v0.25.1

src/secret_store/tests.rs

@@ -0,0 +1,61 @@
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn secret_round_trip_is_encrypted_in_sqlite_and_survives_key_reload() {
+        let dir = tempfile::tempdir().unwrap();
+        crate::auth::prepare_directory(dir.path()).unwrap();
+        let database = dir.path().join("config.sqlite3");
+        crate::auth::prepare_database(&database).unwrap();
+        let store = crate::db::Store::open(&database, &crate::config::Config::default())
+            .await
+            .unwrap();
+        initialize(dir.path()).unwrap();
+        let secret = b"cloudflare-example-token-0123456789";
+        put(
+            &store,
+            dir.path(),
+            "provider/cloudflare/demo/api_token",
+            "cloudflare",
+            secret,
+            serde_json::json!({"id":"demo"}),
+        )
+        .await
+        .unwrap();
+        let row: Vec<u8> = sqlx::query_scalar(
+            "SELECT ciphertext FROM secret_store WHERE secret_id='provider/cloudflare/demo/api_token'",
+        )
+        .fetch_one(&store.pool)
+        .await
+        .unwrap();
+        assert!(!row.windows(secret.len()).any(|window| window == secret));
+        let value = get(
+            &store,
+            dir.path(),
+            "provider/cloudflare/demo/api_token",
+            Some("cloudflare"),
+        )
+        .await
+        .unwrap();
+        assert_eq!(value.as_slice(), secret);
+        drop(value);
+        assert_eq!(read_key(&master_key_path(dir.path())).unwrap().len(), KEY_BYTES);
+    }
+
+    #[tokio::test]
+    async fn tampered_ciphertext_is_rejected() {
+        let dir = tempfile::tempdir().unwrap();
+        crate::auth::prepare_directory(dir.path()).unwrap();
+        let database = dir.path().join("config.sqlite3");
+        crate::auth::prepare_database(&database).unwrap();
+        let store = crate::db::Store::open(&database, &crate::config::Config::default())
+            .await
+            .unwrap();
+        put(&store, dir.path(), "acme/site/cloudflare/credential", "cloudflare", b"secret-value", serde_json::json!({})).await.unwrap();
+        sqlx::query("UPDATE secret_store SET ciphertext = zeroblob(length(ciphertext))")
+            .execute(&store.pool)
+            .await
+            .unwrap();
+        assert!(get(&store, dir.path(), "acme/site/cloudflare/credential", Some("cloudflare")).await.is_err());
+    }
+}