vaultik/internal/cli/config_test.go

package cli //nolint:testpackage // exercises unexported yamlPathGet/yamlPathSet

import (
	"bytes"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"gopkg.in/yaml.v3"
	"sneak.berlin/go/vaultik/internal/config"
)

// TestDefaultConfigTemplateParses ensures the init template is valid YAML
// that unmarshals into the Config struct with the expected snapshots.
func TestDefaultConfigTemplateParses(t *testing.T) {
	t.Parallel()

	var cfg config.Config

	err := yaml.Unmarshal([]byte(defaultConfigTemplate), &cfg)
	if err != nil {
		t.Fatalf("default config template is not valid YAML: %v", err)
	}

	if len(cfg.AgeRecipients) != 1 {
		t.Errorf("expected 1 placeholder age recipient, got %d", len(cfg.AgeRecipients))
	}

	home, ok := cfg.Snapshots["home"]
	if !ok {
		t.Fatal("expected 'home' snapshot in default config")
	}

	if len(home.Paths) == 0 {
		t.Error("home snapshot should have at least one path")
	}

	if len(home.Exclude) == 0 {
		t.Error("home snapshot should have exclude patterns")
	}

	apps, ok := cfg.Snapshots["apps"]
	if !ok {
		t.Fatal("expected 'apps' snapshot in default config")
	}

	if len(apps.Paths) != 1 || apps.Paths[0] != "/Applications" {
		t.Errorf("apps snapshot should back up /Applications, got %v", apps.Paths)
	}

	if len(apps.Exclude) == 0 {
		t.Error("apps snapshot should have exclude patterns")
	}
}

const testYAML = `# top comment
compression_level: 3
age_recipients:
  - age1aaa
s3:
  bucket: oldbucket # inline comment
  region: us-east-1
snapshots:
  home:
    paths:
      - "~"
`

func parseTestYAML(t *testing.T) *yaml.Node {
	t.Helper()

	var root yaml.Node

	err := yaml.Unmarshal([]byte(testYAML), &root)
	if err != nil {
		t.Fatalf("parsing test yaml: %v", err)
	}

	return &root
}

func TestYAMLPathGet(t *testing.T) {
	t.Parallel()

	root := parseTestYAML(t)

	tests := []struct {
		path string
		want string
		err  bool
	}{
		{"compression_level", "3", false},
		{"s3.bucket", "oldbucket", false},
		{"s3.region", "us-east-1", false},
		{"age_recipients.0", "age1aaa", false},
		{"age_recipients.5", "", true},
		{"age_recipients.notanumber", "", true},
		{"s3.nonexistent", "", true},
		{"nonexistent", "", true},
		{"compression_level.sub", "", true},
	}

	for _, tt := range tests {
		t.Run(tt.path, func(t *testing.T) {
			t.Parallel()

			node, err := yamlPathGet(root, splitPath(tt.path))
			if tt.err {
				if err == nil {
					t.Fatalf("expected error for %q", tt.path)
				}

				return
			}

			if err != nil {
				t.Fatalf("unexpected error: %v", err)
			}

			if node.Value != tt.want {
				t.Errorf("get %q = %q, want %q", tt.path, node.Value, tt.want)
			}
		})
	}
}

func TestYAMLPathSet(t *testing.T) {
	t.Parallel()

	root := parseTestYAML(t)

	// Overwrite existing nested value
	err := yamlPathSet(root, splitPath("s3.bucket"), "newbucket")
	if err != nil {
		t.Fatalf("set s3.bucket: %v", err)
	}

	// Create new nested key with intermediate map
	err = yamlPathSet(root, splitPath("s3.endpoint"), "s3.example.com")
	if err != nil {
		t.Fatalf("set s3.endpoint: %v", err)
	}

	err = yamlPathSet(root, splitPath("newmap.newkey"), "val")
	if err != nil {
		t.Fatalf("set newmap.newkey: %v", err)
	}

	// Overwrite a sequence element and append a new one
	err = yamlPathSet(root, splitPath("age_recipients.0"), "age1bbb")
	if err != nil {
		t.Fatalf("set age_recipients.0: %v", err)
	}

	err = yamlPathSet(root, splitPath("age_recipients.1"), "age1ccc")
	if err != nil {
		t.Fatalf("append age_recipients.1: %v", err)
	}

	err = yamlPathSet(root, splitPath("age_recipients.5"), "age1ddd")
	if err == nil {
		t.Error("expected out-of-range append to fail")
	}

