clawbot
5a0da6da12
check / check (push) Failing after 35m29s
The default config backed up /Applications on every system. That directory exists only on macOS, so on Linux the first snapshot create stopped on the missing path. config init now writes the apps snapshot only when runtime.GOOS is darwin; the macOS file is unchanged. Model: opus-5-5 (implementation, review); opus-5-5 (merge)
715 lines
20 KiB
Go
715 lines
20 KiB
Go
package cli //nolint:testpackage // exercises unexported yamlPathGet/yamlPathSet
|
|
|
|
import (
|
|
"bytes"
|
|
"os"
|
|
"path/filepath"
|
|
"strconv"
|
|
"strings"
|
|
"testing"
|
|
|
|
"gopkg.in/yaml.v3"
|
|
"sneak.berlin/go/vaultik/internal/config"
|
|
"sneak.berlin/go/vaultik/internal/ui"
|
|
)
|
|
|
|
// TestDefaultConfigParsesOnMacOS ensures the config `config init` writes on
|
|
// macOS is valid YAML that unmarshals into the Config struct with the
|
|
// expected snapshots.
|
|
func TestDefaultConfigParsesOnMacOS(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
var cfg config.Config
|
|
|
|
err := yaml.Unmarshal([]byte(defaultConfigText("darwin")), &cfg)
|
|
if err != nil {
|
|
t.Fatalf("default config template is not valid YAML: %v", err)
|
|
}
|
|
|
|
// A placeholder recipient would fail config.Load, so the template
|
|
// leaves the list empty.
|
|
if len(cfg.AgeRecipients) != 0 {
|
|
t.Errorf("expected no age recipients, got %d", len(cfg.AgeRecipients))
|
|
}
|
|
|
|
home, ok := cfg.Snapshots["home"]
|
|
if !ok {
|
|
t.Fatal("expected 'home' snapshot in default config")
|
|
}
|
|
|
|
if len(home.Paths) == 0 {
|
|
t.Error("home snapshot should have at least one path")
|
|
}
|
|
|
|
if len(home.Exclude) == 0 {
|
|
t.Error("home snapshot should have exclude patterns")
|
|
}
|
|
|
|
apps, ok := cfg.Snapshots["apps"]
|
|
if !ok {
|
|
t.Fatal("expected 'apps' snapshot in default config")
|
|
}
|
|
|
|
if len(apps.Paths) != 1 || apps.Paths[0] != "/Applications" {
|
|
t.Errorf("apps snapshot should back up /Applications, got %v", apps.Paths)
|
|
}
|
|
|
|
if len(apps.Exclude) == 0 {
|
|
t.Error("apps snapshot should have exclude patterns")
|
|
}
|
|
}
|
|
|
|
// TestDefaultConfigOnLinux checks that the config `config init` writes on
|
|
// Linux loads with its home snapshot and without the apps snapshot, whose
|
|
// /Applications exists only on macOS.
|
|
func TestDefaultConfigOnLinux(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
path := filepath.Join(t.TempDir(), "config.yml")
|
|
|
|
err := os.WriteFile(path, []byte(defaultConfigText("linux")), configFileMode)
|
|
if err != nil {
|
|
t.Fatalf("write config: %v", err)
|
|
}
|
|
|
|
err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
|
|
path, "storage_url", "file:///mnt/backups")
|
|
if err != nil {
|
|
t.Fatalf("config set storage_url: %v", err)
|
|
}
|
|
|
|
cfg, err := config.Load(path)
|
|
if err != nil {
|
|
t.Fatalf("config.Load: %v", err)
|
|
}
|
|
|
|
if _, ok := cfg.Snapshots["home"]; !ok {
|
|
t.Error("expected 'home' snapshot in the Linux default config")
|
|
}
|
|
|
|
if _, ok := cfg.Snapshots["apps"]; ok {
|
|
t.Error("the Linux default config should have no 'apps' snapshot")
|
|
}
|
|
}
|
|
|
|
// testRecipient is a valid age public key.
|
|
const testRecipient = "age1278m9q7dp3chsh2dcy82qk27v047zywyvtxwnj4cvt0z65jw6a7q5dqhfj"
|
|
|
|
// TestConfigSetRecipientOnFreshConfig follows the README quickstart: on the
|
|
// file `config init` writes, `config set age_recipients.0` and
|
|
// `config set storage_url` give a config that loads with that recipient.
|
|
// Neither is refused, although the config does not load until both are set;
|
|
// once it loads, a recipient that is not a valid key is.
