64 lines
2.3 KiB
Elixir
64 lines
2.3 KiB
Elixir
defmodule Towerops.VaultTest do
|
|
use ExUnit.Case, async: false
|
|
|
|
alias Towerops.Vault
|
|
|
|
describe "init/1" do
|
|
test "preserves config when CLOAK_KEY env is unset" do
|
|
original = System.get_env("CLOAK_KEY")
|
|
System.delete_env("CLOAK_KEY")
|
|
|
|
try do
|
|
assert {:ok, config} = Vault.init(ciphers: [])
|
|
assert config[:ciphers] == []
|
|
after
|
|
if original, do: System.put_env("CLOAK_KEY", original)
|
|
end
|
|
end
|
|
|
|
test "overrides ciphers when CLOAK_KEY env is set in :prod" do
|
|
# The env-var override only fires under :env == :prod so a dev
|
|
# shell with a prod CLOAK_KEY set doesn't encrypt local data with
|
|
# the prod key. Flip :env for the duration of the test.
|
|
original_env = System.get_env("CLOAK_KEY")
|
|
original_env_setting = Application.get_env(:towerops, :env)
|
|
key = 32 |> :crypto.strong_rand_bytes() |> Base.encode64()
|
|
System.put_env("CLOAK_KEY", key)
|
|
Application.put_env(:towerops, :env, :prod)
|
|
|
|
try do
|
|
assert {:ok, config} = Vault.init([])
|
|
assert {Cloak.Ciphers.AES.GCM, opts} = config[:ciphers][:default]
|
|
assert opts[:tag] == "AES.GCM.V1"
|
|
assert is_binary(opts[:key]) and byte_size(opts[:key]) > 0
|
|
assert byte_size(opts[:key]) == 32
|
|
after
|
|
if original_env, do: System.put_env("CLOAK_KEY", original_env), else: System.delete_env("CLOAK_KEY")
|
|
Application.put_env(:towerops, :env, original_env_setting)
|
|
end
|
|
end
|
|
|
|
test "preserves config when CLOAK_KEY env is set in non-prod" do
|
|
original = System.get_env("CLOAK_KEY")
|
|
key = 32 |> :crypto.strong_rand_bytes() |> Base.encode64()
|
|
System.put_env("CLOAK_KEY", key)
|
|
|
|
try do
|
|
# :env is :test in the test environment; CLOAK_KEY must be ignored.
|
|
assert {:ok, config} = Vault.init(ciphers: [])
|
|
assert config[:ciphers] == []
|
|
after
|
|
if original, do: System.put_env("CLOAK_KEY", original), else: System.delete_env("CLOAK_KEY")
|
|
end
|
|
end
|
|
end
|
|
|
|
describe "encryption round-trip" do
|
|
test "encrypts and decrypts a binary using the configured key" do
|
|
assert {:ok, ciphertext} = Vault.encrypt("hello")
|
|
assert is_binary(ciphertext) and byte_size(ciphertext) > 0
|
|
assert ciphertext != "hello"
|
|
assert {:ok, "hello"} = Vault.decrypt(ciphertext)
|
|
end
|
|
end
|
|
end
|