hyperhive/nix/script-tests/store-seeded-secret.sh

# Cases for ./store-seeded-secret.nix. Each case sets up the store's leaf, the
# earlier file and the stub's behaviour, runs `store_seeded` under `set -e` as
# the callers' scripts do, and compares its exit status, its output, what the
# store holds afterwards and whether the mint command ran.
set -uo pipefail

failures=0
count=0

fail() {
  echo "FAILED: $case: $*" >&2
  failures=$((failures + 1))
}

leaf=secret/swarm/services/t/keys/k
pem=$'-----BEGIN PRIVATE KEY-----\nMIIfake\nline2\n-----END PRIVATE KEY-----'

# setup <description>
setup() {
  case=$1
  count=$((count + 1))
  dir=$(mktemp -d)
  mkdir "$dir/kv"
  export FAKE_BAO_KV=$dir/kv FAKE_BAO_LOG=$dir/bao.log FAKE_BAO_LOGIN_RC=0
  unset FAKE_BAO_DENY_READ FAKE_BAO_DENY_WRITE FAKE_BAO_RACE FAKE_BAO_READ_TIMEOUT FAKE_BAO_READ_5XX
  : >"$FAKE_BAO_LOG"
  earlier=$dir/earlier
  minted=$dir/minted
  stored=$FAKE_BAO_KV/$(printf '%s' "$leaf" | tr / _)
}

mint() {
  echo run >>"$minted"
  printf 'minted-value\n'
}

# run — `store_seeded` for $leaf and $earlier with the stub first on PATH.
# Sets $rc and $got.
run() {
  got=$(
    set -e
    PATH="$FAKE_BAO_BIN:$PATH"
    unset BAO_TOKEN
    # shellcheck source=/dev/null
    . "$HELPER"
    store_init
    store_login 2>>"$dir/err"
    store_seeded "$leaf" "$earlier" mint 2>"$dir/err"
  )
  rc=$?
}

# expect <status> <output>
expect() {
  if [ "$rc" != "$1" ]; then fail "exited $rc, wanted $1: $(cat "$dir/err")"; fi
  if [ "$got" != "$2" ]; then fail "printed '$got', wanted '$2'"; fi
}

# held <value>, or held "" for a leaf the store does not have.
held() {
  if [ -z "$1" ]; then
    if [ -e "$stored" ]; then fail "the store holds '$(cat "$stored")', wanted nothing"; fi
  elif [ "$(cat "$stored" 2>/dev/null)" != "$1" ]; then
    fail "the store holds '$(cat "$stored" 2>/dev/null)', wanted '$1'"
  fi
}

ran_mint() {
  [ -s "$minted" ]
}

no_write() {
  if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote to the store"; fi
}

no_mint() {
  if ran_mint; then fail "ran the mint command"; fi
}

# err_has <text>: the run's stderr contains it.
err_has() {
  if ! grep -qF -- "$1" "$dir/err"; then fail "stderr lacks '$1': $(cat "$dir/err")"; fi
}

setup "an empty store is seeded from the file, unchanged, and nothing is minted"
printf 'old-value\n' >"$earlier"
run
expect 0 old-value
held old-value
if ran_mint; then fail "minted although the file held a value"; fi
if ! grep -q '^kv put -cas=0 ' "$FAKE_BAO_LOG"; then fail "no create-only write was made"; fi

setup "a multi-line file is seeded unchanged"
printf '%s\n' "$pem" >"$earlier"
run
expect 0 "$pem"
held "$pem"

setup "the store's value wins over the file and is not written over"
printf 'stored-value' >"$stored"
printf 'old-value\n' >"$earlier"
run
expect 0 stored-value
held stored-value
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote to a leaf that held a value"; fi
if ran_mint; then fail "minted although the store held a value"; fi

setup "the store's value is used when there is no file"
printf 'stored-value' >"$stored"
run
expect 0 stored-value
if ran_mint; then fail "minted although the store held a value"; fi

setup "a value is minted into the store when neither holds one"
run
expect 0 minted-value
held minted-value
if ! ran_mint; then fail "did not mint"; fi

setup "a run that loses the race takes the winner's value, not its own seed"
printf 'old-value\n' >"$earlier"
export FAKE_BAO_RACE=winner-value
run
expect 0 winner-value
held winner-value

setup "a refused read uses the file's value, writes nothing, mints nothing and prints the refusal"
printf 'old-value\n' >"$earlier"
export FAKE_BAO_DENY_READ=1 FAKE_BAO_DENY_WRITE=1
run
expect 0 old-value
held ""
no_write
no_mint
err_has "could not read $leaf from the swarm secret store"
err_has "permission denied"
err_has "using the value of $earlier"

setup "a refused read, and no file, fails without writing or minting and prints the refusal"
export FAKE_BAO_DENY_READ=1 FAKE_BAO_DENY_WRITE=1
run
expect 1 ""
held ""
no_write
no_mint
err_has "could not read $leaf from the swarm secret store"
err_has "permission denied"

setup "a read that times out uses the file's value without writing, and says why"
printf 'old-value\n' >"$earlier"
export FAKE_BAO_READ_TIMEOUT=1
run
expect 0 old-value
held ""
no_write
no_mint
err_has "could not read $leaf from the swarm secret store (exit status 124)"

setup "a read that times out, and no file, fails without writing or minting"
export FAKE_BAO_READ_TIMEOUT=1
run
expect 1 ""
held ""
no_write
no_mint
err_has "(exit status 124)"

setup "a read that times out on a leaf the store holds leaves the leaf as it is"
printf 'stored-value' >"$stored"
printf 'old-value\n' >"$earlier"
export FAKE_BAO_READ_TIMEOUT=1
run
expect 0 old-value
held stored-value
no_write
no_mint

setup "a read that gets a server error, and no file, fails without writing and prints the error"
export FAKE_BAO_READ_5XX=1
run
expect 1 ""
held ""
no_write
no_mint
err_has "Code: 503"

setup "a leaf the store does not hold is the only read failure that mints, and no error is printed"
run
expect 0 minted-value
held minted-value
if ! ran_mint; then fail "did not mint"; fi
if grep -q 'could not read' "$dir/err"; then fail "reported a missing leaf as a failed read"; fi

setup "a store that takes no write leaves the file's value in use"
printf 'old-value\n' >"$earlier"
export FAKE_BAO_DENY_WRITE=1
run
expect 0 old-value
held ""
if ran_mint; then fail "minted although the file held a value"; fi

setup "a store that refuses the login leaves the file's value in use and is not called again"
printf 'old-value\n' >"$earlier"
export FAKE_BAO_LOGIN_RC=1
run
expect 0 old-value
if grep -q '^kv' "$FAKE_BAO_LOG"; then fail "called kv after a refused login"; fi

setup "a store that refuses the login, and no file, gives no value"
export FAKE_BAO_LOGIN_RC=1
run
expect 1 ""
if ran_mint; then fail "minted with no store to hold the value"; fi

if [ "$failures" != 0 ]; then
  echo "$failures of $count cases failed" >&2
  exit 1
fi
echo "$count cases passed"