Make another unlocker current when the current one is removed (closes #137)

Removing the vault's current unlocker left current-unlocker naming it,
so every command that opened the vault failed although another
unlocker remained, and the error pointed at the mnemonic.
RemoveUnlocker now first makes current the first other unlocker that
`secret unlocker select` accepts, in the order `secret unlocker list`
shows, and returns its ID, which `secret unlocker remove` prints; with
none, current-unlocker is removed too. When current-unlocker names an
unlocker that does not exist and the vault has another that select
accepts, the error wraps ErrUnlockerNotFound and says to run
`secret unlocker select`, without the mnemonic advice.

Unverified: no test covers that advice for a vault other than the
current one, which gets `secret vault select` first.

Model: opus-5-5

internal/vault/errors_test.go

@@ -81,7 +81,9 @@ func TestVaultErrors(t *testing.T) {
 			return vlt.CopySecretAllVersions(vlt, versionless, "copy", false)
 		}, vault.ErrNoVersions},
 		{"remove a missing unlocker", func(vlt *vault.Vault) error {
-			return vlt.RemoveUnlocker(missingName)
+			_, err := vlt.RemoveUnlocker(missingName)
+
+			return err
 		}, vault.ErrUnlockerNotFound},
 		{"select a missing unlocker", func(vlt *vault.Vault) error {
 			return vlt.SelectUnlocker(missingName)

internal/vault/unlockers.go

@@ -5,8 +5,10 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"maps"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"
 
@@ -19,6 +21,7 @@ import (
 // Unlocker metadata type strings.
 const (
 	unlockerTypePassphrase = "passphrase"
+	unlockerTypePGP        = "pgp"
 )
 
 // GetCurrentUnlocker returns the current unlocker for this vault
@@ -52,6 +55,11 @@ func (v *Vault) GetCurrentUnlocker() (secret.Unlocker, error) {
 		return nil, err
 	}
 
+	err = v.checkCurrentUnlockerExists(unlockerDir)
+	if err != nil {
+		return nil, err
+	}
+
 	secret.DebugWith("Resolved unlocker directory",
 		slog.String("unlocker_dir", unlockerDir),
 		slog.String("vault_name", v.Name),
@@ -74,7 +82,7 @@ func (v *Vault) GetCurrentUnlocker() (secret.Unlocker, error) {
 		passphraseUnlocker := secret.NewPassphraseUnlocker(v.fs, unlockerDir, metadata)
 		passphraseUnlocker.Passphrase = v.UnlockPassphrase
 		unlocker = passphraseUnlocker
-	case "pgp":
+	case unlockerTypePGP:
 		secret.Debug("Creating PGP unlocker instance", "unlocker_type", metadata.Type)
 
 		unlocker = secret.NewPGPUnlocker(v.fs, unlockerDir, metadata)
@@ -119,6 +127,37 @@ func (v *Vault) resolveUnlockerDirectory(currentUnlockerPath string) (string, er
 	return absolutePath, nil
 }
 
+// checkCurrentUnlockerExists fails with ErrUnlockerNotFound, saying to
+// select another unlocker, when unlockerDir, the unlocker directory that
+// current-unlocker names, does not exist and the vault has another unlocker
+// that SelectUnlocker accepts. When it has none, it returns nil: reading the
+// missing unlocker then fails, with the advice that the mnemonic still opens
+// the vault.
+func (v *Vault) checkCurrentUnlockerExists(unlockerDir string) error {
+	exists, err := afero.DirExists(v.fs, unlockerDir)
+	if err != nil {
+		return fmt.Errorf("failed to check for the current unlocker: %w", err)
+	}
+
+	if exists {
+		return nil
+	}
+
+	otherID, err := v.firstOtherUnlockerID(filepath.Base(unlockerDir))
+	if err != nil {
+		return err
+	}
+
+	if otherID == "" {
+		return nil
+	}
+
+	return fmt.Errorf("unlocker with ID %s %w; the vault '%s' has other "+
+		"unlockers: run %s with the ID of one of them to make it the current "+
+		"unlocker", filepath.Base(unlockerDir), ErrUnlockerNotFound, v.Name,
+		v.withVaultSelect("'secret unlocker select'"))
+}
+
 // findUnlockerByID finds an unlocker by its ID and returns the unlocker
 // instance and its directory path. A directory that ListUnlockers skips is
 // skipped here too, with the same warning. Such a directory has no ID: if
@@ -159,7 +198,7 @@ func (v *Vault) findUnlockerByID(
 		switch metadata.Type {
 		case unlockerTypePassphrase:
 			tempUnlocker = secret.NewPassphraseUnlocker(v.fs, unlockerDirPath, metadata)
-		case "pgp":
+		case unlockerTypePGP:
 			tempUnlocker = secret.NewPGPUnlocker(v.fs, unlockerDirPath, metadata)
 		default:
 			continue
@@ -282,10 +321,15 @@ func (v *Vault) HasUnlocker(unlockerID string) (bool, error) {
 // RemoveUnlocker removes an unlocker from this vault. An unlocker
 // directory that ListUnlockers skips is removed by its directory name; its
 // type is unknown, so only the directory is removed.
-func (v *Vault) RemoveUnlocker(unlockerID string) error {
+//
+// It returns the ID of the unlocker it made current, or "" when it made none
+// current. If the removed unlocker is the current one, the unlocker
+// firstOtherUnlockerID returns is made current before the removal; with
+// none, current-unlocker is removed after it.
+func (v *Vault) RemoveUnlocker(unlockerID string) (string, error) {
 	vaultDir, err := v.GetDirectory()
 	if err != nil {
-		return err
+		return "", err
 	}
 
