Give each failure one error value (closes #113)

internal/cli drops its copies of vault.ErrSecretNotFound, ErrVaultNotFound,
ErrVersionNotFound and ErrSecretExists and of the secret package's keychain
and Secure Enclave errors, and its second error for an unknown unlocker
type, an invalid mnemonic, a length below 1, an unsupported secret type and
an oversized secret. vault.ErrNilValueBuffer becomes
secret.ErrNilValueBuffer. Every error of secret.ReadPassphrase wraps
ErrPassphraseNotRead. ResolveGPGKeyFingerprint returns ErrGPGKeyNotFound for
a key the keyring lacks. storeInKeychain returns errNilDataBuffer. bip85's
ErrPasswordTooShort and ErrEncodedTooShort go with their unreachable checks,
as does the macOS check in macOS-only code. Tests that matched these
errors' text use errors.Is.

Model: opus-5-5

internal/cli/input_errors_test.go

@@ -0,0 +1,67 @@
+//nolint:testpackage // white-box test of unexported internals
+package cli
+
+import (
+	"testing"
+
+	"git.eeqj.de/sneak/secret/internal/vault"
+	"github.com/awnumar/memguard"
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/require"
+)
+
+// TestInvalidMnemonicError checks that every command that takes a mnemonic
+// returns errInvalidMnemonicPhrase for one that is not valid BIP39. The vault
+// "other" has no long-term key, as vault import needs.
+func TestInvalidMnemonicError(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		command string
+		run     func(c *Instance) error
+	}{
+		{"secret init", func(c *Instance) error { return c.Init(c.cmd) }},
+		{"secret vault create work", func(c *Instance) error {
+			return c.CreateVault(c.cmd, "work")
+		}},
+		{"secret vault import other", func(c *Instance) error {
+			return c.VaultImport(c.cmd, "other")
+		}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.command, func(t *testing.T) {
+			t.Parallel()
+
+			fs := afero.NewMemMapFs()
+			_, err := vault.CreateVault(fs, listTestStateDir, "other", nil, nil)
+			require.NoError(t, err)
+
+			instance, _ := newTestInstance(fs)
+			instance.Mnemonic = memguard.NewBufferFromBytes([]byte("not a mnemonic"))
+			t.Cleanup(instance.Mnemonic.Destroy)
+
+			require.ErrorIs(t, tt.run(instance), errInvalidMnemonicPhrase)
+		})
+	}
+}
+
+// TestGenerateSecretErrors checks that `secret generate secret` gives one
+// error for a length below 1 and one for a type it cannot generate.
+func TestGenerateSecretErrors(t *testing.T) {
+	t.Parallel()
+
+	instance, cmd := newTestInstance(afero.NewMemMapFs())
+
+	err := instance.GenerateSecret(cmd, "x", 0, "base58", false)
+	require.ErrorIs(t, err, errLengthTooSmall)
+
+	_, err = generateRandomString(0, "ab")
+	require.ErrorIs(t, err, errLengthTooSmall)
+
+	err = instance.GenerateSecret(cmd, "x", defaultSecretLength, "mnemonic", false)
+	require.ErrorIs(t, err, errUnsupportedSecretType)
+
+	err = instance.GenerateSecret(cmd, "x", defaultSecretLength, "hex", false)
+	require.ErrorIs(t, err, errUnsupportedSecretType)
+}