tsafe-cli 1.0.21

tsafe CLI — local secret and credential manager (replaces .env files)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

//! Integration tests for `tsafe rotate` (non-interactive via `TSAFE_NEW_MASTER_PASSWORD`).

use assert_cmd::Command;
use predicates::str::contains;
use tempfile::tempdir;

fn tsafe() -> Command {
    Command::cargo_bin("tsafe").unwrap()
}

#[test]
fn rotate_reencrypts_vault_new_password_unlocks() {
    let dir = tempdir().unwrap();
    let vault_dir = dir.path();
    tsafe()
        .args(["init"])
        .env("TSAFE_VAULT_DIR", vault_dir)
        .env("TSAFE_PASSWORD", "old-master-pw")
        .assert()
        .success();

    tsafe()
        .args(["set", "ROTATE_KEY", "secret-value"])
        .env("TSAFE_VAULT_DIR", vault_dir)
        .env("TSAFE_PASSWORD", "old-master-pw")
        .assert()
        .success();

    tsafe()
        .args(["rotate"])
        .env("TSAFE_VAULT_DIR", vault_dir)
        .env("TSAFE_PASSWORD", "old-master-pw")
        .env("TSAFE_NEW_MASTER_PASSWORD", "new-master-pw")
        .assert()
        .success();

    tsafe()
        .args(["get", "ROTATE_KEY"])
        .env("TSAFE_VAULT_DIR", vault_dir)
        .env("TSAFE_PASSWORD", "old-master-pw")
        .assert()
        .failure()
        .stderr(contains("wrong password"));

    tsafe()
        .args(["get", "ROTATE_KEY"])
        .env("TSAFE_VAULT_DIR", vault_dir)
        .env("TSAFE_PASSWORD", "new-master-pw")
        .assert()
        .success()
        .stdout("secret-value");
}

#[test]
fn rotate_rejects_empty_tsafe_new_master_password() {
    let dir = tempdir().unwrap();
    tsafe()
        .args(["init"])
        .env("TSAFE_VAULT_DIR", dir.path())
        .env("TSAFE_PASSWORD", "pw")
        .assert()
        .success();

    tsafe()
        .args(["rotate"])
        .env("TSAFE_VAULT_DIR", dir.path())
        .env("TSAFE_PASSWORD", "pw")
        .env("TSAFE_NEW_MASTER_PASSWORD", "")
        .assert()
        .failure()
        .stderr(contains("empty"));
}