narratio/internal/app/secrets_env_test.go

package app

import (
	"os"
	"path/filepath"
	"runtime"
	"strings"
	"testing"

	"gitea.maximumdirect.net/eric/narratio/internal/config"
)

func TestLoadSecretsFromConfigLoadsValidFiles(t *testing.T) {
	dir := t.TempDir()
	restoreEnvAfterTest(t, "NARRATIO_TEST_SECRET_A", "NARRATIO_TEST_SECRET_B")
	mustWriteSecretFile(t, filepath.Join(dir, "NARRATIO_TEST_SECRET_A"), "value-1\n")
	mustWriteSecretFile(t, filepath.Join(dir, "NARRATIO_TEST_SECRET_B"), "value-2\r\n")
	mustWriteSecretFile(t, filepath.Join(dir, "not-valid-name.txt"), "ignored")

	cfg := &config.Config{
		Pipeline: &config.PipelineConfig{
			Secrets: &config.SecretsConfig{EnvDir: dir},
		},
	}

	stats, err := loadSecretsFromConfig(cfg, nil)
	if err != nil {
		t.Fatalf("loadSecretsFromConfig() error = %v", err)
	}
	if stats == nil {
		t.Fatal("stats = nil, want non-nil")
	}
	if stats.Loaded != 2 {
		t.Fatalf("Loaded = %d, want 2", stats.Loaded)
	}
	if stats.PreservedExisting != 0 {
		t.Fatalf("PreservedExisting = %d, want 0", stats.PreservedExisting)
	}
	if stats.Skipped == 0 {
		t.Fatalf("Skipped = %d, want > 0 for invalid filename", stats.Skipped)
	}
	if got := os.Getenv("NARRATIO_TEST_SECRET_A"); got != "value-1" {
		t.Fatalf("NARRATIO_TEST_SECRET_A = %q, want value-1", got)
	}
	if got := os.Getenv("NARRATIO_TEST_SECRET_B"); got != "value-2" {
		t.Fatalf("NARRATIO_TEST_SECRET_B = %q, want value-2", got)
	}
}

func TestLoadSecretsFromConfigPreservesExistingEnv(t *testing.T) {
	t.Setenv("OBJECT_STORAGE_KEY", "existing")

	dir := t.TempDir()
	mustWriteSecretFile(t, filepath.Join(dir, "OBJECT_STORAGE_KEY"), "from-file\n")

	cfg := &config.Config{
		Pipeline: &config.PipelineConfig{
			Secrets: &config.SecretsConfig{EnvDir: dir},
		},
	}

	stats, err := loadSecretsFromConfig(cfg, nil)
	if err != nil {
		t.Fatalf("loadSecretsFromConfig() error = %v", err)
	}
	if stats.PreservedExisting != 1 {
		t.Fatalf("PreservedExisting = %d, want 1", stats.PreservedExisting)
	}
	if got := os.Getenv("OBJECT_STORAGE_KEY"); got != "existing" {
		t.Fatalf("OBJECT_STORAGE_KEY = %q, want existing", got)
	}
}

func TestLoadSecretsFromConfigRelativeDirUsesCWD(t *testing.T) {
	cwd := t.TempDir()
	secretsDir := filepath.Join(cwd, "secrets")
	if err := os.MkdirAll(secretsDir, secretDirectoryPrivateMode); err != nil {
		t.Fatalf("MkdirAll(%q): %v", secretsDir, err)
	}
	mustWriteSecretFile(t, filepath.Join(secretsDir, "OBJECT_STORAGE_KEY_ID"), "id-123\n")

	originalWD, err := os.Getwd()
	if err != nil {
		t.Fatalf("Getwd(): %v", err)
	}
	if err := os.Chdir(cwd); err != nil {
		t.Fatalf("Chdir(%q): %v", cwd, err)
	}
	t.Cleanup(func() {
		_ = os.Chdir(originalWD)
	})

	cfg := &config.Config{
		Pipeline: &config.PipelineConfig{
			Secrets: &config.SecretsConfig{EnvDir: "./secrets"},
		},
	}
	if _, err := loadSecretsFromConfig(cfg, nil); err != nil {
		t.Fatalf("loadSecretsFromConfig() error = %v", err)
	}
	if got := os.Getenv("OBJECT_STORAGE_KEY_ID"); got != "id-123" {
		t.Fatalf("OBJECT_STORAGE_KEY_ID = %q, want id-123", got)
	}
}

func TestLoadSecretsFromConfigMissingDirFails(t *testing.T) {
	cfg := &config.Config{
		Pipeline: &config.PipelineConfig{
			Secrets: &config.SecretsConfig{EnvDir: filepath.Join(t.TempDir(), "missing")},
		},
	}

