-
Notifications
You must be signed in to change notification settings - Fork 2
Expand file tree
/
Copy pathservice_test.go
More file actions
100 lines (90 loc) · 3.02 KB
/
service_test.go
File metadata and controls
100 lines (90 loc) · 3.02 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
package scy_test
import (
"context"
"encoding/base64"
"github.com/stretchr/testify/assert"
"github.com/viant/scy"
"github.com/viant/scy/cred"
_ "github.com/viant/scy/kms/blowfish"
"os"
"path"
"testing"
)
func TestService_Load(t *testing.T) {
basePath := "/tmp/" // os.TempDir()
var testCases = []struct {
description string
secret *scy.Secret
resource *scy.Resource
expect interface{}
}{
{
description: "raw secret with local fs and key",
resource: scy.NewResource("key", path.Join(basePath, "secret.sec"), "blowfish://default"),
secret: scy.NewSecret("this is secret", nil),
expect: "this is secret",
},
{
description: "securable secrets",
resource: scy.NewResource(cred.Basic{}, path.Join(basePath, "json.sec"), "blowfish://default"),
secret: scy.NewSecret(&cred.Basic{Username: "Bob", Password: "ch@nge!Me"}, nil),
expect: &cred.Basic{Username: "Bob", Password: "ch@nge!Me"},
},
{
description: "generic secrets",
resource: scy.NewResource("", path.Join(basePath, "json.sec"), "blowfish://default"),
secret: scy.NewSecret(&cred.Basic{Username: "Bob", Password: "ch@nge!Me"}, nil),
expect: &cred.Generic{SSH: cred.SSH{Basic: cred.Basic{Username: "Bob", Password: "ch@nge!Me"}}},
},
{
description: "yaml secrets",
resource: scy.NewResource("", path.Join(basePath, "yaml.yml"), "blowfish://default"),
secret: scy.NewSecret(&cred.Basic{Username: "Alice", Password: "sEcReT"}, nil),
expect: &cred.Generic{SSH: cred.SSH{Basic: cred.Basic{Username: "Alice", Password: "sEcReT"}}},
},
}
for _, testCase := range testCases {
srv := scy.New()
ctx := context.Background()
testCase.secret.Resource = testCase.resource
err := srv.Store(ctx, testCase.secret)
if !assert.Nil(t, err, testCase.description) {
continue
}
secret, err := srv.Load(ctx, testCase.resource)
if !assert.Nil(t, err, testCase.description) {
continue
}
assert.EqualValues(t, testCase.expect, secret.Target, testCase.description)
}
}
func TestService_Load_InlinedBase64EncryptedPayload(t *testing.T) {
ctx := context.Background()
srv := scy.New()
resource := scy.NewResource("key", "/tmp/inlined.sec", "blowfish://default")
secret := scy.NewSecret("this is secret", nil)
secret.Resource = resource
err := srv.Store(ctx, secret)
if !assert.Nil(t, err) {
return
}
payload, err := os.ReadFile(resource.URL)
if !assert.Nil(t, err) {
return
}
inlineURL := "inlined://base64/" + base64.StdEncoding.EncodeToString(payload)
loaded, err := srv.Load(ctx, scy.NewResource("key", inlineURL, "blowfish://default"))
if !assert.Nil(t, err) {
return
}
assert.EqualValues(t, "this is secret", loaded.Target)
}
func TestService_Load_InlinedBase64InvalidPayload(t *testing.T) {
ctx := context.Background()
srv := scy.New()
_, err := srv.Load(ctx, scy.NewResource("key", "inlined://base64/not-base64!!!", "blowfish://default"))
if !assert.NotNil(t, err) {
return
}
assert.Contains(t, err.Error(), "invalid inlined base64 payload")
}