Files
vault-tools/vctx/keyring_test.go
T
unkin-agent 42048ae6ee
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
Encrypt cached tokens with a kernel keyring key
2026-10-23 23:07:35 +11:00

47 lines
1.2 KiB
Go

package main
import (
"errors"
"fmt"
"os"
"strings"
"testing"
"git.unkin.net/unkin/golib/keyring"
"git.unkin.net/unkin/vault-tools/shared"
"golang.org/x/sys/unix"
)
// TestMain seals tokens with a run-unique key, skipping outside CI where
// keyctl is unimplemented.
func TestMain(m *testing.M) {
shared.KeyringDesc = fmt.Sprintf("vault-tools-test:vctx:%d", os.Getpid())
k, err := keyring.Open(shared.KeyringDesc)
if errors.Is(err, unix.ENOSYS) && os.Getenv("CI") == "" {
fmt.Println("skipping: kernel keyring unavailable:", err)
os.Exit(0)
}
if err != nil {
fmt.Println(err)
os.Exit(1)
}
code := m.Run()
_ = k.Forget()
os.Exit(code)
}
func TestBuildInvocationLockedToken(t *testing.T) {
setupVctx(t, vctxConfig, map[string]shared.Token{"sydney": {Address: "https://v", Token: "s.X"}})
k, err := keyring.Open(shared.KeyringDesc)
if err != nil {
t.Fatal(err)
}
if err := k.Forget(); err != nil {
t.Fatal(err)
}
_, _, _, err = buildInvocation("sydney", "", []string{"status"}, nil)
if !errors.Is(err, shared.ErrLocked) || !strings.Contains(err.Error(), "vcm login sydney") {
t.Fatalf("buildInvocation = %v, want ErrLocked with login hint", err)
}
}