vaultik/internal/cli/config_test.go

package cli //nolint:testpackage // exercises unexported yamlPathGet/yamlPathSet

import (
	"bytes"
	"errors"
	"os"
	"path/filepath"
	"strconv"
	"strings"
	"testing"

	"gopkg.in/yaml.v3"
	"sneak.berlin/go/vaultik/internal/config"
	"sneak.berlin/go/vaultik/internal/ui"
)

// TestDefaultConfigParsesOnMacOS ensures the config `config init` writes on
// macOS is valid YAML that unmarshals into the Config struct with the
// expected snapshots.
func TestDefaultConfigParsesOnMacOS(t *testing.T) {
	t.Parallel()

	var cfg config.Config

	err := yaml.Unmarshal([]byte(defaultConfigText("darwin")), &cfg)
	if err != nil {
		t.Fatalf("default config template is not valid YAML: %v", err)
	}

	// A placeholder recipient would fail config.Load, so the template
	// leaves the list empty.
	if len(cfg.AgeRecipients) != 0 {
		t.Errorf("expected no age recipients, got %d", len(cfg.AgeRecipients))
	}

	home, ok := cfg.Snapshots["home"]
	if !ok {
		t.Fatal("expected 'home' snapshot in default config")
	}

	if len(home.Paths) == 0 {
		t.Error("home snapshot should have at least one path")
	}

	if len(home.Exclude) == 0 {
		t.Error("home snapshot should have exclude patterns")
	}

	apps, ok := cfg.Snapshots["apps"]
	if !ok {
		t.Fatal("expected 'apps' snapshot in default config")
	}

	if len(apps.Paths) != 1 || apps.Paths[0] != "/Applications" {
		t.Errorf("apps snapshot should back up /Applications, got %v", apps.Paths)
	}

	if len(apps.Exclude) == 0 {
		t.Error("apps snapshot should have exclude patterns")
	}
}

// TestDefaultConfigOnLinux checks that the config `config init` writes on
// Linux loads with its home snapshot and without the apps snapshot, whose
// /Applications exists only on macOS.
func TestDefaultConfigOnLinux(t *testing.T) {
	t.Parallel()

	path := filepath.Join(t.TempDir(), "config.yml")

	err := os.WriteFile(path, []byte(defaultConfigText("linux")), configFileMode)
	if err != nil {
		t.Fatalf("write config: %v", err)
	}

	err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
		path, "storage_url", "file:///mnt/backups")
	if err != nil {
		t.Fatalf("config set storage_url: %v", err)
	}

	cfg, err := config.Load(path)
	if err != nil {
		t.Fatalf("config.Load: %v", err)
	}

	if _, ok := cfg.Snapshots["home"]; !ok {
		t.Error("expected 'home' snapshot in the Linux default config")
	}

	if _, ok := cfg.Snapshots["apps"]; ok {
		t.Error("the Linux default config should have no 'apps' snapshot")
	}
}

// testRecipient is a valid age public key.
const testRecipient = "age1278m9q7dp3chsh2dcy82qk27v047zywyvtxwnj4cvt0z65jw6a7q5dqhfj"

// TestConfigSetRecipientOnFreshConfig follows the README quickstart: on the
// file `config init` writes, `config set age_recipients.0` and
// `config set storage_url` give a config that loads with that recipient.
// Neither is refused, although the config does not load until both are set;
// once it loads, a recipient that is not a valid key is.
func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
	t.Parallel()

	path := filepath.Join(t.TempDir(), "config.yml")

	err := os.WriteFile(path, []byte(defaultConfigText(macOS)), configFileMode)
	if err != nil {
		t.Fatalf("write config: %v", err)
	}

	out := ui.NewWithColor(&bytes.Buffer{}, false)

	err = writeConfigSet(out, path, "age_recipients.0", testRecipient)
	if err != nil {
		t.Fatalf("config set age_recipients.0: %v", err)
	}

