Add tests

.github/workflows/publish.yaml

@@ -8,6 +8,9 @@ on:
     types:
       - published
 
+permissions:
+  packages: write
+
 jobs:
   build-images:
     runs-on: ubuntu-latest

pkg/handler/validate_test.go

@@ -0,0 +1,62 @@
+package handler
+
+import (
+	"bytes"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+
+	"github.com/bakito/sealed-secrets-web/pkg/mocks/seal"
+	"github.com/gin-gonic/gin"
+	"github.com/golang/mock/gomock"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("Handler ", func() {
+	Context("Validate", func() {
+		var (
+			recorder *httptest.ResponseRecorder
+			c        *gin.Context
+			mock     *gomock.Controller
+			sealer   *seal.MockSealer
+			h        *Handler
+		)
+		BeforeEach(func() {
+			gin.SetMode(gin.ReleaseMode)
+			recorder = httptest.NewRecorder()
+			c, _ = gin.CreateTestContext(recorder)
+			mock = gomock.NewController(GinkgoT())
+			sealer = seal.NewMockSealer(mock)
+			h = &Handler{
+				sealer: sealer,
+			}
+		})
+
+		It("should return success if validation succeeds", func() {
+			c.Request, _ = http.NewRequest("POST", "/v1/validate", bytes.NewReader([]byte(stringDataAsYAML)))
+			c.Request.Header.Set("Content-Type", "application/x-yaml")
+
+			sealer.EXPECT().Validate(gomock.Any()).Return(nil)
+
+			h.Validate(c)
+
+			Ω(recorder.Code).Should(Equal(http.StatusOK))
+			Ω(recorder.Body.String()).Should(Equal("OK"))
+			Ω(recorder.Header().Get("Content-Type")).Should(Equal("text/plain"))
+		})
+
+		It("should return an error if validation fails", func() {
+			c.Request, _ = http.NewRequest("POST", "/v1/validate", bytes.NewReader([]byte(stringDataAsYAML)))
+			c.Request.Header.Set("Content-Type", "application/x-yaml")
+
+			sealer.EXPECT().Validate(gomock.Any()).Return(errors.New("Validation failed"))
+
+			h.Validate(c)
+
+			Ω(recorder.Code).Should(Equal(http.StatusBadRequest))
+			Ω(recorder.Body.String()).Should(Equal("Validation failed"))
+			Ω(recorder.Header().Get("Content-Type")).Should(Equal("text/plain"))
+		})
+	})
+})

pkg/seal/seal.go

@@ -102,16 +102,13 @@ func (a *apiSealer) Raw(data Raw) ([]byte, error) {
 }
 
 func (a *apiSealer) Validate(secret io.Reader) error {
-	if err := kubeseal.ValidateSealedSecret(
+	return kubeseal.ValidateSealedSecret(
 		context.TODO(),
 		a.clientConfig,
 		a.ss.Namespace,
 		a.ss.Service,
 		secret,
-	); err != nil {
-		return err
-	}
-	return nil
+	)
 }
 
 type Raw struct {

testdata/e2e/runTestValidate.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+set -e
+
+curl --version
+
+echo "Test /api/validate should respond 200 if sealed secret is valid"
+
+SEALED_SECRET=$(curl --silent --show-error --request POST 'http://localhost/ssw/api/kubeseal' \
+  --header 'Accept: application/x-yaml' \
+  --data-binary '@stringData.yaml')
+
+echo "$SEALED_SECRET" | yq -r .apiVersion | grep --quiet "bitnami.com/v1alpha1"
+echo "$SEALED_SECRET" | yq -r .kind | grep --quiet "SealedSecret"
+echo "$SEALED_SECRET" | yq -r .metadata.name | grep --quiet "mysecretname"
+echo "$SEALED_SECRET" | yq -r .metadata.namespace | grep --quiet "mysecretnamespace"
+
+RESPONSE=$(curl --silent --show-error --request POST 'http://localhost/ssw/api/validate' \
+  --header 'Accept: text/plain' \
+  --data-binary "$SEALED_SECRET" \
+  --output /dev/null -w "%{http_code}" )
+
+echo "$RESPONSE" | grep --quiet 200
+
+echo "Test /api/validate should respond 400 if sealed secret is invalid"
+
+INVALID_SECRET=$(curl --silent --show-error --request POST 'http://localhost/ssw/api/kubeseal' \
+  --header 'Accept: application/x-yaml' \
+  --data-binary '@stringData.yaml' | yq '.metadata.name = "wrongname"')
+
+echo "$INVALID_SECRET" | yq -r .apiVersion | grep --quiet "bitnami.com/v1alpha1"
+echo "$INVALID_SECRET" | yq -r .kind | grep --quiet "SealedSecret"
+echo "$INVALID_SECRET" | yq -r .metadata.name | grep --quiet "wrongname"
+echo "$INVALID_SECRET" | yq -r .metadata.namespace | grep --quiet "mysecretnamespace"
+
+RESPONSE=$(curl --silent --show-error --request POST 'http://localhost/ssw/api/validate' \
+  --header 'Accept: text/plain' \
+  --data-binary "$INVALID_SECRET" \
+  --output /dev/null -w "%{http_code}" )
+
+echo "$RESPONSE" | grep --quiet 400

testdata/e2e/runTests.sh

@@ -1,6 +1,8 @@
 #!/bin/bash
 set -e
 
+./runTestValidate.sh
+
 ./runTestKubeseal.sh
 
 ./runTestCertificate.sh