Skip to content

Commit f2bf283

Browse files
enbiyagoralenbiyagoral
committed
test: add unit tests for HuaweiCloud KMS integration
1 parent 486a5e9 commit f2bf283

File tree

3 files changed

+246
-1
lines changed

3 files changed

+246
-1
lines changed

‎config/config_test.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,11 +50,13 @@ creation_rules:
5050
kms: "1"
5151
pgp: "2"
5252
gcp_kms: "3"
53+
hckms: "tr-west-1:test-key-1"
5354
hc_vault_transit_uri: http://4:8200/v1/4/keys/4
5455
- path_regex: ""
5556
kms: foo
5657
pgp: bar
5758
gcp_kms: baz
59+
hckms: "tr-west-1:test-key-2"
5860
hc_vault_transit_uri: http://127.0.1.1/v1/baz/keys/baz
5961
`)
6062

@@ -114,6 +116,8 @@ creation_rules:
114116
- bar
115117
gcp_kms:
116118
- resource_id: foo
119+
hckms:
120+
- key_id: tr-west-1:test-key-1
117121
azure_keyvault:
118122
- vaultUrl: https://foo.vault.azure.net
119123
key: foo-key
@@ -128,6 +132,8 @@ creation_rules:
128132
gcp_kms:
129133
- resource_id: bar
130134
- resource_id: baz
135+
hckms:
136+
- key_id: tr-west-1:test-key-2
131137
azure_keyvault:
132138
- vaultUrl: https://bar.vault.azure.net
133139
key: bar-key
@@ -429,13 +435,15 @@ func TestLoadConfigFile(t *testing.T) {
429435
KMS: "1",
430436
PGP: "2",
431437
GCPKMS: "3",
438+
HCKms: "tr-west-1:test-key-1",
432439
VaultURI: "http://4:8200/v1/4/keys/4",
433440
},
434441
{
435442
PathRegex: "",
436443
KMS: "foo",
437444
PGP: "bar",
438445
GCPKMS: "baz",
446+
HCKms: "tr-west-1:test-key-2",
439447
VaultURI: "http://127.0.1.1/v1/baz/keys/baz",
440448
},
441449
},
@@ -493,6 +501,7 @@ func TestLoadConfigFileWithGroups(t *testing.T) {
493501
},
494502
PGP: []string{"bar"},
495503
GCPKMS: []gcpKmsKey{{ResourceID: "foo"}},
504+
HCKms: []hckmsKey{{KeyID: "tr-west-1:test-key-1"}},
496505
AzureKV: []azureKVKey{{VaultURL: "https://foo.vault.azure.net", Key: "foo-key", Version: "fooversion"}},
497506
Vault: []string{"https://foo.vault:8200/v1/foo/keys/foo-key"},
498507
},
@@ -503,6 +512,7 @@ func TestLoadConfigFileWithGroups(t *testing.T) {
503512
{ResourceID: "bar"},
504513
{ResourceID: "baz"},
505514
},
515+
HCKms: []hckmsKey{{KeyID: "tr-west-1:test-key-2"}},
506516
AzureKV: []azureKVKey{{VaultURL: "https://bar.vault.azure.net", Key: "bar-key", Version: "barversion"}},
507517
Vault: []string{"https://baz.vault:8200/v1/baz/keys/baz-key"},
508518
},

‎hckms/keysource.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ func init() {
4343
type MasterKey struct {
4444
// KeyID is the full key identifier in format "region:key-uuid"
4545
KeyID string
46-
// Region is the HuaweiCloud region (e.g., "cn-north-1")
46+
// Region is the HuaweiCloud region (e.g., "tr-west-1")
4747
Region string
4848
// KeyUUID is the UUID of the KMS key
4949
KeyUUID string

