2023-07-26 13:21:57 +00:00
|
|
|
import os
|
2023-08-26 09:44:38 +00:00
|
|
|
from contextlib import contextmanager
|
2023-07-26 13:21:57 +00:00
|
|
|
from pathlib import Path
|
2023-08-26 09:44:38 +00:00
|
|
|
from typing import TYPE_CHECKING, Iterator
|
2023-07-26 13:21:57 +00:00
|
|
|
|
|
|
|
import pytest
|
2023-08-24 15:29:31 +00:00
|
|
|
from cli import Cli
|
2023-07-26 13:21:57 +00:00
|
|
|
|
|
|
|
from clan_cli.errors import ClanError
|
|
|
|
|
2023-08-09 08:17:11 +00:00
|
|
|
if TYPE_CHECKING:
|
2023-08-09 13:51:10 +00:00
|
|
|
from age_keys import KeyPair
|
2023-08-08 16:46:37 +00:00
|
|
|
|
2023-07-26 13:21:57 +00:00
|
|
|
|
|
|
|
def _test_identities(
|
2023-08-09 08:17:11 +00:00
|
|
|
what: str,
|
|
|
|
clan_flake: Path,
|
|
|
|
capsys: pytest.CaptureFixture,
|
2023-08-09 13:51:10 +00:00
|
|
|
age_keys: list["KeyPair"],
|
2023-07-26 13:21:57 +00:00
|
|
|
) -> None:
|
2023-08-24 15:29:31 +00:00
|
|
|
cli = Cli()
|
2023-07-26 13:21:57 +00:00
|
|
|
sops_folder = clan_flake / "sops"
|
|
|
|
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", what, "add", "foo", age_keys[0].pubkey])
|
2023-07-26 13:21:57 +00:00
|
|
|
assert (sops_folder / what / "foo" / "key.json").exists()
|
|
|
|
with pytest.raises(ClanError):
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", what, "add", "foo", age_keys[0].pubkey])
|
2023-07-26 13:21:57 +00:00
|
|
|
|
|
|
|
cli.run(
|
|
|
|
[
|
2023-08-24 15:29:31 +00:00
|
|
|
"secrets",
|
2023-07-26 13:21:57 +00:00
|
|
|
what,
|
|
|
|
"add",
|
|
|
|
"-f",
|
|
|
|
"foo",
|
2023-08-09 13:51:10 +00:00
|
|
|
age_keys[0].privkey,
|
2023-07-26 13:21:57 +00:00
|
|
|
]
|
|
|
|
)
|
|
|
|
capsys.readouterr() # empty the buffer
|
|
|
|
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", what, "list"])
|
2023-07-26 13:21:57 +00:00
|
|
|
out = capsys.readouterr() # empty the buffer
|
|
|
|
assert "foo" in out.out
|
|
|
|
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", what, "remove", "foo"])
|
2023-07-26 13:21:57 +00:00
|
|
|
assert not (sops_folder / what / "foo" / "key.json").exists()
|
|
|
|
|
|
|
|
with pytest.raises(ClanError): # already removed
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", what, "remove", "foo"])
|
2023-07-26 13:21:57 +00:00
|
|
|
|
|
|
|
capsys.readouterr()
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", what, "list"])
|
2023-07-26 13:21:57 +00:00
|
|
|
out = capsys.readouterr()
|
|
|
|
assert "foo" not in out.out
|
|
|
|
|
|
|
|
|
2023-08-09 08:17:11 +00:00
|
|
|
def test_users(
|
2023-08-09 13:51:10 +00:00
|
|
|
clan_flake: Path, capsys: pytest.CaptureFixture, age_keys: list["KeyPair"]
|
2023-08-09 08:17:11 +00:00
|
|
|
) -> None:
|
2023-08-09 13:51:10 +00:00
|
|
|
_test_identities("users", clan_flake, capsys, age_keys)
|
2023-07-26 13:21:57 +00:00
|
|
|
|
|
|
|
|
2023-08-09 08:17:11 +00:00
|
|
|
def test_machines(
|
2023-08-09 13:51:10 +00:00
|
|
|
clan_flake: Path, capsys: pytest.CaptureFixture, age_keys: list["KeyPair"]
|
2023-08-09 08:17:11 +00:00
|
|
|
) -> None:
|
