| 1 | // SPDX-License-Identifier: GPL-3.0-or-later |
| 2 | |
| 3 | package secretresolver |
| 4 | |
| 5 | import ( |
| 6 | "os" |
| 7 | "path/filepath" |
| 8 | "runtime" |
| 9 | "testing" |
| 10 | |
| 11 | "github.com/stretchr/testify/assert" |
| 12 | "github.com/stretchr/testify/require" |
| 13 | ) |
| 14 | |
| 15 | func TestResolveCmd(t *testing.T) { |
| 16 | tests := map[string]struct { |
| 17 | onWindowsSkip bool |
| 18 | buildCfg func(t *testing.T) map[string]any |
| 19 | wantErrContains string |
| 20 | wantValue string |
| 21 | field string |
| 22 | }{ |
| 23 | "success": { |
| 24 | onWindowsSkip: true, |
| 25 | buildCfg: func(t *testing.T) map[string]any { |
| 26 | return map[string]any{"password": "${cmd:/bin/echo hello}"} |
| 27 | }, |
| 28 | field: "password", |
| 29 | wantValue: "hello", |
| 30 | }, |
| 31 | "trims output": { |
| 32 | onWindowsSkip: true, |
| 33 | buildCfg: func(t *testing.T) map[string]any { |
| 34 | return map[string]any{"val": "${cmd:/bin/echo secretval}"} |
| 35 | }, |
| 36 | field: "val", |
| 37 | wantValue: "secretval", |
| 38 | }, |
| 39 | "relative path rejected": { |
| 40 | buildCfg: func(t *testing.T) map[string]any { |
| 41 | return map[string]any{"val": "${cmd:echo hello}"} |
| 42 | }, |
| 43 | wantErrContains: "command path must be absolute", |
| 44 | }, |
| 45 | "empty command": { |
| 46 | buildCfg: func(t *testing.T) map[string]any { |
| 47 | return map[string]any{"val": "${cmd:}"} |
| 48 | }, |
| 49 | wantErrContains: "empty command", |
| 50 | }, |
| 51 | "nonexistent command": { |
| 52 | buildCfg: func(t *testing.T) map[string]any { |
| 53 | return map[string]any{"val": "${cmd:/nonexistent/command}"} |
| 54 | }, |
| 55 | wantErrContains: "command failed", |
| 56 | }, |
| 57 | "command with args": { |
| 58 | onWindowsSkip: true, |
| 59 | buildCfg: func(t *testing.T) map[string]any { |
| 60 | return map[string]any{"val": "${cmd:/usr/bin/printf %s secret}"} |
| 61 | }, |
| 62 | field: "val", |
| 63 | wantValue: "secret", |
| 64 | }, |
| 65 | "script file": { |
| 66 | onWindowsSkip: true, |
| 67 | buildCfg: func(t *testing.T) map[string]any { |
| 68 | dir := t.TempDir() |
| 69 | script := filepath.Join(dir, "secret.sh") |
| 70 | require.NoError(t, os.WriteFile(script, []byte("#!/bin/sh\necho mysecret\n"), 0700)) |
| 71 | return map[string]any{"val": "${cmd:" + script + "}"} |
| 72 | }, |
| 73 | field: "val", |
| 74 | wantValue: "mysecret", |
| 75 | }, |
| 76 | } |
| 77 | |
| 78 | for name, tc := range tests { |
| 79 | t.Run(name, func(t *testing.T) { |
| 80 | if tc.onWindowsSkip && runtime.GOOS == "windows" { |
| 81 | t.Skip("skipping on windows") |
| 82 | } |
| 83 | |
| 84 | resolver := New() |
| 85 | cfg := tc.buildCfg(t) |
| 86 | err := resolver.Resolve(cfg) |
| 87 | |
| 88 | if tc.wantErrContains != "" { |
| 89 | require.Error(t, err) |
| 90 | assert.Contains(t, err.Error(), tc.wantErrContains) |
| 91 | return |
| 92 | } |
| 93 | |
| 94 | require.NoError(t, err) |
| 95 | assert.Equal(t, tc.wantValue, cfg[tc.field]) |
| 96 | }) |
| 97 | } |
| 98 | } |