feat(secrets): sqlite secret store (overwrite-in-place, tombstone, manifest, LWW)

2026-07-15 16:50:59 -04:00
parent e99a8731e9
commit 10455ec53b
3 changed files with 530 additions and 1 deletions
@@ -0,0 +1,227 @@
+using Microsoft.Data.Sqlite;
+using ZB.MOM.WW.Secrets.Abstractions;
+using ZB.MOM.WW.Secrets.Sqlite;
+
+namespace ZB.MOM.WW.Secrets.Tests.Sqlite;
+
+public sealed class SqliteSecretStoreTests : IAsyncLifetime, IDisposable
+{
+    private readonly string _dbPath =
+        Path.Combine(Path.GetTempPath(), $"zb-secrets-store-{Guid.NewGuid():N}.db");
+
+    private readonly SecretsSqliteConnectionFactory _factory;
+    private readonly SqliteSecretStore _store;
+
+    public SqliteSecretStoreTests()
+    {
+        _factory = new SecretsSqliteConnectionFactory(_dbPath);
+        _store = new SqliteSecretStore(_factory);
+    }
+
+    public async Task InitializeAsync() =>
+        await new SqliteSecretsStoreMigrator(_factory).MigrateAsync(CancellationToken.None);
+
+    public Task DisposeAsync() => Task.CompletedTask;
+
+    private static StoredSecret MakeSecret(
+        string name,
+        long revision = 0,
+        byte[]? ciphertext = null,
+        DateTimeOffset? updatedUtc = null,
+        DateTimeOffset? createdUtc = null,
+        bool isDeleted = false,
+        DateTimeOffset? deletedUtc = null,
+        string? createdBy = "alice",
+        string? updatedBy = "alice") => new()
+        {
+            Name = new SecretName(name),
+            Description = "desc",
+            ContentType = SecretContentType.ConnectionString,
+            Ciphertext = ciphertext ?? [1, 2, 3],
+            Nonce = [4, 5, 6],
+            Tag = [7, 8, 9],
+            WrappedDek = [10, 11, 12],
+            WrapNonce = [13, 14, 15],
+            WrapTag = [16, 17, 18],
+            KekId = "kek-1",
+            Revision = revision,
+            IsDeleted = isDeleted,
+            DeletedUtc = deletedUtc,
+            CreatedUtc = createdUtc ?? DateTimeOffset.UtcNow,
+            UpdatedUtc = updatedUtc ?? DateTimeOffset.UtcNow,
+            CreatedBy = createdBy,
+            UpdatedBy = updatedBy,
+        };
+
+    [Fact]
+    public async Task Upsert_Then_Get_RoundTrips()
+    {
+        StoredSecret row = MakeSecret("app/db-conn");
+        await _store.UpsertAsync(row, CancellationToken.None);
+
+        StoredSecret? got = await _store.GetAsync(new SecretName("app/db-conn"), CancellationToken.None);
+
+        Assert.NotNull(got);
+        Assert.Equal("app/db-conn", got!.Name.Value);
+        Assert.Equal("desc", got.Description);
+        Assert.Equal(SecretContentType.ConnectionString, got.ContentType);
+        Assert.Equal(new byte[] { 1, 2, 3 }, got.Ciphertext);
+        Assert.Equal(new byte[] { 4, 5, 6 }, got.Nonce);
+        Assert.Equal(new byte[] { 7, 8, 9 }, got.Tag);
+        Assert.Equal(new byte[] { 10, 11, 12 }, got.WrappedDek);
+        Assert.Equal(new byte[] { 13, 14, 15 }, got.WrapNonce);
+        Assert.Equal(new byte[] { 16, 17, 18 }, got.WrapTag);
+        Assert.Equal("kek-1", got.KekId);
+        Assert.Equal(0, got.Revision);
+        Assert.False(got.IsDeleted);
+        Assert.Null(got.DeletedUtc);
+        Assert.Equal("alice", got.CreatedBy);
+        Assert.Equal("alice", got.UpdatedBy);
+    }
+
+    [Fact]
+    public async Task Get_ReturnsNull_WhenAbsent()
+    {
+        StoredSecret? got = await _store.GetAsync(new SecretName("nope"), CancellationToken.None);
+        Assert.Null(got);
+    }
+
+    [Fact]
+    public async Task Upsert_Existing_OverwritesInPlace_BumpsRevision()
+    {
+        StoredSecret first = MakeSecret("app/rotating", ciphertext: [1, 1, 1], createdBy: "alice", updatedBy: "alice");
+        await _store.UpsertAsync(first, CancellationToken.None);
+
+        StoredSecret afterFirst = (await _store.GetAsync(new SecretName("app/rotating"), CancellationToken.None))!;
+        Assert.Equal(0, afterFirst.Revision);
+        DateTimeOffset originalCreatedUtc = afterFirst.CreatedUtc;
+
+        // Second write: different crypto bytes and a different actor.