‎hckms/keysource_test.go‎

Lines changed: 235 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,235 @@
1+
package hckms
2+
3+
import (
4+
"testing"
5+
"time"
6+
7+
"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth"
8+
"github.com/stretchr/testify/assert"
9+
)
10+
11+
const (
12+
testKeyID1 = "tr-west-1:12345678-1234-1234-1234-123456789abc"
13+
testKeyID2 = "tr-west-1:87654321-4321-4321-4321-cba987654321"
14+
)
15+
16+
func TestNewMasterKey(t *testing.T) {
17+
tests := []struct {
18+
name string
19+
keyID string
20+
expectErr bool
21+
expectKey MasterKey
22+
}{
23+
{
24+
name: "valid key ID",
25+
keyID: testKeyID1,
26+
expectKey: MasterKey{
27+
KeyID: testKeyID1,
28+
Region: "tr-west-1",
29+
KeyUUID: "12345678-1234-1234-1234-123456789abc",
30+
},
31+
},
32+
{
33+
name: "invalid format - no colon",
34+
keyID: "tr-west-1-12345678-1234-1234-1234-123456789abc",
35+
expectErr: true,
36+
},
37+
{
38+
name: "invalid format - empty region",
39+
keyID: ":12345678-1234-1234-1234-123456789abc",
40+
expectErr: true,
41+
},
42+
{
43+
name: "invalid format - empty UUID",
44+
keyID: "tr-west-1:",
45+
expectErr: true,
46+
},
47+
{
48+
name: "invalid format - empty string",
49+
keyID: "",
50+
expectErr: true,
51+
},
52+
}
53+
54+
for _, tt := range tests {
55+
t.Run(tt.name, func(t *testing.T) {
56+
key, err := NewMasterKey(tt.keyID)
57+
if tt.expectErr {
58+
assert.Error(t, err)
59+
assert.Nil(t, key)
60+
return
61+
}
62+
assert.NoError(t, err)
63+
assert.Equal(t, tt.expectKey.KeyID, key.KeyID)
64+
assert.Equal(t, tt.expectKey.Region, key.Region)
65+
assert.Equal(t, tt.expectKey.KeyUUID, key.KeyUUID)
66+
assert.NotNil(t, key.CreationDate)
67+
})
68+
}
69+
}
70+
71+
func TestNewMasterKeyFromKeyIDString(t *testing.T) {
72+
tests := []struct {
73+
name string
74+
keyIDString string
75+
expectErr bool
76+
expectKeyCount int
77+
expectKeys []MasterKey
78+
}{
79+
{
80+
name: "single key ID",
81+
keyIDString: testKeyID1,
82+
expectKeyCount: 1,
83+
expectKeys: []MasterKey{
84+
{
85+
KeyID: testKeyID1,
86+
Region: "tr-west-1",
87+
KeyUUID: "12345678-1234-1234-1234-123456789abc",
88+
},
89+
},
90+
},
91+
{
92+
name: "multiple key IDs",
93+
keyIDString: testKeyID1 + "," + testKeyID2,
94+
expectKeyCount: 2,
95+
expectKeys: []MasterKey{
96+
{
97+
KeyID: testKeyID1,
98+
Region: "tr-west-1",
99+
KeyUUID: "12345678-1234-1234-1234-123456789abc",
100+
},
101+
{
102+
KeyID: testKeyID2,
103+
Region: "tr-west-1",
104+
KeyUUID: "87654321-4321-4321-4321-cba987654321",
105+
},
106+
},
107+
},
108+
{
109+
name: "multiple key IDs with spaces",
110+
keyIDString: " " + testKeyID1 + " , " + testKeyID2 + " ",
111+
expectKeyCount: 2,
112+
expectKeys: []MasterKey{
113+
{
114+
KeyID: testKeyID1,
115+
Region: "tr-west-1",
116+
KeyUUID: "12345678-1234-1234-1234-123456789abc",
117+
},
118+
{
119+
KeyID: testKeyID2,
120+
Region: "tr-west-1",
121+
KeyUUID: "87654321-4321-4321-4321-cba987654321",
122+
},
123+
},
124+
},
125+
{
126+
name: "empty string",
127+
keyIDString: "",
128+
expectKeyCount: 0,
129+
},
130+
{
131+
name: "invalid key ID in list",
132+
keyIDString: testKeyID1 + ",invalid-key-id",
133+
expectErr: true,
134+
},
135+
}
136+
137+
for _, tt := range tests {
138+
t.Run(tt.name, func(t *testing.T) {
139+
keys, err := NewMasterKeyFromKeyIDString(tt.keyIDString)
