fnox 1.25.1

A flexible secret management tool supporting multiple providers and encryption methods
Documentation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
#!/usr/bin/env bats

# Tests for secret resolution priority order:
# 1. Provider (if specified)
# 2. Default value
# 3. Environment variable

setup() {
	load 'test_helper/common_setup'
	_common_setup
}

teardown() {
	_common_teardown
}

@test "provider takes priority over default value" {
	# Create config with plain provider, secret has both provider value and default
	cat >fnox.toml <<'EOF'
root = true

[providers.plain]
type = "plain"

[secrets.MY_SECRET]
provider = "plain"
value = "from-provider"
default = "from-default"
EOF

	# Should return provider value, not default
	run "$FNOX_BIN" get MY_SECRET
	assert_success
	assert_output "from-provider"
}

@test "provider takes priority over environment variable" {
	# Create config with plain provider
	cat >fnox.toml <<'EOF'
root = true

[providers.plain]
type = "plain"

[secrets.MY_SECRET]
provider = "plain"
value = "from-provider"
EOF

	# Set env var
	export MY_SECRET="from-env-var"

	# Should return provider value, not env var
	run "$FNOX_BIN" get MY_SECRET
	assert_success
	assert_output "from-provider"
}

@test "provider takes priority over both default and env var" {
	# Create config with plain provider, secret has provider, default, and env var
	cat >fnox.toml <<'EOF'
root = true

[providers.plain]
type = "plain"

[secrets.MY_SECRET]
provider = "plain"
value = "from-provider"
default = "from-default"
EOF

	# Set env var
	export MY_SECRET="from-env-var"

	# Should return provider value (highest priority)
	run "$FNOX_BIN" get MY_SECRET
	assert_success
	assert_output "from-provider"
}

@test "default takes priority over environment variable" {
	# Create config with default but no provider value
	cat >fnox.toml <<'EOF'
root = true

[providers.plain]
type = "plain"

[secrets.MY_SECRET]
default = "from-default"
EOF

	# Set env var
	export MY_SECRET="from-env-var"

	# Should return default value, not env var
	run "$FNOX_BIN" get MY_SECRET
	assert_success
	assert_output "from-default"
}

@test "environment variable used when no provider and no default" {
	# Create config with no provider value and no default
	cat >fnox.toml <<'EOF'
root = true

[providers.plain]
type = "plain"

[secrets.MY_SECRET]
EOF

	# Set env var
	export MY_SECRET="from-env-var"

	# Should return env var (lowest priority, but only option)
	run "$FNOX_BIN" get MY_SECRET
	assert_success
	assert_output "from-env-var"
}

@test "error when secret not found and no fallback" {
	# Create config with no provider, no default, no env var
	# Set if_missing = "error" to require the secret
	cat >fnox.toml <<'EOF'
root = true

[providers.plain]
type = "plain"

[secrets.MY_SECRET]
if_missing = "error"
EOF

	# Don't set env var - should error
	run "$FNOX_BIN" get MY_SECRET
	assert_failure
	assert_output --partial "Secret 'MY_SECRET' not found"
}

@test "priority order works with fnox exec" {
	# Create config with provider value and default
	cat >fnox.toml <<'EOF'
root = true

[providers.plain]
type = "plain"

[secrets.PROVIDER_SECRET]
provider = "plain"
value = "from-provider"
default = "from-default"

[secrets.DEFAULT_SECRET]
default = "from-default"

[secrets.ENV_SECRET]
EOF

	# Set env vars
	export PROVIDER_SECRET="from-env-var"
	export DEFAULT_SECRET="from-env-var"
	export ENV_SECRET="from-env-var"

	# Run a command that prints the env vars
	run "$FNOX_BIN" exec -- sh -c 'echo "$PROVIDER_SECRET|$DEFAULT_SECRET|$ENV_SECRET"'
	assert_success
	# Provider > default > env
	assert_output "from-provider|from-default|from-env-var"
}

@test "priority order works in CI redact mode" {
	# Skip if not in a CI environment (we'll simulate GitHub Actions)
	export CI=true
	export GITHUB_ACTIONS=true

	# Create config
	cat >fnox.toml <<'EOF'
root = true

[providers.plain]
type = "plain"

[secrets.PROVIDER_SECRET]
provider = "plain"
value = "provider-value-to-mask"
default = "default-value"

[secrets.DEFAULT_SECRET]
default = "default-value-to-mask"
EOF

	# Set env vars (should be ignored)
	export PROVIDER_SECRET="env-value"
	export DEFAULT_SECRET="env-value"

	# Run ci-redact
	run "$FNOX_BIN" ci-redact
	assert_success

	# Should mask provider value, not default or env
	assert_output --partial "::add-mask::provider-value-to-mask"
	assert_output --partial "::add-mask::default-value-to-mask"