	// Round-trip and verify values + comment preservation
	out, err := yaml.Marshal(root)
	if err != nil {
		t.Fatalf("marshal: %v", err)
	}

	text := string(out)

	wants := []string{
		"newbucket", "s3.example.com", "newkey: val",
		"# top comment", "# inline comment", "age1bbb", "age1ccc",
	}
	for _, want := range wants {
		if !contains(text, want) {
			t.Errorf("round-tripped YAML missing %q:\n%s", want, text)
		}
	}

	got, err := yamlPathGet(root, splitPath("s3.bucket"))
	if err != nil {
		t.Fatalf("get after set: %v", err)
	}

	if got.Value != "newbucket" {
		t.Errorf("s3.bucket = %q after set, want newbucket", got.Value)
	}
}

// TestConfigSetPreservesFormatting asserts the `config set` write path
// (marshalConfigYAML) round-trips a 2-space-indented file without reindenting
// it to yaml.Marshal's 4-space default, and keeps comments.
func TestConfigSetPreservesFormatting(t *testing.T) {
	t.Parallel()

	root := parseTestYAML(t)

	err := yamlPathSet(root, splitPath("s3.bucket"), "newbucket")
	if err != nil {
		t.Fatalf("set s3.bucket: %v", err)
	}

	out, err := marshalConfigYAML(root)
	if err != nil {
		t.Fatalf("marshal: %v", err)
	}

	text := string(out)

	for _, want := range []string{"# top comment", "# inline comment"} {
		if !contains(text, want) {
			t.Errorf("round-tripped YAML dropped comment %q:\n%s", want, text)
		}
	}

	// Nested map keys stay at 2-space indent; the bug reindented them to 4.
	if !contains(text, "\n  bucket: newbucket") {
		t.Errorf("expected 2-space indent for s3.bucket, got:\n%s", text)
	}

	if contains(text, "\n    bucket:") {
		t.Errorf("s3.bucket reindented to 4 spaces:\n%s", text)
	}

	// Sequence items under a key also stay at 2 spaces.
	if !contains(text, "\n  - age1aaa") {
		t.Errorf("expected 2-space indent for sequence item, got:\n%s", text)
	}
}

// TestWriteConfigSetHidesSecret checks that setting a secret key prints
// only the key name, never the value, to the confirmation output.
func TestWriteConfigSetHidesSecret(t *testing.T) {
	t.Parallel()

	const secret = "SUPERSECRETVALUE"

	path := filepath.Join(t.TempDir(), "config.yaml")

	err := os.WriteFile(path, []byte("version: 1\n"), 0o600)
	if err != nil {
		t.Fatalf("seed config: %v", err)
	}

	var out bytes.Buffer

	err = writeConfigSet(&out, path, "s3.secret_access_key", secret)
	if err != nil {
		t.Fatalf("writeConfigSet: %v", err)
	}

	if strings.Contains(out.String(), secret) {
		t.Errorf("output echoed the secret value: %q", out.String())
	}

	if !strings.Contains(out.String(), "s3.secret_access_key") {
		t.Errorf("output did not confirm the key name: %q", out.String())
	}
}

// TestWriteConfigSetTightensMode checks that a pre-existing group- or
// world-readable config is tightened to owner-only after a set, since
// os.WriteFile leaves an existing file's mode untouched.
func TestWriteConfigSetTightensMode(t *testing.T) {
	t.Parallel()

	path := filepath.Join(t.TempDir(), "config.yaml")

	// Seed a world-readable config; the loose mode is the condition under
	// test, so gosec's G306 is expected here.
	err := os.WriteFile(path, []byte("version: 1\n"), 0o644) //nolint:gosec // G306
	if err != nil {
		t.Fatalf("seed config: %v", err)
	}

	var out bytes.Buffer

	err = writeConfigSet(&out, path, "compression_level", "9")
	if err != nil {
		t.Fatalf("writeConfigSet: %v", err)
	}

	info, err := os.Stat(path)
	if err != nil {
		t.Fatalf("stat config: %v", err)
	}

	if info.Mode().Perm() != 0o600 {
		t.Errorf("config mode = %04o, want 0600", info.Mode().Perm())
	}
}

func splitPath(s string) []string {
	return strings.Split(s, ".")
}

func contains(haystack, needle string) bool {
	return strings.Contains(haystack, needle)
}