narratio/internal/app/secrets_env_test.go

package app

import (
	"os"
	"path/filepath"
	"runtime"
	"strings"
	"testing"

	"gitea.maximumdirect.net/eric/narratio/internal/config"
)

func TestLoadSecretsFromConfigLoadsValidFiles(t *testing.T) {
	dir := t.TempDir()
	mustWriteSecretFile(t, filepath.Join(dir, "NARRATIO_TEST_SECRET_A"), "value-1\n")
	mustWriteSecretFile(t, filepath.Join(dir, "NARRATIO_TEST_SECRET_B"), "value-2\r\n")
	mustWriteSecretFile(t, filepath.Join(dir, "not-valid-name.txt"), "ignored")

	cfg := &config.Config{
		Pipeline: &config.PipelineConfig{
			Secrets: &config.SecretsConfig{EnvDir: dir},
		},
	}

	stats, err := loadSecretsFromConfig(cfg, nil)
	if err != nil {
		t.Fatalf("loadSecretsFromConfig() error = %v", err)
	}
	if stats == nil {
		t.Fatal("stats = nil, want non-nil")
	}
	if stats.Loaded != 2 {
		t.Fatalf("Loaded = %d, want 2", stats.Loaded)
	}
	if stats.PreservedExisting != 0 {
		t.Fatalf("PreservedExisting = %d, want 0", stats.PreservedExisting)
	}
	if stats.Skipped == 0 {
		t.Fatalf("Skipped = %d, want > 0 for invalid filename", stats.Skipped)
	}
	if got := os.Getenv("NARRATIO_TEST_SECRET_A"); got != "value-1" {
		t.Fatalf("NARRATIO_TEST_SECRET_A = %q, want value-1", got)
	}
	if got := os.Getenv("NARRATIO_TEST_SECRET_B"); got != "value-2" {
		t.Fatalf("NARRATIO_TEST_SECRET_B = %q, want value-2", got)
	}
}

func TestLoadSecretsFromConfigPreservesExistingEnv(t *testing.T) {
	t.Setenv("OBJECT_STORAGE_KEY", "existing")

	dir := t.TempDir()
	mustWriteSecretFile(t, filepath.Join(dir, "OBJECT_STORAGE_KEY"), "from-file\n")

	cfg := &config.Config{
		Pipeline: &config.PipelineConfig{
			Secrets: &config.SecretsConfig{EnvDir: dir},
		},
	}

	stats, err := loadSecretsFromConfig(cfg, nil)
	if err != nil {
		t.Fatalf("loadSecretsFromConfig() error = %v", err)
	}
	if stats.PreservedExisting != 1 {
		t.Fatalf("PreservedExisting = %d, want 1", stats.PreservedExisting)
	}
	if got := os.Getenv("OBJECT_STORAGE_KEY"); got != "existing" {
		t.Fatalf("OBJECT_STORAGE_KEY = %q, want existing", got)
	}
}

func TestLoadSecretsFromConfigRelativeDirUsesCWD(t *testing.T) {
	cwd := t.TempDir()
	secretsDir := filepath.Join(cwd, "secrets")
	if err := os.MkdirAll(secretsDir, 0o755); err != nil {
		t.Fatalf("MkdirAll(%q): %v", secretsDir, err)
	}
	mustWriteSecretFile(t, filepath.Join(secretsDir, "OBJECT_STORAGE_KEY_ID"), "id-123\n")

	originalWD, err := os.Getwd()
	if err != nil {
		t.Fatalf("Getwd(): %v", err)
	}
	if err := os.Chdir(cwd); err != nil {
		t.Fatalf("Chdir(%q): %v", cwd, err)
	}
	t.Cleanup(func() {
		_ = os.Chdir(originalWD)
	})

	cfg := &config.Config{
		Pipeline: &config.PipelineConfig{
			Secrets: &config.SecretsConfig{EnvDir: "./secrets"},
		},
	}
	if _, err := loadSecretsFromConfig(cfg, nil); err != nil {
		t.Fatalf("loadSecretsFromConfig() error = %v", err)
	}
	if got := os.Getenv("OBJECT_STORAGE_KEY_ID"); got != "id-123" {
		t.Fatalf("OBJECT_STORAGE_KEY_ID = %q, want id-123", got)
	}
}

func TestLoadSecretsFromConfigMissingDirFails(t *testing.T) {
	cfg := &config.Config{
		Pipeline: &config.PipelineConfig{
			Secrets: &config.SecretsConfig{EnvDir: filepath.Join(t.TempDir(), "missing")},
		},
	}

	_, err := loadSecretsFromConfig(cfg, nil)
	if err == nil {
		t.Fatal("expected error, got nil")
	}
	if !strings.Contains(err.Error(), "read secrets env_dir") {
		t.Fatalf("error = %q, want read-dir context", err.Error())
	}
}

func TestLoadSecretsFromConfigUnreadableValidEntryFails(t *testing.T) {
	if runtime.GOOS == "windows" {
		t.Skip("symlink behavior differs on windows")
	}

	dir := t.TempDir()
	broken := filepath.Join(dir, "OPENROUTER_API_KEY")
	if err := os.Symlink(filepath.Join(dir, "does-not-exist"), broken); err != nil {
		t.Fatalf("Symlink(%q): %v", broken, err)
	}

	cfg := &config.Config{
		Pipeline: &config.PipelineConfig{
			Secrets: &config.SecretsConfig{EnvDir: dir},
		},
	}

	_, err := loadSecretsFromConfig(cfg, nil)
	if err == nil {
		t.Fatal("expected error, got nil")
	}
	if !strings.Contains(err.Error(), "read secret file") {
		t.Fatalf("error = %q, want read secret file context", err.Error())
	}
}

func mustWriteSecretFile(t *testing.T, path, contents string) {
	t.Helper()
	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
		t.Fatalf("MkdirAll(%q): %v", path, err)
	}
	if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
		t.Fatalf("WriteFile(%q): %v", path, err)
	}
}