secret/internal/secret/secret_test.go

//nolint:testpackage // white-box test of unexported internals
package secret

import (
	"errors"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"filippo.io/age"
	"git.eeqj.de/sneak/secret/pkg/agehd"
	"github.com/awnumar/memguard"
	"github.com/spf13/afero"
	"github.com/stretchr/testify/require"
)

// testMnemonicValue is the standard BIP39 test vector mnemonic.
//
//nolint:dupword // BIP39 test mnemonic repeats words by design
const testMnemonicValue = "abandon abandon abandon abandon abandon abandon " +
	"abandon abandon abandon abandon abandon about"

var (
	errMnemonicNotSet       = errors.New("SB_SECRET_MNEMONIC not set")
	errNotImplementedInMock = errors.New("not implemented in mock")
)

// MockVault is a test implementation of the VaultInterface
type MockVault struct {
	name            string
	fs              afero.Fs
	directory       string
	derivationIndex uint32
}

func (m *MockVault) GetDirectory() (string, error) {
	return m.directory, nil
}

func (m *MockVault) AddSecret(name string, value *memguard.LockedBuffer, _ bool) error {
	// Create secret directory with proper storage name conversion
	storageName := strings.ReplaceAll(name, "/", "%")
	secretDir := filepath.Join(m.directory, "secrets.d", storageName)

	err := m.fs.MkdirAll(secretDir, 0o700)
	if err != nil {
		return err
	}

	// Create version directory with proper path
	versionName := "20240101.001" // Use a fixed version name for testing
	versionDir := filepath.Join(secretDir, "versions", versionName)

	err = m.fs.MkdirAll(versionDir, 0o700)
	if err != nil {
		return err
	}

	// Read the vault's long-term public key
	ltPubKeyPath := filepath.Join(m.directory, "pub.age")

	// Derive long-term key using the vault's derivation index
	mnemonic := os.Getenv(EnvMnemonic)
	if mnemonic == "" {
		return errMnemonicNotSet
	}

	ltIdentity, err := agehd.DeriveIdentity(mnemonic, m.derivationIndex)
	if err != nil {
		return err
	}

	// Write long-term public key if it doesn't exist
	_, err = m.fs.Stat(ltPubKeyPath)
	if os.IsNotExist(err) {
		pubKey := ltIdentity.Recipient().String()

		err = afero.WriteFile(m.fs, ltPubKeyPath, []byte(pubKey), 0o600)
		if err != nil {
			return err
		}
	}

	err = m.writeVersionFiles(versionDir, value, ltIdentity)
	if err != nil {
		return err
	}

	// Create current file pointing to the version (just the version name)
	currentLink := filepath.Join(secretDir, "current")

	return afero.WriteFile(m.fs, currentLink, []byte(versionName), 0o600)
}

func (m *MockVault) GetName() string {
	return m.name
}

//nolint:ireturn // implements VaultInterface
func (m *MockVault) GetFilesystem() afero.Fs {
	return m.fs
}

//nolint:ireturn // implements VaultInterface
func (m *MockVault) GetCurrentUnlocker() (Unlocker, error) {
	return nil, errNotImplementedInMock
}

func (m *MockVault) CreatePassphraseUnlocker(
	_ *memguard.LockedBuffer,
) (*PassphraseUnlocker, error) {
	return nil, errNotImplementedInMock
}

// writeVersionFiles generates a version keypair and writes the version
// key and value files for the mock vault.
func (m *MockVault) writeVersionFiles(
	versionDir string,
	value *memguard.LockedBuffer,
	ltIdentity *age.X25519Identity,
) error {
	// Generate version-specific keypair
	versionIdentity, err := age.GenerateX25519Identity()
	if err != nil {
		return err
	}

	// Write version public key
	pubKeyPath := filepath.Join(versionDir, "pub.age")

	err = afero.WriteFile(
		m.fs, pubKeyPath, []byte(versionIdentity.Recipient().String()), 0o600)
	if err != nil {
		return err
	}