	err = writeConfigSet(out, path, "storage_url", "file:///mnt/backups")
	if err != nil {
		t.Fatalf("config set storage_url: %v", err)
	}

	cfg, err := config.Load(path)
	if err != nil {
		t.Fatalf("config.Load: %v", err)
	}

	if len(cfg.AgeRecipients) != 1 || cfg.AgeRecipients[0] != testRecipient {
		t.Errorf("age_recipients = %v, want [%s]", cfg.AgeRecipients, testRecipient)
	}

	err = writeConfigSet(out, path, "age_recipients.0", "notakey")
	if err == nil || !strings.Contains(err.Error(), "not a valid recipient") {
		t.Errorf("config set age_recipients.0 notakey gives error %v, "+
			"want one saying it is not a valid recipient", err)
	}

	_, err = config.Load(path)
	if err != nil {
		t.Errorf("config.Load after the refused change: %v", err)
	}
}

// configWithoutRecipients loads, but has no age_recipients key and no
// snapshot named work.
const configWithoutRecipients = `storage_url: file:///mnt/backups
snapshots:
  home:
    paths:
      - "~"
`

// testS3URL is an S3 storage_url, which needs credentials to load.
const testS3URL = "s3://bucket/prefix?endpoint=https://s3.example.com"

// configWithS3Keys loads: its storage_url is testS3URL and both S3 keys are
// set.
const configWithS3Keys = storageURLKey + ": " + testS3URL + `
s3:
  access_key_id: AKIAEXAMPLE
  secret_access_key: example-secret
snapshots:
  home:
    paths:
      - "~"
`

// configWithUnsetReference loads only where VAULTIK_TEST_UNSET_SECRET is
// set, as a backup job's environment might set it. No test sets it.
const configWithUnsetReference = configWithoutRecipients + `s3:
  secret_access_key: ${ENV:VAULTIK_TEST_UNSET_SECRET}
`

// configWithLevelReference returns configWithoutRecipients with a ${FILE:...}
// reference on compression_level to a file holding 9, so that the config
// loads once the reference is filled in.
func configWithLevelReference(t *testing.T) string {
	t.Helper()

	levelPath := filepath.Join(t.TempDir(), "level")

	err := os.WriteFile(levelPath, []byte("9"), configFileMode)
	if err != nil {
		t.Fatalf("write level: %v", err)
	}

	return configWithoutRecipients +
		"compression_level: ${FILE:" + levelPath + "}\n"
}

// TestConfigSetIndexUnderMissingKey checks that a list index under a key
// the file does not have creates a list, and that the result loads.
func TestConfigSetIndexUnderMissingKey(t *testing.T) {
	t.Parallel()

	tests := []struct {
		key   string
		value string
		field func(cfg *config.Config) []string
	}{
		{"age_recipients.0", testRecipient,
			func(cfg *config.Config) []string { return cfg.AgeRecipients }},
		{"snapshots.work.paths.0", "/srv/work",
			func(cfg *config.Config) []string { return cfg.Snapshots["work"].Paths }},
	}

	for _, tt := range tests {
		t.Run(tt.key, func(t *testing.T) {
			t.Parallel()

			path := filepath.Join(t.TempDir(), "config.yml")

			err := os.WriteFile(path, []byte(configWithoutRecipients), configFileMode)
			if err != nil {
				t.Fatalf("write config: %v", err)
			}

			err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
				path, tt.key, tt.value)
			if err != nil {
				t.Fatalf("config set %s: %v", tt.key, err)
			}

			cfg, err := config.Load(path)
			if err != nil {
				t.Fatalf("config.Load: %v", err)
			}

			got := tt.field(cfg)
			if len(got) != 1 || got[0] != tt.value {
				t.Errorf("%s gives %v, want [%s]", tt.key, got, tt.value)
			}
		})
	}
}

