0f9de1c2fd
- Add RECIPIENTS_FILE_NAME / RECIPIENTS_FILE constants; update resolve_store to re-derive RECIPIENTS_FILE after store resolution. - Add _validate_age_recipient (native age1 X25519 key format check, injection rail). - Add RECIPIENT_ARGS global array and _load_recipients (absent → single pubkey legacy path; present → parse+validate recipients.txt, refuse symlink, die on bad/empty). - Rewire all 5 push encrypt sites (push_dir_to_project, cmd_push inline, push_external_files ×2, cmd_push_workspaces) to use RECIPIENT_ARGS; drop pubkey threading from push_dir_to_project and push_external_files signatures. - New test/recipients.bats (4 tests): legacy single-key, multi-recipient decrypt, invalid key rejection, symlink rejection. - Fix test/test_helper.bash: set GIT_AUTHOR/COMMITTER env vars so git commit works with isolated $HOME. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
78 lines
2.4 KiB
Bash
78 lines
2.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Shared setup/teardown for secrets bats tests.
|
|
# Creates isolated temp directories for each test — no side effects.
|
|
|
|
SECRETS_BIN="$(cd "$(dirname "${BATS_TEST_FILENAME}")/.." && pwd)/secrets"
|
|
|
|
setup() {
|
|
# Check age is available
|
|
if ! command -v age >/dev/null 2>&1; then
|
|
skip "age is not installed"
|
|
fi
|
|
|
|
# Create isolated temp environment
|
|
export TEST_TMPDIR
|
|
TEST_TMPDIR=$(mktemp -d)
|
|
|
|
# Isolate HOME so .secrets-store walk-up cannot stray into the real
|
|
# developer's home directory (or pick up files in / if HOME happens to
|
|
# not be a real ancestor of /tmp). EGB-281 F9.
|
|
export HOME="$TEST_TMPDIR"
|
|
|
|
# Provide git author identity so `git commit` works with the fresh temp HOME
|
|
# (no ~/.gitconfig is present in the isolated dir). GIT_* env vars override
|
|
# any global config and survive the HOME redirect.
|
|
export GIT_AUTHOR_NAME="Test User"
|
|
export GIT_AUTHOR_EMAIL="test@example.com"
|
|
export GIT_COMMITTER_NAME="Test User"
|
|
export GIT_COMMITTER_EMAIL="test@example.com"
|
|
|
|
# Secrets repo lives in temp
|
|
export SECRETS_DIR="$TEST_TMPDIR/secrets-repo"
|
|
|
|
# Working directory for simulating project dirs (kept under $HOME so
|
|
# the .secrets-store walk-up logic, which is bounded by $HOME, can find
|
|
# files placed in test fixtures).
|
|
export WORK_DIR="$HOME/work"
|
|
mkdir -p "$WORK_DIR"
|
|
|
|
# Create a bare "remote" repo for push/pull testing
|
|
export REMOTE_DIR="$TEST_TMPDIR/remote.git"
|
|
git init --bare "$REMOTE_DIR" >/dev/null 2>&1
|
|
}
|
|
|
|
teardown() {
|
|
rm -rf "$TEST_TMPDIR"
|
|
}
|
|
|
|
# Helper: initialize secrets and add remote
|
|
init_with_remote() {
|
|
run "$SECRETS_BIN" init
|
|
cd "$SECRETS_DIR"
|
|
git remote add origin "$REMOTE_DIR"
|
|
# Initial commit so push works
|
|
git commit --allow-empty -m "init" >/dev/null 2>&1
|
|
git push -u origin main >/dev/null 2>&1 || git push -u origin master >/dev/null 2>&1
|
|
cd -
|
|
}
|
|
|
|
# Helper: create .env files in a temp project dir and cd into it
|
|
create_project_dir() {
|
|
local name="${1:-testproj}"
|
|
local dir="$WORK_DIR/$name"
|
|
mkdir -p "$dir"
|
|
echo "SECRET_KEY=abc123" > "$dir/.env"
|
|
echo "DB_HOST=staging.db.example.com" > "$dir/.env.staging"
|
|
cd "$dir"
|
|
}
|
|
|
|
# Helper: create a project dir bound to a store via .secrets-store file
|
|
create_bound_project_dir() {
|
|
local name="$1"
|
|
local store_value="$2"
|
|
local dir="$WORK_DIR/$name"
|
|
mkdir -p "$dir"
|
|
echo "SECRET_KEY=abc123" > "$dir/.env"
|
|
echo "$store_value" > "$dir/.secrets-store"
|
|
cd "$dir"
|
|
}
|