	_, err := loadSecretsFromConfig(cfg, nil)
	if err == nil {
		t.Fatal("expected error, got nil")
	}
	if !strings.Contains(err.Error(), "API-key loader") {
		t.Fatalf("error = %q, want API-key loader context", err.Error())
	}
}

func TestLoadSecretsFromConfigUnreadableValidEntryFails(t *testing.T) {
	if runtime.GOOS == "windows" {
		t.Skip("symlink behavior differs on windows")
	}

	dir := t.TempDir()
	ensureSecretDirectory(t, dir)
	broken := filepath.Join(dir, "OPENROUTER_API_KEY")
	if err := os.Symlink(filepath.Join(dir, "does-not-exist"), broken); err != nil {
		t.Fatalf("Symlink(%q): %v", broken, err)
	}

	cfg := &config.Config{
		Pipeline: &config.PipelineConfig{
			Secrets: &config.SecretsConfig{EnvDir: dir},
		},
	}

	_, err := loadSecretsFromConfig(cfg, nil)
	if err == nil {
		t.Fatal("expected error, got nil")
	}
	if !strings.Contains(err.Error(), "API-key loader") {
		t.Fatalf("error = %q, want API-key loader context", err.Error())
	}
}

func TestLoadSecretsFromConfigRejectsUnsafeModes(t *testing.T) {
	if runtime.GOOS == "windows" {
		t.Skip("Windows access control is verified with ACLs")
	}
	for _, tc := range []struct {
		name       string
		directory  os.FileMode
		file       os.FileMode
		wantSecret string
	}{
		{name: "directory", directory: 0o750, file: secretFilePrivateMode, wantSecret: "directory-secret"},
		{name: "file", directory: secretDirectoryPrivateMode, file: 0o640, wantSecret: "file-secret"},
	} {
		t.Run(tc.name, func(t *testing.T) {
			dir := t.TempDir()
			restoreEnvAfterTest(t, "OPENROUTER_API_KEY")
			path := filepath.Join(dir, "OPENROUTER_API_KEY")
			mustWriteSecretFile(t, path, tc.wantSecret)
			if err := os.Chmod(dir, tc.directory); err != nil {
				t.Fatalf("Chmod(directory) error = %v", err)
			}
			if err := os.Chmod(path, tc.file); err != nil {
				t.Fatalf("Chmod(file) error = %v", err)
			}

			_, err := loadSecretsFromConfig(secretConfig(dir), nil)
			if err == nil || !strings.Contains(err.Error(), "API-key loader") {
				t.Fatalf("loadSecretsFromConfig() error = %v, want API-key loader failure", err)
			}
			if strings.Contains(err.Error(), tc.wantSecret) {
				t.Fatalf("error leaked secret content: %q", err)
			}
		})
	}
}

func TestLoadSecretsFromConfigRejectsNonRegularAndOversizedEntries(t *testing.T) {
	dir := t.TempDir()
	ensureSecretDirectory(t, dir)
	restoreEnvAfterTest(t, "OPENROUTER_API_KEY")
	if err := os.Mkdir(filepath.Join(dir, "OPENROUTER_API_KEY"), secretDirectoryPrivateMode); err != nil {
		t.Fatalf("Mkdir(non-regular entry) error = %v", err)
	}
	if _, err := loadSecretsFromConfig(secretConfig(dir), nil); err == nil || !strings.Contains(err.Error(), "not a regular file") {
		t.Fatalf("loadSecretsFromConfig(non-regular) error = %v, want regular-file failure", err)
	}

