Check errors by identity, not by message text, in tests (closes #49)

Tests that asserted a failure by a fragment of its message now use
errors.Is: a refactor returning the wrong error, or wrapping with %v
instead of %w, now fails them. New tests return each exported error of
internal/vault and pkg/bip85 that no test returned, and check wrapped
causes (os.ErrNotExist, ErrMnemonicMismatch through GetSecret,
ErrInvalidPathComponent through DeriveBIP85Entropy). The 999-versions
test moves into package secret to name its unexported error. Checks of
errors no test can name keep their text; they are listed on the issue.

Model: opus-5-5

internal/cli/move_test.go

@@ -30,6 +30,8 @@ func TestRejectedMoveWithinVaultLeavesStateUnchanged(t *testing.T) {
 		workX      = "work:x"
 	)
 
+	// internal/cli declares these errors itself and does not export them, so
+	// only their text can be compared.
 	tests := []struct {
 		command      string
 		source, dest string
@@ -52,21 +54,6 @@ func TestRejectedMoveWithinVaultLeavesStateUnchanged(t *testing.T) {
 			"mv --force nosuch:x nosuch:y", "nosuch:x", "nosuch:y", true,
 			"vault 'nosuch' does not exist",
 		},
-		// Each of these spells "work" a second way. The spelling is not a
-		// valid vault name, so the move is not taken for a move between two
-		// vaults, which would delete the destination, here the source.
-		{
-			"mv --force work:x work/:x", workX, "work/:x", true,
-			vault.ValidateVaultName("work/").Error(),
-		},
-		{
-			"mv --force work/:x work:", "work/:x", "work:", true,
-			vault.ValidateVaultName("work/").Error(),
-		},
-		{
-			"mv --force work:x ./work:x", workX, "./work:x", true,
-			vault.ValidateVaultName("./work").Error(),
-		},
 	}
 
 	for _, tt := range tests {
@@ -82,6 +69,26 @@ func TestRejectedMoveWithinVaultLeavesStateUnchanged(t *testing.T) {
 			require.EqualError(t, err, tt.wantErr)
 		})
 	}
+
+	// Each of these spells "work" a second way. The spelling is not a valid
+	// vault name, so the move is not taken for a move between two vaults,
+	// which would delete the destination, here the source.
+	invalidNames := []struct{ source, dest string }{
+		{workX, "work/:x"},
+		{"work/:x", "work:"},
+		{workX, "./work:x"},
+	}
+
+	for _, tt := range invalidNames {
+		t.Run("mv --force "+tt.source+" "+tt.dest, func(t *testing.T) {
+			t.Parallel()
+
+			requireRejectedAndUnchanged(t, before, vault.ErrInvalidVaultName,
+				func(c *cli.Instance) error {
+					return c.MoveSecret(&cobra.Command{}, tt.source, tt.dest, true)
+				})
+		})
+	}
 }
 
 // TestMoveWithinOtherVaultKeepsCurrentVault checks that `secret mv work:x

internal/secret/seunlocker_test.go

@@ -5,6 +5,7 @@ package secret
 
 import (
 	"os"
+	"path/filepath"
 	"testing"
 	"time"
 
@@ -107,5 +108,10 @@ func TestSecureEnclaveUnlockerGetIdentityMissingFile(t *testing.T) {
 	// GetIdentity should fail because the encrypted longterm key file is missing
 	identity, err := unlocker.GetIdentity()
 	assert.Nil(t, identity)
+
+	var cause *os.PathError
+
+	require.ErrorAs(t, err, &cause)
 	require.ErrorIs(t, err, os.ErrNotExist)
+	assert.Equal(t, filepath.Join(dir, seLongtermFilename), cause.Path)
 }

internal/vault/errors_test.go

@@ -70,13 +70,15 @@ func TestVaultErrors(t *testing.T) {
 			return vlt.CopySecretAllVersions(vlt, testSecretName, testSecretName, false)
 		}, vault.ErrSecretExists},
 		{"copy a secret without versions", func(vlt *vault.Vault) error {
+			const versionless = "versionless"
+
 			err := vlt.GetFilesystem().MkdirAll(
-				filepath.Join(vaultDir, "secrets.d", missingName), secret.DirPerms)
+				filepath.Join(vaultDir, "secrets.d", versionless), secret.DirPerms)
 			if err != nil {
 				return err
 			}
 
-			return vlt.CopySecretAllVersions(vlt, missingName, "copy", false)
+			return vlt.CopySecretAllVersions(vlt, versionless, "copy", false)
 		}, vault.ErrNoVersions},
 		{"remove a missing unlocker", func(vlt *vault.Vault) error {
 			return vlt.RemoveUnlocker(missingName)

internal/vault/vault_error_test.go

@@ -37,8 +37,13 @@ func TestAddSecretFailsWithMissingPublicKey(t *testing.T) {
 	defer value.Destroy()
 
 	err := vlt.AddSecret(testSecretName, value, false)
+
+	var cause *os.PathError
+
+	require.ErrorAs(t, err, &cause)
 	require.ErrorIs(t, err, os.ErrNotExist,
 		"AddSecret should fail when public key is missing")
+	assert.Equal(t, filepath.Join(vaultDir, "pub.age"), cause.Path)
 
 	// Verify that the secret directory was NOT created
 	secretDir := filepath.Join(vaultDir, "secrets.d", testSecretName)