	// Encrypt value to version's public key (value is already a LockedBuffer)
	encryptedValue, err := EncryptToRecipient(value, versionIdentity.Recipient())
	if err != nil {
		return err
	}

	// Write encrypted value
	valuePath := filepath.Join(versionDir, "value.age")

	err = afero.WriteFile(m.fs, valuePath, encryptedValue, 0o600)
	if err != nil {
		return err
	}

	// Encrypt version private key to long-term public key
	versionPrivKeyBuffer := memguard.NewBufferFromBytes([]byte(versionIdentity.String()))
	defer versionPrivKeyBuffer.Destroy()

	encryptedPrivKey, err := EncryptToRecipient(
		versionPrivKeyBuffer, ltIdentity.Recipient())
	if err != nil {
		return err
	}

	// Write encrypted version private key
	privKeyPath := filepath.Join(versionDir, "priv.age")

	return afero.WriteFile(m.fs, privKeyPath, encryptedPrivKey, 0o600)
}

// setupMockVaultDirs creates the vault directory structure, long-term
// public key, and current vault pointer for tests.
func setupMockVaultDirs(t *testing.T, fs afero.Fs, baseDir, vaultDir string) {
	t.Helper()

	// Create vault directory structure
	err := fs.MkdirAll(filepath.Join(vaultDir, "secrets.d"), DirPerms)
	if err != nil {
		t.Fatalf("Failed to create vault directory: %v", err)
	}

	// Generate a long-term keypair for the vault using the test mnemonic
	ltIdentity, err := agehd.DeriveIdentity(testMnemonicValue, 0)
	if err != nil {
		t.Fatalf("Failed to generate long-term identity: %v", err)
	}

	// Write long-term public key
	ltPubKeyPath := filepath.Join(vaultDir, "pub.age")

	err = afero.WriteFile(
		fs,
		ltPubKeyPath,
		[]byte(ltIdentity.Recipient().String()),
		0o600,
	)
	if err != nil {
		t.Fatalf("Failed to write long-term public key: %v", err)
	}

	// Set current vault
	currentVaultPath := filepath.Join(baseDir, "currentvault")

	err = afero.WriteFile(fs, currentVaultPath, []byte(vaultDir), FilePerms)
	if err != nil {
		t.Fatalf("Failed to set current vault: %v", err)
	}
}

// verifySecretFiles checks that AddSecret created the expected version
// files for the secret.
func verifySecretFiles(t *testing.T, fs afero.Fs, vaultDir, secretName string) {
	t.Helper()

	secretDir := filepath.Join(vaultDir, "secrets.d", secretName)

	// Check versions directory exists
	versionsDir := filepath.Join(secretDir, "versions")

	versionsDirExists, err := afero.DirExists(fs, versionsDir)
	if err != nil || !versionsDirExists {
		t.Fatalf("versions directory was not created")
	}

	// Check current file exists and points at a version
	currentVersion, err := GetCurrentVersion(fs, secretDir)
	if err != nil {
		t.Fatalf("Failed to get current version: %v", err)
	}

	// Check value.age exists in the version directory
	versionDir := filepath.Join(versionsDir, currentVersion)

	valueExists, err := afero.Exists(fs, filepath.Join(versionDir, "value.age"))
	if err != nil || !valueExists {
		t.Fatalf("value.age file was not created in version directory")
	}
}

//nolint:paralleltest // uses t.Setenv (process-global environment)
func TestPerSecretKeyFunctionality(t *testing.T) {
	// Create an in-memory filesystem for testing
	fs := afero.NewMemMapFs()

	// Set test mnemonic for direct encryption/decryption
	t.Setenv(EnvMnemonic, testMnemonicValue)

	// Set up a test vault structure
	baseDir := "/test-config/berlin.sneak.pkg.secret"
	vaultDir := filepath.Join(baseDir, "vaults.d", "test-vault")

	setupMockVaultDirs(t, fs, baseDir, vaultDir)

	// Create vault instance using the mock vault
	vault := &MockVault{
		name:            "test-vault",
		fs:              fs,
		directory:       vaultDir,
		derivationIndex: 0,
	}

