Check the -o path before looking for the mnemonic (closes #87)

age encrypt and age decrypt looked at the -o path only after the
mnemonic had been obtained, so a path that could never be written
still prompted for the mnemonic or ran the mnemonic command. Both now
refuse, before the key is derived, an -o path that is a directory or a
symlink to one, whose directory is missing or is not a directory, or
that is a symlink pointing at nothing. The check creates nothing;
output still looks at the path when it writes, so the file beside the
target is made when it was before. The README names the -o path among
what is checked first.

Model: opus-5-5

README.md

@@ -119,17 +119,19 @@ order; the first one found wins:
 4. A prompt on the terminal with echo turned off.
 
 If none of these is available and standard input is not a terminal, the tool
-refuses and exits with status 1. A mnemonic that fails the BIP-39 checksum is
-refused with a message saying so. Keys are derived from the mnemonic's words
-joined by single spaces, whatever whitespace is around or between them, so one
-word per line, tabs or extra spaces give the same keys.
+refuses and exits with status 1. A mnemonic that is empty, does not have 12, 15,
+18, 21 or 24 words, has a word that is not on the BIP-39 word list, or fails the
+BIP-39 checksum is refused with a message saying which. A word that is not on
+the list is named by its position, never printed. Keys are derived from the
+mnemonic's words joined by single spaces, whatever whitespace is around or
+between them, so one word per line, tabs or extra spaces give the same keys.
 
 The key index, `--words`, the `--to` recipients, the file `age encrypt` or
 `age decrypt` is given to read and its `-o` path are checked before the mnemonic
 is looked for, so a run refused for one of them never prompts for the mnemonic
-or runs the mnemonic command. An `-o` path is refused at that point if its
-directory is missing or is not a directory, or if it is a symlink that points at
-nothing; anything else wrong with it shows only when the output is written.
+or runs the mnemonic command. An `-o` path is refused at that point if it is a
+directory or a symlink to one, if its directory is missing or is not a
+directory, or if it is a symlink that points at nothing.
 
 `KEYFUNC_MNEMONIC` and `KEYFUNC_MNEMONIC_COMMAND` are removed from the
 environment before the mnemonic command, the system `ssh` (`keyfunc ssh to`) and

internal/cli/age/age.go

@@ -11,6 +11,7 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
+	"syscall"
 
 	"github.com/spf13/cobra"
 	"sneak.berlin/go/keyfunc/internal/agekey"
@@ -236,9 +237,10 @@ func input(cmd *cobra.Command, args []string) (io.Reader, func(), error) {
 }
 
 // checkOutput refuses an -o path that output could not write to,
-// before anything is written: one whose directory is missing or is not
-// a directory, or a symlink that points at nothing. It creates nothing;
-// output looks at the path again when it writes.
+// before anything is written: a directory or a symlink to one, one
+// whose directory is missing or is not a directory, or a symlink that
+// points at nothing. It creates nothing; output looks at the path again
+// when it writes.
 func checkOutput(cmd *cobra.Command) error {
 	name, err := cmd.Flags().GetString("output")
 	if err != nil {
@@ -262,15 +264,21 @@ func checkOutput(cmd *cobra.Command) error {
 		if err != nil {
 			return fmt.Errorf("looking at %s: %w", directory, err)
 		}
+
+		return nil
 	case err != nil:
 		return fmt.Errorf("looking at %s: %w", name, err)
 	case info.Mode().Type() == fs.ModeSymlink:
-		_, err = os.Stat(name)
+		info, err = os.Stat(name)
 		if err != nil {
 			return fmt.Errorf("following %s: %w", name, err)
 		}
 	}
 
+	if info.IsDir() {
+		return fmt.Errorf("writing to %s: %w", name, syscall.EISDIR)
+	}
+
 	return nil
 }
 

internal/cli/age_test.go

@@ -119,10 +119,15 @@ func TestAnOutputPathThatCannotBeWrittenIsRefused(t *testing.T) {
 	dangling := filepath.Join(directory, "dangling")
 	require.NoError(t, os.Symlink(missing, dangling))
 
+	toDirectory := filepath.Join(directory, "to-directory")
+	require.NoError(t, os.Symlink(t.TempDir(), toDirectory))
+
 	refusals := map[string]error{
 		filepath.Join(missing, "notes.age"): fs.ErrNotExist,
 		filepath.Join(plain, "notes.age"):   syscall.ENOTDIR,
 		dangling:                            fs.ErrNotExist,
+		directory:                           syscall.EISDIR,
+		toDirectory:                         syscall.EISDIR,
 	}
 
 	for name, refusal := range refusals {
@@ -135,10 +140,10 @@ func TestAnOutputPathThatCannotBeWrittenIsRefused(t *testing.T) {
 		require.Empty(t, out, name)
 	}
 
-	// Nothing was made beside the symlink.
+	// Nothing was made beside the two symlinks.
 	left, err := os.ReadDir(directory)
 	require.NoError(t, err)
-	require.Len(t, left, 1)
+	require.Len(t, left, 2)
 }
 
 func TestAFileForAnotherKeyIsRefused(t *testing.T) {

internal/mnemonic/mnemonic.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"slices"
 	"strings"
 
 	"golang.org/x/term"
@@ -29,6 +30,28 @@ var ErrMissing = errors.New(
 	"no mnemonic given and standard input is not a terminal",
 )
 
