Function TestMasterKey_Decrypt

kms/keysource_test.go:306–350

(t *testing.T)

}

func TestMasterKey_Decrypt(t *testing.T) {
	t.Run("decrypt", func(t *testing.T) {
		key := createTestMasterKey(testKMSARN)
		kmsClient, err := createTestKMSClient(key)
		assert.NoError(t, err)

		dataKey := []byte("it's always DNS")
		out, err := kmsClient.Encrypt(context.TODO(), &kms.EncryptInput{
			Plaintext: dataKey, KeyId: &key.Arn, EncryptionContext: stringPointerToStringMap(key.EncryptionContext),
		})
		assert.NoError(t, err)

		key.EncryptedKey = base64.StdEncoding.EncodeToString(out.CiphertextBlob)
		got, err := key.Decrypt()
		assert.NoError(t, err)
		assert.Equal(t, dataKey, got)
	})

	t.Run("data key error", func(t *testing.T) {
		key := createTestMasterKey(testKMSARN)
		key.EncryptedKey = "invalid"
		got, err := key.Decrypt()
		assert.Error(t, err)
		assert.ErrorContains(t, err, "error base64-decoding encrypted data key")
		assert.Nil(t, got)
	})

	t.Run("decrypt error", func(t *testing.T) {
		// Valid ARN but invalid for test server.
		key := createTestMasterKey(dummyARN)
		key.EncryptedKey = base64.StdEncoding.EncodeToString([]byte("invalid"))
		got, err := key.Decrypt()
		assert.Error(t, err)
		assert.ErrorContains(t, err, "failed to decrypt sops data key with AWS KMS")
		assert.Nil(t, got)
	})

	t.Run("config error", func(t *testing.T) {
		key := createTestMasterKey("arn:gcp:kms:antartica-north-2::key/45e6-aca6-a5b005693a48")
		got, err := key.Decrypt()
		assert.Error(t, err)
		assert.ErrorContains(t, err, "no valid ARN found")
		assert.Nil(t, got)
	})
}

func TestMasterKey_EncryptDecrypt_RoundTrip(t *testing.T) {
	dataKey := []byte("the wheels on the bus go round and round")