egbt/secrets
1
0
Fork 0
Code Issues Pull requests Projects Releases 13 Packages Wiki Activity Actions

test: coverage for verify gap branches (external decrypt-fail, unsafe path, unknown flag, malformed manifest, empty --all)

Browse source 
Coverage audit found 5 untested branches in cmd_verify (all single-test
fills, no logic defects): external blob decrypt-failure (only the missing
case was covered), the rail-skip finding for an unsafe dotenv path in the
manifest, the unknown-flag die, a malformed manifest through the verify
entry point, and the empty-store 'verify --all' no-op. Full suite 210/210.
This commit is contained in:
Brian Majewski 2026-06-07 15:14:54 -07:00
parent 52528f2e06
commit 33aad4f89a
1 changed files with 50 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

50
test/manifest.bats
View file

@ -860,3 +860,53 @@ m_nojq_path() {
[ "$status" -eq 1 ]
[[ "$output" == *"packages/web/.env.development"* ]] || false
}
@test "verify: external blob that fails to decrypt is a finding (exit 1)" {
init_with_remote
m_gradle_src $'beaconClerkPkTest=pk_test_abc\n'
create_project_dir verifyextcorrupt
printf 'gradle-properties ~/.gradle/gradle.properties beaconClerkPkTest\n' > .secrets-files
"$SECRETS_BIN" push >/dev/null 2>&1
printf 'garbage' > "$SECRETS_DIR/verifyextcorrupt/external/"*.age
run "$SECRETS_BIN" verify
[ "$status" -eq 1 ]
[[ "$output" == *"external"* ]] || false
}
@test "verify: an unsafe dotenv path in the manifest is a finding (exit 1)" {
init_with_remote
create_project_dir verifyunsafe
"$SECRETS_BIN" push >/dev/null 2>&1
# Hand-edit the committed manifest to declare a traversal path the rail refuses.
jq '.dotenv += ["../evil"]' .secrets.json > .secrets.json.tmp && mv .secrets.json.tmp .secrets.json
run "$SECRETS_BIN" verify
[ "$status" -eq 1 ]
[[ "$output" == *"unsafe"* ]] || false
}
@test "verify: unknown flag dies with usage" {
init_with_remote
create_project_dir verifyflag
"$SECRETS_BIN" push >/dev/null 2>&1
run "$SECRETS_BIN" verify --bogus
[ "$status" -eq 1 ]
[[ "$output" == *"Unknown verify flag"* ]] || false
}
@test "verify: malformed manifest is refused" {
init_with_remote
create_project_dir verifymalformed
"$SECRETS_BIN" push >/dev/null 2>&1
printf 'not json{' > .secrets.json
run "$SECRETS_BIN" verify
[ "$status" -eq 1 ]
[[ "$output" == *"JSON"* ]] || false
}
@test "verify --all: empty store reports nothing to check (exit 0)" {
init_with_remote
cd "$WORK_DIR"
run "$SECRETS_BIN" verify --all
[ "$status" -eq 0 ]
[[ "$output" == *"empty"* ]] || false
}