fix(secrets-cli): contain file-source key IO/access errors in doctor + bundle-import flows

2026-07-19 10:38:16 -04:00
parent 6dbb372adf
commit 980b4a37f6
4 changed files with 103 additions and 4 deletions
@@ -226,6 +226,41 @@ public sealed class KekDoctorFlowTests : IAsyncLifetime, IDisposable
        Assert.Equal(_kekA.KekId, (await GetAsync("svc/a")).KekId); // nothing changed
    }

+    [Fact]
+    public async Task File_old_key_source_permission_denied_renders_friendly_error_and_still_re_diagnoses()
+    {
+        Skip.IfNot(!OperatingSystem.IsWindows(), "Unix permission bits are exercised via UnixFileMode.");
+
+        await SeedAsync("svc/a", "value-a", _kekA);
+        SecretsSession session = Session(_kekB);
+
+        // A key file that exists (so FileMasterKeyProvider's File.Exists gate passes) but has no read
+        // permission: File.ReadAllBytes inside ResolveKeyBytes throws UnauthorizedAccessException, which
+        // FileMasterKeyProvider does not itself wrap into MasterKeyUnavailableException.
+        string keyFilePath = Path.Combine(Path.GetTempPath(), $"zb-secrets-doctorflow-nokey-{Guid.NewGuid():N}");
+        await File.WriteAllBytesAsync(keyFilePath, new byte[32], CancellationToken.None);
+        File.SetUnixFileMode(keyFilePath, UnixFileMode.None);
+        try
+        {
+            TestConsole console = NewConsole();
+            console.Input.PushKey(ConsoleKey.Enter);     // "Rewrap from old KEK"
+            console.Input.PushKey(ConsoleKey.DownArrow); // old-key source: skip "Environment variable"
+            console.Input.PushKey(ConsoleKey.Enter);     // choose "Key file" (index 1)
+            console.Input.PushTextWithEnter(keyFilePath);
+
+            await new KekDoctorFlow().RunAsync(console, session, CancellationToken.None);
+
+            Assert.Contains("Old KEK unavailable", console.Output, StringComparison.Ordinal); // contained
+            Assert.Contains("Re-diagnosis", console.Output, StringComparison.Ordinal); // closing summary still runs
+            Assert.Equal(_kekA.KekId, (await GetAsync("svc/a")).KekId); // nothing changed
+        }
+        finally
+        {
+            File.SetUnixFileMode(keyFilePath, UnixFileMode.UserRead | UnixFileMode.UserWrite);
+            File.Delete(keyFilePath);
+        }
+    }
+
    [Fact]
    public async Task Corrupt_row_is_offered_reset_as_the_only_remedy()
    {