1package cli
2
3import (
4 "testing"
5
6 "github.com/bnema/zerowrap"
7 "github.com/spf13/viper"
8 "github.com/stretchr/testify/require"
9
10 "github.com/bnema/gordon/internal/adapters/out/domainsecrets"
11 "github.com/bnema/gordon/internal/domain"
12)
13
14func TestResolveLocalSecretsBackend(t *testing.T) {
15 t.Run("auth backend takes precedence", func(t *testing.T) {
16 v := viper.New()
17 v.Set("auth.secrets_backend", "pass")
18 v.Set("secrets.backend", "unsafe")
19
20 got := resolveLocalSecretsBackend(v)
21 require.Equal(t, domain.SecretsBackendPass, got)
22 })
23
24 t.Run("falls back to legacy secrets backend key", func(t *testing.T) {
25 v := viper.New()
26 v.Set("secrets.backend", "pass")
27
28 got := resolveLocalSecretsBackend(v)
29 require.Equal(t, domain.SecretsBackendPass, got)
30 })
31
32 t.Run("defaults to unsafe for unknown backend", func(t *testing.T) {
33 v := viper.New()
34 v.Set("auth.secrets_backend", "wat")
35
36 got := resolveLocalSecretsBackend(v)
37 require.Equal(t, domain.SecretsBackendUnsafe, got)
38 })
39}
40
41func TestHasLocalTLSCapableEntrypoint(t *testing.T) {
42 for _, tt := range []struct {
43 name string
44 config map[string]any
45 want bool
46 }{
47 {name: "smart tcp", config: map[string]any{"edge": map[string]any{"protocol": "smart_tcp"}}, want: true},
48 {name: "tls mux", config: map[string]any{"edge": map[string]any{"protocol": "tls_mux"}}, want: true},
49 {name: "plain tcp", config: map[string]any{"edge": map[string]any{"protocol": "tcp"}}, want: false},
50 {name: "empty", config: map[string]any{}, want: false},
51 } {
52 t.Run(tt.name, func(t *testing.T) {
53 v := viper.New()
54 v.Set("entrypoints", tt.config)
55 require.Equal(t, tt.want, hasLocalTLSCapableEntrypoint(v))
56 })
57 }
58}
59
60func TestCreateLocalDomainSecretStore_UsesPassStoreForPass(t *testing.T) {
61 // pass(1) must be available on the system for this test
62 if _, err := domainsecrets.NewPassStore(zerowrap.New(zerowrap.Config{Level: "error", Format: "console"})); err != nil {
63 t.Skipf("pass store not available: %v", err)
64 }
65
66 v := viper.New()
67 v.Set("auth.secrets_backend", "pass")
68
69 log := zerowrap.New(zerowrap.Config{Level: "error", Format: "console"})
70 store, err := createLocalDomainSecretStore(v, t.TempDir(), log)
71 require.NoError(t, err)
72 require.IsType(t, &domainsecrets.PassStore{}, store)
73}
74
75func TestCreateLocalDomainSecretStore_RejectsSopsBackend(t *testing.T) {
76 v := viper.New()
77 v.Set("auth.secrets_backend", "sops")
78
79 log := zerowrap.New(zerowrap.Config{Level: "error", Format: "console"})
80 _, err := createLocalDomainSecretStore(v, t.TempDir(), log)
81 require.Error(t, err)
82 require.Contains(t, err.Error(), "sops backend not yet supported")
83}
84
85func TestCreateLocalDomainSecretStore_UsesFileStoreForUnsafe(t *testing.T) {
86 v := viper.New()
87 v.Set("auth.secrets_backend", "unsafe")
88
89 log := zerowrap.New(zerowrap.Config{Level: "error", Format: "console"})
90 store, err := createLocalDomainSecretStore(v, t.TempDir(), log)
91 require.NoError(t, err)
92 require.IsType(t, &domainsecrets.FileStore{}, store)
93}