48 lines
1.8 KiB
Go
48 lines
1.8 KiB
Go
//go:build integration
|
|
|
|
package openbao_test
|
|
|
|
import (
|
|
"maps"
|
|
"testing"
|
|
|
|
bao "github.com/openbao/openbao/api/v2"
|
|
|
|
"git.ddupan.top/panxiao81/ayatori/internal/database/adapter/openbao"
|
|
)
|
|
|
|
func TestConfirmedCredentialRecoveryWithRealOpenBao(t *testing.T) {
|
|
root := baoFixture(t)
|
|
store := fixtureStore(t, root)
|
|
credential := fixtureCredential(t)
|
|
if err := store.Create(t.Context(), credentialPath, credential); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
// 新 adapter 模拟进程重启：只有已持久化的版本才能恢复读取。
|
|
restarted := fixtureStore(t, root)
|
|
if _, err := restarted.ReadConfirmed(t.Context(), credentialPath, 0); err != openbao.ErrConflict {
|
|
t.Fatal("已有值不能替代缺失的确认记录")
|
|
}
|
|
observed, err := restarted.ReadConfirmed(t.Context(), credentialPath, 1)
|
|
if err != nil || !maps.Equal(observed.SecretData(), credential.SecretData()) {
|
|
t.Fatal("确认版本的凭据不能恢复读取")
|
|
}
|
|
// 即使内容相同，新增版本也不属于已确认写入；历史版本仍在不能掩盖改写。
|
|
if _, err := root.KVv2("secret").Put(t.Context(), credentialPath, credential.SecretData(), bao.WithCheckAndSet(1)); err != nil {
|
|
t.Fatal("无法准备测试中的版本变化")
|
|
}
|
|
if _, err := restarted.ReadConfirmed(t.Context(), credentialPath, 1); err != openbao.ErrConflict {
|
|
t.Fatal("最新版本漂移必须报冲突")
|
|
}
|
|
if err := root.KVv2("secret").Delete(t.Context(), credentialPath); err != nil {
|
|
t.Fatal("无法准备测试中的软删除")
|
|
}
|
|
if _, err := restarted.ReadConfirmed(t.Context(), credentialPath, 1); err != openbao.ErrConflict {
|
|
t.Fatal("已确认凭据被删除必须报冲突")
|
|
}
|
|
metadata, err := root.KVv2("secret").GetMetadata(t.Context(), credentialPath)
|
|
if err != nil || metadata.CurrentVersion != 2 {
|
|
t.Fatal("恢复检查不得生成或覆盖凭据")
|
|
}
|
|
}
|