|
| 1 | +package teststate_test |
| 2 | + |
| 3 | +import ( |
| 4 | + "fmt" |
| 5 | + "path/filepath" |
| 6 | + "strings" |
| 7 | + "testing" |
| 8 | + |
| 9 | + "github.com/gruntwork-io/terratest/modules/core/v2/logger" |
| 10 | + "github.com/gruntwork-io/terratest/modules/core/v2/teststate" |
| 11 | + gotesting "github.com/gruntwork-io/terratest/modules/core/v2/testing" |
| 12 | + "github.com/stretchr/testify/assert" |
| 13 | + "github.com/stretchr/testify/require" |
| 14 | +) |
| 15 | + |
| 16 | +// tStringLogger captures everything written to the logger so a test can assert on what was, and was not, logged. |
| 17 | +type tStringLogger struct { |
| 18 | + sb strings.Builder |
| 19 | +} |
| 20 | + |
| 21 | +func (l *tStringLogger) Logf(t gotesting.TestingT, format string, args ...any) { |
| 22 | + t.Helper() |
| 23 | + fmt.Fprintf(&l.sb, format, args...) |
| 24 | + l.sb.WriteRune('\n') |
| 25 | +} |
| 26 | + |
| 27 | +// captureLog swaps logger.Default for the duration of the test. Tests using it must not call t.Parallel. |
| 28 | +func captureLog(t *testing.T) *tStringLogger { |
| 29 | + t.Helper() |
| 30 | + |
| 31 | + def, slogger := logger.Default, &tStringLogger{} |
| 32 | + logger.Default = logger.New(slogger) |
| 33 | + |
| 34 | + t.Cleanup(func() { logger.Default = def }) |
| 35 | + |
| 36 | + return slogger |
| 37 | +} |
| 38 | + |
| 39 | +func TestFormatPath(t *testing.T) { |
| 40 | + t.Parallel() |
| 41 | + |
| 42 | + assert.Equal(t, filepath.Join("/foo", ".test-data", "Bar.json"), teststate.FormatPath("/foo", "Bar.json")) |
| 43 | +} |
| 44 | + |
| 45 | +func TestSaveAndLoadRoundTrip(t *testing.T) { |
| 46 | + t.Parallel() |
| 47 | + |
| 48 | + type payload struct { |
| 49 | + Name string |
| 50 | + Count int |
| 51 | + } |
| 52 | + |
| 53 | + path := teststate.FormatPath(t.TempDir(), "Payload.json") |
| 54 | + expected := payload{Name: "terratest", Count: 3} |
| 55 | + |
| 56 | + teststate.Save(t, path, true, expected) |
| 57 | + |
| 58 | + var actual payload |
| 59 | + |
| 60 | + teststate.Load(t, path, &actual) |
| 61 | + assert.Equal(t, expected, actual) |
| 62 | +} |
| 63 | + |
| 64 | +func TestSaveOverwriteSemantics(t *testing.T) { |
| 65 | + t.Parallel() |
| 66 | + |
| 67 | + path := teststate.FormatPath(t.TempDir(), "Value.json") |
| 68 | + |
| 69 | + teststate.Save(t, path, true, "first") |
| 70 | + |
| 71 | + // overwrite=false must leave the existing value alone. |
| 72 | + teststate.Save(t, path, false, "second") |
| 73 | + |
| 74 | + var got string |
| 75 | + |
| 76 | + teststate.Load(t, path, &got) |
| 77 | + assert.Equal(t, "first", got, "overwrite=false must not clobber an existing value") |
| 78 | + |
| 79 | + // overwrite=true must replace it. |
| 80 | + teststate.Save(t, path, true, "third") |
| 81 | + teststate.Load(t, path, &got) |
| 82 | + assert.Equal(t, "third", got) |
| 83 | +} |
| 84 | + |
| 85 | +// TestSaveLogsValueAndSaveRedactedDoesNot is the behavioural contract that callers holding secrets depend on. |
| 86 | +func TestSaveLogsValueAndSaveRedactedDoesNot(t *testing.T) { |
| 87 | + const secret = "-----BEGIN RSA PRIVATE KEY-----sentinel-----END RSA PRIVATE KEY-----" |
| 88 | + |
| 89 | + t.Run("Save logs the marshalled value", func(t *testing.T) { |
| 90 | + slogger := captureLog(t) |
| 91 | + teststate.Save(t, teststate.FormatPath(t.TempDir(), "Plain.json"), true, secret) |
| 92 | + assert.Contains(t, slogger.sb.String(), secret, "Save is expected to log the marshalled JSON") |
| 93 | + }) |
| 94 | + |
| 95 | + t.Run("SaveRedacted does not", func(t *testing.T) { |
| 96 | + slogger := captureLog(t) |
| 97 | + teststate.SaveRedacted(t, teststate.FormatPath(t.TempDir(), "Secret.json"), true, secret) |
| 98 | + assert.NotContains(t, slogger.sb.String(), secret, "SaveRedacted must not log the marshalled JSON") |
| 99 | + }) |
