feat: run TreatVault as a service image

internal/vault/store_test.go

@@ -86,23 +86,29 @@ func TestStoreRejectsWrongIdentityAndInvalidValues(t *testing.T) {
 	}
 }
 
-func TestGenerateIdentityDoesNotOverwrite(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "identity.txt")
-	recipient, err := GenerateIdentity(path)
+func TestOpenOrInitializeCreatesReusableEmptyVault(t *testing.T) {
+	identity, err := age.GenerateX25519Identity()
 	if err != nil {
 		t.Fatal(err)
 	}
-	if recipient == "" {
-		t.Fatal("recipient is empty")
+	directory := t.TempDir()
+	identityPath := filepath.Join(directory, "identity.txt")
+	if err := os.WriteFile(identityPath, []byte(identity.String()), 0o600); err != nil {
+		t.Fatal(err)
 	}
-	if _, err := GenerateIdentity(path); err == nil {
-		t.Fatal("GenerateIdentity() overwrote existing identity")
-	}
-	info, err := os.Stat(path)
+	path := filepath.Join(directory, "state", "secrets.age")
+	store, err := OpenOrInitialize(path, identityPath)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if info.Mode().Perm() != 0o600 {
-		t.Fatalf("identity permissions = %o", info.Mode().Perm())
+	snapshot, err := store.Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(snapshot.Secrets) != 0 {
+		t.Fatalf("initial secrets = %#v", snapshot.Secrets)
+	}
+	if _, err := OpenOrInitialize(path, identityPath); err != nil {
+		t.Fatalf("OpenOrInitialize existing vault: %v", err)
 	}
 }