Skip to content

Commit b32c85f

Browse files
samrosesamrose
committed
chore: proposed additions to vault regress tests
1 parent 0940d40 commit b32c85f

File tree

2 files changed

+160
-62
lines changed

2 files changed

+160
-62
lines changed

‎nix/tests/expected/vault.out‎

Lines changed: 98 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,101 @@
1-
select
2-
1
3-
from
4-
vault.create_secret('my_s3kre3t');
5-
?column?
6-
----------
7-
1
8-
(1 row)
9-
10-
select
11-
1
12-
from
13-
vault.create_secret(
1+
SET ROLE service_role;
2+
SELECT EXISTS (
3+
SELECT 1 FROM vault.create_secret('my_s3kre3t')
4+
) AS can_create_secret;
5+
can_create_secret
6+
-------------------
7+
t
8+
(1 row)
9+
10+
SELECT EXISTS (
11+
SELECT 1 FROM vault.create_secret(
1412
'another_s3kre3t',
1513
'unique_name',
1614
'This is the description'
17-
);
18-
?column?
19-
----------
20-
1
21-
(1 row)
22-
23-
insert into vault.secrets (secret)
24-
values
25-
('s3kre3t_k3y');
26-
select
27-
name,
28-
description
29-
from
30-
vault.decrypted_secrets
31-
order by
32-
created_at desc
33-
limit
34-
3;
35-
name | description
36-
-------------+-------------------------
37-
|
38-
unique_name | This is the description
39-
|
40-
(3 rows)
41-
42-
15+
)
16+
) AS can_create_secret_with_params;
17+
can_create_secret_with_params
18+
-------------------------------
19+
t
20+
(1 row)
21+
22+
SELECT EXISTS (
23+
SELECT 1 FROM vault.secrets LIMIT 1
24+
) AS can_select_from_secrets;
25+
can_select_from_secrets
26+
-------------------------
27+
t
28+
(1 row)
29+
30+
INSERT INTO vault.secrets (secret)
31+
VALUES ('s3kre3t_k3y')
32+
RETURNING EXISTS (
33+
SELECT 1
34+
) AS can_insert_into_secrets;
35+
ERROR: permission denied for function _crypto_aead_det_noncegen
36+
SELECT EXISTS (
37+
SELECT name, description FROM vault.decrypted_secrets LIMIT 1
38+
) AS can_select_from_decrypted_secrets;
39+
can_select_from_decrypted_secrets
40+
-----------------------------------
41+
t
42+
(1 row)
43+
44+
INSERT INTO vault.secrets (secret) VALUES ('temp_secret_to_delete');
45+
ERROR: permission denied for function _crypto_aead_det_noncegen
46+
WITH deleted AS (
47+
DELETE FROM vault.secrets
48+
WHERE secret = 'temp_secret_to_delete'
49+
RETURNING 1
50+
)
51+
SELECT EXISTS (SELECT 1 FROM deleted) AS can_delete_from_secrets;
52+
can_delete_from_secrets
53+
-------------------------
54+
f
55+
(1 row)
56+
57+
INSERT INTO vault.secrets (secret) VALUES ('temp_secret_to_delete_from_decrypted');
58+
ERROR: permission denied for function _crypto_aead_det_noncegen
59+
WITH deleted AS (
60+
DELETE FROM vault.decrypted_secrets
61+
WHERE secret = 'temp_secret_to_delete_from_decrypted'
62+
RETURNING 1
63+
)
64+
SELECT EXISTS (SELECT 1 FROM deleted) AS can_delete_from_decrypted_secrets;
65+
can_delete_from_decrypted_secrets
66+
-----------------------------------
67+
f
68+
(1 row)
69+
70+
WITH secret_id AS (
71+
SELECT id FROM vault.secrets ORDER BY created_at DESC LIMIT 1
72+
)
73+
SELECT EXISTS (
74+
SELECT 1 FROM vault.update_secret(
75+
(SELECT id FROM secret_id),
76+
'updated_secret'
77+
)
78+
) AS can_update_secret;
79+
can_update_secret
80+
-------------------
81+
t
82+
(1 row)
83+
84+
WITH encrypted_value AS (
85+
SELECT secret FROM vault.secrets ORDER BY created_at DESC LIMIT 1
86+
)
87+
SELECT EXISTS (
88+
SELECT 1 FROM vault._crypto_aead_det_decrypt(
89+
decode((SELECT secret FROM encrypted_value), 'base64'),
90+
convert_to((SELECT id FROM vault.secrets ORDER BY created_at DESC LIMIT 1)::text, 'utf8'),
91+
0,
92+
'pgsodium'::bytea,
93+
(SELECT nonce FROM vault.secrets ORDER BY created_at DESC LIMIT 1)
94+
)
95+
) AS can_decrypt;
96+
can_decrypt
97+
-------------
98+
t
99+
(1 row)
100+
101+
RESET ROLE;

