nullkey
a39805aa89
Empty cli/ Go module with Factory + Options skeleton that all v0.x commands plug into. Foundation packages (10 internal/): - cmdutil: Factory(3 closure: Config/Client/Prompter) + Options + Errors with namespaced ErrorCode + typed predicates (IsAuthError / IsNotFound / IsTransient / IsAuthExpired) + Exporter + AddJSONFlags + ExitCode/PrintError - iostreams: package singleton with TTY detection; ColorEnabled honors NO_COLOR / TERM=dumb on demand - agent: mode + detect + annotations (Stripe pkg/useragent pattern; CLAUDECODE / CURSOR_AGENT / CODEX_* / AIDER_* / CONTINUE_* / OPENCODE_* / GEMINICODER env detection) - build: ldflags-injected version/commit/date - safepaths: separator-aware path-traversal protection - config: yaml.v3 schema + atomic save 0600 (XDG-style) - format: success/failure envelope (code/hint/request_id/risk/retryable/ console_url) with typed RiskLevel - prompt: Prompter interface + AgentPrompter (rejects in agent mode) - secrets: file 0600 store with weknora:<context>:<key> namespace - testutil: XDGTempDir(t) test helper Smoke command: weknora version (-/--json). Build/test/vet matrix in .github/workflows/cli.yml across linux x macos x windows x Go 1.24. Factory.Client returns CodeLocalUnimplemented until PR-3 wires the SDK adapter; PR-1 commands (version) don't need it.
88 lines
2.4 KiB
Go
88 lines
2.4 KiB
Go
package secrets
|
|
|
|
import (
|
|
"errors"
|
|
"os"
|
|
"runtime"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/Tencent/WeKnora/cli/internal/testutil"
|
|
)
|
|
|
|
func TestFileStore_RoundTrip(t *testing.T) {
|
|
testutil.XDGTempDir(t)
|
|
s, err := NewFileStore()
|
|
require.NoError(t, err)
|
|
|
|
_, err = s.Get("prod", "access")
|
|
require.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrNotFound))
|
|
|
|
require.NoError(t, s.Set("prod", "access", "secret-value"))
|
|
got, err := s.Get("prod", "access")
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "secret-value", got)
|
|
|
|
require.NoError(t, s.Delete("prod", "access"))
|
|
_, err = s.Get("prod", "access")
|
|
require.True(t, errors.Is(err, ErrNotFound))
|
|
|
|
require.NoError(t, s.Delete("prod", "access"), "Delete on missing must be a no-op")
|
|
}
|
|
|
|
func TestFileStore_FileMode(t *testing.T) {
|
|
if runtime.GOOS == "windows" {
|
|
t.Skip("file mode bits don't map to Windows ACLs; 0600 invariant is Unix-only")
|
|
}
|
|
testutil.XDGTempDir(t)
|
|
s, err := NewFileStore()
|
|
require.NoError(t, err)
|
|
require.NoError(t, s.Set("prod", "access", "v"))
|
|
|
|
st, err := os.Stat(s.path("prod", "access"))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, os.FileMode(0o600), st.Mode().Perm(), "secrets must be 0600")
|
|
}
|
|
|
|
func TestFileStore_NamespaceIsolation(t *testing.T) {
|
|
testutil.XDGTempDir(t)
|
|
s, err := NewFileStore()
|
|
require.NoError(t, err)
|
|
require.NoError(t, s.Set("prod", "access", "P"))
|
|
require.NoError(t, s.Set("staging", "access", "S"))
|
|
|
|
got, _ := s.Get("prod", "access")
|
|
assert.Equal(t, "P", got)
|
|
got, _ = s.Get("staging", "access")
|
|
assert.Equal(t, "S", got)
|
|
}
|
|
|
|
func TestFileStore_Ref(t *testing.T) {
|
|
testutil.XDGTempDir(t)
|
|
s, err := NewFileStore()
|
|
require.NoError(t, err)
|
|
ref := s.Ref("prod", "access")
|
|
// Ref is RFC 8089: scheme + slash-normalized path. On Windows the path
|
|
// starts with a drive letter (file:///C:/...); on Unix file:///home/...
|
|
assert.True(t, strings.HasPrefix(ref, "file:///"), "expected file:/// scheme, got %q", ref)
|
|
assert.Contains(t, ref, "/prod/access")
|
|
}
|
|
|
|
func TestMemStore_RoundTripAndRef(t *testing.T) {
|
|
s := NewMemStore()
|
|
_, err := s.Get("p", "k")
|
|
require.ErrorIs(t, err, ErrNotFound)
|
|
require.NoError(t, s.Set("p", "k", "v"))
|
|
got, err := s.Get("p", "k")
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "v", got)
|
|
assert.Equal(t, "mem://p/k", s.Ref("p", "k"))
|
|
require.NoError(t, s.Delete("p", "k"))
|
|
_, err = s.Get("p", "k")
|
|
require.ErrorIs(t, err, ErrNotFound)
|
|
}
|