Files
ThothII/backend/test/secret-bundle.test.ts
T

59 lines
2.6 KiB
TypeScript

import { afterEach, expect, test } from "vitest";
import { chmodSync, mkdtempSync, renameSync, rmSync, writeFileSync } from "node:fs";
import { join } from "node:path";
import { tmpdir } from "node:os";
import { loadSecretBundle, secretValue } from "../src/config/secret-bundle.js";
const dirs: string[] = [];
afterEach(() => { for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true }); });
function bundle(contents: string, mode = 0o600): string {
const dir = mkdtempSync(join(tmpdir(), "thothii-secret-bundle-"));
dirs.push(dir);
const file = join(dir, "bundle");
writeFileSync(file, contents, { mode });
chmodSync(file, mode);
return file;
}
test("parses comments, blank lines and values containing equals", () => {
const file = bundle("# comment\n\nTHT_MODEL_API_KEY=abc=123\nTHT_DWH_API_KEY=dwh\n");
expect(loadSecretBundle(file)).toEqual(new Map([
["THT_MODEL_API_KEY", "abc=123"], ["THT_DWH_API_KEY", "dwh"],
]));
});
test.each([
["duplicate", "THT_MODEL_API_KEY=a\nTHT_MODEL_API_KEY=b\n"],
["unknown", "UNKNOWN_KEY=x\n"],
["empty", "THT_MODEL_API_KEY=\n"],
["syntax", "THT_MODEL_API_KEY\n"],
])("rejects %s bundle lines without exposing values", (_name, contents) => {
expect(() => loadSecretBundle(bundle(contents))).toThrow("secret bundle is unavailable");
expect(() => loadSecretBundle(bundle(contents))).not.toThrow(/abc|dwh/);
});
test("rejects missing and insecure files", () => {
const file = bundle("THT_MODEL_API_KEY=secret\n", 0o644);
expect(() => loadSecretBundle(file)).toThrow("secret bundle is unavailable");
expect(() => loadSecretBundle(join(file, "missing"))).toThrow("secret bundle is unavailable");
});
test("checks inode identity before parsing", () => {
const file = bundle("THT_MODEL_API_KEY=secret\n");
const replacement = `${file}.replacement`;
writeFileSync(replacement, "THT_MODEL_API_KEY=replaced\n", { mode: 0o600 });
// A real replacement is safe because the loader's open/fstat check is the invariant;
// this also ensures the normal post-replacement file remains parseable.
renameSync(replacement, file);
expect(loadSecretBundle(file).get("THT_MODEL_API_KEY")).toBe("replaced");
});
test("secretValue prefers bundle and supports the legacy file fallback", () => {
const file = bundle("THT_MODEL_API_KEY=from-bundle\n");
const legacy = bundle("from-legacy");
expect(secretValue({ secretsFile: file, secretFiles: { THT_MODEL_API_KEY_SECRET_FILE: legacy } }, "THT_MODEL_API_KEY"))
.toBe("from-bundle");
expect(secretValue({ secretFiles: { THT_MODEL_API_KEY_SECRET_FILE: legacy } }, "THT_MODEL_API_KEY"))
.toBe("from-legacy");
});