leetcrypt
425c299359
v1: discover → migrate → expiry tracking → sealed export/import. - vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop - discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker, kube, git) and a file/dir harvester (--path) - sink: gopass streaming insert; length-prefixed bundle framing; Sealer interface with three impls — age (default, authenticated), hmac (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback, unauthenticated; OpenSSL 3.x enc refuses AEAD) - policy: local expiry engine, 60d/8w threshold parser - audit: redacted append-only JSONL, injectable clock - export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into locked memory; secrets stream gopass<->Sealer as bytes, never Go strings - tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass; go test ./... green, -race clean Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
49 lines
1.1 KiB
Go
49 lines
1.1 KiB
Go
package audit
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestWriteUsesInjectedClock(t *testing.T) {
|
|
p := filepath.Join(t.TempDir(), "audit.log")
|
|
fixed := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
|
|
|
|
log, err := Open(p, func() time.Time { return fixed })
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := log.Write(Entry{Action: "scan", Source: "aws", Identity: "default / AKIA***", Outcome: "ok"}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
log.Close()
|
|
|
|
b, err := os.ReadFile(p)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
out := string(b)
|
|
if !strings.Contains(out, "2026-01-02T03:04:05Z") {
|
|
t.Errorf("injected clock not used: %s", out)
|
|
}
|
|
if !strings.Contains(out, `"action":"scan"`) || !strings.Contains(out, `"source":"aws"`) {
|
|
t.Errorf("entry not serialized as expected: %s", out)
|
|
}
|
|
}
|
|
|
|
func TestNoopLogWhenPathEmpty(t *testing.T) {
|
|
log, err := Open("", nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := log.Write(Entry{Action: "scan"}); err != nil {
|
|
t.Errorf("no-op Write should not error: %v", err)
|
|
}
|
|
if err := log.Close(); err != nil {
|
|
t.Errorf("no-op Close should not error: %v", err)
|
|
}
|
|
}
|