	# Should NOT contain env value
	refute_output --partial "env-value"
}

@test "value field requires provider to be used" {
	# Create config with value but no provider specified and no default provider
	cat >fnox.toml <<'EOF'
root = true

[providers.plain1]
type = "plain"

[providers.plain2]
type = "plain"

[secrets.MY_SECRET]
value = "value-needs-provider"
default = "from-default"
EOF

	# With multiple providers and no default, can't auto-select provider
	# So value field can't be used - should fall back to default
	run "$FNOX_BIN" get MY_SECRET
	assert_success
	assert_output "from-default"
}

@test "provider value used as provider input, not direct output" {
	# This tests that the 'value' field is used as input to the provider
	# not returned directly
	cat >fnox.toml <<'EOF'
root = true

[providers.plain]
type = "plain"

[secrets.MY_SECRET]
provider = "plain"
value = "plain-provider-input-value"
EOF

	# The plain provider should return the value as-is
	# (demonstrating value is passed to provider)
	run "$FNOX_BIN" get MY_SECRET
	assert_success
	assert_output "plain-provider-input-value"
}

@test "multiple secrets respect individual priorities" {
	cat >fnox.toml <<'EOF'
root = true

[providers.plain]
type = "plain"

[secrets.SECRET_A]
provider = "plain"
value = "a-provider"
default = "a-default"

[secrets.SECRET_B]
default = "b-default"

[secrets.SECRET_C]
# No provider, no default - will use env
EOF

	# Set env vars for all
	export SECRET_A="a-env"
	export SECRET_B="b-env"
	export SECRET_C="c-env"

	# A: provider wins
	run "$FNOX_BIN" get SECRET_A
	assert_success
	assert_output "a-provider"

	# B: default wins over env
	run "$FNOX_BIN" get SECRET_B
	assert_success
	assert_output "b-default"

	# C: env var is used (only option)
	run "$FNOX_BIN" get SECRET_C
	assert_success
	assert_output "c-env"
}

@test "default provider with explicit value follows priority" {
	cat >fnox.toml <<'EOF'
root = true
default_provider = "plain"

[providers.plain]
type = "plain"

[secrets.MY_SECRET]
# Uses default provider
value = "provider-value"
default = "default-value"
EOF

	export MY_SECRET="env-value"

	# Should use provider (default provider) with value
	run "$FNOX_BIN" get MY_SECRET
	assert_success
	assert_output "provider-value"
}

@test "secret with provider but no value falls back to default" {
	cat >fnox.toml <<'EOF'
root = true

[providers.plain]
type = "plain"

[secrets.MY_SECRET]
provider = "plain"
# No value - provider can't be used
default = "default-value"
EOF

	export MY_SECRET="env-value"

	# Can't use provider without value, should fall back to default
	run "$FNOX_BIN" get MY_SECRET
	assert_success
	assert_output "default-value"
}

@test "if_missing=warn allows missing secrets without error" {
	cat >fnox.toml <<'EOF'
root = true

[providers.plain]
type = "plain"

[secrets.OPTIONAL_SECRET]
if_missing = "warn"
EOF

	# Don't set env var - should warn but not error
	run "$FNOX_BIN" get OPTIONAL_SECRET
	assert_success
	# Should produce warning on stderr
}

@test "if_missing=ignore silently skips missing secrets" {
	cat >fnox.toml <<'EOF'
root = true

[providers.plain]
type = "plain"

[secrets.OPTIONAL_SECRET]
if_missing = "ignore"
EOF

	# Don't set env var - should silently skip
	run "$FNOX_BIN" get OPTIONAL_SECRET
	assert_success
	assert_output ""
}

@test "priority works with profile-specific secrets" {
	cat >fnox.toml <<'EOF'
root = true

[providers.plain]
type = "plain"

[secrets.GLOBAL_SECRET]
provider = "plain"
value = "global-provider"
default = "global-default"

[profiles.dev]

[profiles.dev.providers.plain]
type = "plain"

[profiles.dev.secrets.DEV_SECRET]
default = "dev-default"

[profiles.dev.secrets.PROFILE_PROVIDER]
provider = "plain"
value = "profile-provider"
EOF

	export GLOBAL_SECRET="env-value"
	export DEV_SECRET="env-value"
	export PROFILE_PROVIDER="env-value"

	# Global secret from default profile should still use provider
	run "$FNOX_BIN" get GLOBAL_SECRET
	assert_success
	assert_output "global-provider"

	# Dev profile secret should use default over env
	run "$FNOX_BIN" get --profile dev DEV_SECRET
	assert_success
	assert_output "dev-default"

	# Profile secret with provider should use provider over env
	run "$FNOX_BIN" get --profile dev PROFILE_PROVIDER
	assert_success
	assert_output "profile-provider"
}