secret/internal/secret/validation_darwin_test.go

//go:build darwin

package secret

import (
	"testing"
)

func TestValidateKeychainItemName(t *testing.T) {
	tests := []struct {
		name     string
		itemName string
		wantErr  bool
	}{
		// Valid cases
		{
			name:     "valid simple name",
			itemName: "my-secret-key",
			wantErr:  false,
		},
		{
			name:     "valid name with dots",
			itemName: "com.example.app.key",
			wantErr:  false,
		},
		{
			name:     "valid name with underscores",
			itemName: "my_secret_key_123",
			wantErr:  false,
		},
		{
			name:     "valid alphanumeric",
			itemName: "Secret123Key",
			wantErr:  false,
		},
		{
			name:     "valid with hyphen at start",
			itemName: "-my-key",
			wantErr:  false,
		},
		{
			name:     "valid with dot at start",
			itemName: ".hidden-key",
			wantErr:  false,
		},

		// Invalid cases
		{
			name:     "empty item name",
			itemName: "",
			wantErr:  true,
		},
		{
			name:     "item name with spaces",
			itemName: "my secret key",
			wantErr:  true,
		},
		{
			name:     "item name with semicolon",
			itemName: "key;rm -rf /",
			wantErr:  true,
		},
		{
			name:     "item name with pipe",
			itemName: "key|cat /etc/passwd",
			wantErr:  true,
		},
		{
			name:     "item name with backticks",
			itemName: "key`whoami`",
			wantErr:  true,
		},
		{
			name:     "item name with dollar sign",
			itemName: "key$(whoami)",
			wantErr:  true,
		},
		{
			name:     "item name with quotes",
			itemName: "key\"name",
			wantErr:  true,
		},
		{
			name:     "item name with single quotes",
			itemName: "key'name",
			wantErr:  true,
		},
		{
			name:     "item name with backslash",
			itemName: "key\\name",
			wantErr:  true,
		},
		{
			name:     "item name with newline",
			itemName: "key\nname",
			wantErr:  true,
		},
		{
			name:     "item name with carriage return",
			itemName: "key\rname",
			wantErr:  true,
		},
		{
			name:     "item name with ampersand",
			itemName: "key&echo test",
			wantErr:  true,
		},
		{
			name:     "item name with redirect",
			itemName: "key>/tmp/test",
			wantErr:  true,
		},
		{
			name:     "item name with null byte",
			itemName: "key\x00name",
			wantErr:  true,
		},
		{
			name:     "item name with parentheses",
			itemName: "key(test)",
			wantErr:  true,
		},
		{
			name:     "item name with brackets",
			itemName: "key[test]",
			wantErr:  true,
		},
		{
			name:     "item name with asterisk",
			itemName: "key*",
			wantErr:  true,
		},
		{
			name:     "item name with question mark",
			itemName: "key?",
			wantErr:  true,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			err := validateKeychainItemName(tt.itemName)
			if (err != nil) != tt.wantErr {
				t.Errorf("validateKeychainItemName() error = %v, wantErr %v", err, tt.wantErr)
			}
		})
	}
}