feat(secrets-cli): set/get/list/rm/rotate commands

2026-07-15 17:26:14 -04:00
parent 21556cc1a7
commit 0ab276dac0
7 changed files with 504 additions and 3 deletions
@@ -0,0 +1,156 @@
+using ZB.MOM.WW.Audit;
+using ZB.MOM.WW.Secrets.Abstractions;
+using ZB.MOM.WW.Secrets.Cli;
+using ZB.MOM.WW.Secrets.Crypto;
+using ZB.MOM.WW.Secrets.Sqlite;
+using ZB.MOM.WW.Secrets.Tests.Fakes;
+
+namespace ZB.MOM.WW.Secrets.Tests.Cli;
+
+/// <summary>
+/// Exercises the headless <see cref="SecretCommands"/> layer over a real migrated SQLite store,
+/// the real envelope cipher, and the real resolver — asserting round-trips, exit codes, and the
+/// hard invariant that list/set output never carries a plaintext value.
+/// </summary>
+public sealed class SecretCommandsTests : IAsyncLifetime, IDisposable
+{
+    private readonly string _dbPath =
+        Path.Combine(Path.GetTempPath(), $"zb-secrets-cli-{Guid.NewGuid():N}.db");
+
+    private readonly SecretsSqliteConnectionFactory _factory;
+    private readonly SqliteSecretStore _store;
+    private readonly AesGcmEnvelopeCipher _cipher;
+    private readonly DefaultSecretResolver _resolver;
+
+    public SecretCommandsTests()
+    {
+        _factory = new SecretsSqliteConnectionFactory(_dbPath);
+        _store = new SqliteSecretStore(_factory);
+        _cipher = new AesGcmEnvelopeCipher(new FakeMasterKeyProvider("kek-cli"));
+        // A near-zero TTL keeps the resolver from serving a stale plaintext across a rotate/remove.
+        _resolver = new DefaultSecretResolver(
+            _store, _cipher, NoOpAuditWriter.Instance, TimeSpan.Zero);
+    }
+
+    public async Task InitializeAsync() =>
+        await new SqliteSecretsStoreMigrator(_factory).MigrateAsync(CancellationToken.None);
+
+    public Task DisposeAsync() => Task.CompletedTask;
+
+    public void Dispose()
+    {
+        if (File.Exists(_dbPath))
+        {
+            try { File.Delete(_dbPath); } catch (IOException) { /* best-effort temp cleanup */ }
+        }
+    }
+
+    private (SecretCommands cmd, StringWriter output) NewSut()
+    {
+        var output = new StringWriter();
+        return (new SecretCommands(_store, _cipher, _resolver, output), output);
+    }
+
+    private static CancellationToken Ct => CancellationToken.None;
+
+    [Fact]
+    public async Task Set_Then_Get_RoundTrips()
+    {
+        var (cmd, setOut) = NewSut();
+
+        int setRc = await cmd.SetAsync(
+            "sql/db-conn", "hunter2", SecretContentType.ConnectionString, "prod db", "alice", Ct);
+
+        Assert.Equal(0, setRc);
+        // set confirmation must NOT leak the value.
+        Assert.DoesNotContain("hunter2", setOut.ToString());
+        Assert.Contains("\"action\":\"set\"", setOut.ToString());
+        Assert.Contains("sql/db-conn", setOut.ToString());
+
+        // A fresh writer for get so we can assert exactly the plaintext came back.