|
|
func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
path := filepath.Join(t.TempDir(), "config.yml")
|
|
|
|
err := os.WriteFile(path, []byte(defaultConfigText(macOS)), configFileMode)
|
|
if err != nil {
|
|
t.Fatalf("write config: %v", err)
|
|
}
|
|
|
|
out := ui.NewWithColor(&bytes.Buffer{}, false)
|
|
|
|
err = writeConfigSet(out, path, "age_recipients.0", testRecipient)
|
|
if err != nil {
|
|
t.Fatalf("config set age_recipients.0: %v", err)
|
|
}
|
|
|
|
err = writeConfigSet(out, path, "storage_url", "file:///mnt/backups")
|
|
if err != nil {
|
|
t.Fatalf("config set storage_url: %v", err)
|
|
}
|
|
|
|
cfg, err := config.Load(path)
|
|
if err != nil {
|
|
t.Fatalf("config.Load: %v", err)
|
|
}
|
|
|
|
if len(cfg.AgeRecipients) != 1 || cfg.AgeRecipients[0] != testRecipient {
|
|
t.Errorf("age_recipients = %v, want [%s]", cfg.AgeRecipients, testRecipient)
|
|
}
|
|
|
|
err = writeConfigSet(out, path, "age_recipients.0", "notakey")
|
|
if err == nil || !strings.Contains(err.Error(), "not a valid recipient") {
|
|
t.Errorf("config set age_recipients.0 notakey gives error %v, "+
|
|
"want one saying it is not a valid recipient", err)
|
|
}
|
|
|
|
_, err = config.Load(path)
|
|
if err != nil {
|
|
t.Errorf("config.Load after the refused change: %v", err)
|
|
}
|
|
}
|
|
|
|
// configWithoutRecipients loads, but has no age_recipients key and no
|
|
// snapshot named work.
|
|
const configWithoutRecipients = `storage_url: file:///mnt/backups
|
|
snapshots:
|
|
home:
|
|
paths:
|
|
- "~"
|
|
`
|
|
|
|
// configWithUnsetReference loads only where VAULTIK_TEST_UNSET_SECRET is
|
|
// set, as a backup job's environment might set it. No test sets it.
|
|
const configWithUnsetReference = configWithoutRecipients + `s3:
|
|
secret_access_key: ${ENV:VAULTIK_TEST_UNSET_SECRET}
|
|
`
|
|
|
|
// configWithLevelReference returns configWithoutRecipients with a ${FILE:...}
|
|
// reference on compression_level to a file holding 9, so that the config
|
|
// loads once the reference is filled in.
|
|
func configWithLevelReference(t *testing.T) string {
|
|
t.Helper()
|
|
|
|
levelPath := filepath.Join(t.TempDir(), "level")
|
|
|
|
err := os.WriteFile(levelPath, []byte("9"), configFileMode)
|
|
if err != nil {
|
|
t.Fatalf("write level: %v", err)
|
|
}
|
|
|
|
return configWithoutRecipients +
|
|
"compression_level: ${FILE:" + levelPath + "}\n"
|
|
}
|
|
|
|
// TestConfigSetIndexUnderMissingKey checks that a list index under a key
|
|
// the file does not have creates a list, and that the result loads.
|
|
func TestConfigSetIndexUnderMissingKey(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
tests := []struct {
|
|
key string
|
|
value string
|
|
field func(cfg *config.Config) []string
|
|
}{
|
|
{"age_recipients.0", testRecipient,
|
|
func(cfg *config.Config) []string { return cfg.AgeRecipients }},
|
|
{"snapshots.work.paths.0", "/srv/work",
|
|
func(cfg *config.Config) []string { return cfg.Snapshots["work"].Paths }},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.key, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
path := filepath.Join(t.TempDir(), "config.yml")
|
|
|
|
err := os.WriteFile(path, []byte(configWithoutRecipients), configFileMode)
|
|
if err != nil {
|
|
t.Fatalf("write config: %v", err)
|
|
}
|
|
|
|
err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
|
|
path, tt.key, tt.value)
|
|
if err != nil {
|
|
t.Fatalf("config set %s: %v", tt.key, err)
|
|
}
|
|
|
|
cfg, err := config.Load(path)
|
|
if err != nil {
|
|
t.Fatalf("config.Load: %v", err)
|
|
}
|
|
|
|
got := tt.field(cfg)
|
|
if len(got) != 1 || got[0] != tt.value {
|
|
t.Errorf("%s gives %v, want [%s]", tt.key, got, tt.value)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestConfigSetKeepsFileThatWouldNotLoad checks that config set refuses a
|
|
// change after which the config would not load, with an error giving the
|
|
// reason, and leaves the file as it was. On the file `config init` writes,
|
|
// which does not load until storage_url is set, and on one that cannot be
|
|
// read here, only a value of the wrong type is refused.
