feat: Spring Boot config files in repos
application*.properties/.yml and bootstrap* files tracked by git are
listed under Repos, with their secret-looking keys as secrets.
- Keys whose name ends like a secret (password, secret, token, key, …)
or whose value looks like one (Jasypt ENC(...), a URL or connection
string with a password) are listed; providers.repos.spring.keys and
.values replace the patterns, also in a repo's .lazysecrets.yaml.
- A file's details count the keys left out; ${VAR} values are marked
as references, and a tracked file is only marked red when a listed
value is in plain text.
- Later YAML/properties documents name their keys after the profile:
spring.datasource.password (prod).
- Maven's @placeholders@ parse; Argo CD's applications.yaml and Helm
templates aren't Spring files.
- A green leaf icon, themeable with springColor.
This commit is contained in:
15 files changed
+733
-18
No files matched your search
@@ -0,0 +1,222 @@
|
||||
package repo
|
||||
|
||||
import (
|
||||
"context"
|
||||
"maps"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"slices"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"git.kebcloud.no/keb/lazysecrets/internal/provider"
|
||||
)
|
||||
|
||||
func TestIsSpring(t *testing.T) {
|
||||
for f, want := range map[string]bool{
|
||||
"src/main/resources/application.yml": true,
|
||||
"application-prod.properties": true,
|
||||
"config/application-local.yaml": true,
|
||||
"bootstrap.yml": true,
|
||||
"applicationset/dev/applications.yaml": false, // Argo CD's
|
||||
"chart/templates/application.yaml": false, // Helm's
|
||||
"application.yml.example": false,
|
||||
"application.json": false,
|
||||
"src/main/resources/applicationContext.xml": false,
|
||||
} {
|
||||
if IsSpring(f) != want {
|
||||
t.Errorf("%s: %t", f, !want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func springNames(keys []springKey) map[string]string {
|
||||
out := map[string]string{}
|
||||
for _, k := range keys {
|
||||
out[k.name] = k.value
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
func TestParseProperties(t *testing.T) {
|
||||
got := springNames(parseProperties([]byte(`# a comment
|
||||
! another
|
||||
a=1
|
||||
b : 2
|
||||
c 3
|
||||
d\:e=4
|
||||
long=one, \
|
||||
two
|
||||
unicode=café
|
||||
empty=
|
||||
#---
|
||||
spring.config.activate.on-profile=prod
|
||||
a=prod-1
|
||||
`)))
|
||||
want := map[string]string{
|
||||
"a": "1", "b": "2", "c": "3", "d:e": "4", "long": "one, two", "unicode": "café", "empty": "",
|
||||
"spring.config.activate.on-profile (prod)": "prod", "a (prod)": "prod-1",
|
||||
}
|
||||
if !maps.Equal(got, want) {
|
||||
t.Errorf("got %v\nwant %v", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseSpringYAML(t *testing.T) {
|
||||
keys, err := parseSpringYAML([]byte(`info.version: @project.version@
|
||||
artifacts:
|
||||
- @project.artifactId@
|
||||
spring:
|
||||
datasource:
|
||||
password: ${DB_PASSWORD}
|
||||
servers:
|
||||
- name: a
|
||||
secret: x
|
||||
logging.level:
|
||||
com.example: DEBUG
|
||||
---
|
||||
spring:
|
||||
config.activate.on-profile: prod
|
||||
datasource:
|
||||
password: hunter2
|
||||
---
|
||||
other: y
|
||||
`))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
want := map[string]string{
|
||||
"info.version": "@project.version@", "artifacts[0]": "@project.artifactId@",
|
||||
"spring.datasource.password": "${DB_PASSWORD}", "servers[0].name": "a", "servers[0].secret": "x",
|
||||
"logging.level.com.example": "DEBUG",
|
||||
"spring.config.activate.on-profile (prod)": "prod", "spring.datasource.password (prod)": "hunter2",
|
||||
"other (document 3)": "y",
|
||||
}
|
||||
if got := springNames(keys); !maps.Equal(got, want) {
|
||||
t.Errorf("got %v\nwant %v", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpringDefaults(t *testing.T) {
|
||||
f, err := compileSpring(SpringPatterns{})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for key, value := range map[string]string{
|
||||
"spring.datasource.password": "x",
|
||||
"spring.security.oauth2.client.registration.a.client-secret": "x",
|
||||
"profapp.payment.checkoutKey": "x",
|
||||
"app.clients.sgig.sgig-passord": "x",
|
||||
"jasypt.encryptor.password": "${JASYPT_ENCRYPTOR_PASSWORD}",
|
||||
"spring.datasource.url": "jdbc:postgresql://app:hunter2@db:5432/app",
|
||||
"app.servicebus.connection": "Endpoint=sb://x/;SharedAccessKeyName=a;SharedAccessKey=b",
|
||||
"app.name": "ENC(abc==)",
