84 lines
2.0 KiB
Go
84 lines
2.0 KiB
Go
package internalsecrets
|
|
|
|
import (
|
|
"bytes"
|
|
"os"
|
|
"path/filepath"
|
|
"runtime"
|
|
"sync"
|
|
"testing"
|
|
)
|
|
|
|
func TestEnsureGeneratesAndReusesSecret(t *testing.T) {
|
|
path := filepath.Join(t.TempDir(), "private", "token")
|
|
created, err := Ensure(path, os.Getuid(), os.Getgid(), 0o600)
|
|
if err != nil || !created {
|
|
t.Fatalf("first Ensure() = %v, %v", created, err)
|
|
}
|
|
first, err := os.ReadFile(path)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
created, err = Ensure(path, os.Getuid(), os.Getgid(), 0o600)
|
|
if err != nil || created {
|
|
t.Fatalf("second Ensure() = %v, %v", created, err)
|
|
}
|
|
second, _ := os.ReadFile(path)
|
|
if len(first) != 32 || !bytes.Equal(first, second) {
|
|
t.Fatal("secret was not generated once and reused")
|
|
}
|
|
if runtime.GOOS != "windows" {
|
|
info, _ := os.Stat(path)
|
|
if info.Mode().Perm() != 0o600 {
|
|
t.Fatalf("secret permissions = %o", info.Mode().Perm())
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestEnsureConcurrentInitializationCreatesOneSecret(t *testing.T) {
|
|
path := filepath.Join(t.TempDir(), "private", "token")
|
|
var wait sync.WaitGroup
|
|
created := make(chan bool, 2)
|
|
errors := make(chan error, 2)
|
|
for range 2 {
|
|
wait.Add(1)
|
|
go func() {
|
|
defer wait.Done()
|
|
wasCreated, err := Ensure(path, os.Getuid(), os.Getgid(), 0o600)
|
|
created <- wasCreated
|
|
errors <- err
|
|
}()
|
|
}
|
|
wait.Wait()
|
|
close(created)
|
|
close(errors)
|
|
createdCount := 0
|
|
for wasCreated := range created {
|
|
if wasCreated {
|
|
createdCount++
|
|
}
|
|
}
|
|
for err := range errors {
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
if createdCount != 1 {
|
|
t.Fatalf("created count = %d, want 1", createdCount)
|
|
}
|
|
}
|
|
|
|
func TestEnsureRefusesInvalidExistingSecret(t *testing.T) {
|
|
path := filepath.Join(t.TempDir(), "master_key")
|
|
if err := os.WriteFile(path, []byte("short"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if created, err := Ensure(path, os.Getuid(), os.Getgid(), 0o600); err == nil || created {
|
|
t.Fatalf("invalid existing secret was accepted: %v, %v", created, err)
|
|
}
|
|
got, _ := os.ReadFile(path)
|
|
if string(got) != "short" {
|
|
t.Fatal("invalid existing secret was replaced")
|
|
}
|
|
}
|