	if err := os.Remove(filepath.Join(dir, "OPENROUTER_API_KEY")); err != nil {
		t.Fatalf("Remove(non-regular entry) error = %v", err)
	}
	overLimit := strings.Repeat("credential-value-", int(APIKeyFileByteLimit/17)+1)
	mustWriteSecretFile(t, filepath.Join(dir, "OPENROUTER_API_KEY"), overLimit)
	_, err := loadSecretsFromConfig(secretConfig(dir), nil)
	if err == nil || !strings.Contains(err.Error(), "API-key loader") || !strings.Contains(err.Error(), "8192-byte limit") {
		t.Fatalf("loadSecretsFromConfig(over-limit) error = %v, want bounded API-key loader failure", err)
	}
	if strings.Contains(err.Error(), overLimit[:32]) {
		t.Fatalf("error leaked secret content: %q", err)
	}
}

func TestLoadSecretsFromConfigRejectsSymlinkAndAncestorReplacement(t *testing.T) {
	if runtime.GOOS == "windows" {
		t.Skip("symlink behavior differs on windows")
	}
	dir := t.TempDir()
	outside := t.TempDir()
	ensureSecretDirectory(t, dir)
	restoreEnvAfterTest(t, "OPENROUTER_API_KEY")
	outsideValue := "outside-secret-value"
	mustWriteSecretFile(t, filepath.Join(outside, "OPENROUTER_API_KEY"), outsideValue)
	if err := os.Symlink(filepath.Join(outside, "OPENROUTER_API_KEY"), filepath.Join(dir, "OPENROUTER_API_KEY")); err != nil {
		t.Fatalf("Symlink(leaf) error = %v", err)
	}
	_, err := loadSecretsFromConfig(secretConfig(dir), nil)
	if err == nil || !strings.Contains(err.Error(), "API-key loader") {
		t.Fatalf("loadSecretsFromConfig(symlink) error = %v, want failure", err)
	}
	if strings.Contains(err.Error(), outsideValue) {
		t.Fatalf("error leaked secret content: %q", err)
	}

	if err := os.Remove(filepath.Join(dir, "OPENROUTER_API_KEY")); err != nil {
		t.Fatalf("Remove(leaf symlink) error = %v", err)
	}
	mustWriteSecretFile(t, filepath.Join(dir, "OPENROUTER_API_KEY"), "inside-secret")
	original := readSecretsDirectoryEntries
	readSecretsDirectoryEntries = func(path string) ([]os.DirEntry, error) {
		entries, err := original(path)
		if err != nil {
			return nil, err
		}
		if err := os.Remove(filepath.Join(dir, "OPENROUTER_API_KEY")); err != nil {
			return nil, err
		}
		if err := os.Remove(dir); err != nil {
			return nil, err
		}
		if err := os.Symlink(outside, dir); err != nil {
			return nil, err
		}
		return entries, nil
	}
	t.Cleanup(func() { readSecretsDirectoryEntries = original })
	_, err = loadSecretsFromConfig(secretConfig(dir), nil)
	if err == nil || !strings.Contains(err.Error(), "API-key loader") {
		t.Fatalf("loadSecretsFromConfig(ancestor replacement) error = %v, want failure", err)
	}
	if _, exists := os.LookupEnv("OPENROUTER_API_KEY"); exists {
		t.Fatal("ancestor replacement loaded a secret value")
	}
}

func mustWriteSecretFile(t *testing.T, path, contents string) {
	t.Helper()
	if err := os.MkdirAll(filepath.Dir(path), secretDirectoryPrivateMode); err != nil {
		t.Fatalf("MkdirAll(%q): %v", path, err)
	}
	if err := os.Chmod(filepath.Dir(path), secretDirectoryPrivateMode); err != nil {
		t.Fatalf("Chmod(%q): %v", filepath.Dir(path), err)
	}
	if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
		t.Fatalf("WriteFile(%q): %v", path, err)
	}
}

func secretConfig(dir string) *config.Config {
	return &config.Config{Pipeline: &config.PipelineConfig{Secrets: &config.SecretsConfig{EnvDir: dir}}}
}

func ensureSecretDirectory(t *testing.T, directory string) {
	t.Helper()
	if err := os.Chmod(directory, secretDirectoryPrivateMode); err != nil {
		t.Fatalf("Chmod(%q): %v", directory, err)
	}
}