diff options
Diffstat (limited to 'railties/test/secrets_test.rb')
-rw-r--r-- | railties/test/secrets_test.rb | 102 |
1 files changed, 78 insertions, 24 deletions
diff --git a/railties/test/secrets_test.rb b/railties/test/secrets_test.rb index 36c8ef1fd9..06877bc76a 100644 --- a/railties/test/secrets_test.rb +++ b/railties/test/secrets_test.rb @@ -1,29 +1,24 @@ -require "abstract_unit" +# frozen_string_literal: true + require "isolation/abstract_unit" -require "rails/generators" -require "rails/generators/rails/encrypted_secrets/encrypted_secrets_generator" require "rails/secrets" class Rails::SecretsTest < ActiveSupport::TestCase include ActiveSupport::Testing::Isolation - def setup - build_app - end - - def teardown - teardown_app - end + setup :build_app + teardown :teardown_app test "setting read to false skips parsing" do run_secrets_generator do Rails::Secrets.write(<<-end_of_secrets) - test: + production: yeah_yeah: lets-walk-in-the-cool-evening-light end_of_secrets - Rails.application.config.read_encrypted_secrets = false - Rails.application.instance_variable_set(:@secrets, nil) # Dance around caching 💃🕺 + add_to_env_config("production", "config.read_encrypted_secrets = false") + app("production") + assert_not Rails.application.secrets.yeah_yeah end end @@ -45,7 +40,7 @@ class Rails::SecretsTest < ActiveSupport::TestCase ENV["RAILS_MASTER_KEY"] = IO.binread("config/secrets.yml.key").strip FileUtils.rm("config/secrets.yml.key") - assert_match "production:\n# external_api_key", Rails::Secrets.read + assert_match "# production:\n# external_api_key:", Rails::Secrets.read ensure ENV["RAILS_MASTER_KEY"] = old_key end @@ -67,7 +62,7 @@ class Rails::SecretsTest < ActiveSupport::TestCase Rails::Secrets.read_for_editing do |tmp_path| decrypted_path = tmp_path - assert_match(/production:\n# external_api_key/, File.read(tmp_path)) + assert_match(/# production:\n# external_api_key/, File.read(tmp_path)) File.write(tmp_path, "Empty streets, empty nights. The Downtown Lights.") end @@ -80,18 +75,18 @@ class Rails::SecretsTest < ActiveSupport::TestCase test "merging secrets with encrypted precedence" do run_secrets_generator do File.write("config/secrets.yml", <<-end_of_secrets) - test: + production: yeah_yeah: lets-go-walking-down-this-empty-street end_of_secrets Rails::Secrets.write(<<-end_of_secrets) - test: + production: yeah_yeah: lets-walk-in-the-cool-evening-light end_of_secrets - Rails.application.config.root = app_path - Rails.application.config.read_encrypted_secrets = true - Rails.application.instance_variable_set(:@secrets, nil) # Dance around caching 💃🕺 + add_to_env_config("production", "config.read_encrypted_secrets = true") + app("production") + assert_equal "lets-walk-in-the-cool-evening-light", Rails.application.secrets.yeah_yeah end end @@ -107,16 +102,75 @@ class Rails::SecretsTest < ActiveSupport::TestCase config.dereferenced_secret = Rails.application.secrets.some_secret end_of_config - assert_equal "yeah yeah\n", `bin/rails runner -e production "puts Rails.application.config.dereferenced_secret"` + app("production") + + assert_equal "yeah yeah", Rails.application.config.dereferenced_secret + end + end + + test "do not update secrets.yml.enc when secretes do not change" do + run_secrets_generator do + Rails::Secrets.read_for_editing do |tmp_path| + File.write(tmp_path, "Empty streets, empty nights. The Downtown Lights.") + end + + FileUtils.cp("config/secrets.yml.enc", "config/secrets.yml.enc.bk") + + Rails::Secrets.read_for_editing do |tmp_path| + File.write(tmp_path, "Empty streets, empty nights. The Downtown Lights.") + end + + assert_equal File.read("config/secrets.yml.enc.bk"), File.read("config/secrets.yml.enc") + end + end + + test "can read secrets written in binary" do + run_secrets_generator do + secrets = <<-end_of_secrets + production: + api_key: 00112233445566778899aabbccddeeff… + end_of_secrets + + Rails::Secrets.write(secrets.dup.force_encoding(Encoding::ASCII_8BIT)) + + Rails::Secrets.read_for_editing do |tmp_path| + assert_match(/production:\n\s*api_key: 00112233445566778899aabbccddeeff…\n/, File.read(tmp_path)) + end + + app("production") + + assert_equal "00112233445566778899aabbccddeeff…", Rails.application.secrets.api_key + end + end + + test "can read secrets written in non-binary" do + run_secrets_generator do + secrets = <<-end_of_secrets + production: + api_key: 00112233445566778899aabbccddeeff… + end_of_secrets + + Rails::Secrets.write(secrets) + + Rails::Secrets.read_for_editing do |tmp_path| + assert_equal(secrets.dup.force_encoding(Encoding::ASCII_8BIT), IO.binread(tmp_path)) + end + + app("production") + + assert_equal "00112233445566778899aabbccddeeff…", Rails.application.secrets.api_key end end private def run_secrets_generator Dir.chdir(app_path) do - capture(:stdout) do - Rails::Generators::EncryptedSecretsGenerator.start - end + File.write("config/secrets.yml.key", "f731758c639da2604dfb6bf3d1025de8") + File.write("config/secrets.yml.enc", "sEB0mHxDbeP1/KdnMk00wyzPFACl9K6t0cZWn5/Mfx/YbTHvnI07vrneqHg9kaH3wOS7L6pIQteu1P077OtE4BSx/ZRc/sgQPHyWu/tXsrfHqnPNpayOF/XZqizE91JacSFItNMWpuPsp9ynbzz+7cGhoB1S4aPNIU6u0doMrzdngDbijsaAFJmsHIQh6t/QHoJx--8aMoE0PvUWmw1Iqz--ldFqnM/K0g9k17M8PKoN/Q==") + + add_to_config <<-RUBY + config.read_encrypted_secrets = true + RUBY yield end |