tests/testthat/test-vault.R

In shunsambongi/vault: Locally store encrypted secrets

library(fs)
library(mockery)
library(RSQLite)
library(withr)

test_that("vault_initialize() creates the db", {
  local_tempfile("tmp")
  local_mock("vault:::vault_path" = function() tmp)
  vault_initialize()
  expect_true(file_exists(tmp))

  con <- local_db_connection(dbConnect(SQLite(), tmp))
  expect_true(dbExistsTable(con, "secrets"))
  expected <- data.frame(
    stringsAsFactors = FALSE,
    id = integer(),
    app = character(),
    service = character(),
    name = character(),
    value = character(),
    nonce = character(),
    tag = character()
  )
  expect_identical(dbReadTable(con, "secrets"), expected)
})

test_that("vault_delete() deletes the file", {
  local_tempfile("tmp")
  file_create(tmp)
  local_mock("vault:::vault_path" = function() tmp)
  expect_true(file_exists(tmp))
  vault_delete()
  expect_false(file_exists(tmp))
})

test_that("vault_reset() deletes and initializes db", {
  del_mock <- mock()
  init_mock <- mock()
  local_mock(
    "vault:::vault_delete" = del_mock,
    "vault:::vault_initialize" = init_mock
  )
  vault_reset()
  expect_called(del_mock, n = 1)
  expect_called(init_mock, n = 1)
})

describe("vault_ensure()", {
  it("initializes the db if it doesn't exist", {
    local_tempfile("tmp")
    mock <- mock(invisible())
    local_mock(
      "vault:::vault_path" = function() tmp,
      "vault:::vault_initialize" = mock,
      "vault:::vault_validate_schema" = function(...) {}
    )
    vault_ensure()
    expect_called(mock, 1L)
  })

  it("initializes if the file exists but table does not", {
    local_tempfile("tmp")
    fs::file_create(tmp)
    mock <- mock(invisible())
    local_mock(
      "vault:::vault_path" = function() tmp,
      "vault:::vault_initialize" = mock,
      "vault:::vault_validate_schema" = function(...) {}
    )
    vault_ensure()
    expect_called(mock, 1L)
  })

  it("fails if the table exists but with wrong schema", {
    local_tempfile("tmp")
    mock <- mock(invisible())
    local_mock(
      "vault:::vault_path" = function() tmp,
      "vault:::vault_initialize" = mock
    )
    con <- local_vault_connection()
    RSQLite::dbWriteTable(con, "secrets", mtcars)
    expect_error(vault_ensure(con))
    expect_called(mock, 0L)
  })
})

describe("vault_path()", {
  it("prioritizes the vault_path option", {
    local_options(list("vault_path" = "option"))
    path <- vault_path()
    expect_s3_class(path, "fs_path")
    expect_equal(path, "option")
  })

  it("uses envvar if option is not set", {
    local_envvar(list("VAULT_PATH" = "envvar"))
    path <- vault_path()
    expect_s3_class(path, "fs_path")
    expect_equal(path, "envvar")
  })

  it("still returns a path if option and envvar not set", {
    path <- vault_path()
    expect_s3_class(path, "fs_path")
  })

  it("expands ~", {
    local_options(list("vault_path" = "~/option"))
    path <- vault_path()
    expect_s3_class(path, "fs_path")
    expect_equal(path(path_dir(path)), path_home())
  })
})

test_that("local_vault() allows a different vault location", {
  local_tempfile("tmp")
  tmp <- path_norm(tmp)
  local_vault(tmp)
  expect_equal(vault_path(), tmp)
})