Function TestUserSecrets

enterprise/dbcrypt/dbcrypt_internal_test.go:1575–1768

(t *testing.T)

}

func TestUserSecrets(t *testing.T) {
	t.Parallel()
	ctx := context.Background()

	const (
		//nolint:gosec // test credentials
		initialValue = "super-secret-value-initial"
		//nolint:gosec // test credentials
		updatedValue = "super-secret-value-updated"
	)

	insertUserSecret := func(
		t *testing.T,
		crypt *dbCrypt,
		ciphers []Cipher,
	) database.UserSecret {
		t.Helper()
		user := dbgen.User(t, crypt, database.User{})
		secret, err := crypt.CreateUserSecret(ctx, database.CreateUserSecretParams{
			ID:     uuid.New(),
			UserID: user.ID,
			Name:   "test-secret-" + uuid.NewString()[:8],
			Value:  initialValue,
		})
		require.NoError(t, err)
		require.Equal(t, initialValue, secret.Value)
		if len(ciphers) > 0 {
			require.Equal(t, ciphers[0].HexDigest(), secret.ValueKeyID.String)
		}
		return secret
	}

	t.Run("CreateUserSecretEncryptsValue", func(t *testing.T) {
		t.Parallel()
		db, crypt, ciphers := setup(t)
		secret := insertUserSecret(t, crypt, ciphers)

		// Reading through crypt should return plaintext.
		got, err := crypt.GetUserSecretByUserIDAndName(ctx, database.GetUserSecretByUserIDAndNameParams{
			UserID: secret.UserID,
			Name:   secret.Name,
		})
		require.NoError(t, err)
		require.Equal(t, initialValue, got.Value)

		// Reading through raw DB should return encrypted value.
		raw, err := db.GetUserSecretByUserIDAndName(ctx, database.GetUserSecretByUserIDAndNameParams{
			UserID: secret.UserID,
			Name:   secret.Name,
		})
		require.NoError(t, err)
		require.NotEqual(t, initialValue, raw.Value)
		requireEncryptedEquals(t, ciphers[0], raw.Value, initialValue)
	})

	t.Run("ListUserSecretsWithValuesDecrypts", func(t *testing.T) {
		t.Parallel()
		_, crypt, ciphers := setup(t)