forked from hashicorp/vault
-
Notifications
You must be signed in to change notification settings - Fork 0
/
sys_init_test.go
125 lines (106 loc) · 2.7 KB
/
sys_init_test.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
package http
import (
"encoding/hex"
"net/http"
"reflect"
"testing"
"github.com/hashicorp/vault/vault"
)
func TestSysInit_get(t *testing.T) {
core := vault.TestCore(t)
ln, addr := TestServer(t, core)
defer ln.Close()
{
// Pre-init
resp, err := http.Get(addr + "/v1/sys/init")
if err != nil {
t.Fatalf("err: %s", err)
}
var actual map[string]interface{}
expected := map[string]interface{}{
"initialized": false,
}
testResponseStatus(t, resp, 200)
testResponseBody(t, resp, &actual)
if !reflect.DeepEqual(actual, expected) {
t.Fatalf("bad: %#v", actual)
}
}
vault.TestCoreInit(t, core)
{
// Post-init
resp, err := http.Get(addr + "/v1/sys/init")
if err != nil {
t.Fatalf("err: %s", err)
}
var actual map[string]interface{}
expected := map[string]interface{}{
"initialized": true,
}
testResponseStatus(t, resp, 200)
testResponseBody(t, resp, &actual)
if !reflect.DeepEqual(actual, expected) {
t.Fatalf("bad: %#v", actual)
}
}
}
// Test to check if the API errors out when wrong number of PGP keys are
// supplied
func TestSysInit_pgpKeysEntries(t *testing.T) {
core := vault.TestCore(t)
ln, addr := TestServer(t, core)
defer ln.Close()
resp := testHttpPut(t, "", addr+"/v1/sys/init", map[string]interface{}{
"secret_shares": 5,
"secret_threshold": 3,
"pgp_keys": []string{"pgpkey1"},
})
testResponseStatus(t, resp, 400)
}
// Test to check if the API errors out when wrong number of PGP keys are
// supplied for recovery config
func TestSysInit_pgpKeysEntriesForRecovery(t *testing.T) {
core := vault.TestCoreNewSeal(t)
ln, addr := TestServer(t, core)
defer ln.Close()
resp := testHttpPut(t, "", addr+"/v1/sys/init", map[string]interface{}{
"secret_shares": 1,
"secret_threshold": 1,
"stored_shares": 1,
"recovery_shares": 5,
"recovery_threshold": 3,
"recovery_pgp_keys": []string{"pgpkey1"},
})
testResponseStatus(t, resp, 400)
}
func TestSysInit_put(t *testing.T) {
core := vault.TestCore(t)
ln, addr := TestServer(t, core)
defer ln.Close()
resp := testHttpPut(t, "", addr+"/v1/sys/init", map[string]interface{}{
"secret_shares": 5,
"secret_threshold": 3,
})
var actual map[string]interface{}
testResponseStatus(t, resp, 200)
testResponseBody(t, resp, &actual)
keysRaw, ok := actual["keys"]
if !ok {
t.Fatalf("no keys: %#v", actual)
}
if _, ok := actual["root_token"]; !ok {
t.Fatal("no root token")
}
for _, key := range keysRaw.([]interface{}) {
keySlice, err := hex.DecodeString(key.(string))
if err != nil {
t.Fatalf("bad: %s", err)
}
if _, err := core.Unseal(keySlice); err != nil {
t.Fatalf("bad: %s", err)
}
}
if core.Sealed() {
t.Fatal("should not be sealed")
}
}