|
|
func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
levelReference := configWithLevelReference(t)
|
|
|
|
tests := []struct {
|
|
config string
|
|
key string
|
|
value string
|
|
reason string
|
|
}{
|
|
// Index 1 of the empty list the missing key gives.
|
|
{configWithoutRecipients, "age_recipients.1", testRecipient,
|
|
"index out of range"},
|
|
// A list set to a single value.
|
|
{configWithoutRecipients, "snapshots.home.paths", "/srv",
|
|
"into []string"},
|
|
{configWithoutRecipients, "chunk_size", "fast",
|
|
"invalid size format"},
|
|
// Values of the right type that fail validation.
|
|
{configWithoutRecipients, "compression_level", "99",
|
|
"compression_level must be between 1 and 19"},
|
|
{configWithoutRecipients, "chunk_size", "1KB",
|
|
"chunk_size must be at least 1MB"},
|
|
// With its reference filled in, the config loads.
|
|
{levelReference, "blob_size_limit", "1MB",
|
|
"blob_size_limit must be at least"},
|
|
// The type check on a config that does not load yet.
|
|
{defaultConfigText(macOS), "snapshots.apps.paths", "/srv",
|
|
"into []string"},
|
|
// The type check on a config that cannot be read here.
|
|
{configWithUnsetReference, "snapshots.home.paths", "/x",
|
|
"cannot unmarshal !!str `/x`"},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.key+" "+tt.value, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
path := filepath.Join(t.TempDir(), "config.yml")
|
|
|
|
err := os.WriteFile(path, []byte(tt.config), configFileMode)
|
|
if err != nil {
|
|
t.Fatalf("write config: %v", err)
|
|
}
|
|
|
|
err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
|
|
path, tt.key, tt.value)
|
|
if err == nil || !strings.Contains(err.Error(), tt.reason) {
|
|
t.Errorf("config set %s %s gives error %v, want one saying %q",
|
|
tt.key, tt.value, err, tt.reason)
|
|
}
|
|
|
|
data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
|
|
if err != nil {
|
|
t.Fatalf("read config: %v", err)
|
|
}
|
|
|
|
if string(data) != tt.config {
|
|
t.Errorf("config set %s changed the file to:\n%s",
|
|
tt.key, data)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestConfigSetRefusesOnlyItsOwnFailure checks that setting another key
|
|
// works on a config with a ${...} reference on compression_level, which
|
|
// loads because loading fills the reference in, on one whose
|
|
// compression_level already fails to load, and on one with a reference
|
|
// that cannot be filled in here.
|
|
func TestConfigSetRefusesOnlyItsOwnFailure(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
configs := map[string]string{
|
|
"reference": configWithLevelReference(t),
|
|
"failing": configWithoutRecipients + "compression_level: fast\n",
|
|
"unset reference": configWithUnsetReference,
|
|
}
|
|
|
|
for name, configYAML := range configs {
|
|
t.Run(name, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
path := filepath.Join(t.TempDir(), "config.yml")
|
|
|
|
err := os.WriteFile(path, []byte(configYAML), configFileMode)
|
|
if err != nil {
|
|
t.Fatalf("write config: %v", err)
|
|
}
|
|
|
|
err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
|
|
path, "hostname", "myhost")
|
|
if err != nil {
|
|
t.Fatalf("config set hostname: %v", err)
|
|
}
|
|
|
|
data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
|
|
if err != nil {
|
|
t.Fatalf("read config: %v", err)
|
|
}
|
|
|
|
if !strings.Contains(string(data), "hostname: myhost") {
|
|
t.Errorf("config set hostname wrote:\n%s", data)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestConfigSetStringLooksLikeNumber sets string settings to values that
|
|
// YAML reads as numbers or booleans when they are unquoted, and checks that
|
|
// config.Load returns each one unchanged.