// TestConfigSetKeepsFileThatWouldNotLoad checks that config set refuses a
// change after which the config would not load, with an error giving the
// reason, and leaves the file as it was. On the file `config init` writes,
// which does not load until storage_url is set, and on one that cannot be
// read here, only an unknown key or a value of the wrong type is refused.
func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
	t.Parallel()

	levelReference := configWithLevelReference(t)

	tests := []struct {
		config string
		key    string
		value  string
		reason string
	}{
		// Keys that no setting has, on a config that loads and on one
		// that does not.
		{configWithoutRecipients, "nosuchkey", "1",
			`unknown config key "nosuchkey"`},
		{configWithoutRecipients, "snapshots.home.exlude", "/tmp",
			`unknown config key "snapshots.home.exlude"`},
		{defaultConfigText(macOS), "compression_lvl", "9",
			`unknown config key "compression_lvl"`},
		// Index 1 of the empty list the missing key gives.
		{configWithoutRecipients, "age_recipients.1", testRecipient,
			"index out of range"},
		// A list set to a single value.
		{configWithoutRecipients, "snapshots.home.paths", "/srv",
			"into []string"},
		{configWithoutRecipients, "chunk_size", "fast",
			`chunk_size: "fast" is not a size`},
		// Values of the right type that fail validation.
		{configWithoutRecipients, "compression_level", "99",
			"compression_level must be between 1 and 19"},
		{configWithoutRecipients, "chunk_size", "1KB",
			"chunk_size must be at least 1MB"},
		// An s3:// URL before its credentials names them.
		{configWithoutRecipients, storageURLKey, testS3URL,
			"s3.access_key_id is required for s3:// URLs; " +
				"set s3.access_key_id and s3.secret_access_key first"},
		{configWithoutRecipients + "s3:\n  access_key_id: AKIAEXAMPLE\n",
			storageURLKey, testS3URL,
			"s3.secret_access_key is required for s3:// URLs; " +
				"set s3.access_key_id and s3.secret_access_key first"},
		// With its reference filled in, the config loads.
		{levelReference, "blob_size_limit", "1MB",
			"blob_size_limit must be at least"},
		// The type check on a config that does not load yet.
		{defaultConfigText(macOS), "snapshots.apps.paths", "/srv",
			"into []string"},
		// The type check on a config that cannot be read here.
		{configWithUnsetReference, "snapshots.home.paths", "/x",
			"cannot unmarshal !!str `/x`"},
	}

	for _, tt := range tests {
		t.Run(tt.key+" "+tt.value, func(t *testing.T) {
			t.Parallel()

			path := filepath.Join(t.TempDir(), "config.yml")

			err := os.WriteFile(path, []byte(tt.config), configFileMode)
			if err != nil {
				t.Fatalf("write config: %v", err)
			}

			err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
				path, tt.key, tt.value)
			if err == nil || !strings.Contains(err.Error(), tt.reason) {
				t.Errorf("config set %s %s gives error %v, want one saying %q",
					tt.key, tt.value, err, tt.reason)
			}

			data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
			if err != nil {
				t.Fatalf("read config: %v", err)
			}

			if string(data) != tt.config {
				t.Errorf("config set %s changed the file to:\n%s",
					tt.key, data)
			}
		})
	}
}

// TestConfigSetRefusesOnlyItsOwnFailure checks that setting another key
// works on a config with a ${...} reference on compression_level, which
// loads because loading fills the reference in, on one whose
// compression_level already fails to load, and on one with a reference
// that cannot be filled in here.
func TestConfigSetRefusesOnlyItsOwnFailure(t *testing.T) {
	t.Parallel()

	configs := map[string]string{
		"reference":       configWithLevelReference(t),
		"failing":         configWithoutRecipients + "compression_level: fast\n",
		"unset reference": configWithUnsetReference,
	}

	for name, configYAML := range configs {
		t.Run(name, func(t *testing.T) {
			t.Parallel()

			path := filepath.Join(t.TempDir(), "config.yml")

			err := os.WriteFile(path, []byte(configYAML), configFileMode)
			if err != nil {
				t.Fatalf("write config: %v", err)
			}

			err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
				path, "hostname", "myhost")
			if err != nil {
				t.Fatalf("config set hostname: %v", err)
			}

			data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
			if err != nil {
				t.Fatalf("read config: %v", err)
			}

			if !strings.Contains(string(data), "hostname: myhost") {
				t.Errorf("config set hostname wrote:\n%s", data)
			}
		})
	}
}

