| 1 | use super::{EnvVarGuard, clear_known_envs, env_lock}; |
| 2 | use crate::{ |
| 3 | SECRET_BACKEND_ENV, SecretBackendDiagnosticKind, SecretBackendInspection, |
| 4 | SecretBackendPresence, diagnose_secret_backend, |
| 5 | }; |
| 6 | |
| 7 | #[test] |
| 8 | fn system_backend_diagnostic_is_literal_unknown_and_not_probed() { |
| 9 | let _lock = env_lock(); |
| 10 | clear_known_envs(); |
| 11 | let tmp = tempfile::tempdir().unwrap(); |
| 12 | let _home = EnvVarGuard::set("CODEWHALE_HOME", tmp.path()); |
| 13 | let _backend = EnvVarGuard::set(SECRET_BACKEND_ENV, "system"); |
| 14 | |
| 15 | let diagnostic = diagnose_secret_backend(); |
| 16 | |
| 17 | assert_eq!(diagnostic.backend, SecretBackendDiagnosticKind::System); |
| 18 | assert_eq!(diagnostic.inspection, SecretBackendInspection::NotProbed); |
| 19 | assert_eq!(diagnostic.presence, SecretBackendPresence::Unknown); |
| 20 | assert_eq!(diagnostic.path, None); |
| 21 | assert_eq!(diagnostic.legacy_path, None); |
| 22 | } |
| 23 | |
| 24 | #[test] |
| 25 | fn file_backend_diagnostic_reads_metadata_not_secret_contents() { |
| 26 | let _lock = env_lock(); |
| 27 | clear_known_envs(); |
| 28 | let tmp = tempfile::tempdir().unwrap(); |
| 29 | let codewhale_home = std::fs::canonicalize(tmp.path()) |
| 30 | .unwrap() |
| 31 | .join("isolated-home"); |
| 32 | let path = codewhale_home.join("secrets").join("secrets.json"); |
| 33 | std::fs::create_dir_all(path.parent().unwrap()).unwrap(); |
| 34 | let sentinel = "diagnostic-must-not-emit-this-secret"; |
| 35 | let invalid_secret_blob = format!("not-json:{sentinel}"); |
| 36 | std::fs::write(&path, &invalid_secret_blob).unwrap(); |
| 37 | let _home = EnvVarGuard::set("CODEWHALE_HOME", &codewhale_home); |
| 38 | let _backend = EnvVarGuard::set(SECRET_BACKEND_ENV, "file"); |
| 39 | |
| 40 | let diagnostic = diagnose_secret_backend(); |
| 41 | let serialized = serde_json::to_string(&diagnostic).unwrap(); |
| 42 | |
| 43 | assert_eq!(diagnostic.backend, SecretBackendDiagnosticKind::File); |
| 44 | assert_eq!(diagnostic.inspection, SecretBackendInspection::MetadataOnly); |
| 45 | assert_eq!(diagnostic.path.as_deref(), Some(path.as_path())); |
| 46 | assert_eq!(diagnostic.presence, SecretBackendPresence::Present); |
| 47 | assert_eq!(diagnostic.legacy_path, None); |
| 48 | assert!(!serialized.contains(sentinel)); |
| 49 | assert_eq!(std::fs::read_to_string(path).unwrap(), invalid_secret_blob); |
| 50 | } |
| 51 | |
| 52 | #[test] |
| 53 | fn absent_file_backend_diagnostic_creates_no_state() { |
| 54 | let _lock = env_lock(); |
| 55 | clear_known_envs(); |
| 56 | let tmp = tempfile::tempdir().unwrap(); |
| 57 | let codewhale_home = tmp.path().join("never-created-home"); |
| 58 | let path = codewhale_home.join("secrets").join("secrets.json"); |
| 59 | let _home = EnvVarGuard::set("CODEWHALE_HOME", &codewhale_home); |
| 60 | let _backend = EnvVarGuard::set(SECRET_BACKEND_ENV, "file"); |
| 61 | |
| 62 | let diagnostic = diagnose_secret_backend(); |
| 63 | |
| 64 | assert_eq!(diagnostic.path.as_deref(), Some(path.as_path())); |
| 65 | assert_eq!(diagnostic.presence, SecretBackendPresence::Absent); |
| 66 | assert!(!codewhale_home.exists()); |
| 67 | } |
| 68 | |
| 69 | #[cfg(unix)] |
| 70 | #[test] |
| 71 | fn file_backend_diagnostic_rejects_a_symlinked_parent() { |
| 72 | use std::os::unix::fs::symlink; |
| 73 | |
| 74 | let _lock = env_lock(); |
| 75 | clear_known_envs(); |
| 76 | let tmp = tempfile::tempdir().unwrap(); |
| 77 | let real_home = tmp.path().join("real-home"); |
| 78 | let linked_home = tmp.path().join("linked-home"); |
| 79 | let path = real_home.join("secrets").join("secrets.json"); |
| 80 | std::fs::create_dir_all(path.parent().unwrap()).unwrap(); |
| 81 | std::fs::write(&path, "parent-symlink-secret-sentinel").unwrap(); |
| 82 | symlink(&real_home, &linked_home).unwrap(); |
| 83 | let _home = EnvVarGuard::set("CODEWHALE_HOME", &linked_home); |
| 84 | let _backend = EnvVarGuard::set(SECRET_BACKEND_ENV, "file"); |
| 85 | |
| 86 | let diagnostic = diagnose_secret_backend(); |
| 87 | |
| 88 | assert_eq!(diagnostic.presence, SecretBackendPresence::Unknown); |
| 89 | } |
| 90 |