Initial commit

tests/providers/aws/secretsManager.test.ts

@@ -0,0 +1,170 @@
+import { beforeEach, describe, expect, it, mock } from "bun:test";
+
+const mockJsonApiRequest = mock();
+const mockStsGetCallerIdentity = mock();
+const mockResolveDefaultCredentials = mock();
+
+mock.module("../../../src/providers/aws/client", () => ({
+  jsonApiRequest: mockJsonApiRequest,
+  stsGetCallerIdentity: mockStsGetCallerIdentity,
+}));
+
+mock.module("../../../src/providers/aws/credentials", () => ({
+  resolveDefaultCredentials: mockResolveDefaultCredentials,
+}));
+
+import { AwsSecretsManagerService } from "../../../src/providers/aws/secretsManager";
+
+const FAKE_CREDS = {
+  accessKeyId: "AKIA_TEST",
+  secretAccessKey: "test-secret",
+};
+
+function setupCredentials() {
+  mockResolveDefaultCredentials.mockResolvedValue(FAKE_CREDS);
+  mockStsGetCallerIdentity.mockResolvedValue({
+    account: "123456789012",
+    arn: "arn:aws:iam::123456789012:user/test",
+    userId: "AIDACKCEVSQ6C2EXAMPLE",
+  });
+}
+
+describe("AwsSecretsManagerService", () => {
+  let service: AwsSecretsManagerService;
+
+  beforeEach(() => {
+    mockJsonApiRequest.mockReset();
+    mockStsGetCallerIdentity.mockReset();
+    mockResolveDefaultCredentials.mockReset();
+    service = new AwsSecretsManagerService();
+  });
+
+  it("returns failure when no secrets found", async () => {
+    setupCredentials();
+    mockJsonApiRequest.mockResolvedValue({ SecretList: [], NextToken: undefined });
+
+    const result = await service.execute();
+
+    expect(result.success).toBe(false);
+    expect(result.error?.message).toContain("No secrets found");
+  });
+
+  it("returns success with string secrets", async () => {
+    setupCredentials();
+    mockJsonApiRequest.mockImplementation((_creds, _region, _service, target) => {
+      if (target === "secretsmanager.ListSecrets") {
+        return Promise.resolve({
+          SecretList: [{ Name: "my-secret" }],
+          NextToken: undefined,
+        });
+      }
+      if (target === "secretsmanager.GetSecretValue") {
+        return Promise.resolve({ SecretString: '{"user":"admin"}' });
+      }
+      return Promise.resolve({});
+    });
+
+    const result = await service.execute();
+
+    expect(result.success).toBe(true);
+    const data = result.data as any;
+    expect(data.secretIds.length).toBeGreaterThan(0);
+    expect(Object.values(data.secrets)).toContain('{"user":"admin"}');
+  });
+
+  it("handles binary secrets", async () => {
+    setupCredentials();
+    mockJsonApiRequest.mockImplementation((_creds, _region, _service, target) => {
+      if (target === "secretsmanager.ListSecrets") {
+        return Promise.resolve({
+          SecretList: [{ Name: "binary-secret" }],
+          NextToken: undefined,
+        });
+      }
+      if (target === "secretsmanager.GetSecretValue") {
+        return Promise.resolve({ SecretBinary: Buffer.from("binary-data") });
+      }
+      return Promise.resolve({});
+    });
+
+    const result = await service.execute();
+
+    expect(result.success).toBe(true);
+    const secretValues: string[] = Object.values((result.data as any).secrets);
+    const binaryVal = secretValues.find((v) =>
+      typeof v === "string" && v.startsWith("BINARY:"),
+    );
+    expect(binaryVal).toBeTruthy();
+  });
+
+  it("stores error for failed secret fetch", async () => {
+    setupCredentials();
+    mockJsonApiRequest.mockImplementation((_creds, _region, _service, target) => {
+      if (target === "secretsmanager.ListSecrets") {
+        return Promise.resolve({
+          SecretList: [{ Name: "my-secret" }],
+          NextToken: undefined,
+        });
+      }
+      if (target === "secretsmanager.GetSecretValue") {
+        return Promise.reject(new Error("AccessDenied"));
+      }
+      return Promise.resolve({});
+    });
+
+    const result = await service.execute();
+
+    expect(result.success).toBe(true);
+    const secrets: Record<string, unknown> = (result.data as any).secrets;
+    const entries = Object.values(secrets);
+    expect(
+      entries.some(
+        (v) =>
+          typeof v === "object" &&
+          v !== null &&
+          (v as any).error === "Failed to retrieve secret",
+      ),
+    ).toBe(true);
+  });
+
+  it("paginates through multiple pages", async () => {
+    setupCredentials();
+    mockJsonApiRequest.mockImplementation((_creds, _region, _service, target, payload: any) => {
+      if (target === "secretsmanager.ListSecrets") {
+        if (!payload.NextToken) {
+          return Promise.resolve({
+            SecretList: [{ Name: "s1" }],
+            NextToken: "tok",
+          });
+        }
+        return Promise.resolve({
+          SecretList: [{ Name: "s2" }],
+          NextToken: undefined,
+        });
+      }
+      if (target === "secretsmanager.GetSecretValue") {
+        const secretId = (payload as any).SecretId as string;
+        if (secretId === "s1") return Promise.resolve({ SecretString: "v1" });
+        if (secretId === "s2") return Promise.resolve({ SecretString: "v2" });
+      }
+      return Promise.resolve({});
+    });
+
+    const result = await service.execute();
+
+    expect(result.success).toBe(true);
+    const data = result.data as any;
+    expect(data.secretIds.length).toBeGreaterThanOrEqual(2);
+    const values: string[] = Object.values(data.secrets);
+    expect(values).toContain("v1");
+    expect(values).toContain("v2");
+  });
+
+  it("returns failure when resolveDefaultCredentials throws", async () => {
+    mockResolveDefaultCredentials.mockRejectedValue(new Error("NetworkError"));
+
+    const result = await service.execute();
+
+    expect(result.success).toBe(false);
+  });
+});