2023-08-09 13:51:10 +00:00
|
|
|
_test_identities("machines", clan_flake, capsys, age_keys)
|
2023-07-26 13:21:57 +00:00
|
|
|
|
|
|
|
|
2023-08-09 08:17:11 +00:00
|
|
|
def test_groups(
|
2023-08-09 13:51:10 +00:00
|
|
|
clan_flake: Path, capsys: pytest.CaptureFixture, age_keys: list["KeyPair"]
|
2023-08-09 08:17:11 +00:00
|
|
|
) -> None:
|
2023-08-24 15:29:31 +00:00
|
|
|
cli = Cli()
|
2023-07-26 13:21:57 +00:00
|
|
|
capsys.readouterr() # empty the buffer
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", "groups", "list"])
|
2023-07-26 13:21:57 +00:00
|
|
|
assert capsys.readouterr().out == ""
|
|
|
|
|
|
|
|
with pytest.raises(ClanError): # machine does not exist yet
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", "groups", "add-machine", "group1", "machine1"])
|
2023-07-26 13:21:57 +00:00
|
|
|
with pytest.raises(ClanError): # user does not exist yet
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", "groups", "add-user", "groupb1", "user1"])
|
|
|
|
cli.run(["secrets", "machines", "add", "machine1", age_keys[0].pubkey])
|
|
|
|
cli.run(["secrets", "groups", "add-machine", "group1", "machine1"])
|
2023-07-26 13:21:57 +00:00
|
|
|
|
|
|
|
# Should this fail?
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", "groups", "add-machine", "group1", "machine1"])
|
2023-07-26 13:21:57 +00:00
|
|
|
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", "users", "add", "user1", age_keys[0].pubkey])
|
|
|
|
cli.run(["secrets", "groups", "add-user", "group1", "user1"])
|
2023-07-26 13:21:57 +00:00
|
|
|
|
|
|
|
capsys.readouterr() # empty the buffer
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", "groups", "list"])
|
2023-07-26 13:21:57 +00:00
|
|
|
out = capsys.readouterr().out
|
|
|
|
assert "user1" in out
|
|
|
|
assert "machine1" in out
|
|
|
|
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", "groups", "remove-user", "group1", "user1"])
|
|
|
|
cli.run(["secrets", "groups", "remove-machine", "group1", "machine1"])
|
2023-07-26 13:21:57 +00:00
|
|
|
groups = os.listdir(clan_flake / "sops" / "groups")
|
|
|
|
assert len(groups) == 0
|
|
|
|
|
|
|
|
|
2023-08-26 09:44:38 +00:00
|
|
|
@contextmanager
|
|
|
|
def use_key(key: str, monkeypatch: pytest.MonkeyPatch) -> Iterator[None]:
|
|
|
|
old_key = os.environ["SOPS_AGE_KEY_FILE"]
|
|
|
|
monkeypatch.setenv("SOPS_AGE_KEY", key)
|
|
|
|
yield
|
|
|
|
monkeypatch.delenv("SOPS_AGE_KEY")
|
|
|
|
monkeypatch.setenv("SOPS_AGE_KEY_FILE", old_key)
|
|
|
|
|
|
|
|
|
2023-08-09 08:17:11 +00:00
|
|
|
def test_secrets(
|
2023-08-26 09:44:38 +00:00
|
|
|
clan_flake: Path,
|
|
|
|
capsys: pytest.CaptureFixture,
|
|
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
|
|
age_keys: list["KeyPair"],
|
2023-08-09 08:17:11 +00:00
|
|
|
) -> None:
|
2023-08-24 15:29:31 +00:00
|
|
|
cli = Cli()
|
2023-07-26 13:21:57 +00:00
|
|
|
capsys.readouterr() # empty the buffer
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", "list"])
|
2023-07-26 13:21:57 +00:00
|
|
|
assert capsys.readouterr().out == ""
|
|
|
|
|
