Add tests for internal/storage: URL parsing, backends, shared conformance suite (closes #66)

internal/storage, the package that parses store URLs and selects the backend, had no tests.

Adds table-driven tests for URL parsing (each scheme, query parameters, malformed input, unknown scheme, backend type chosen); one shared conformance suite for the Storer interface, run against the file backend in a temp directory and the s3 backend on the in-process harness internal/s3 already uses, so a new backend inherits it; and rclone construction and argument tests using its in-process local backend. A comment records that rclone data operations need a configured remote and are not unit-tested. No production code changed and no defect surfaced.

model: claude-opus-4-8 (implementation, review); claude-fable-5-1 (merge)

internal/storage/s3_test.go

@@ -13,18 +13,23 @@ import (
 	"sneak.berlin/go/vaultik/internal/storage"
 )
 
-// TestS3StorerMissingKeyMapsToErrNotFound verifies that the s3 backend reports
-// a missing object as storage.ErrNotFound, matching the file and rclone
-// backends and the Storer contract. Without the mapping, Get and Stat leak the
-// raw SDK error and errors.Is(err, storage.ErrNotFound) is false.
+// s3TestBucket is the bucket created for each in-process S3 server.
+const s3TestBucket = "test-bucket"
+
+// newS3Storer builds an s3:// backend backed by a fresh in-process
+// S3 server. It reuses the same in-memory S3 harness (gofakes3 + s3mem
+// over httptest) that internal/s3 and the not-found regression test use,
+// so no new mock or dependency is introduced. Each call gets its own
+// server, bucket, and client, so the conformance suite's per-section
+// instances stay isolated.
 //
-//nolint:paralleltest // shares an in-process S3 server via t.Cleanup
-func TestS3StorerMissingKeyMapsToErrNotFound(t *testing.T) {
-	const bucket = "test-bucket"
+//nolint:ireturn // conformance runs against the Storer interface by design
+func newS3Storer(t *testing.T) storage.Storer {
+	t.Helper()
 
 	backend := s3mem.New()
 
-	err := backend.CreateBucket(bucket)
+	err := backend.CreateBucket(s3TestBucket)
 	if err != nil {
 		t.Fatalf("create bucket: %v", err)
 	}
@@ -32,11 +37,9 @@ func TestS3StorerMissingKeyMapsToErrNotFound(t *testing.T) {
 	srv := httptest.NewServer(gofakes3.New(backend).Server())
 	t.Cleanup(srv.Close)
 
-	ctx := context.Background()
-
-	client, err := s3.NewClient(ctx, s3.Config{
+	client, err := s3.NewClient(context.Background(), s3.Config{
 		Endpoint:        srv.URL,
-		Bucket:          bucket,
+		Bucket:          s3TestBucket,
 		AccessKeyID:     "test",
 		SecretAccessKey: "test",
 		Region:          "us-east-1",
@@ -45,9 +48,28 @@ func TestS3StorerMissingKeyMapsToErrNotFound(t *testing.T) {
 		t.Fatalf("new client: %v", err)
 	}
 
-	storer := storage.NewS3Storer(client)
+	return storage.NewS3Storer(client)
+}
 
-	_, err = storer.Get(ctx, "does-not-exist")
+// TestS3Storer runs the shared Storer contract against the s3:// backend,
+// so it is held to the same round-trip, list, delete, and not-found
+// behaviour as the file:// backend.
+func TestS3Storer(t *testing.T) {
+	t.Parallel()
+	runStorerConformance(t, newS3Storer)
+}
+
+// TestS3StorerMissingKeyMapsToErrNotFound pins the specific contract that a
+// missing object surfaces as storage.ErrNotFound rather than the raw AWS SDK
+// error. Without the mapping, errors.Is(err, storage.ErrNotFound) is false on
+// s3 and callers would branch differently per backend.
+func TestS3StorerMissingKeyMapsToErrNotFound(t *testing.T) {
+	t.Parallel()
+
+	storer := newS3Storer(t)
+	ctx := context.Background()
+
+	_, err := storer.Get(ctx, "does-not-exist")
 	if !errors.Is(err, storage.ErrNotFound) {
 		t.Errorf("Get on missing key: got %v, want ErrNotFound", err)
 	}