|
|
func TestConfigSetStringLooksLikeNumber(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
tests := []struct {
|
|
key string
|
|
value string
|
|
field func(cfg *config.Config) string
|
|
}{
|
|
{"s3.access_key_id", "00112233",
|
|
func(cfg *config.Config) string { return cfg.S3.AccessKeyID }},
|
|
{"s3.secret_access_key", "12345678901234567890123456789012",
|
|
func(cfg *config.Config) string { return cfg.S3.SecretAccessKey }},
|
|
{"hostname", "007",
|
|
func(cfg *config.Config) string { return cfg.Hostname }},
|
|
{"s3.prefix", "1e5",
|
|
func(cfg *config.Config) string { return cfg.S3.Prefix }},
|
|
{"s3.bucket", "true",
|
|
func(cfg *config.Config) string { return cfg.S3.Bucket }},
|
|
{"s3.region", "FALSE",
|
|
func(cfg *config.Config) string { return cfg.S3.Region }},
|
|
{"snapshots.home.exclude.0", "1.10",
|
|
func(cfg *config.Config) string { return cfg.Snapshots["home"].Exclude[0] }},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.key+"="+tt.value, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
cfg := loadAfterConfigSet(t, tt.key, tt.value)
|
|
|
|
got := tt.field(cfg)
|
|
if got != tt.value {
|
|
t.Errorf("%s = %q after config set %q", tt.key, got, tt.value)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestConfigSetNonUTF8Path checks that config set still accepts a value that
|
|
// is not valid UTF-8, such as a path with a Latin-1 file name, and that
|
|
// config.Load returns it unchanged.
|
|
func TestConfigSetNonUTF8Path(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const dir = "/srv/caf\xe9"
|
|
|
|
cfg := loadAfterConfigSet(t, "snapshots.home.paths.0", dir)
|
|
|
|
got := cfg.Snapshots["home"].Paths[0]
|
|
if got != dir {
|
|
t.Errorf("snapshots.home.paths.0 = %q, want %q", got, dir)
|
|
}
|
|
}
|
|
|
|
// TestConfigSetNumberStaysNumber checks that a number set for an integer
|
|
// setting is still read as a number, not as a quoted string.
|
|
func TestConfigSetNumberStaysNumber(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const level = 9
|
|
|
|
cfg := loadAfterConfigSet(t, "compression_level", strconv.Itoa(level))
|
|
|
|
if cfg.CompressionLevel != level {
|
|
t.Errorf("compression_level = %d, want %d", cfg.CompressionLevel, level)
|
|
}
|
|
}
|
|
|
|
// loadAfterConfigSet writes the file `config init` writes, sets storage_url
|
|
// to a local directory so that the file passes validation, applies
|
|
// `config set key value` and returns what config.Load reads back.
|
|
func loadAfterConfigSet(t *testing.T, key, value string) *config.Config {
|
|
t.Helper()
|
|
|
|
path := filepath.Join(t.TempDir(), "config.yml")
|
|
|
|
err := os.WriteFile(path, []byte(defaultConfigText(macOS)), configFileMode)
|
|
if err != nil {
|
|
t.Fatalf("write config: %v", err)
|
|
}
|
|
|
|
out := ui.NewWithColor(&bytes.Buffer{}, false)
|
|
|
|
err = writeConfigSet(out, path, "storage_url", "file:///mnt/backups")
|
|
if err != nil {
|
|
t.Fatalf("config set storage_url: %v", err)
|
|
}
|
|
|
|
err = writeConfigSet(out, path, key, value)
|
|
if err != nil {
|
|
t.Fatalf("config set %s: %v", key, err)
|
|
}
|
|
|
|
cfg, err := config.Load(path)
|
|
if err != nil {
|
|
t.Fatalf("config.Load: %v", err)
|
|
}
|
|
|
|
return cfg
|
|
}
|
|
|
|
const testYAML = `# top comment
|
|
compression_level: 3
|
|
age_recipients:
|
|
- age1aaa
|
|
s3:
|
|
bucket: oldbucket # inline comment
|
|
region: us-east-1
|
|
snapshots:
|
|
home:
|
|
paths:
|
|
- "~"
|
|
`
|
|
|
|
func parseTestYAML(t *testing.T) *yaml.Node {
|
|
t.Helper()
|
|
|
|
var root yaml.Node
|
|
|
|
err := yaml.Unmarshal([]byte(testYAML), &root)
|
|
if err != nil {
|
|
t.Fatalf("parsing test yaml: %v", err)
|
|
}
|
|
|
|
return &root
|
|
}
|
|
|
|
