sneak
d01a277448
check / check (push) Canceled after 0s
The passphrase and mnemonic prompts open /dev/tty and ask there, so `echo v | secret add s1 --force`, `secret encrypt` and `secret decrypt` with piped input ask at a terminal instead of failing. Only a process with no controlling terminal still gets the error naming the variable to set; stdin and stderr no longer matter. On SIGINT or SIGTERM, Entry() restores the settings of /dev/tty instead of stdin, since that is where the prompt turns echo off; with stdin piped, Ctrl-C at the prompt otherwise left echo off. The two tests that pin the no-terminal message run the binary in a new session, so it has no terminal wherever the tests run. Unverified by a test: the echo restore after Ctrl-C, checked by hand. Model: opus-5-5
134 lines
3.7 KiB
Go
134 lines
3.7 KiB
Go
package cli_test
|
|
|
|
import (
|
|
"bufio"
|
|
"bytes"
|
|
"context"
|
|
"io"
|
|
"os"
|
|
"os/exec"
|
|
"strings"
|
|
"syscall"
|
|
"testing"
|
|
|
|
"filippo.io/age"
|
|
"github.com/awnumar/memguard"
|
|
"github.com/creack/pty"
|
|
"github.com/spf13/afero"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"sneak.berlin/go/secret/internal/secret"
|
|
"sneak.berlin/go/secret/internal/vault"
|
|
)
|
|
|
|
// TestPassphraseAskedAtTerminalWithPipedStdin is a regression test for
|
|
// https://git.eeqj.de/sneak/secret/issues/144: run at a terminal with stdin
|
|
// a pipe, as in `echo v2 | secret add s1 --force`, a command that needed
|
|
// the passphrase failed instead of asking for it. Each command here must ask
|
|
// on the terminal and succeed once the passphrase is typed there.
|
|
func TestPassphraseAskedAtTerminalWithPipedStdin(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
stateDir := t.TempDir()
|
|
|
|
passphrase := memguard.NewBufferFromBytes([]byte(testPassphrase))
|
|
defer passphrase.Destroy()
|
|
|
|
vlt, err := vault.CreateVault(afero.NewOsFs(), stateDir, "default",
|
|
testMnemonicBuffer(t), passphrase)
|
|
require.NoError(t, err)
|
|
|
|
value := memguard.NewBufferFromBytes([]byte("v1"))
|
|
defer value.Destroy()
|
|
|
|
require.NoError(t, vlt.AddSecret("s1", value, false))
|
|
|
|
identity, err := age.GenerateX25519Identity()
|
|
require.NoError(t, err)
|
|
|
|
key := secret.IdentityToLockedBuffer(identity)
|
|
defer key.Destroy()
|
|
|
|
require.NoError(t, vlt.AddSecret("mykey", key, false))
|
|
|
|
runAtTerminal(t, stateDir, "v2\n", "add", "s1", "--force")
|
|
|
|
vlt.UnlockPassphrase = passphrase
|
|
|
|
added, err := vlt.GetSecret("s1")
|
|
require.NoError(t, err)
|
|
|
|
defer added.Destroy()
|
|
|
|
assert.Equal(t, "v2", added.String())
|
|
|
|
encrypted := runAtTerminal(t, stateDir, "a document\n", "encrypt", "mykey")
|
|
decrypted := runAtTerminal(t, stateDir, encrypted, "decrypt", "mykey")
|
|
assert.Equal(t, "a document\n", decrypted)
|
|
}
|
|
|
|
// runAtTerminal runs the secret binary with args and input on stdin, in a
|
|
// new session whose controlling terminal is a new terminal, which is also
|
|
// its stderr: a command typed at a terminal with its input piped. pty.Open
|
|
// is described above TestRemoveIgnoresTerminalOnStdout. runAtTerminal waits
|
|
// for the passphrase prompt on the terminal, types the passphrase there,
|
|
// and returns what the command wrote to stdout once it has succeeded.
|
|
func runAtTerminal(t *testing.T, stateDir, input string, args ...string) string {
|
|
t.Helper()
|
|
|
|
ctx, cancel := context.WithTimeout(t.Context(), commandWait)
|
|
defer cancel()
|
|
|
|
//nolint:gosec // G204: test executes the freshly built secret binary
|
|
cmd := exec.CommandContext(ctx, secretBinaryPath(t), args...)
|
|
cmd.Env = []string{
|
|
secret.EnvStateDir + "=" + stateDir,
|
|
"PATH=" + os.Getenv("PATH"),
|
|
"HOME=" + os.Getenv("HOME"),
|
|
}
|
|
|
|
ptmx, tty, err := pty.Open()
|
|
require.NoError(t, err)
|
|
|
|
defer func() { _ = ptmx.Close() }()
|
|
|
|
deadline, _ := ctx.Deadline()
|
|
require.NoError(t, ptmx.SetReadDeadline(deadline))
|
|
|
|
var stdout strings.Builder
|
|
|
|
cmd.Stdin = strings.NewReader(input)
|
|
cmd.Stdout = &stdout
|
|
cmd.Stderr = tty
|
|
// Ctty is a descriptor in the new process: 2, its stderr.
|
|
cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true, Setctty: true, Ctty: 2}
|
|
|
|
require.NoError(t, cmd.Start())
|
|
|
|
_ = tty.Close()
|
|
|
|
var (
|
|
shown []byte
|
|
char byte
|
|
)
|
|
|
|
terminal := bufio.NewReader(ptmx)
|
|
for !bytes.HasSuffix(shown, []byte("Enter unlock passphrase: ")) {
|
|
char, err = terminal.ReadByte()
|
|
require.NoError(t, err, "secret %v did not ask on the terminal: %s",
|
|
args, shown)
|
|
|
|
shown = append(shown, char)
|
|
}
|
|
|
|
_, err = ptmx.WriteString(testPassphrase + "\n")
|
|
require.NoError(t, err)
|
|
|
|
// The read ends once the command has exited and so closed the terminal.
|
|
rest, _ := io.ReadAll(terminal)
|
|
|
|
require.NoError(t, cmd.Wait(), "secret %v: %s%s", args, shown, rest)
|
|
|
|
return stdout.String()
|
|
}
|