leetcrypt
425c299359
v1: discover → migrate → expiry tracking → sealed export/import. - vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop - discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker, kube, git) and a file/dir harvester (--path) - sink: gopass streaming insert; length-prefixed bundle framing; Sealer interface with three impls — age (default, authenticated), hmac (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback, unauthenticated; OpenSSL 3.x enc refuses AEAD) - policy: local expiry engine, 60d/8w threshold parser - audit: redacted append-only JSONL, injectable clock - export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into locked memory; secrets stream gopass<->Sealer as bytes, never Go strings - tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass; go test ./... green, -race clean Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
83 lines
1.9 KiB
Go
83 lines
1.9 KiB
Go
package policy
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"gopkg.in/yaml.v3"
|
|
|
|
"incredigo/internal/discover"
|
|
)
|
|
|
|
func TestDaysUnmarshal(t *testing.T) {
|
|
ok := map[string]Days{
|
|
"60": 60,
|
|
"60d": 60,
|
|
"8w": 56,
|
|
" 90d ": 90,
|
|
"0": 0,
|
|
}
|
|
for in, want := range ok {
|
|
var d Days
|
|
if err := yaml.Unmarshal([]byte(in), &d); err != nil {
|
|
t.Errorf("%q: unexpected error %v", in, err)
|
|
continue
|
|
}
|
|
if d != want {
|
|
t.Errorf("%q: got %d want %d", in, d, want)
|
|
}
|
|
}
|
|
for _, bad := range []string{"60x", "abc", "d"} {
|
|
var d Days
|
|
if err := yaml.Unmarshal([]byte(bad), &d); err == nil {
|
|
t.Errorf("%q: expected error, got %d", bad, d)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestPolicyYAMLWithSuffixes(t *testing.T) {
|
|
src := `
|
|
defaults:
|
|
warn_after: 60d
|
|
stale_after: 90d
|
|
overrides:
|
|
private_key:
|
|
warn_after: 26w
|
|
`
|
|
p := Default()
|
|
if err := yaml.Unmarshal([]byte(src), &p); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if p.Defaults.WarnAfter != 60 || p.Defaults.StaleAfter != 90 {
|
|
t.Errorf("defaults = %+v", p.Defaults)
|
|
}
|
|
if p.Overrides[discover.KindPrivateKey].WarnAfter != 182 { // 26*7
|
|
t.Errorf("private_key warn_after = %d, want 182", p.Overrides[discover.KindPrivateKey].WarnAfter)
|
|
}
|
|
}
|
|
|
|
func TestEvaluate(t *testing.T) {
|
|
p := Default() // defaults 60/90; aws_key 30/90
|
|
now := time.Now()
|
|
aged := func(days int, kind discover.Kind) discover.Credential {
|
|
return discover.Credential{Kind: kind, Modified: now.Add(-time.Duration(days) * 24 * time.Hour)}
|
|
}
|
|
|
|
cases := []struct {
|
|
name string
|
|
cred discover.Credential
|
|
want State
|
|
}{
|
|
{"fresh token", aged(10, discover.KindToken), OK},
|
|
{"warn token", aged(70, discover.KindToken), Warn},
|
|
{"stale token", aged(100, discover.KindToken), Stale},
|
|
{"aws warns earlier", aged(40, discover.KindAWSKey), Warn},
|
|
{"aws fresh", aged(20, discover.KindAWSKey), OK},
|
|
}
|
|
for _, c := range cases {
|
|
if st, _ := p.Evaluate(c.cred, now); st != c.want {
|
|
t.Errorf("%s: got %s want %s", c.name, st, c.want)
|
|
}
|
|
}
|
|
}
|