/out/domainsecrets"
11 "github.com/bnema/gordon/internal/domain"
12)
13
14func TestResolveLocalSecretsBackend(t *testing.T) {
15 t.Run("auth backend takes precedence", func(t *testing.T) {
16 v := viper.New()
17 v.Set("auth.secrets_backend", "pass")
18 v.Set("secrets.backend", "unsafe")
19
20 got := resolveLocalSecretsBackend(v)
21 require.Equal(t, domain.SecretsBackendPass, got)
22 })
23
24 t.Run("falls back to legacy secrets backend key", func(t *testing.T) {
25 v := viper.New()
26 v.Set("secrets.backend", "pass")
27
28 got := resolveLocalSecretsBackend(v)
29 require.Equal(t, domain.SecretsBackendPass, got)
30 })
31
32 t.Run("defaults to unsafe for unknown backend", func(t *testing.T) {
33 v := viper.New()
34 v.Set("auth.secrets_backend", "wat")
35
36 got := resolveLocalSecretsBackend(v)
37 require.Equal(t, domain.SecretsBackendUnsafe, got)
38 })
39}
40
41func TestCreateLocalDomainSecretStore_UsesPassStoreForPass(t *testing.T) {
42 // pass(1) must be available on the system for this test
43 if _, err := domainsecrets.NewPassStore(zerowrap.New(zerowrap.Config{Level: "error", Format: "console"})); err != nil {
44 t.Skipf("pass store not available: %v", err)
45 }
46
47 v := viper.New()
48 v.Set("auth.secrets_backend", "pass")
49
50 log := zerowrap.New(zerowrap.Config{Level: "error", Format: "console"})
51 store, err := createLocalDomainSecretStore(v, t.TempDir(), log)
52 require.NoError(t, err)
53 require.IsType(t, &domainsecrets.PassStore{}, store)
54}
55
56func TestCreateLocalDomainSecretStore_RejectsSopsBackend(t *testing.T) {
57 v := viper.New()
58 v.Set("auth.secrets_backend", "sops")
59
60 log := zerowrap.New(zerowrap.Config{Level: "error", Format: "console"})
61 _, err := createLocalDomainSecretStore(v, t.TempDir(), log)
62 require.Error(t, err)
63 require.Contains(t, err.Error(), "sops backend not yet supported")
64}
65
66func TestCreateLocalDomainSecretStore_UsesFileStoreForUnsafe(t *testing.T) {
67 v := viper.New()
68 v.Set("auth.secrets_backend", "unsafe")
69
70 log := zerowrap.New(zerowrap.Config{Level: "error", Format: "console"})
71 store, err := createLocalDomainSecretStore(v, t.TempDir(), log)
72 require.NoError(t, err)
73 require.IsType(t, &domainsecrets.FileStore{}, store)
74}