72 lines
2.5 KiB
Python
72 lines
2.5 KiB
Python
import copy
|
|
|
|
import pytest
|
|
|
|
from secrets_engine.catalog import validate_entry
|
|
from secrets_engine.errors import DeliveryError
|
|
from secrets_engine.exec_delivery import (
|
|
_npm_userconfig,
|
|
_registry_authkey,
|
|
exec_with_secret,
|
|
)
|
|
from tests.test_catalog import VALID
|
|
|
|
|
|
def test_registry_authkey_strips_scheme_and_trails_slash():
|
|
assert (
|
|
_registry_authkey("https://forgejo.coulomb.social/api/packages/coulomb/npm/")
|
|
== "//forgejo.coulomb.social/api/packages/coulomb/npm/"
|
|
)
|
|
# missing trailing slash is added
|
|
assert _registry_authkey("https://host/api/npm") == "//host/api/npm/"
|
|
|
|
|
|
def test_npm_userconfig_writes_registry_and_token_ref_not_value():
|
|
registry = "https://forgejo.coulomb.social/api/packages/coulomb/npm/"
|
|
with _npm_userconfig(registry, "@whynot", "NPM_AUTH_TOKEN") as path:
|
|
body = path.read_text()
|
|
assert f"@whynot:registry={registry}" in body
|
|
# token is referenced via env expansion, never written literally
|
|
assert "${NPM_AUTH_TOKEN}" in body
|
|
assert "//forgejo.coulomb.social/api/packages/coulomb/npm/:_authToken" in body
|
|
# file is mode 0600
|
|
assert (path.stat().st_mode & 0o077) == 0
|
|
# cleaned up on context exit
|
|
assert not path.exists()
|
|
|
|
|
|
def test_exec_env_injects_only_selected_declared_field(monkeypatch):
|
|
data = copy.deepcopy(VALID)
|
|
data["fields"] = ["primary", "selected_value"]
|
|
entry = validate_entry(data)
|
|
|
|
def fake_fetch(_client, got_entry, field):
|
|
assert got_entry == entry
|
|
assert field == "selected_value"
|
|
return "test-secret-value"
|
|
|
|
def fake_spawn(command, env, secret):
|
|
assert command == ["probe"]
|
|
assert secret == "test-secret-value"
|
|
assert env["SELECTED_VALUE"] == "test-secret-value"
|
|
assert "PRIMARY" not in env
|
|
return 0
|
|
|
|
monkeypatch.setattr("secrets_engine.exec_delivery._fetch_value", fake_fetch)
|
|
monkeypatch.setattr("secrets_engine.exec_delivery._spawn", fake_spawn)
|
|
assert (
|
|
exec_with_secret(
|
|
object(), entry, "selected_value", ["probe"], mode="exec-env"
|
|
)
|
|
== 0
|
|
)
|
|
|
|
|
|
def test_exec_rejects_undeclared_field_before_fetch(monkeypatch):
|
|
entry = validate_entry(VALID)
|
|
monkeypatch.setattr(
|
|
"secrets_engine.exec_delivery._fetch_value",
|
|
lambda *_args, **_kwargs: pytest.fail("must not fetch undeclared field"),
|
|
)
|
|
with pytest.raises(DeliveryError):
|
|
exec_with_secret(object(), entry, "other_field", ["probe"], mode="exec-env")
|