func TestYAMLPathGet(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
root := parseTestYAML(t)
|
|
|
|
tests := []struct {
|
|
path string
|
|
want string
|
|
err bool
|
|
}{
|
|
{"compression_level", "3", false},
|
|
{"s3.bucket", "oldbucket", false},
|
|
{"s3.region", "us-east-1", false},
|
|
{"age_recipients.0", "age1aaa", false},
|
|
{"age_recipients.5", "", true},
|
|
{"age_recipients.notanumber", "", true},
|
|
{"s3.nonexistent", "", true},
|
|
{"nonexistent", "", true},
|
|
{"compression_level.sub", "", true},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.path, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
node, err := yamlPathGet(root, splitPath(tt.path))
|
|
if tt.err {
|
|
if err == nil {
|
|
t.Fatalf("expected error for %q", tt.path)
|
|
}
|
|
|
|
return
|
|
}
|
|
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
|
|
if node.Value != tt.want {
|
|
t.Errorf("get %q = %q, want %q", tt.path, node.Value, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestYAMLPathSet(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
root := parseTestYAML(t)
|
|
|
|
// Overwrite existing nested value
|
|
err := yamlPathSet(root, splitPath("s3.bucket"), "newbucket")
|
|
if err != nil {
|
|
t.Fatalf("set s3.bucket: %v", err)
|
|
}
|
|
|
|
// Create new nested key with intermediate map
|
|
err = yamlPathSet(root, splitPath("s3.endpoint"), "s3.example.com")
|
|
if err != nil {
|
|
t.Fatalf("set s3.endpoint: %v", err)
|
|
}
|
|
|
|
err = yamlPathSet(root, splitPath("newmap.newkey"), "val")
|
|
if err != nil {
|
|
t.Fatalf("set newmap.newkey: %v", err)
|
|
}
|
|
|
|
// Overwrite a sequence element and append a new one
|
|
err = yamlPathSet(root, splitPath("age_recipients.0"), "age1bbb")
|
|
if err != nil {
|
|
t.Fatalf("set age_recipients.0: %v", err)
|
|
}
|
|
|
|
err = yamlPathSet(root, splitPath("age_recipients.1"), "age1ccc")
|
|
if err != nil {
|
|
t.Fatalf("append age_recipients.1: %v", err)
|
|
}
|
|
|
|
err = yamlPathSet(root, splitPath("age_recipients.5"), "age1ddd")
|
|
if err == nil {
|
|
t.Error("expected out-of-range append to fail")
|
|
}
|
|
|
|
// Round-trip and verify values + comment preservation
|
|
out, err := yaml.Marshal(root)
|
|
if err != nil {
|
|
t.Fatalf("marshal: %v", err)
|
|
}
|
|
|
|
text := string(out)
|
|
|
|
wants := []string{
|
|
"newbucket", "s3.example.com", "newkey: val",
|
|
"# top comment", "# inline comment", "age1bbb", "age1ccc",
|
|
}
|
|
for _, want := range wants {
|
|
if !contains(text, want) {
|
|
t.Errorf("round-tripped YAML missing %q:\n%s", want, text)
|
|
}
|
|
}
|
|
|
|
got, err := yamlPathGet(root, splitPath("s3.bucket"))
|
|
if err != nil {
|
|
t.Fatalf("get after set: %v", err)
|
|
}
|
|
|
|
if got.Value != "newbucket" {
|
|
t.Errorf("s3.bucket = %q after set, want newbucket", got.Value)
|
|
}
|
|
}
|
|
|
|
// TestConfigSetPreservesFormatting asserts the `config set` write path
|
|
// (marshalConfigYAML) round-trips a 2-space-indented file without reindenting
|
|
// it to yaml.Marshal's 4-space default, and keeps comments.
|
|
func TestConfigSetPreservesFormatting(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
root := parseTestYAML(t)
|
|
|
|
err := yamlPathSet(root, splitPath("s3.bucket"), "newbucket")
|
|
if err != nil {
|
|
t.Fatalf("set s3.bucket: %v", err)
|
|
}
|
|
|
|
out, err := marshalConfigYAML(root)
|
|
if err != nil {
|
|
t.Fatalf("marshal: %v", err)
|
|
}
|
|
|
|
text := string(out)
|
|
|
|
for _, want := range []string{"# top comment", "# inline comment"} {
|
|
if !contains(text, want) {
|
|
t.Errorf("round-tripped YAML dropped comment %q:\n%s", want, text)
|
|
}
|
|
}
|
|
|
|
// Nested map keys stay at 2-space indent; the bug reindented them to 4.