// TestConfigSetS3KeysBeforeStorageURL checks that the order the refusal
// gives works on a config that loads with a file:// storage_url.
func TestConfigSetS3KeysBeforeStorageURL(t *testing.T) {
	t.Parallel()

	path := filepath.Join(t.TempDir(), "config.yml")

	err := os.WriteFile(path, []byte(configWithoutRecipients), configFileMode)
	if err != nil {
		t.Fatalf("write config: %v", err)
	}

	for _, set := range [][2]string{
		{"s3.access_key_id", "AKIAEXAMPLE"},
		{"s3.secret_access_key", "example-secret"},
		{storageURLKey, testS3URL},
	} {
		err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
			path, set[0], set[1])
		if err != nil {
			t.Fatalf("config set %s: %v", set[0], err)
		}
	}

	data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
	if err != nil {
		t.Fatalf("read config: %v", err)
	}

	if !strings.Contains(string(data), storageURLKey+": "+testS3URL) {
		t.Errorf("config set storage_url wrote:\n%s", data)
	}
}

// TestConfigSetRefusesClearingS3Key checks that clearing s3.access_key_id on
// a config with an s3:// storage_url is refused without saying to set the
// S3 keys first. That advice is only for a change to storage_url.
func TestConfigSetRefusesClearingS3Key(t *testing.T) {
	t.Parallel()

	const key = "s3.access_key_id"

	path := filepath.Join(t.TempDir(), "config.yml")

	err := os.WriteFile(path, []byte(configWithS3Keys), configFileMode)
	if err != nil {
		t.Fatalf("write config: %v", err)
	}

	err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false), path, key, "")
	if !errors.Is(err, errWouldNotLoad) {
		t.Errorf("clearing %s gives error %v, want one saying %q",
			key, err, errWouldNotLoad)
	}

	if errors.Is(err, errSetS3KeysFirst) {
		t.Errorf("clearing %s gives error %v, want one not saying %q",
			key, err, errSetS3KeysFirst)
	}

	data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
	if err != nil {
		t.Fatalf("read config: %v", err)
	}

	if string(data) != configWithS3Keys {
		t.Errorf("clearing %s changed the file to:\n%s", key, data)
	}
}

// TestConfigSetWritesEnvSection checks that config set writes a key under
// the top-level env section, whose keys are not settings, on a config that
// loads.
func TestConfigSetWritesEnvSection(t *testing.T) {
	const name = "VAULTIK_TEST_CONFIG_SET_ENV"

	// Loading the changed config sets the variable; t.Setenv restores it
	// after the test.
	t.Setenv(name, "")

	path := filepath.Join(t.TempDir(), "config.yml")

	err := os.WriteFile(path, []byte(configWithoutRecipients), configFileMode)
	if err != nil {
		t.Fatalf("write config: %v", err)
	}

	err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
		path, "env."+name, "value")
	if err != nil {
		t.Fatalf("config set env.%s: %v", name, err)
	}

	data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
	if err != nil {
		t.Fatalf("read config: %v", err)
	}

	if !strings.Contains(string(data), "env:\n  "+name+": value\n") {
		t.Errorf("config set env.%s wrote:\n%s", name, data)
	}
}

