plugin_test.go

// Copyright 2026 Docker, Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package pass

import (
	"bytes"
	"encoding/binary"
	"errors"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"

	pass "github.com/docker/secrets-engine/plugins/pass/store"
	"github.com/docker/secrets-engine/plugins/pass/teststore"
	"github.com/docker/secrets-engine/store"
	"github.com/docker/secrets-engine/x/secrets"
	"github.com/docker/secrets-engine/x/testhelper"
)

func Test_passPlugin(t *testing.T) {
	t.Parallel()
	t.Run("ok", func(t *testing.T) {
		mock := teststore.NewMockStore(teststore.WithStore(map[store.ID]store.Secret{
			store.MustParseID("foo"): pass.NewPassValue([]byte("bar")),
		}))
		p := &passPlugin{kc: mock, logger: testhelper.TestLogger(t)}
		e, err := p.GetSecrets(t.Context(), secrets.MustParsePattern("foo"))
		require.NoError(t, err)
		require.NotEmpty(t, e)
		assert.Equal(t, "bar", string(e[0].Value))
	})
	t.Run("no secrets", func(t *testing.T) {
		mock := teststore.NewMockStore(teststore.WithStore(map[store.ID]store.Secret{}))
		p := &passPlugin{kc: mock}
		_, err := p.GetSecrets(t.Context(), secrets.MustParsePattern("foo"))
		assert.ErrorIs(t, err, secrets.ErrNotFound)
	})
	t.Run("store error", func(t *testing.T) {
		errFilter := errors.New("filter error")
		mock := teststore.NewMockStore(teststore.WithStoreFilterErr(errFilter))
		p := &passPlugin{kc: mock, logger: testhelper.TestLogger(t)}
		_, err := p.GetSecrets(t.Context(), secrets.MustParsePattern("foo"))
		assert.ErrorIs(t, err, errFilter)
	})
	t.Run("unwrap error", func(*testing.T) {
		mock := teststore.NewMockStore(teststore.WithStore(map[store.ID]store.Secret{
			store.MustParseID("foo"): &MockMyOtherValue{Value: 7},
		}))
		p := &passPlugin{kc: mock, logger: testhelper.TestLogger(t)}
		_, err := p.GetSecrets(t.Context(), secrets.MustParsePattern("foo"))
		assert.ErrorIs(t, err, secrets.ErrNotFound)
	})
}

var _ store.Secret = &MockMyOtherValue{}

type MockMyOtherValue struct {
	Value int64 `json:"value"`
}

func (m *MockMyOtherValue) Marshal() ([]byte, error) {
	buf := new(bytes.Buffer)
	if err := binary.Write(buf, binary.BigEndian, m.Value); err != nil {
		return nil, err
	}
	data := buf.Bytes()
	return data, nil
}

func (m *MockMyOtherValue) Unmarshal(data []byte) error {
	var decoded int64
	if err := binary.Read(bytes.NewReader(data), binary.BigEndian, &decoded); err != nil {
		return err
	}
	m.Value = decoded
	return nil
}

func (m *MockMyOtherValue) Metadata() map[string]string {
	return nil
}

func (m *MockMyOtherValue) SetMetadata(map[string]string) error {
	return nil
}