feat: --demo has expired, disabled and expiring secrets

internal/provider/fake/fake.go

@@ -349,6 +349,19 @@ func Azure(delay time.Duration) *Provider {
 	p.add(kvDev, provider.TypeSecret, provider.Object{
 		Name: "db-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-app-dev", "db-password"),
 	}, "dev-password")
+	// Left behind, as dev vaults are: expired, disabled, or both.
+	p.add(kvDev, provider.TypeSecret, provider.Object{
+		Name: "stripe-webhook-secret", Enabled: &yes, Updated: base.AddDate(-1, 0, 0),
+		Expires: base.AddDate(0, -2, 0), Reference: secretRef("kv-app-dev", "stripe-webhook-secret"),
+	}, "whsec_demo_expired")
+	p.add(kvDev, provider.TypeSecret, provider.Object{
+		Name: "test-user-password", Enabled: &no, Updated: base.AddDate(0, -5, 0),
+		Reference: secretRef("kv-app-dev", "test-user-password"),
+	}, "disabled-demo-password")
+	p.add(kvDev, provider.TypeSecret, provider.Object{
+		Name: "vendor-token", Enabled: &no, Updated: base.AddDate(-2, 0, 0),
+		Expires: base.AddDate(-1, 0, 0), Reference: secretRef("kv-app-dev", "vendor-token"),
+	}, "expired-and-disabled")
 
 	return p
 }
@@ -384,6 +397,12 @@ func AzureOps(delay time.Duration) *Provider {
 	p.add(kv, provider.TypeSecret, provider.Object{
 		Name: "pagerduty-token", Enabled: &yes, Updated: base.AddDate(0, -1, 0), Reference: secretRef("kv-ops-tools", "pagerduty-token"),
 	}, "pd-demo-token")
+	// Expiring soon whenever the demo runs: the other dates are fixed,
+	// and would have passed. Tests use the first account only.
+	p.add(kv, provider.TypeSecret, provider.Object{
+		Name: "grafana-api-key", Enabled: &yes, Updated: base.AddDate(0, -11, 0),
+		Expires: time.Now().AddDate(0, 0, 12).Truncate(24 * time.Hour), Reference: secretRef("kv-ops-tools", "grafana-api-key"),
+	}, "glsa_demo_expiring")
 
 	return p
 }