// TestConfigSetStringLooksLikeNumber sets string settings to values that
// YAML reads as numbers or booleans when they are unquoted, and checks that
// config.Load returns each one unchanged.
func TestConfigSetStringLooksLikeNumber(t *testing.T) {
	t.Parallel()

	tests := []struct {
		key   string
		value string
		field func(cfg *config.Config) string
	}{
		{"s3.access_key_id", "00112233",
			func(cfg *config.Config) string { return cfg.S3.AccessKeyID }},
		{"s3.secret_access_key", "12345678901234567890123456789012",
			func(cfg *config.Config) string { return cfg.S3.SecretAccessKey }},
		{"hostname", "007",
			func(cfg *config.Config) string { return cfg.Hostname }},
		{"s3.prefix", "1e5",
			func(cfg *config.Config) string { return cfg.S3.Prefix }},
		{"s3.bucket", "true",
			func(cfg *config.Config) string { return cfg.S3.Bucket }},
		{"s3.region", "FALSE",
			func(cfg *config.Config) string { return cfg.S3.Region }},
		{"snapshots.home.exclude.0", "1.10",
			func(cfg *config.Config) string { return cfg.Snapshots["home"].Exclude[0] }},
	}

	for _, tt := range tests {
		t.Run(tt.key+"="+tt.value, func(t *testing.T) {
			t.Parallel()

			cfg := loadAfterConfigSet(t, tt.key, tt.value)

			got := tt.field(cfg)
			if got != tt.value {
				t.Errorf("%s = %q after config set %q", tt.key, got, tt.value)
			}
		})
	}
}

// TestConfigSetNonUTF8Path checks that config set still accepts a value that
// is not valid UTF-8, such as a path with a Latin-1 file name, and that
// config.Load returns it unchanged.
func TestConfigSetNonUTF8Path(t *testing.T) {
	t.Parallel()

	const dir = "/srv/caf\xe9"

	cfg := loadAfterConfigSet(t, "snapshots.home.paths.0", dir)

	got := cfg.Snapshots["home"].Paths[0]
	if got != dir {
		t.Errorf("snapshots.home.paths.0 = %q, want %q", got, dir)
	}
}

// TestConfigSetNumberStaysNumber checks that a number set for an integer
// setting is still read as a number, not as a quoted string.
func TestConfigSetNumberStaysNumber(t *testing.T) {
	t.Parallel()

	const level = 9

	cfg := loadAfterConfigSet(t, "compression_level", strconv.Itoa(level))

	if cfg.CompressionLevel != level {
		t.Errorf("compression_level = %d, want %d", cfg.CompressionLevel, level)
	}
}

// loadAfterConfigSet writes the file `config init` writes, sets storage_url
// to a local directory so that the file passes validation, applies
// `config set key value` and returns what config.Load reads back.
func loadAfterConfigSet(t *testing.T, key, value string) *config.Config {
	t.Helper()

	path := filepath.Join(t.TempDir(), "config.yml")

	err := os.WriteFile(path, []byte(defaultConfigText(macOS)), configFileMode)
	if err != nil {
		t.Fatalf("write config: %v", err)
	}

	out := ui.NewWithColor(&bytes.Buffer{}, false)

	err = writeConfigSet(out, path, "storage_url", "file:///mnt/backups")
	if err != nil {
		t.Fatalf("config set storage_url: %v", err)
	}

	err = writeConfigSet(out, path, key, value)
	if err != nil {
		t.Fatalf("config set %s: %v", key, err)
	}

	cfg, err := config.Load(path)
	if err != nil {
		t.Fatalf("config.Load: %v", err)
	}

	return cfg
}

const testYAML = `# top comment
compression_level: 3
age_recipients:
  - age1aaa
s3:
  bucket: oldbucket # inline comment
  region: us-east-1
snapshots:
  home:
    paths:
      - "~"
`

func parseTestYAML(t *testing.T) *yaml.Node {
	t.Helper()

	var root yaml.Node

	err := yaml.Unmarshal([]byte(testYAML), &root)
	if err != nil {
		t.Fatalf("parsing test yaml: %v", err)
	}