2023-08-26 09:44:38 +00:00
|
|
|
monkeypatch.setenv("SOPS_NIX_SECRET", "foo")
|
|
|
|
monkeypatch.setenv("SOPS_AGE_KEY_FILE", str(clan_flake / ".." / "age.key"))
|
|
|
|
|
|
|
|
with pytest.raises(ClanError): # does not exist yet
|
|
|
|
cli.run(["secrets", "get", "nonexisting"])
|
|
|
|
cli.run(["secrets", "set", "key"])
|
|
|
|
capsys.readouterr()
|
|
|
|
cli.run(["secrets", "get", "key"])
|
|
|
|
assert capsys.readouterr().out == "foo"
|
|
|
|
capsys.readouterr()
|
|
|
|
cli.run(["secrets", "users", "list"])
|
|
|
|
users = capsys.readouterr().out.rstrip().split("\n")
|
|
|
|
assert len(users) == 1, f"users: {users}"
|
|
|
|
owner = users[0]
|
|
|
|
|
|
|
|
capsys.readouterr() # empty the buffer
|
|
|
|
cli.run(["secrets", "list"])
|
|
|
|
assert capsys.readouterr().out == "key\n"
|
|
|
|
|
|
|
|
cli.run(["secrets", "machines", "add", "machine1", age_keys[0].pubkey])
|
|
|
|
cli.run(["secrets", "machines", "add-secret", "machine1", "key"])
|
|
|
|
|
|
|
|
with use_key(age_keys[0].privkey, monkeypatch):
|
2023-07-26 13:21:57 +00:00
|
|
|
capsys.readouterr()
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", "get", "key"])
|
2023-07-26 13:21:57 +00:00
|
|
|
assert capsys.readouterr().out == "foo"
|
2023-08-26 09:44:38 +00:00
|
|
|
|
|
|
|
cli.run(["secrets", "machines", "remove-secret", "machine1", "key"])
|
|
|
|
|
|
|
|
cli.run(["secrets", "users", "add", "user1", age_keys[1].pubkey])
|
|
|
|
cli.run(["secrets", "users", "add-secret", "user1", "key"])
|
|
|
|
capsys.readouterr()
|
|
|
|
with use_key(age_keys[1].privkey, monkeypatch):
|
|
|
|
cli.run(["secrets", "get", "key"])
|
|
|
|
assert capsys.readouterr().out == "foo"
|
|
|
|
cli.run(["secrets", "users", "remove-secret", "user1", "key"])
|
|
|
|
|
|
|
|
with pytest.raises(ClanError): # does not exist yet
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", "groups", "add-secret", "admin-group", "key"])
|
2023-08-26 09:44:38 +00:00
|
|
|
cli.run(["secrets", "groups", "add-user", "admin-group", "user1"])
|
|
|
|
cli.run(["secrets", "groups", "add-user", "admin-group", owner])
|
|
|
|
cli.run(["secrets", "groups", "add-secret", "admin-group", "key"])
|
2023-08-08 11:44:15 +00:00
|
|
|
|
2023-08-26 09:44:38 +00:00
|
|
|
capsys.readouterr() # empty the buffer
|
|
|
|
cli.run(["secrets", "set", "--group", "admin-group", "key2"])
|
2023-08-08 17:40:35 +00:00
|
|
|
|
2023-08-26 09:44:38 +00:00
|
|
|
with use_key(age_keys[1].privkey, monkeypatch):
|
|
|
|
capsys.readouterr()
|
|
|
|
cli.run(["secrets", "get", "key"])
|
|
|
|
assert capsys.readouterr().out == "foo"
|
|
|
|
cli.run(["secrets", "groups", "remove-secret", "admin-group", "key"])
|
2023-08-08 11:44:15 +00:00
|
|
|
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", "remove", "key"])
|
|
|
|
cli.run(["secrets", "remove", "key2"])
|
2023-08-02 09:36:49 +00:00
|
|
|
|
|
|
|
capsys.readouterr() # empty the buffer
|
2023-08-24 15:29:31 +00:00
|
|
|
cli.run(["secrets", "list"])
|
2023-08-02 09:36:49 +00:00
|
|
|
assert capsys.readouterr().out == ""
|