+        var getOut = new StringWriter();
+        var getCmd = new SecretCommands(_store, _cipher, _resolver, getOut);
+        int getRc = await getCmd.GetAsync("sql/db-conn", Ct);
+
+        Assert.Equal(0, getRc);
+        Assert.Equal("hunter2", getOut.ToString().TrimEnd('\r', '\n'));
+    }
+
+    [Fact]
+    public async Task List_PrintsMetadata_NoValues()
+    {
+        var (cmd, _) = NewSut();
+        await cmd.SetAsync("app/one", "value-one", SecretContentType.Text, null, "alice", Ct);
+        await cmd.SetAsync("app/two", "value-two", SecretContentType.Json, "second", "alice", Ct);
+
+        var listOut = new StringWriter();
+        var listCmd = new SecretCommands(_store, _cipher, _resolver, listOut);
+        int rc = await listCmd.ListAsync(includeDeleted: false, Ct);
+
+        string json = listOut.ToString();
+        Assert.Equal(0, rc);
+        Assert.Contains("app/one", json);
+        Assert.Contains("app/two", json);
+        Assert.DoesNotContain("value-one", json);
+        Assert.DoesNotContain("value-two", json);
+    }
+
+    [Fact]
+    public async Task Rm_Tombstones()
+    {
+        var (cmd, _) = NewSut();
+        await cmd.SetAsync("app/gone", "bye", SecretContentType.Text, null, "alice", Ct);
+
+        var rm1Out = new StringWriter();
+        int rc1 = await new SecretCommands(_store, _cipher, _resolver, rm1Out).RemoveAsync("app/gone", "alice", Ct);
+        Assert.Equal(0, rc1);
+        Assert.Contains("\"found\":true", rm1Out.ToString());
+
+        // Second remove: already tombstoned → not found.
+        var rm2Out = new StringWriter();
+        int rc2 = await new SecretCommands(_store, _cipher, _resolver, rm2Out).RemoveAsync("app/gone", "alice", Ct);
+        Assert.NotEqual(0, rc2);
+        Assert.Contains("\"found\":false", rm2Out.ToString());
+
+        // Get after removal → not-found.
+        var getOut = new StringWriter();
+        int getRc = await new SecretCommands(_store, _cipher, _resolver, getOut).GetAsync("app/gone", Ct);
+        Assert.NotEqual(0, getRc);
+        Assert.Contains("not-found", getOut.ToString());
+    }
+
+    [Fact]
+    public async Task Rotate_RequiresExisting_OverwritesInPlace()
+    {
+        // Rotate on a missing secret → non-zero, nothing created.
+        var missingOut = new StringWriter();
+        int missingRc = await new SecretCommands(_store, _cipher, _resolver, missingOut)
+            .RotateAsync("app/rot", "v1", SecretContentType.Text, null, "alice", Ct);
+        Assert.NotEqual(0, missingRc);
+
+        // After a set, rotate to a new value → 0, and get returns the new value.
+        await new SecretCommands(_store, _cipher, _resolver, new StringWriter())
+            .SetAsync("app/rot", "v1", SecretContentType.Text, null, "alice", Ct);
+
+        var rotateOut = new StringWriter();
+        int rotateRc = await new SecretCommands(_store, _cipher, _resolver, rotateOut)
+            .RotateAsync("app/rot", "v2", SecretContentType.Text, null, "bob", Ct);
+        Assert.Equal(0, rotateRc);
+        Assert.Contains("\"action\":\"rotate\"", rotateOut.ToString());
+        Assert.DoesNotContain("v2", rotateOut.ToString());
+
+        var getOut = new StringWriter();
+        await new SecretCommands(_store, _cipher, _resolver, getOut).GetAsync("app/rot", Ct);
+        Assert.Equal("v2", getOut.ToString().TrimEnd('\r', '\n'));
+    }
+
+    [Fact]
+    public async Task Get_MissingSecret_ReturnsNonZero()
+    {
+        var (cmd, output) = NewSut();
+        int rc = await cmd.GetAsync("nope/missing", Ct);
+
+        Assert.NotEqual(0, rc);
+        Assert.Contains("not-found", output.ToString());
+    }
+}
@@ -21,6 +21,7 @@
  <ItemGroup>
    <ProjectReference Include="..\..\src\ZB.MOM.WW.Secrets\ZB.MOM.WW.Secrets.csproj" />
    <ProjectReference Include="..\..\src\ZB.MOM.WW.Secrets.Abstractions\ZB.MOM.WW.Secrets.Abstractions.csproj" />
+    <ProjectReference Include="..\..\src\ZB.MOM.WW.Secrets.Cli\ZB.MOM.WW.Secrets.Cli.csproj" />
  </ItemGroup>

 </Project>