140+
if tt.expectErr {
141+
assert.Error(t, err)
142+
assert.Nil(t, keys)
143+
return
144+
}
145+
assert.NoError(t, err)
146+
assert.Equal(t, tt.expectKeyCount, len(keys))
147+
for i, expectedKey := range tt.expectKeys {
148+
if i < len(keys) {
149+
assert.Equal(t, expectedKey.KeyID, keys[i].KeyID)
150+
assert.Equal(t, expectedKey.Region, keys[i].Region)
151+
assert.Equal(t, expectedKey.KeyUUID, keys[i].KeyUUID)
152+
}
153+
}
154+
})
155+
}
156+
}
157+
158+
func TestMasterKey_ToString(t *testing.T) {
159+
key, err := NewMasterKey(testKeyID1)
160+
assert.NoError(t, err)
161+
assert.Equal(t, testKeyID1, key.ToString())
162+
}
163+
164+
func TestMasterKey_ToMap(t *testing.T) {
165+
key, err := NewMasterKey(testKeyID1)
166+
assert.NoError(t, err)
167+
key.EncryptedKey = "test-encrypted-key"
168+
key.CreationDate = time.Date(2025, 1, 1, 12, 0, 0, 0, time.UTC)
169+
170+
m := key.ToMap()
171+
assert.Equal(t, testKeyID1, m["key_id"])
172+
assert.Equal(t, "test-encrypted-key", m["enc"])
173+
assert.Equal(t, "2025-01-01T12:00:00Z", m["created_at"])
174+
}
175+
176+
func TestMasterKey_TypeToIdentifier(t *testing.T) {
177+
key, err := NewMasterKey(testKeyID1)
178+
assert.NoError(t, err)
179+
assert.Equal(t, KeyTypeIdentifier, key.TypeToIdentifier())
180+
}
181+
182+
func TestMasterKey_NeedsRotation(t *testing.T) {
183+
key, err := NewMasterKey(testKeyID1)
184+
assert.NoError(t, err)
185+
186+
// New key should not need rotation
187+
assert.False(t, key.NeedsRotation())
188+
189+
// Key older than TTL should need rotation
190+
key.CreationDate = time.Now().UTC().Add(-hckmsTTL - time.Hour)
191+
assert.True(t, key.NeedsRotation())
192+
}
193+
194+
func TestMasterKey_EncryptedDataKey(t *testing.T) {
195+
key, err := NewMasterKey(testKeyID1)
196+
assert.NoError(t, err)
197+
key.EncryptedKey = "test-encrypted-data"
198+
assert.Equal(t, []byte("test-encrypted-data"), key.EncryptedDataKey())
199+
}
200+
201+
func TestMasterKey_SetEncryptedDataKey(t *testing.T) {
202+
key, err := NewMasterKey(testKeyID1)
203+
assert.NoError(t, err)
204+
key.SetEncryptedDataKey([]byte("test-encrypted-data"))
205+
assert.Equal(t, "test-encrypted-data", key.EncryptedKey)
206+
}
207+
208+
func TestMasterKey_EncryptIfNeeded(t *testing.T) {
209+
key, err := NewMasterKey(testKeyID1)
210+
assert.NoError(t, err)
211+
212+
// Key without encrypted data should attempt encryption
213+
// (will fail without credentials, but that's expected)
214+
err = key.EncryptIfNeeded([]byte("test-data"))
215+
// We expect an error because we don't have real credentials
216+
assert.Error(t, err)
217+
218+
// Key with encrypted data should not attempt encryption
219+
key.EncryptedKey = "already-encrypted"
220+
err = key.EncryptIfNeeded([]byte("test-data"))
221+
assert.NoError(t, err)
222+
assert.Equal(t, "already-encrypted", key.EncryptedKey)
223+
}
224+
225+
func TestCredentials_ApplyToMasterKey(t *testing.T) {
226+
basicCred := auth.NewBasicCredentialsBuilder().
227+
WithAk("test-ak").
228+
WithSk("test-sk").
229+
Build()
230+
cred := NewCredentials(basicCred)
231+
key, err := NewMasterKey(testKeyID1)
232+
assert.NoError(t, err)
233+
cred.ApplyToMasterKey(key)
234+
assert.Equal(t, cred.credential, key.credentials)
235+
}

0 commit comments

Comments
 (0)