clawbot
017b8d73bf
check / check (push) Failing after 2s
script/lint-darwin (make lint-darwin; run by script/check, and its commands by the Dockerfile lint stage) runs go vet and golangci-lint with GOOS=darwin and cgo off. Compiling cgo for macOS needs Apple's SDK, so the three functions that call go-keychain, which is cgo there, move to keychainunlocker_cgo.go; a macOS build without cgo gets keychainunlocker_nocgo.go and the macse stub, whose errors name the missing macOS build with cgo. The rest of the keychain unlocker and its plain-Go tests are now checked; their findings are fixed without changing behaviour, and lines over 88 columns in the unchecked files are wrapped. Model: opus-5-5
114 lines
3.0 KiB
Go
114 lines
3.0 KiB
Go
//go:build darwin
|
|
|
|
//nolint:testpackage // white-box test of unexported Secure Enclave helpers
|
|
package secret
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/spf13/afero"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestNewSecureEnclaveUnlocker(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
fs := afero.NewMemMapFs()
|
|
dir := "/tmp/test-se-unlocker"
|
|
metadata := UnlockerMetadata{
|
|
Type: seUnlockerType,
|
|
CreatedAt: time.Date(2026, 1, 15, 10, 30, 0, 0, time.UTC),
|
|
Flags: []string{seUnlockerType, "macos"},
|
|
}
|
|
|
|
unlocker := NewSecureEnclaveUnlocker(fs, dir, metadata)
|
|
require.NotNil(t, unlocker, "NewSecureEnclaveUnlocker should return a valid instance")
|
|
|
|
// Test GetType returns correct type
|
|
assert.Equal(t, seUnlockerType, unlocker.GetType())
|
|
|
|
// Test GetMetadata returns the metadata we passed in
|
|
assert.Equal(t, metadata, unlocker.GetMetadata())
|
|
|
|
// Test GetDirectory returns the directory we passed in
|
|
assert.Equal(t, dir, unlocker.GetDirectory())
|
|
}
|
|
|
|
func TestSecureEnclaveUnlockerImplementsInterface(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
fs := afero.NewMemMapFs()
|
|
metadata := UnlockerMetadata{
|
|
Type: seUnlockerType,
|
|
CreatedAt: time.Now().UTC(),
|
|
}
|
|
|
|
unlocker := NewSecureEnclaveUnlocker(fs, "/tmp/test", metadata)
|
|
|
|
// Verify the darwin implementation implements the Unlocker interface
|
|
var _ Unlocker = unlocker
|
|
}
|
|
|
|
func TestSecureEnclaveUnlockerGetIDFormat(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
fs := afero.NewMemMapFs()
|
|
metadata := UnlockerMetadata{
|
|
Type: seUnlockerType,
|
|
CreatedAt: time.Date(2026, 3, 10, 14, 30, 0, 0, time.UTC),
|
|
}
|
|
|
|
unlocker := NewSecureEnclaveUnlocker(fs, "/tmp/test", metadata)
|
|
id := unlocker.GetID()
|
|
|
|
// ID should contain the timestamp and "secure-enclave" type
|
|
assert.Contains(t, id, "2026-03-10.14.30")
|
|
assert.Contains(t, id, seUnlockerType)
|
|
}
|
|
|
|
func TestGenerateSEKeyLabel(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
label, err := generateSEKeyLabel("test-vault")
|
|
require.NoError(t, err)
|
|
|
|
// Label should contain the prefix and vault name
|
|
assert.Contains(t, label, seKeyLabelPrefix)
|
|
assert.Contains(t, label, "test-vault")
|
|
}
|
|
|
|
func TestSecureEnclaveUnlockerGetIdentityMissingFile(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
fs := afero.NewMemMapFs()
|
|
dir := "/tmp/test-se-unlocker-missing"
|
|
|
|
// Create unlocker directory with metadata but no encrypted key file
|
|
require.NoError(t, fs.MkdirAll(dir, DirPerms))
|
|
|
|
metadataJSON := `{
|
|
"type": "secure-enclave",
|
|
"createdAt": "2026-01-15T10:30:00Z",
|
|
"seKeyLabel": "berlin.sneak.app.secret.se.test",
|
|
"seKeyHash": "abc123"
|
|
}`
|
|
require.NoError(t, afero.WriteFile(
|
|
fs, dir+"/unlocker-metadata.json", []byte(metadataJSON), FilePerms,
|
|
))
|
|
|
|
metadata := UnlockerMetadata{
|
|
Type: seUnlockerType,
|
|
CreatedAt: time.Date(2026, 1, 15, 10, 30, 0, 0, time.UTC),
|
|
}
|
|
|
|
unlocker := NewSecureEnclaveUnlocker(fs, dir, metadata)
|
|
|
|
// GetIdentity should fail because the encrypted longterm key file is missing
|
|
identity, err := unlocker.GetIdentity()
|
|
assert.Nil(t, identity)
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), "failed to read SE-encrypted long-term key")
|
|
}
|