dohertj2/scadaproj
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(secrets-cli): structural no-plaintext assert (base64 '+' JSON-escaping flake) + override doc note

Browse Source
This commit is contained in:
Joseph Doherty
2026-07-19 09:46:26 -04:00
parent 779f8a8d78
commit 6ad710bdbd
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Cli/Interactive/BundleService.cs
+4 -1
View File
@@ -99,7 +99,10 @@ public sealed class BundleService
/// verbatim replicate would be silently rejected by the LWW gate, so that single case is written /// verbatim replicate would be silently rejected by the LWW gate, so that single case is written
/// through <see cref="ISecretStore.UpsertAsync"/> instead — a local-write that restamps the row as /// through <see cref="ISecretStore.UpsertAsync"/> instead — a local-write that restamps the row as
/// current, which is exactly what makes the operator's forced choice durable rather than flipped /// current, which is exactly what makes the operator's forced choice durable rather than flipped
/// back on the next reconciliation. /// back on the next reconciliation. Note the narrowed remnant of this: a
/// <paramref name="conflictOverride"/> that forces an <em>older, tombstoned</em> bundle row over a
/// newer live local row resurrects it, because that forced <see cref="ISecretStore.UpsertAsync"/>
/// path clears the tombstone.
/// </para> /// </para>
/// </remarks> /// </remarks>
/// <param name="session">The full session to import into.</param> /// <param name="session">The full session to import into.</param>
ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/BundleServiceTests.cs
+6 -2
View File
@@ -239,11 +239,15 @@ public sealed class BundleServiceTests : IDisposable
string raw = await File.ReadAllTextAsync(BundlePath, CancellationToken.None); string raw = await File.ReadAllTextAsync(BundlePath, CancellationToken.None);
Assert.DoesNotContain(sentinel, raw, StringComparison.Ordinal); Assert.DoesNotContain(sentinel, raw, StringComparison.Ordinal);
// The base64 ciphertext of the sealed row is present in the file. // The base64 ciphertext of the sealed row is present in the file. Assert structurally through
// the codec rather than by raw-text match: System.Text.Json escapes '+' as +, so a raw
// Contains on the base64 string is flaky whenever the ciphertext base64 contains a '+'.
StoredSecret? row = await source.Store.GetAsync(new SecretName("svc/secret"), CancellationToken.None); StoredSecret? row = await source.Store.GetAsync(new SecretName("svc/secret"), CancellationToken.None);
Assert.NotNull(row); Assert.NotNull(row);
Assert.Contains(Convert.ToBase64String(row!.Ciphertext), raw, StringComparison.Ordinal);
Assert.Contains("\"Ciphertext\"", raw, StringComparison.Ordinal); Assert.Contains("\"Ciphertext\"", raw, StringComparison.Ordinal);
SecretBundle parsed = SecretBundleCodec.Deserialize(raw);
BundleEntry parsedEntry = Assert.Single(parsed.Entries);
Assert.Equal(Convert.ToBase64String(row!.Ciphertext), parsedEntry.Ciphertext);
} }
[Fact] [Fact]