 	// Find the unlocker directory and create the unlocker instance
@@ -294,19 +338,92 @@ func (v *Vault) RemoveUnlocker(unlockerID string) error {
 	// Find the unlocker by ID
 	unlocker, unlockerDir, err := v.findUnlockerByID(unlockersDir, unlockerID)
 	if err != nil {
-		return err
+		return "", err
 	}
 
 	if unlockerDir == "" {
-		return fmt.Errorf("unlocker with ID %s %w", unlockerID, ErrUnlockerNotFound)
+		return "", fmt.Errorf("unlocker with ID %s %w", unlockerID, ErrUnlockerNotFound)
+	}
+
+	currentUnlockerPath := filepath.Join(vaultDir, "current-unlocker")
+
+	currentDir, err := v.resolveUnlockerDirectory(currentUnlockerPath)
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return "", err
+	}
+
+	isCurrent := currentDir == unlockerDir
+	newCurrentID := ""
+
+	if isCurrent {
+		newCurrentID, err = v.selectOtherUnlocker(unlockerID)
+		if err != nil {
+			return "", err
+		}
 	}
 
 	if unlocker == nil {
-		return secret.RemoveDirAtomic(v.fs, unlockerDir)
+		err = secret.RemoveDirAtomic(v.fs, unlockerDir)
+	} else {
+		err = unlocker.Remove()
 	}
 
-	// Use the unlocker's Remove method
-	return unlocker.Remove()
+	if err != nil {
+		return "", err
+	}
+
+	if isCurrent && newCurrentID == "" {
+		err = v.fs.Remove(currentUnlockerPath)
+		if err != nil {
+			return "", fmt.Errorf("failed to remove current-unlocker file: %w", err)
+		}
+	}
+
+	return newCurrentID, nil
+}
+
+// selectOtherUnlocker makes the unlocker firstOtherUnlockerID returns for
+// unlockerID the current unlocker and returns its ID. It returns "" when
+// there is no such unlocker.
+func (v *Vault) selectOtherUnlocker(unlockerID string) (string, error) {
+	otherID, err := v.firstOtherUnlockerID(unlockerID)
+	if err != nil {
+		return "", err
+	}
+
+	if otherID == "" {
+		return "", nil
+	}
+
+	err = v.SelectUnlocker(otherID)
+	if err != nil {
+		return "", err
+	}
+
+	return otherID, nil
+}
+
+// firstOtherUnlockerID returns the ID of the vault's first unlocker other
+// than unlockerID, in ID order, the order `secret unlocker list` shows, that
+// SelectUnlocker accepts, or "" when there is none. SelectUnlocker refuses
+// an unlocker whose metadata names a type other than passphrase or pgp,
+// which ListUnlockers still returns.
+func (v *Vault) firstOtherUnlockerID(unlockerID string) (string, error) {
+	unlockers, err := v.ListUnlockers()
+	if err != nil {
+		return "", err
+	}
+
+	for _, id := range slices.Sorted(maps.Keys(unlockers)) {
+		unlockerType := unlockers[id].Type
+
+		if id != unlockerID && (unlockerType == unlockerTypePassphrase ||
+			unlockerType == unlockerTypePGP) {
+			return id, nil
+		}
+	}
+
+	return "", nil
 }
 
 // SelectUnlocker selects an unlocker as current for this vault

internal/vault/vault.go

@@ -291,9 +291,11 @@ func (v *Vault) unlockLongTermKey(
 // without a mnemonic records none, and without its metadata the key cannot
 // be derived. It is not added when the passphrase could not be read: the
 // unlocker was not tried, and adding one would need a passphrase read the
-// same way.
+// same way. Nor is it added when the current unlocker does not exist and the
+// vault has others: the error already says to select one of them.
 func (v *Vault) withMnemonicAdvice(err error) error {
-	if errors.Is(err, secret.ErrPassphraseNotRead) {
+	if errors.Is(err, secret.ErrPassphraseNotRead) ||
+		errors.Is(err, ErrUnlockerNotFound) {
 		return err
 	}
 
@@ -304,15 +306,21 @@ func (v *Vault) withMnemonicAdvice(err error) error {
 		return err
 	}
 
-	// 'secret unlocker add' acts on the current vault only.
-	steps := "'secret unlocker add passphrase'"
-
-	current, currentErr := GetCurrentVault(v.fs, v.stateDir)
-	if currentErr != nil || current.Name != v.Name {
-		steps = fmt.Sprintf("'secret vault select %s', then %s", v.Name, steps)
-	}
-
 	return fmt.Errorf("%w; the vault '%s' still opens with its mnemonic: run "+
 		"%s with %s set to the mnemonic to give it a new unlocker",
-		err, v.Name, steps, secret.EnvMnemonic)
+		err, v.Name, v.withVaultSelect("'secret unlocker add passphrase'"),
+		secret.EnvMnemonic)
+}
+
+// withVaultSelect returns command, a quoted 'secret unlocker' command, for
+// advice about this vault. Such a command acts on the current vault only,
+// so when this vault is not the current one, the command that selects it
+// comes first.
+func (v *Vault) withVaultSelect(command string) string {
+	current, err := GetCurrentVault(v.fs, v.stateDir)
+	if err != nil || current.Name != v.Name {
+		return fmt.Sprintf("'secret vault select %s', then %s", v.Name, command)
+	}
+
+	return command
 }