| 100 | +} |
| 101 | + |
| 102 | +// TestSaveRedactedDoesNotLeakViaOverwriteWarning covers the second log statement in the save path. The overwrite |
| 103 | +// warning renders the value with %v, which is not suppressed by the redacted flag, so a redacted save over an |
| 104 | +// existing file could still leak. Values reaching SaveRedacted are secrets by definition. |
| 105 | +func TestSaveRedactedDoesNotLeakViaOverwriteWarning(t *testing.T) { |
| 106 | + const secret = "-----BEGIN RSA PRIVATE KEY-----sentinel-----END RSA PRIVATE KEY-----" |
| 107 | + |
| 108 | + path := teststate.FormatPath(t.TempDir(), "Secret.json") |
| 109 | + |
| 110 | + // First save creates the file, so the second one takes the overwrite-warning branch. |
| 111 | + teststate.SaveRedacted(t, path, true, secret) |
| 112 | + |
| 113 | + slogger := captureLog(t) |
| 114 | + teststate.SaveRedacted(t, path, true, secret) |
| 115 | + |
| 116 | + assert.NotContains(t, slogger.sb.String(), secret, |
| 117 | + "the overwrite warning must not render a redacted value") |
| 118 | +} |
| 119 | + |
| 120 | +func TestIsPresent(t *testing.T) { |
| 121 | + t.Parallel() |
| 122 | + |
| 123 | + path := teststate.FormatPath(t.TempDir(), "Maybe.json") |
| 124 | + assert.False(t, teststate.IsPresent(t, path), "a missing file is not present") |
| 125 | + |
| 126 | + teststate.Save(t, path, true, "value") |
| 127 | + assert.True(t, teststate.IsPresent(t, path)) |
| 128 | + |
| 129 | + // An empty JSON value counts as absent, so a stage can re-create it. |
| 130 | + teststate.Save(t, path, true, "") |
| 131 | + assert.False(t, teststate.IsPresent(t, path), "an empty value counts as absent") |
| 132 | +} |
| 133 | + |
| 134 | +func TestIsEmptyJSON(t *testing.T) { |
| 135 | + t.Parallel() |
| 136 | + |
| 137 | + testCases := []struct { |
| 138 | + name string |
| 139 | + bytes string |
| 140 | + empty bool |
| 141 | + }{ |
| 142 | + {"no bytes", "", true}, |
| 143 | + {"null", "null", true}, |
| 144 | + {"false", "false", true}, |
| 145 | + {"zero", "0", true}, |
| 146 | + {"empty string", `""`, true}, |
| 147 | + {"empty array", "[]", true}, |
| 148 | + {"empty object", "{}", true}, |
| 149 | + {"true", "true", false}, |
| 150 | + {"non-zero", "42", false}, |
| 151 | + {"string", `"value"`, false}, |
| 152 | + {"array", `[1]`, false}, |
| 153 | + {"object", `{"a":1}`, false}, |
| 154 | + } |
| 155 | + |
| 156 | + for _, testCase := range testCases { |
| 157 | + t.Run(testCase.name, func(t *testing.T) { |
| 158 | + t.Parallel() |
| 159 | + assert.Equal(t, testCase.empty, teststate.IsEmptyJSON(t, []byte(testCase.bytes))) |
| 160 | + }) |
| 161 | + } |
| 162 | +} |
| 163 | + |
| 164 | +func TestCleanup(t *testing.T) { |
| 165 | + t.Parallel() |
| 166 | + |
| 167 | + folder := t.TempDir() |
| 168 | + path := teststate.FormatPath(folder, "Value.json") |
| 169 | + |
| 170 | + teststate.Save(t, path, true, "value") |
| 171 | + require.FileExists(t, path) |
| 172 | + |
| 173 | + teststate.Cleanup(t, path) |
| 174 | + assert.NoFileExists(t, path) |
| 175 | + |
| 176 | + // Cleaning up an already-absent path is a no-op, not a failure. |
| 177 | + assert.NotPanics(t, func() { teststate.Cleanup(t, path) }) |
| 178 | +} |
| 179 | + |
| 180 | +func TestCleanupFolder(t *testing.T) { |
| 181 | + t.Parallel() |
| 182 | + |
| 183 | + folder := t.TempDir() |
| 184 | + teststate.Save(t, teststate.FormatPath(folder, "One.json"), true, "1") |
| 185 | + teststate.Save(t, teststate.FormatPath(folder, "Two.json"), true, "2") |
| 186 | + |
| 187 | + require.NoError(t, teststate.CleanupFolderE(t, folder)) |
| 188 | + assert.NoDirExists(t, filepath.Join(folder, ".test-data")) |
| 189 | + |
| 190 | + // Cleaning an absent folder is a no-op. |
| 191 | + require.NoError(t, teststate.CleanupFolderE(t, folder)) |
| 192 | +} |
0 commit comments