tsafe-cli 1.0.28

Secrets runtime for developers — inject credentials into processes via exec, never into shell history or .env files
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128

//! Integration tests for `tsafe rotate-key` (HR-4).

use assert_cmd::Command;
use predicates::str::contains;
use tempfile::tempdir;

fn tsafe() -> Command {
    Command::cargo_bin("tsafe").unwrap()
}

/// Verify that after `rotate-key`, the vault opens with the new password and
/// rejects the old one.
#[test]
fn rotate_key_changes_password_and_unlocks_with_new() {
    let dir = tempdir().unwrap();

    // Init vault and store a secret.
    tsafe()
        .args(["init"])
        .env("TSAFE_VAULT_DIR", dir.path())
        .env("TSAFE_PASSWORD", "old-master-pw")
        .assert()
        .success();

    tsafe()
        .args(["set", "REKEY_SECRET", "rekey-value"])
        .env("TSAFE_VAULT_DIR", dir.path())
        .env("TSAFE_PASSWORD", "old-master-pw")
        .assert()
        .success();

    // rotate-key: provide both passwords via env vars (non-interactive).
    tsafe()
        .args(["rotate-key"])
        .env("TSAFE_VAULT_DIR", dir.path())
        .env("TSAFE_PASSWORD", "old-master-pw")
        .env("TSAFE_NEW_MASTER_PASSWORD", "new-master-pw")
        .assert()
        .success()
        .stdout(contains("re-encrypted successfully"));

    // Old password must no longer work.
    tsafe()
        .args(["get", "REKEY_SECRET"])
        .env("TSAFE_VAULT_DIR", dir.path())
        .env("TSAFE_PASSWORD", "old-master-pw")
        .assert()
        .failure()
        .stderr(contains("wrong password"));

    // New password must open the vault and retrieve the secret.
    tsafe()
        .args(["get", "REKEY_SECRET"])
        .env("TSAFE_VAULT_DIR", dir.path())
        .env("TSAFE_PASSWORD", "new-master-pw")
        .assert()
        .success()
        .stdout("rekey-value");
}

/// rotate-key with an empty TSAFE_NEW_MASTER_PASSWORD must fail with a clear message.
#[test]
fn rotate_key_rejects_empty_new_password() {
    let dir = tempdir().unwrap();

    tsafe()
        .args(["init"])
        .env("TSAFE_VAULT_DIR", dir.path())
        .env("TSAFE_PASSWORD", "pw")
        .assert()
        .success();

    tsafe()
        .args(["rotate-key"])
        .env("TSAFE_VAULT_DIR", dir.path())
        .env("TSAFE_PASSWORD", "pw")
        .env("TSAFE_NEW_MASTER_PASSWORD", "")
        .assert()
        .failure()
        .stderr(contains("empty"));
}

/// rotate-key preserves all secrets (round-trips all stored keys).
#[test]
fn rotate_key_preserves_all_secrets() {
    let dir = tempdir().unwrap();

    tsafe()
        .args(["init"])
        .env("TSAFE_VAULT_DIR", dir.path())
        .env("TSAFE_PASSWORD", "before")
        .assert()
        .success();

    for (k, v) in [("ALPHA", "a"), ("BETA", "b"), ("GAMMA", "c")] {
        tsafe()
            .args(["set", k, v])
            .env("TSAFE_VAULT_DIR", dir.path())
            .env("TSAFE_PASSWORD", "before")
            .assert()
            .success();
    }

    tsafe()
        .args(["rotate-key"])
        .env("TSAFE_VAULT_DIR", dir.path())
        .env("TSAFE_PASSWORD", "before")
        .env("TSAFE_NEW_MASTER_PASSWORD", "after")
        .assert()
        .success();

    for (k, v) in [("ALPHA", "a"), ("BETA", "b"), ("GAMMA", "c")] {
        let out = tsafe()
            .args(["get", k])
            .env("TSAFE_VAULT_DIR", dir.path())
            .env("TSAFE_PASSWORD", "after")
            .assert()
            .success()
            .get_output()
            .stdout
            .clone();
        assert_eq!(
            String::from_utf8(out).unwrap().trim(),
            v,
            "key {k} should survive rotate-key"
        );
    }
}