+        StoredSecret second = MakeSecret("app/rotating", ciphertext: [9, 9, 9], createdBy: "bob", updatedBy: "bob");
+        await _store.UpsertAsync(second, CancellationToken.None);
+
+        StoredSecret afterSecond = (await _store.GetAsync(new SecretName("app/rotating"), CancellationToken.None))!;
+        Assert.Equal(1, afterSecond.Revision);
+        Assert.Equal(new byte[] { 9, 9, 9 }, afterSecond.Ciphertext);
+        // created_utc / created_by are preserved from the original insert.
+        Assert.Equal(originalCreatedUtc, afterSecond.CreatedUtc);
+        Assert.Equal("alice", afterSecond.CreatedBy);
+        // updated_by reflects the second write.
+        Assert.Equal("bob", afterSecond.UpdatedBy);
+        Assert.False(afterSecond.IsDeleted);
+    }
+
+    [Fact]
+    public async Task List_ExcludesTombstoned_ByDefault()
+    {
+        await _store.UpsertAsync(MakeSecret("keep"), CancellationToken.None);
+        await _store.UpsertAsync(MakeSecret("gone"), CancellationToken.None);
+        await _store.DeleteAsync(new SecretName("gone"), "carol", CancellationToken.None);
+
+        IReadOnlyList<SecretMetadata> visible = await _store.ListAsync(includeDeleted: false, CancellationToken.None);
+        Assert.DoesNotContain(visible, m => m.Name.Value == "gone");
+        Assert.Contains(visible, m => m.Name.Value == "keep");
+
+        IReadOnlyList<SecretMetadata> all = await _store.ListAsync(includeDeleted: true, CancellationToken.None);
+        Assert.Contains(all, m => m.Name.Value == "gone");
+        Assert.Contains(all, m => m.Name.Value == "keep");
+
+        // Compile-time proof the projection carries no byte[] members: SecretMetadata is the element type.
+        SecretMetadata sample = all[0];
+        Assert.NotNull(sample);
+    }
+
+    [Fact]
+    public async Task Delete_SetsTombstone_BumpsRevision_ReturnsFalseWhenAbsent()
+    {
+        await _store.UpsertAsync(MakeSecret("app/secret"), CancellationToken.None);
+
+        bool first = await _store.DeleteAsync(new SecretName("app/secret"), "carol", CancellationToken.None);
+        Assert.True(first);
+
+        StoredSecret tombstoned = (await _store.GetAsync(new SecretName("app/secret"), CancellationToken.None))!;
+        Assert.True(tombstoned.IsDeleted);
+        Assert.NotNull(tombstoned.DeletedUtc);
+        Assert.Equal(1, tombstoned.Revision);
+        Assert.Equal("carol", tombstoned.UpdatedBy);
+
+        // Deleting an already-tombstoned row returns false.
+        bool second = await _store.DeleteAsync(new SecretName("app/secret"), "carol", CancellationToken.None);
+        Assert.False(second);
+
+        // Deleting an unknown name returns false.