	// Test data
	secretName := "test-secret"
	secretValue := []byte("this is a test secret value")

	// Create a secure buffer for the test value
	valueBuffer := memguard.NewBufferFromBytes(secretValue)
	defer valueBuffer.Destroy()

	// Test AddSecret
	t.Run("AddSecret", func(t *testing.T) {
		err := vault.AddSecret(secretName, valueBuffer, false)
		if err != nil {
			t.Fatalf("AddSecret failed: %v", err)
		}

		// Verify that all expected files were created
		verifySecretFiles(t, fs, vaultDir, secretName)

		t.Logf("All expected files created successfully with versioning")
	})

	// Create a Secret object to test with
	secret := NewSecret(vault, secretName)

	// Test GetValue (this will need to be modified since we're using a mock vault)
	t.Run("GetSecret", func(t *testing.T) {
		// This test is simplified since we're not implementing the full encryption/decryption
		// in the mock. We just verify the Secret object is created correctly.
		if secret.Name != secretName {
			t.Fatalf("Secret name doesn't match. Expected: %s, Got: %s", secretName, secret.Name)
		}

		if secret.vault != vault {
			t.Fatalf("Secret vault reference doesn't match expected vault")
		}

		t.Logf("Successfully created Secret object with correct properties")
	})

	// Test Exists
	t.Run("SecretExists", func(t *testing.T) {
		exists, err := secret.Exists()
		if err != nil {
			t.Fatalf("Error checking if secret exists: %v", err)
		}

		if !exists {
			t.Fatalf("Secret should exist but Exists() returned false")
		}

		t.Logf("Secret.Exists() works correctly")
	})
}

// For testing purposes only
func isValidSecretName(name string) bool {
	if name == "" {
		return false
	}
	// Valid characters for secret names: letters, numbers, dash, dot, underscore, slash
	for _, char := range name {
		if (char < 'a' || char > 'z') && // lowercase letters
			(char < 'A' || char > 'Z') && // uppercase letters
			(char < '0' || char > '9') && // numbers
			char != '-' && // dash
			char != '.' && // dot
			char != '_' && // underscore
			char != '/' { // slash
			return false
		}
	}

	return true
}

func TestSecretNameValidation(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name  string
		valid bool
	}{
		{"valid-name", true},
		{"valid.name", true},
		{"valid_name", true},
		{"valid/path/name", true},
		{"123valid", true},
		{"", false},
		{"Valid-Upper-Name", true}, // uppercase allowed
		{"2025-11-21-ber1app1-vaultik-test-bucket-AKI", true}, // real-world uppercase key ID
		{"MixedCase/Path/Name", true},                         // mixed case with path
		{"invalid name", false},                               // space not allowed
		{"invalid@name", false},                               // @ not allowed
	}

	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			t.Parallel()

			result := isValidSecretName(test.name)
			if result != test.valid {
				t.Errorf(
					"isValidSecretName(%q) = %v, want %v",
					test.name,
					result,
					test.valid,
				)
			}
		})
	}
}

func TestSecretGetValueWithEnvMnemonicUsesVaultDerivationIndex(t *testing.T) {
	// This test demonstrates the bug where GetValue uses hardcoded index 0
	// instead of the vault's actual derivation index when using environment mnemonic

	// Set up test mnemonic
	t.Setenv(EnvMnemonic, testMnemonicValue)

	// Create temporary directory for vaults
	fs := afero.NewOsFs()
	tempDir, err := afero.TempDir(fs, "", "secret-test-")
	require.NoError(t, err)

	defer func() {
		_ = fs.RemoveAll(tempDir)
	}()

	stateDir := filepath.Join(tempDir, ".secret")
	require.NoError(t, fs.MkdirAll(stateDir, 0o700))

	// This test is now in the integration test file where it can use real vaults
	// The bug is demonstrated there - see test31EnvMnemonicUsesVaultDerivationIndex
	t.Log("This test demonstrates the bug in the integration test file")
}