	return &root
}

func TestYAMLPathGet(t *testing.T) {
	t.Parallel()

	root := parseTestYAML(t)

	tests := []struct {
		path string
		want string
		err  bool
	}{
		{"compression_level", "3", false},
		{"s3.bucket", "oldbucket", false},
		{"s3.region", "us-east-1", false},
		{"age_recipients.0", "age1aaa", false},
		{"age_recipients.5", "", true},
		{"age_recipients.notanumber", "", true},
		{"s3.nonexistent", "", true},
		{"nonexistent", "", true},
		{"compression_level.sub", "", true},
	}

	for _, tt := range tests {
		t.Run(tt.path, func(t *testing.T) {
			t.Parallel()

			node, err := yamlPathGet(root, splitPath(tt.path))
			if tt.err {
				if err == nil {
					t.Fatalf("expected error for %q", tt.path)
				}

				return
			}

			if err != nil {
				t.Fatalf("unexpected error: %v", err)
			}

			if node.Value != tt.want {
				t.Errorf("get %q = %q, want %q", tt.path, node.Value, tt.want)
			}
		})
	}
}

func TestYAMLPathSet(t *testing.T) {
	t.Parallel()

	root := parseTestYAML(t)

	// Overwrite existing nested value
	err := yamlPathSet(root, splitPath("s3.bucket"), "newbucket")
	if err != nil {
		t.Fatalf("set s3.bucket: %v", err)
	}

	// Create new nested key with intermediate map
	err = yamlPathSet(root, splitPath("s3.endpoint"), "s3.example.com")
	if err != nil {
		t.Fatalf("set s3.endpoint: %v", err)
	}

	err = yamlPathSet(root, splitPath("newmap.newkey"), "val")
	if err != nil {
		t.Fatalf("set newmap.newkey: %v", err)
	}

	// Overwrite a sequence element and append a new one
	err = yamlPathSet(root, splitPath("age_recipients.0"), "age1bbb")
	if err != nil {
		t.Fatalf("set age_recipients.0: %v", err)
	}

	err = yamlPathSet(root, splitPath("age_recipients.1"), "age1ccc")
	if err != nil {
		t.Fatalf("append age_recipients.1: %v", err)
	}

	err = yamlPathSet(root, splitPath("age_recipients.5"), "age1ddd")
	if err == nil {
		t.Error("expected out-of-range append to fail")
	}

	// Round-trip and verify values + comment preservation
	out, err := yaml.Marshal(root)
	if err != nil {
		t.Fatalf("marshal: %v", err)
	}

	text := string(out)

	wants := []string{
		"newbucket", "s3.example.com", "newkey: val",
		"# top comment", "# inline comment", "age1bbb", "age1ccc",
	}
	for _, want := range wants {
		if !contains(text, want) {
			t.Errorf("round-tripped YAML missing %q:\n%s", want, text)
		}
	}

	got, err := yamlPathGet(root, splitPath("s3.bucket"))
	if err != nil {
		t.Fatalf("get after set: %v", err)
	}

	if got.Value != "newbucket" {
		t.Errorf("s3.bucket = %q after set, want newbucket", got.Value)
	}
}

// TestConfigSetPreservesFormatting asserts the `config set` write path
// (marshalConfigYAML) round-trips a 2-space-indented file without reindenting
// it to yaml.Marshal's 4-space default, and keeps comments.
func TestConfigSetPreservesFormatting(t *testing.T) {
	t.Parallel()

	root := parseTestYAML(t)

	err := yamlPathSet(root, splitPath("s3.bucket"), "newbucket")
	if err != nil {
		t.Fatalf("set s3.bucket: %v", err)
	}

	out, err := marshalConfigYAML(root)
	if err != nil {
		t.Fatalf("marshal: %v", err)
	}

	text := string(out)

	for _, want := range []string{"# top comment", "# inline comment"} {
		if !contains(text, want) {
			t.Errorf("round-tripped YAML dropped comment %q:\n%s", want, text)
		}
	}