‎nix/tests/sql/vault.sql‎

Lines changed: 62 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,69 @@
1-
select
2-
1
3-
from
4-
vault.create_secret('my_s3kre3t');
5-
6-
select
7-
1
8-
from
9-
vault.create_secret(
1+
SET ROLE service_role;
2+
3+
SELECT EXISTS (
4+
SELECT 1 FROM vault.create_secret('my_s3kre3t')
5+
) AS can_create_secret;
6+
7+
SELECT EXISTS (
8+
SELECT 1 FROM vault.create_secret(
109
'another_s3kre3t',
1110
'unique_name',
1211
'This is the description'
13-
);
12+
)
13+
) AS can_create_secret_with_params;
14+
15+
SELECT EXISTS (
16+
SELECT 1 FROM vault.secrets LIMIT 1
17+
) AS can_select_from_secrets;
18+
19+
INSERT INTO vault.secrets (secret)
20+
VALUES ('s3kre3t_k3y')
21+
RETURNING EXISTS (
22+
SELECT 1
23+
) AS can_insert_into_secrets;
24+
25+
SELECT EXISTS (
26+
SELECT name, description FROM vault.decrypted_secrets LIMIT 1
27+
) AS can_select_from_decrypted_secrets;
28+
29+
INSERT INTO vault.secrets (secret) VALUES ('temp_secret_to_delete');
30+
31+
WITH deleted AS (
32+
DELETE FROM vault.secrets
33+
WHERE secret = 'temp_secret_to_delete'
34+
RETURNING 1
35+
)
36+
SELECT EXISTS (SELECT 1 FROM deleted) AS can_delete_from_secrets;
1437

15-
insert into vault.secrets (secret)
16-
values
17-
('s3kre3t_k3y');
38+
INSERT INTO vault.secrets (secret) VALUES ('temp_secret_to_delete_from_decrypted');
39+
WITH deleted AS (
40+
DELETE FROM vault.decrypted_secrets
41+
WHERE secret = 'temp_secret_to_delete_from_decrypted'
42+
RETURNING 1
43+
)
44+
SELECT EXISTS (SELECT 1 FROM deleted) AS can_delete_from_decrypted_secrets;
1845

19-
select
20-
name,
21-
description
22-
from
23-
vault.decrypted_secrets
24-
order by
25-
created_at desc
26-
limit
27-
3;
28-
46+
WITH secret_id AS (
47+
SELECT id FROM vault.secrets ORDER BY created_at DESC LIMIT 1
48+
)
49+
SELECT EXISTS (
50+
SELECT 1 FROM vault.update_secret(
51+
(SELECT id FROM secret_id),
52+
'updated_secret'
53+
)
54+
) AS can_update_secret;
2955

56+
WITH encrypted_value AS (
57+
SELECT secret FROM vault.secrets ORDER BY created_at DESC LIMIT 1
58+
)
59+
SELECT EXISTS (
60+
SELECT 1 FROM vault._crypto_aead_det_decrypt(
61+
decode((SELECT secret FROM encrypted_value), 'base64'),
62+
convert_to((SELECT id FROM vault.secrets ORDER BY created_at DESC LIMIT 1)::text, 'utf8'),
63+
0,
64+
'pgsodium'::bytea,
65+
(SELECT nonce FROM vault.secrets ORDER BY created_at DESC LIMIT 1)
66+
)
67+
) AS can_decrypt;
3068

69+
RESET ROLE;

0 commit comments

Comments
 (0)