|
||||
} {
|
||||
if !f.secret(springKey{key: key, value: value}) {
|
||||
t.Errorf("%s=%s isn't listed", key, value)
|
||||
}
|
||||
}
|
||||
for key, value := range map[string]string{
|
||||
"spring.security.oauth2.client.provider.a.token-uri": "https://idp/token",
|
||||
"spring.security.oauth2.client.registration.a.authorization-grant-type": "client_credentials",
|
||||
"app.frontend.keycloak.url": "https://keycloak",
|
||||
"server.port": "8080",
|
||||
"spring.datasource.url": "jdbc:postgresql://db:5432/app",
|
||||
} {
|
||||
if f.secret(springKey{key: key, value: value}) {
|
||||
t.Errorf("%s=%s is listed", key, value)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestSpringFiles(t *testing.T) {
|
||||
root := gitRepo(t, map[string]string{
|
||||
"src/main/resources/application.yml": `server:
|
||||
port: 8080
|
||||
spring:
|
||||
datasource:
|
||||
url: jdbc:postgresql://db/app
|
||||
password: ${DB_PASSWORD}
|
||||
jasypt:
|
||||
encryptor:
|
||||
password: ${JASYPT_ENCRYPTOR_PASSWORD}
|
||||
app:
|
||||
api-key: ENC(abc==)
|
||||
`,
|
||||
"src/main/resources/application-local.properties": "server.port=8081\nspring.datasource.password=hunter2\n",
|
||||
"applicationset/applications.yaml": "kind: ApplicationSet\n",
|
||||
})
|
||||
ctx := context.Background()
|
||||
details := func(p *Provider, c provider.Container) map[string]provider.Attr {
|
||||
attrs, err := p.Details(ctx, c)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
out := map[string]provider.Attr{}
|
||||
for _, a := range attrs {
|
||||
out[a.Label] = a
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
p := New(Settings{Dir: root})
|
||||
srcs, _ := p.Sources(ctx)
|
||||
cs, err := p.Containers(ctx, srcs[0])
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var files []string
|
||||
for _, c := range cs {
|
||||
files = append(files, c.Name+" · "+c.Detail)
|
||||
}
|
||||
if want := []string{
|
||||
"src/main/resources/application-local.properties · spring · properties",
|
||||
"src/main/resources/application.yml · spring · yaml",
|
||||
}; !slices.Equal(files, want) {
|
||||
t.Fatalf("files %v\nwant %v", files, want)
|
||||
}
|
||||
local, yml := cs[0], cs[1]
|
||||
|
||||
keys, _ := p.Objects(ctx, yml, provider.TypeSecret)
|
||||
var names []string
|
||||
for _, k := range keys {
|
||||
names = append(names, k.Name)
|
||||
}
|
||||
if want := []string{"spring.datasource.password", "jasypt.encryptor.password", "app.api-key"}; !slices.Equal(names, want) {
|
||||
t.Errorf("keys %v, want %v", names, want)
|
||||
}
|
||||
if v, err := p.Value(ctx, keys[2]); err != nil || v.Reveal() != "ENC(abc==)" {
|
||||
t.Errorf("value: %q %v", v.Reveal(), err)
|
||||
}
|
||||
link := provider.Object{Container: provider.Container{Source: srcs[0], Name: "src/main/resources/application.yml"}, Name: "spring.datasource.password"}
|
||||
if v, err := p.Value(ctx, link); err != nil || v.Reveal() != "${DB_PASSWORD}" {
|
||||
t.Errorf("from a link: %q %v", v.Reveal(), err)
|
||||
}
|
||||
if f, _ := p.File(yml, &keys[1]); f.Line != 9 || f.Sops != "" {
|
||||
t.Errorf("file: %+v", f)
|
||||
}
|
||||
|
||||
// References and Jasypt aren't plain text in git; a password is.
|
||||
if d := details(p, yml); d["other keys"].Value != "2, not matched by the secret patterns" || d["git"].Warn || d["encryption"].Value != "jasypt: 1 of 5 values" {
|
||||
t.Errorf("yml: %+v", d)
|
||||
}
|
||||
if d := details(p, local); !d["git"].Warn {
|
||||
t.Errorf("local: %+v", d)
|
||||
}
|
||||
|
||||
// The config's patterns, and the repo's over them.
|
||||
all := []string{".*"}
|
||||
p = New(Settings{Dir: root, Spring: SpringPatterns{Keys: &all}})
|
||||
if keys, _ := p.Objects(ctx, yml, provider.TypeSecret); len(keys) != 5 {
|
||||
t.Errorf("every key: %d", len(keys))
|
||||
}
|
||||
lazysecrets := filepath.Join(root, ".lazysecrets.yaml")
|
||||
os.WriteFile(lazysecrets, []byte("spring:\n keys: [\"url$\"]\n values: []\n"), 0o644)
|
||||
if keys, _ := p.Objects(ctx, yml, provider.TypeSecret); len(keys) != 1 || keys[0].Name != "spring.datasource.url" {
|
||||
t.Errorf("repo's patterns: %v", keys)
|
||||
}
|
||||
os.WriteFile(lazysecrets, []byte("spring:\n keys: [\"(\"]\n"), 0o644)
|
||||
if _, err := p.Objects(ctx, yml, provider.TypeSecret); err == nil || !strings.Contains(err.Error(), ".lazysecrets.yaml: spring.keys[0]") {
|
||||
t.Errorf("bad pattern: %v", err)
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user