1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
# Copyright 2026 Heath Stewart.
# Licensed under the MIT License. See LICENSE.txt in the project root for license information.
#Requires -Modules @{ ModuleName = 'Pester'; ModuleVersion = '5.0.0' }
# Run with: Invoke-Pester tests/Secrets.Tests.ps1
# Pass -Release to test a release build:
# $container = New-PesterContainer -Path ./tests/Secrets.Tests.ps1 -Data @{ Release = $true }
# $config = New-PesterConfiguration
# $config.Run.Container = $container
# Invoke-Pester -Configuration $config
#
# Requires a provisioned Key Vault via `azd up` or AZURE_KEYVAULT_URL set in the environment.
param(
[switch] $Release
)
# cspell:ignore LASTEXITCODE
Describe 'Secrets' -Tag 'Secrets' {
BeforeAll {
# Build the binary before running tests.
$repoRoot = Join-Path $PSScriptRoot '..' -Resolve
if ($Release) {
Write-Host 'Building release binary...'
cargo build --release 2>&1
$script:akv = Join-Path $repoRoot 'target' 'release' 'akv'
} else {
Write-Host 'Building debug binary...'
cargo build 2>&1
$script:akv = Join-Path $repoRoot 'target' 'debug' 'akv'
}
if ($LASTEXITCODE -ne 0) {
throw "cargo build failed with exit code $LASTEXITCODE"
}
# Resolve AZURE_KEYVAULT_URL from the environment or via azd.
$script:AZURE_KEYVAULT_URL = if ($env:AZURE_KEYVAULT_URL) {
$env:AZURE_KEYVAULT_URL
} else {
azd env get-value AZURE_KEYVAULT_URL 2>$null
}
if (-not $script:AZURE_KEYVAULT_URL) {
throw "AZURE_KEYVAULT_URL is not set. Run 'azd up' to provision resources first."
}
$script:AZURE_KEYVAULT_URL = $script:AZURE_KEYVAULT_URL.TrimEnd('/')
$script:secretName = 'test-secret'
# Create first version and capture the versioned ID.
$v1 = & $script:akv secret create "${script:secretName}=version1" --vault $script:AZURE_KEYVAULT_URL --output json | ConvertFrom-Json
$script:secretV1Url = $v1.id
# Create second version by setting the same secret name with a new value.
$v2 = & $script:akv secret create "${script:secretName}=version2" --vault $script:AZURE_KEYVAULT_URL --output json | ConvertFrom-Json
$script:secretV2Url = $v2.id
}
Context 'Args' -Tag 'Args' {
It 'rejects URL with --name' {
& $script:akv secret get $script:secretV1Url --name $script:secretName 2>$null
$LASTEXITCODE | Should -Be 2
}
It 'rejects URL with --version' {
$version = $script:secretV1Url.Split('/')[-1]
& $script:akv secret get $script:secretV1Url --version $version 2>$null
$LASTEXITCODE | Should -Be 2
}
It 'rejects --version without --name' {
$version = $script:secretV1Url.Split('/')[-1]
& $script:akv secret get --vault $script:AZURE_KEYVAULT_URL --version $version 2>$null
$LASTEXITCODE | Should -Be 2
}
}
Context 'Select by URL' -Tag 'URL' {
It 'edits a secret using URL form' {
$result = & $script:akv secret edit $script:secretV1Url --tags env=test --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.id | Should -Match "/secrets/${script:secretName}/"
}
It 'lists versions using URL form' {
$versions = & $script:akv secret list-versions $script:secretV1Url --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$versions.Count | Should -BeGreaterOrEqual 2
}
It 'gets a versioned secret using URL form' {
$result = & $script:akv secret get $script:secretV1Url --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.id | Should -Be $script:secretV1Url
}
It 'gets the latest (versionless) secret using URL form' {
$versionlessUrl = "${script:AZURE_KEYVAULT_URL}/secrets/${script:secretName}"
$result = & $script:akv secret get $versionlessUrl --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.id | Should -Match "/secrets/${script:secretName}/"
}
It 'reads a versioned secret using URL form' {
$value = & $script:akv read $script:secretV1Url -n
$LASTEXITCODE | Should -Be 0
$value | Should -Be 'version1'
}
}
Context 'Select by --name' -Tag 'Name' {
It 'edits a secret using --name' {
$result = & $script:akv secret edit --name $script:secretName --vault $script:AZURE_KEYVAULT_URL --tags env=test --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.id | Should -Match "/secrets/${script:secretName}/"
}
It 'edits a versioned secret using --name and --version' {
$version = $script:secretV1Url.Split('/')[-1]
$result = & $script:akv secret edit --name $script:secretName --vault $script:AZURE_KEYVAULT_URL --version $version --tags env=test --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.id | Should -Be $script:secretV1Url
}
It 'lists versions using --name' {
$versions = & $script:akv secret list-versions --name $script:secretName --vault $script:AZURE_KEYVAULT_URL --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$versions.Count | Should -BeGreaterOrEqual 2
}
It 'gets the latest (versionless) secret using --name' {
# Latest version (v2) should differ from v1 URL.
$result = & $script:akv secret get --name $script:secretName --vault $script:AZURE_KEYVAULT_URL --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.id | Should -Match "/secrets/${script:secretName}/"
$result.id | Should -Not -Be $script:secretV1Url
}
It 'gets a versioned secret using --name and --version' {
$version = $script:secretV1Url.Split('/')[-1]
$result = & $script:akv secret get --name $script:secretName --vault $script:AZURE_KEYVAULT_URL --version $version --output json | ConvertFrom-Json
$LASTEXITCODE | Should -Be 0
$result.id | Should -Be $script:secretV1Url
}
It 'reads the latest secret using --name' {
$value = & $script:akv read --name $script:secretName --vault $script:AZURE_KEYVAULT_URL -n
$LASTEXITCODE | Should -Be 0
$value | Should -Be 'version2'
}
}
}