|
|
if !contains(text, "\n bucket: newbucket") {
|
|
t.Errorf("expected 2-space indent for s3.bucket, got:\n%s", text)
|
|
}
|
|
|
|
if contains(text, "\n bucket:") {
|
|
t.Errorf("s3.bucket reindented to 4 spaces:\n%s", text)
|
|
}
|
|
|
|
// Sequence items under a key also stay at 2 spaces.
|
|
if !contains(text, "\n - age1aaa") {
|
|
t.Errorf("expected 2-space indent for sequence item, got:\n%s", text)
|
|
}
|
|
}
|
|
|
|
// TestWriteConfigSetHidesSecret checks that setting a secret key prints
|
|
// only the key name, never the value, to the confirmation output.
|
|
func TestWriteConfigSetHidesSecret(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const secret = "SUPERSECRETVALUE"
|
|
|
|
path := filepath.Join(t.TempDir(), "config.yaml")
|
|
|
|
err := os.WriteFile(path, []byte("version: 1\n"), 0o600)
|
|
if err != nil {
|
|
t.Fatalf("seed config: %v", err)
|
|
}
|
|
|
|
var buf bytes.Buffer
|
|
|
|
err = writeConfigSet(ui.NewWithColor(&buf, false), path,
|
|
"s3.secret_access_key", secret)
|
|
if err != nil {
|
|
t.Fatalf("writeConfigSet: %v", err)
|
|
}
|
|
|
|
if strings.Contains(buf.String(), secret) {
|
|
t.Errorf("output echoed the secret value: %q", buf.String())
|
|
}
|
|
|
|
if !strings.Contains(buf.String(), "s3.secret_access_key") {
|
|
t.Errorf("output did not confirm the key name: %q", buf.String())
|
|
}
|
|
}
|
|
|
|
// TestWriteConfigSetTightensMode checks that a pre-existing group- or
|
|
// world-readable config is tightened to owner-only after a set, since
|
|
// os.WriteFile leaves an existing file's mode untouched.
|
|
func TestWriteConfigSetTightensMode(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
path := filepath.Join(t.TempDir(), "config.yaml")
|
|
|
|
// Seed a world-readable config; the loose mode is the condition under
|
|
// test, so gosec's G306 is expected here.
|
|
err := os.WriteFile(path, []byte("version: 1\n"), 0o644) //nolint:gosec // G306
|
|
if err != nil {
|
|
t.Fatalf("seed config: %v", err)
|
|
}
|
|
|
|
var buf bytes.Buffer
|
|
|
|
err = writeConfigSet(ui.NewWithColor(&buf, false), path,
|
|
"compression_level", "9")
|
|
if err != nil {
|
|
t.Fatalf("writeConfigSet: %v", err)
|
|
}
|
|
|
|
info, err := os.Stat(path)
|
|
if err != nil {
|
|
t.Fatalf("stat config: %v", err)
|
|
}
|
|
|
|
if info.Mode().Perm() != 0o600 {
|
|
t.Errorf("config mode = %04o, want 0600", info.Mode().Perm())
|
|
}
|
|
}
|
|
|
|
// TestConfigEditEditorWithArgument checks that an $EDITOR carrying an
|
|
// argument works and that a config path with a space reaches it whole.
|
|
// The "editor" is cp with the replacement file as its argument, so the
|
|
// config ends up with the replacement's content only if both arrived.
|
|
func TestConfigEditEditorWithArgument(t *testing.T) {
|
|
dir := t.TempDir()
|
|
path := seedFile(t, dir, "my config.yml", "compression_level: 3\n")
|
|
edited := seedFile(t, dir, "edited.yml", "compression_level: 9\n")
|
|
|
|
setRootFlags(t, RootFlags{ConfigPath: path})
|
|
t.Setenv("EDITOR", "cp '"+edited+"'")
|
|
|
|
mustExecute(t, newConfigEditCommand())
|
|
|
|
data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
|
|
if err != nil {
|
|
t.Fatalf("reading config back: %v", err)
|
|
}
|
|
|
|
if string(data) != "compression_level: 9\n" {
|
|
t.Errorf("config after edit = %q, want the edited content", data)
|
|
}
|
|
}
|
|
|
|
func splitPath(s string) []string {
|
|
return strings.Split(s, ".")
|
|
}
|
|
|
|
func contains(haystack, needle string) bool {
|
|
return strings.Contains(haystack, needle)
|
|
}
|