Check errors by identity, not by message text, in tests (closes #49)

Tests that asserted a failure by a fragment of its message now use
errors.Is: a refactor returning the wrong error, or wrapping with %v
instead of %w, now fails them. New tests return each exported error of
internal/vault and pkg/bip85 that no test returned, and check wrapped
causes (os.ErrNotExist, ErrMnemonicMismatch through GetSecret,
ErrInvalidPathComponent through DeriveBIP85Entropy). The 999-versions
test moves into package secret to name its unexported error. Checks of
errors no test can name keep their text; they are listed on the issue.

Model: opus-5-5

internal/cli/secrets_size_test.go

@@ -93,8 +93,8 @@ func newSizeTestVault(t *testing.T) (afero.Fs, *vault.Vault) {
 }
 
 // runAddSecretSizeCase adds a secret of the given size through stdin and
-// verifies the outcome.
-func runAddSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string) {
+// verifies the outcome: wantErr, or the secret stored when wantErr is nil.
+func runAddSecretSizeCase(t *testing.T, size int, wantErr error) {
 	t.Helper()
 	skipIfLockedMemoryTooLow(t, size)
 
@@ -128,9 +128,8 @@ func runAddSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string) {
 	secretName := fmt.Sprintf("test-secret-%d", size)
 	err = cli.AddSecret(secretName, false)
 
-	if wantErr {
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), errMsg)
+	if wantErr != nil {
+		require.ErrorIs(t, err, wantErr)
 
 		return
 	}
@@ -148,8 +147,8 @@ func runAddSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string) {
 }
 
 // runImportSecretSizeCase imports a secret file of the given size and
-// verifies the outcome.
-func runImportSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string) {
+// verifies the outcome: wantErr, or the secret stored when wantErr is nil.
+func runImportSecretSizeCase(t *testing.T, size int, wantErr error) {
 	t.Helper()
 	skipIfLockedMemoryTooLow(t, size)
 
@@ -181,9 +180,8 @@ func runImportSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string
 	secretName := fmt.Sprintf("imported-secret-%d", size)
 	err = cli.ImportSecret(cmd, secretName, testFile, false)
 
-	if wantErr {
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), errMsg)
+	if wantErr != nil {
+		require.ErrorIs(t, err, wantErr)
 
 		return
 	}
@@ -205,57 +203,48 @@ func runImportSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string
 //nolint:paralleltest // together the subtests lock more than the memlock limit
 func TestAddSecretVariousSizes(t *testing.T) {
 	tests := []struct {
-		name        string
-		size        int
-		shouldError bool
-		errorMsg    string
+		name    string
+		size    int
+		wantErr error
 	}{
 		{
-			name:        "1KB secret",
-			size:        1024,
-			shouldError: false,
+			name: "1KB secret",
+			size: 1024,
 		},
 		{
-			name:        "10KB secret",
-			size:        10 * 1024,
-			shouldError: false,
+			name: "10KB secret",
+			size: 10 * 1024,
 		},
 		{
-			name:        "100KB secret",
-			size:        100 * 1024,
-			shouldError: false,
+			name: "100KB secret",
+			size: 100 * 1024,
 		},
 		{
-			name:        "1MB secret",
-			size:        1024 * 1024,
-			shouldError: false,
+			name: "1MB secret",
+			size: 1024 * 1024,
 		},
 		{
-			name:        "10MB secret",
-			size:        10 * 1024 * 1024,
-			shouldError: false,
+			name: "10MB secret",
+			size: 10 * 1024 * 1024,
 		},
 		{
-			name:        "99MB secret",
-			size:        99 * 1024 * 1024,
-			shouldError: false,
+			name: "99MB secret",
+			size: 99 * 1024 * 1024,
 		},
 		{
-			name:        "100MB secret minus 1 byte",
-			size:        100*1024*1024 - 1,
-			shouldError: false,
+			name: "100MB secret minus 1 byte",
+			size: 100*1024*1024 - 1,
 		},
 		{
-			name:        "101MB secret - should fail",
-			size:        101 * 1024 * 1024,
-			shouldError: true,
-			errorMsg:    "secret too large: exceeds 100MB limit",
+			name:    "101MB secret - should fail",
+			size:    101 * 1024 * 1024,
+			wantErr: errSecretTooLarge,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			runAddSecretSizeCase(t, tt.size, tt.shouldError, tt.errorMsg)
+			runAddSecretSizeCase(t, tt.size, tt.wantErr)
 		})
 	}
 }
@@ -265,57 +254,48 @@ func TestAddSecretVariousSizes(t *testing.T) {
 //nolint:paralleltest // together the subtests lock more than the memlock limit
 func TestImportSecretVariousSizes(t *testing.T) {
 	tests := []struct {
-		name        string
-		size        int
-		shouldError bool
-		errorMsg    string
+		name    string
+		size    int
+		wantErr error
 	}{
 		{
-			name:        "1KB file",
-			size:        1024,
-			shouldError: false,
+			name: "1KB file",
+			size: 1024,
 		},
 		{
-			name:        "10KB file",
-			size:        10 * 1024,
-			shouldError: false,
+			name: "10KB file",
+			size: 10 * 1024,
 		},
 		{
-			name:        "100KB file",
-			size:        100 * 1024,
-			shouldError: false,
+			name: "100KB file",
+			size: 100 * 1024,
 		},
 		{
-			name:        "1MB file",
-			size:        1024 * 1024,
-			shouldError: false,
+			name: "1MB file",
+			size: 1024 * 1024,
 		},
 		{
-			name:        "10MB file",
-			size:        10 * 1024 * 1024,
-			shouldError: false,
+			name: "10MB file",
+			size: 10 * 1024 * 1024,
 		},
 		{
-			name:        "99MB file",
-			size:        99 * 1024 * 1024,
-			shouldError: false,
+			name: "99MB file",
+			size: 99 * 1024 * 1024,
 		},
 		{
-			name:        "100MB file",
-			size:        100 * 1024 * 1024,
-			shouldError: false,
+			name: "100MB file",
+			size: 100 * 1024 * 1024,
 		},
 		{
-			name:        "101MB file - should fail",
-			size:        101 * 1024 * 1024,
-			shouldError: true,
-			errorMsg:    "secret file too large: exceeds 100MB limit",
+			name:    "101MB file - should fail",
+			size:    101 * 1024 * 1024,
+			wantErr: errSecretFileTooLarge,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			runImportSecretSizeCase(t, tt.size, tt.shouldError, tt.errorMsg)
+			runImportSecretSizeCase(t, tt.size, tt.wantErr)
 		})
 	}
 }