+        bool unknown = await _store.DeleteAsync(new SecretName("never-existed"), "carol", CancellationToken.None);
+        Assert.False(unknown);
+    }
+
+    [Fact]
+    public async Task GetManifest_ReturnsAllRows()
+    {
+        await _store.UpsertAsync(MakeSecret("a"), CancellationToken.None);
+        await _store.UpsertAsync(MakeSecret("b"), CancellationToken.None);
+        await _store.DeleteAsync(new SecretName("b"), "carol", CancellationToken.None);
+
+        IReadOnlyList<SecretManifestEntry> manifest = await _store.GetManifestAsync(CancellationToken.None);
+
+        Assert.Equal(2, manifest.Count);
+        SecretManifestEntry a = manifest.Single(e => e.Name.Value == "a");
+        SecretManifestEntry b = manifest.Single(e => e.Name.Value == "b");
+        Assert.False(a.IsDeleted);
+        Assert.Equal(0, a.Revision);
+        Assert.True(b.IsDeleted);
+        Assert.Equal(1, b.Revision);
+    }
+
+    [Fact]
+    public async Task ApplyReplicated_AppliesNewer_IgnoresStale()
+    {
+        DateTimeOffset t1 = new(2026, 1, 1, 0, 0, 0, TimeSpan.Zero);
+        DateTimeOffset t2 = new(2026, 1, 2, 0, 0, 0, TimeSpan.Zero);
+        DateTimeOffset t3 = new(2026, 1, 3, 0, 0, 0, TimeSpan.Zero);
+
+        // Seed a local row at revision 5 / T2.
+        StoredSecret seed = MakeSecret("repl", revision: 5, ciphertext: [5, 5, 5], updatedUtc: t2, createdUtc: t1);
+        await _store.ApplyReplicatedAsync(seed, CancellationToken.None);
+
+        StoredSecret afterSeed = (await _store.GetAsync(new SecretName("repl"), CancellationToken.None))!;
+        Assert.Equal(5, afterSeed.Revision);
+
+        // Newer row (revision 6 / T3) is applied verbatim (revision NOT bumped past 6).
+        StoredSecret newer = MakeSecret("repl", revision: 6, ciphertext: [6, 6, 6], updatedUtc: t3, createdUtc: t1);
+        await _store.ApplyReplicatedAsync(newer, CancellationToken.None);
+
+        StoredSecret afterNewer = (await _store.GetAsync(new SecretName("repl"), CancellationToken.None))!;
+        Assert.Equal(6, afterNewer.Revision);
+        Assert.Equal(new byte[] { 6, 6, 6 }, afterNewer.Ciphertext);
+        Assert.Equal(t3, afterNewer.UpdatedUtc);
+
+        // Stale row (revision 4 / T1) is ignored.
+        StoredSecret stale = MakeSecret("repl", revision: 4, ciphertext: [4, 4, 4], updatedUtc: t1, createdUtc: t1);
+        await _store.ApplyReplicatedAsync(stale, CancellationToken.None);
+
+        StoredSecret afterStale = (await _store.GetAsync(new SecretName("repl"), CancellationToken.None))!;
+        Assert.Equal(6, afterStale.Revision);
+        Assert.Equal(new byte[] { 6, 6, 6 }, afterStale.Ciphertext);
+    }
+
+    public void Dispose()
+    {
+        // Drop pooled connections so the WAL/-shm/-wal sidecars release before we delete.
+        SqliteConnection.ClearAllPools();
+
+        foreach (string path in new[] { _dbPath, _dbPath + "-wal", _dbPath + "-shm" })
+        {
+            try
+            {
+                if (File.Exists(path))
+                {
+                    File.Delete(path);
+                }
+            }
+            catch (IOException)
+            {
+                // Best-effort temp cleanup; a leaked temp file is not a test failure.
+            }
+        }
+    }
+}