+// The lengths a BIP-39 mnemonic may have.
+const (
+	twelve     = 12
+	fifteen    = 15
+	eighteen   = 18
+	twentyOne  = 21
+	twentyFour = 24
+)
+
+// ErrEmpty is returned for a mnemonic with no words in it, such as the
+// output of a mnemonic command that printed nothing.
+var ErrEmpty = errors.New("the mnemonic is empty")
+
+// ErrWordCount is returned for a mnemonic with a number of words that
+// BIP-39 does not allow.
+var ErrWordCount = errors.New("a mnemonic has 12, 15, 18, 21 or 24 words")
+
+// ErrUnknownWord is returned for a mnemonic with a word that is not on
+// the BIP-39 English word list. The error gives the word's position,
+// never the word, so the mnemonic stays out of the message.
+var ErrUnknownWord = errors.New("not on the BIP-39 word list")
+
 // ErrChecksum is returned for a mnemonic that fails the BIP-39
 // checksum.
 var ErrChecksum = errors.New("the mnemonic fails its BIP-39 checksum")
@@ -126,13 +149,34 @@ func ask() (string, error) {
 
 // checked joins the words with single spaces, whatever whitespace
 // separated them, since the seed is computed over the string itself,
-// and refuses a mnemonic that does not pass the BIP-39 checksum.
-func checked(words string) (string, error) {
-	words = strings.Join(strings.Fields(words), " ")
+// and refuses a mnemonic that is not a valid BIP-39 mnemonic, with an
+// error that says what is wrong with it.
+func checked(text string) (string, error) {
+	words := strings.Fields(text)
 
-	if !bip39.IsMnemonicValid(words) {
+	switch len(words) {
+	case 0:
+		return "", ErrEmpty
+	case twelve, fifteen, eighteen, twentyOne, twentyFour:
+	default:
+		return "", fmt.Errorf("%w, not %d", ErrWordCount, len(words))
+	}
+
+	wordList := bip39.English()
+
+	for i, word := range words {
+		if !slices.Contains(wordList, word) {
+			return "", fmt.Errorf(
+				"word %d of the mnemonic is %w", i+1, ErrUnknownWord,
+			)
+		}
+	}
+
+	joined := strings.Join(words, " ")
+
+	if !bip39.IsMnemonicValid(joined) {
 		return "", ErrChecksum
 	}
 
-	return words, nil
+	return joined, nil
 }

internal/mnemonic/mnemonic_test.go

@@ -97,6 +97,27 @@ func TestAFailingCommandSaysWhatWentWrong(t *testing.T) {
 	require.Contains(t, err.Error(), "nothing here")
 }
 
+func TestValidMnemonicsOf15To24WordsAreAccepted(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, "")
+
+	// abandon repeated, then the last word that makes the checksum
+	// match: 15, 18, 21 and 24 words.
+	valid := []string{
+		strings.Repeat("abandon ", 14) + "address",
+		strings.Repeat("abandon ", 17) + "agent",
+		strings.Repeat("abandon ", 20) + "admit",
+		strings.Repeat("abandon ", 23) + "art",
+	}
+
+	for _, words := range valid {
+		t.Setenv(mnemonic.Variable, words)
+
+		got, err := mnemonic.Read(t.Context(), "")
+		require.NoError(t, err)
+		require.Equal(t, words, got)
+	}
+}
+
 func TestABadChecksumIsRefused(t *testing.T) {
 	t.Setenv(mnemonic.CommandVariable, "")
 	t.Setenv(mnemonic.Variable, broken())
@@ -105,6 +126,38 @@ func TestABadChecksumIsRefused(t *testing.T) {
 	require.ErrorIs(t, err, mnemonic.ErrChecksum)
 }
 
+func TestACommandThatPrintsNothingGivesAnEmptyMnemonic(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, "")
+	t.Setenv(mnemonic.Variable, "")
+
+	_, err := mnemonic.Read(t.Context(), "true")
+	require.ErrorIs(t, err, mnemonic.ErrEmpty)
+	require.NotContains(t, err.Error(), "checksum")
+}
+
+func TestAWrongWordCountIsRefused(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, "")
+	t.Setenv(mnemonic.Variable, strings.Repeat("abandon ", 3))
+
+	_, err := mnemonic.Read(t.Context(), "")
+	require.ErrorIs(t, err, mnemonic.ErrWordCount)
+	require.ErrorContains(t, err, "not 3")
+	require.NotContains(t, err.Error(), "checksum")
+}
+
+func TestAWordNotOnTheListIsNamedByPositionOnly(t *testing.T) {
+	const typo = "abuot"
+
+	t.Setenv(mnemonic.CommandVariable, "")
+	t.Setenv(mnemonic.Variable, strings.Repeat("abandon ", 11)+typo)
+
+	_, err := mnemonic.Read(t.Context(), "")
+	require.ErrorIs(t, err, mnemonic.ErrUnknownWord)
+	require.ErrorContains(t, err, "word 12 ")
+	require.NotContains(t, err.Error(), typo)
+	require.NotContains(t, err.Error(), "checksum")
+}
+
 func TestNothingToReadAndNobodyToAsk(t *testing.T) {
 	t.Setenv(mnemonic.CommandVariable, "")
 	t.Setenv(mnemonic.Variable, "")