Create a vault whole in a temporary directory, then select it (closes #105)

vault.CreateVault takes the unlocker passphrase and writes the vault
directory, its metadata, long-term public key and passphrase unlocker
into a temporary directory, renames that into vaults.d once complete,
and only then makes the vault current. secret init and secret vault
create call it once instead of adding the unlocker afterwards, so a
kill part-way leaves either no vault, whose temporary directory the
next command that takes the lock deletes, or a complete one. A test
records the state directory before every change the call makes and
checks each state, and the command run again from it.

Model: opus-5-5

internal/cli/create_vault_test.go

@@ -2,7 +2,9 @@ package cli_test
 
 import (
 	"bytes"
+	"io"
 	"os"
+	"strings"
 	"testing"
 
 	"git.eeqj.de/sneak/secret/internal/cli"
@@ -155,7 +157,7 @@ func TestStopAtPassphrasePromptLeavesNothing(t *testing.T) {
 	require.NoError(t, empty.MkdirAll(testStateDir, secret.DirPerms))
 
 	withDefault := afero.NewMemMapFs()
-	_, err := vault.CreateVault(withDefault, testStateDir, "default", mnemonic)
+	_, err := vault.CreateVault(withDefault, testStateDir, "default", mnemonic, nil)
 	require.NoError(t, err)
 
 	cmd := &cobra.Command{}
@@ -193,3 +195,166 @@ func TestStopAtPassphrasePromptLeavesNothing(t *testing.T) {
 		})
 	}
 }
+
+// TestStopDuringCreateLeavesWholeVaultOrNone is a regression test for
+// https://git.eeqj.de/sneak/secret/issues/105: `secret init` or `secret vault
+// create` killed after the passphrase prompt but before the unlocker was
+// written left a vault with no unlocker, which neither command would then
+// create again. After the prompt, each command changes the state directory
+// only through vault.CreateVault. The test makes that call as the command
+// does and records the state directory before each change it makes, and once
+// after it returns: what a stop at that point leaves. Each must hold either
+// no vault, and not name it current, or exactly the finished vault, which
+// opens with the passphrase through its current unlocker. The command, run
+// again on each as after a killed command, must then create the vault, or
+// refuse the one there, and delete what the stop left under a temporary name.
+//
+//nolint:paralleltest // commands on the in-memory filesystem share one lock
+func TestStopDuringCreateLeavesWholeVaultOrNone(t *testing.T) {
+	mnemonic := testMnemonicBuffer(t)
+	passphrase := memguard.NewBufferFromBytes([]byte(testPassphrase))
+	t.Cleanup(passphrase.Destroy)
+
+	cmd := &cobra.Command{}
+	cmd.SetOut(io.Discard)
+
+	tests := []struct {
+		command string
+		name    string
+		exists  string
+		run     func(c *cli.Instance) error
+	}{
+		{
+			"init", "default",
+			"failed to create default vault: vault default already exists",
+			func(c *cli.Instance) error { return c.Init(cmd) },
+		},
+		{
+			"vault create work", "work",
+			"vault work already exists",
+			func(c *cli.Instance) error { return c.CreateVault(cmd, "work") },
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.command, func(t *testing.T) {
+			// `secret init` starts from an empty state directory, `secret
+			// vault create work` from one holding the vault "default"
+			fs := afero.NewMemMapFs()
+			require.NoError(t, fs.MkdirAll(testStateDir, secret.DirPerms))
+
+			if tt.name != "default" {
+				_, err := vault.CreateVault(fs, testStateDir, "default", mnemonic, nil)
+				require.NoError(t, err)
+			}
+
+			var stops []map[string]string
+
+			record := func() { stops = append(stops, snapshotStateDir(t, fs)) }
+
+			_, err := vault.CreateVault(hookFs{Fs: fs, before: record},
+				testStateDir, tt.name, mnemonic, passphrase)
+			require.NoError(t, err)
+			record()
+
+			vaultDir := testStateDir + "/vaults.d/" + tt.name
+			finished := entriesUnder(stops[len(stops)-1], vaultDir)
+
+			opener := vault.NewVault(fs, testStateDir, tt.name)
+			opener.UnlockPassphrase = passphrase
+
+			key, err := opener.UnlockVault()
+			require.NoError(t, err)
+			require.Equal(t, finished[vaultDir+"/pub.age"], key.Recipient().String())
+
+			for i, stop := range stops {
+				stopped := newFsFromSnapshot(t, stop)
+				c := cli.NewCLIInstanceWithStateDir(stopped, testStateDir)
+				c.Mnemonic = mnemonic
+				c.UnlockPassphrase = passphrase
+
+				if _, there := stop[vaultDir+"/"]; there {
+					require.Equal(t, finished, entriesUnder(stop, vaultDir),
+						"stop %d left a partial vault", i)
+					require.EqualError(t, tt.run(c), tt.exists, "stop %d", i)
+				} else {
+					require.NotEqual(t, tt.name, stop[testStateDir+"/currentvault"],
+						"stop %d made a missing vault current", i)
+					require.NoError(t, tt.run(c), "stop %d", i)
+				}
+
+				for path := range snapshotStateDir(t, stopped) {
+					require.NotContains(t, path, ".tmp-", "stop %d", i)
+				}
+			}
+		})
+	}
+}
+
+// entriesUnder returns the entries of a tree recorded by snapshotStateDir
+// that are under dir.
+func entriesUnder(tree map[string]string, dir string) map[string]string {
+	entries := map[string]string{}
+
+	for path, content := range tree {
+		if strings.HasPrefix(path, dir+"/") {
+			entries[path] = content
+		}
+	}
+
+	return entries
+}
+
+// hookFs passes every call through to Fs, but first calls before for each
+// call that can change the filesystem.
+type hookFs struct {
+	afero.Fs
+
+	before func()
+}
+
+//nolint:ireturn // implements afero.Fs
+func (h hookFs) Create(name string) (afero.File, error) {
+	h.before()
+
+	return h.Fs.Create(name)
+}
+
+//nolint:ireturn // implements afero.Fs
+func (h hookFs) OpenFile(
+	name string, flag int, perm os.FileMode,
+) (afero.File, error) {
+	h.before()
+
+	return h.Fs.OpenFile(name, flag, perm)
+}
+
+func (h hookFs) Mkdir(name string, perm os.FileMode) error {
+	h.before()
+
+	return h.Fs.Mkdir(name, perm)
+}
+
+func (h hookFs) MkdirAll(path string, perm os.FileMode) error {
+	h.before()
+
+	return h.Fs.MkdirAll(path, perm)
+}
+
+func (h hookFs) Remove(name string) error {
+	h.before()
+
+	return h.Fs.Remove(name)
+}
+
+func (h hookFs) RemoveAll(path string) error {
+	h.before()
+
+	return h.Fs.RemoveAll(path)
+}
+
+func (h hookFs) Rename(oldname, newname string) error {
+	h.before()
+
+	return h.Fs.Rename(oldname, newname)
+}