towerops/test/towerops/vault_test.exs
2026-06-16 09:56:51 -05:00

64 lines
2.3 KiB
Elixir

defmodule Towerops.VaultTest do
use ExUnit.Case, async: false
alias Towerops.Vault
describe "init/1" do
test "preserves config when CLOAK_KEY env is unset" do
original = System.get_env("CLOAK_KEY")
System.delete_env("CLOAK_KEY")
try do
assert {:ok, config} = Vault.init(ciphers: [])
assert config[:ciphers] == []
after
if original, do: System.put_env("CLOAK_KEY", original)
end
end
test "overrides ciphers when CLOAK_KEY env is set in :prod" do
# The env-var override only fires under :env == :prod so a dev
# shell with a prod CLOAK_KEY set doesn't encrypt local data with
# the prod key. Flip :env for the duration of the test.
original_env = System.get_env("CLOAK_KEY")
original_env_setting = Application.get_env(:towerops, :env)
key = 32 |> :crypto.strong_rand_bytes() |> Base.encode64()
System.put_env("CLOAK_KEY", key)
Application.put_env(:towerops, :env, :prod)
try do
assert {:ok, config} = Vault.init([])
assert {Cloak.Ciphers.AES.GCM, opts} = config[:ciphers][:default]
assert opts[:tag] == "AES.GCM.V1"
assert is_binary(opts[:key]) and byte_size(opts[:key]) > 0
assert byte_size(opts[:key]) == 32
after
if original_env, do: System.put_env("CLOAK_KEY", original_env), else: System.delete_env("CLOAK_KEY")
Application.put_env(:towerops, :env, original_env_setting)
end
end
test "preserves config when CLOAK_KEY env is set in non-prod" do
original = System.get_env("CLOAK_KEY")
key = 32 |> :crypto.strong_rand_bytes() |> Base.encode64()
System.put_env("CLOAK_KEY", key)
try do
# :env is :test in the test environment; CLOAK_KEY must be ignored.
assert {:ok, config} = Vault.init(ciphers: [])
assert config[:ciphers] == []
after
if original, do: System.put_env("CLOAK_KEY", original), else: System.delete_env("CLOAK_KEY")
end
end
end
describe "encryption round-trip" do
test "encrypts and decrypts a binary using the configured key" do
assert {:ok, ciphertext} = Vault.encrypt("hello")
assert is_binary(ciphertext) and byte_size(ciphertext) > 0
assert ciphertext != "hello"
assert {:ok, "hello"} = Vault.decrypt(ciphertext)
end
end
end