	// Nested map keys stay at 2-space indent; the bug reindented them to 4.
	if !contains(text, "\n  bucket: newbucket") {
		t.Errorf("expected 2-space indent for s3.bucket, got:\n%s", text)
	}

	if contains(text, "\n    bucket:") {
		t.Errorf("s3.bucket reindented to 4 spaces:\n%s", text)
	}

	// Sequence items under a key also stay at 2 spaces.
	if !contains(text, "\n  - age1aaa") {
		t.Errorf("expected 2-space indent for sequence item, got:\n%s", text)
	}
}

// TestWriteConfigSetHidesSecret checks that setting a secret key prints
// only the key name, never the value, to the confirmation output.
func TestWriteConfigSetHidesSecret(t *testing.T) {
	t.Parallel()

	const secret = "SUPERSECRETVALUE"

	path := filepath.Join(t.TempDir(), "config.yaml")

	err := os.WriteFile(path, []byte("version: 1\n"), 0o600)
	if err != nil {
		t.Fatalf("seed config: %v", err)
	}

	var buf bytes.Buffer

	err = writeConfigSet(ui.NewWithColor(&buf, false), path,
		"s3.secret_access_key", secret)
	if err != nil {
		t.Fatalf("writeConfigSet: %v", err)
	}

	if strings.Contains(buf.String(), secret) {
		t.Errorf("output echoed the secret value: %q", buf.String())
	}

	if !strings.Contains(buf.String(), "s3.secret_access_key") {
		t.Errorf("output did not confirm the key name: %q", buf.String())
	}
}

// TestWriteConfigSetTightensMode checks that a pre-existing group- or
// world-readable config is tightened to owner-only after a set, since
// os.WriteFile leaves an existing file's mode untouched.
func TestWriteConfigSetTightensMode(t *testing.T) {
	t.Parallel()

	path := filepath.Join(t.TempDir(), "config.yaml")

	// Seed a world-readable config; the loose mode is the condition under
	// test, so gosec's G306 is expected here.
	err := os.WriteFile(path, []byte("version: 1\n"), 0o644) //nolint:gosec // G306
	if err != nil {
		t.Fatalf("seed config: %v", err)
	}

	var buf bytes.Buffer

	err = writeConfigSet(ui.NewWithColor(&buf, false), path,
		"compression_level", "9")
	if err != nil {
		t.Fatalf("writeConfigSet: %v", err)
	}

	info, err := os.Stat(path)
	if err != nil {
		t.Fatalf("stat config: %v", err)
	}

	if info.Mode().Perm() != 0o600 {
		t.Errorf("config mode = %04o, want 0600", info.Mode().Perm())
	}
}

// TestConfigEditEditorWithArgument checks that an $EDITOR carrying an
// argument works and that a config path with a space reaches it whole.
// The "editor" is cp with the replacement file as its argument, so the
// config ends up with the replacement's content only if both arrived.
func TestConfigEditEditorWithArgument(t *testing.T) {
	dir := t.TempDir()
	path := seedFile(t, dir, "my config.yml", "compression_level: 3\n")
	edited := seedFile(t, dir, "edited.yml", "compression_level: 9\n")

	setRootFlags(t, RootFlags{ConfigPath: path})
	t.Setenv("EDITOR", "cp '"+edited+"'")

	mustExecute(t, newConfigEditCommand())

	data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
	if err != nil {
		t.Fatalf("reading config back: %v", err)
	}

	if string(data) != "compression_level: 9\n" {
		t.Errorf("config after edit = %q, want the edited content", data)
	}
}

func splitPath(s string) []string {
	return strings.Split(s, ".")
}

func contains(haystack, needle string) bool {
	return strings.Contains(haystack, needle)
}