(t *testing.T)
| 100 | } |
| 101 | |
| 102 | func TestResolveEnv(t *testing.T) { |
| 103 | t.Parallel() |
| 104 | |
| 105 | resolver := testhelper.MockResolver{ |
| 106 | Store: map[secrets.ID]string{ |
| 107 | secrets.MustParseID("gh-token"): "ghp_abc123", |
| 108 | secrets.MustParseID("myapp/postgres/password"): "s3cr3t", |
| 109 | }, |
| 110 | } |
| 111 | |
| 112 | t.Run("passthrough when no se:// values", func(t *testing.T) { |
| 113 | in := []string{"PATH=/usr/bin", "HOME=/home/x", "EMPTY="} |
| 114 | out, err := resolveEnv(t.Context(), resolver, in) |
| 115 | require.NoError(t, err) |
| 116 | assert.Equal(t, in, out) |
| 117 | }) |
| 118 | |
| 119 | t.Run("resolves exact se:// reference", func(t *testing.T) { |
| 120 | in := []string{"PATH=/usr/bin", "SE_TOKEN=se://gh-token"} |
| 121 | out, err := resolveEnv(t.Context(), resolver, in) |
| 122 | require.NoError(t, err) |
| 123 | assert.Equal(t, []string{"PATH=/usr/bin", "SE_TOKEN=ghp_abc123"}, out) |
| 124 | }) |
| 125 | |
| 126 | t.Run("resolves nested ID", func(t *testing.T) { |
| 127 | in := []string{"PG_PWD=se://myapp/postgres/password"} |
| 128 | out, err := resolveEnv(t.Context(), resolver, in) |
| 129 | require.NoError(t, err) |
| 130 | assert.Equal(t, []string{"PG_PWD=s3cr3t"}, out) |
| 131 | }) |
| 132 | |
| 133 | t.Run("embedded se:// is left untouched", func(t *testing.T) { |
| 134 | in := []string{"DSN=postgres://user:se://gh-token@host/db"} |
| 135 | out, err := resolveEnv(t.Context(), resolver, in) |
| 136 | require.NoError(t, err) |
| 137 | assert.Equal(t, in, out) |
| 138 | }) |
| 139 | |
| 140 | t.Run("missing reference hard-fails", func(t *testing.T) { |
| 141 | in := []string{"X=se://does-not-exist"} |
| 142 | out, err := resolveEnv(t.Context(), resolver, in) |
| 143 | require.Error(t, err) |
| 144 | assert.Nil(t, out) |
| 145 | assert.Contains(t, err.Error(), "resolving X") |
| 146 | }) |
| 147 | |
| 148 | t.Run("invalid ID hard-fails", func(t *testing.T) { |
| 149 | in := []string{"X=se://"} |
| 150 | out, err := resolveEnv(t.Context(), resolver, in) |
| 151 | require.Error(t, err) |
| 152 | assert.Nil(t, out) |
| 153 | assert.Contains(t, err.Error(), "resolving X") |
| 154 | }) |
| 155 | |
| 156 | t.Run("wildcard in reference is rejected", func(t *testing.T) { |
| 157 | in := []string{"X=se://foo/*"} |
| 158 | out, err := resolveEnv(t.Context(), resolver, in) |
| 159 | require.Error(t, err) |
nothing calls this directly
no test coverage detected