97 lines
3.3 KiB
Go
97 lines
3.3 KiB
Go
package adminui
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"cloud.campbellwireless.net/git/barkstack/treatvault/internal/manager"
|
|
"cloud.campbellwireless.net/git/barkstack/treatvault/internal/provider"
|
|
)
|
|
|
|
func TestManifestDescribesTreatVaultPlugin(t *testing.T) {
|
|
response := httptest.NewRecorder()
|
|
Handler(&fakeManager{}).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/barkstack/ui/manifest.json", nil))
|
|
if response.Code != http.StatusOK {
|
|
t.Fatalf("status = %d", response.Code)
|
|
}
|
|
var got manifest
|
|
if err := json.Unmarshal(response.Body.Bytes(), &got); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got.ID != "treatvault" || got.Element != "barkstack-treatvault" || got.Entry != entryPath {
|
|
t.Fatalf("manifest = %#v", got)
|
|
}
|
|
}
|
|
|
|
func TestListNeverReturnsSecretValues(t *testing.T) {
|
|
manager := &fakeManager{status: manager.Status{State: "ready", Secrets: []manager.Secret{{Name: "database_password", InUse: true, Synced: true}}}}
|
|
response := httptest.NewRecorder()
|
|
Handler(manager).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/barkstack/api/secrets", nil))
|
|
if response.Code != http.StatusOK {
|
|
t.Fatalf("status = %d", response.Code)
|
|
}
|
|
if strings.Contains(response.Body.String(), "secret-value") || !strings.Contains(response.Body.String(), "database_password") {
|
|
t.Fatalf("body = %s", response.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestPutSetsSecretAndReturnsNoValue(t *testing.T) {
|
|
manager := &fakeManager{}
|
|
response := httptest.NewRecorder()
|
|
request := httptest.NewRequest(http.MethodPut, "/barkstack/api/secrets/database_password", strings.NewReader(`{"value":"secret-value"}`))
|
|
Handler(manager).ServeHTTP(response, request)
|
|
if response.Code != http.StatusNoContent {
|
|
t.Fatalf("status = %d, body = %s", response.Code, response.Body.String())
|
|
}
|
|
if manager.setName != "database_password" || string(manager.setValue) != "secret-value" {
|
|
t.Fatalf("set = %q %q", manager.setName, manager.setValue)
|
|
}
|
|
if strings.Contains(response.Body.String(), "secret-value") {
|
|
t.Fatal("response disclosed the secret value")
|
|
}
|
|
}
|
|
|
|
func TestDeleteReturnsConflictForInUseSecret(t *testing.T) {
|
|
manager := &fakeManager{deleteErr: fmtInUse("database_password")}
|
|
response := httptest.NewRecorder()
|
|
Handler(manager).ServeHTTP(response, httptest.NewRequest(http.MethodDelete, "/barkstack/api/secrets/database_password", nil))
|
|
if response.Code != http.StatusConflict {
|
|
t.Fatalf("status = %d, body = %s", response.Code, response.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestInvalidSecretNameIsRejected(t *testing.T) {
|
|
response := httptest.NewRecorder()
|
|
Handler(&fakeManager{}).ServeHTTP(response, httptest.NewRequest(http.MethodPut, "/barkstack/api/secrets/UPPERCASE", strings.NewReader(`{"value":"value"}`)))
|
|
if response.Code != http.StatusBadRequest {
|
|
t.Fatalf("status = %d", response.Code)
|
|
}
|
|
}
|
|
|
|
type fakeManager struct {
|
|
status manager.Status
|
|
setName string
|
|
setValue []byte
|
|
setErr error
|
|
deleteErr error
|
|
}
|
|
|
|
func (m *fakeManager) Status() manager.Status { return m.status }
|
|
|
|
func (m *fakeManager) Set(_ context.Context, name string, value []byte) error {
|
|
m.setName = name
|
|
m.setValue = append([]byte(nil), value...)
|
|
return m.setErr
|
|
}
|
|
|
|
func (m *fakeManager) Delete(context.Context, string) error { return m.deleteErr }
|
|
|
|
func fmtInUse(name string) error {
|
|
return errors.Join(provider.ErrSecretInUse, errors.New(name))
|
|
}
|