Files
claude beaa24754c Read the CalDAV password from a file, not from argv (V-644)
mavcaldav took -pass and -render-pass as flag values, so enabling it would
have put his calendar password in `ps` inside the container, in the compose
file, and in shell history. mavpoll and mavmaild both read their secret from
a file for exactly that reason.

readSecret reads once at start, trims, and refuses an empty or missing file.
An empty file is a deployment mistake, not a password, and basic auth would
otherwise send "" and collect a 401 every poll. A rotated password means a
restart, which is cheaper than re-reading the credential every five minutes.

Nothing called the old flags: no compose service, no systemd unit, no test.
So they are replaced rather than kept beside the new ones.
2026-08-07 01:19:33 +04:00

241 lines
6.9 KiB
Go

package main
import (
"context"
"fmt"
"net/http"
"net/http/httptest"
"os"
"path/filepath"
"testing"
"time"
"github.com/kami/maven/internal/ipc"
)
// The password comes from a file so it never reaches argv. An empty or missing
// file must fail at start rather than authenticate as "" against his calendar.
func TestReadSecret(t *testing.T) {
dir := t.TempDir()
good := filepath.Join(dir, "ok")
if err := os.WriteFile(good, []byte(" hunter2\n"), 0o600); err != nil {
t.Fatal(err)
}
if got, err := readSecret(good); err != nil || got != "hunter2" {
t.Fatalf("readSecret(good) = %q, %v; want \"hunter2\", nil", got, err)
}
empty := filepath.Join(dir, "empty")
if err := os.WriteFile(empty, []byte("\n \n"), 0o600); err != nil {
t.Fatal(err)
}
if _, err := readSecret(empty); err == nil {
t.Fatal("readSecret(empty) = nil error, want refusal")
}
if _, err := readSecret(filepath.Join(dir, "absent")); err == nil {
t.Fatal("readSecret(absent) = nil error, want refusal")
}
}
type fakeCore struct {
ipc.UnimplementedCoreAPI
facts map[string]ipc.Fact // composite key "key|source" → Fact
writeLog []ipc.WriteFactReq
writeErr error
readErr error
}
func (f *fakeCore) LatestFactBySource(_ context.Context, key, source string) (ipc.Fact, error) {
if f.readErr != nil {
return ipc.Fact{}, f.readErr
}
if f.facts == nil {
return ipc.Fact{}, ipc.ErrNoFact
}
fk := key + "|" + source
fact, ok := f.facts[fk]
if !ok {
return ipc.Fact{}, ipc.ErrNoFact
}
return fact, nil
}
func (f *fakeCore) WriteFact(_ context.Context, req ipc.WriteFactReq) (int64, error) {
if f.writeErr != nil {
return 0, f.writeErr
}
if f.facts == nil {
f.facts = make(map[string]ipc.Fact)
}
fk := req.Key + "|" + req.Source
f.facts[fk] = ipc.Fact{
Key: req.Key,
Value: req.Value,
Source: req.Source,
}
f.writeLog = append(f.writeLog, req)
return int64(len(f.writeLog)), nil
}
// ---------------------------------------------------------------------------
// Core logic tests
// ---------------------------------------------------------------------------
func TestWriteIfChanged(t *testing.T) {
ctx := context.Background()
now := time.Date(2026, 7, 3, 12, 0, 0, 0, time.UTC)
t.Run("no previous fact writes", func(t *testing.T) {
fc := &fakeCore{}
p := &poller{core: fc}
err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now)
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if len(fc.writeLog) != 1 {
t.Fatalf("expected 1 write, got %d", len(fc.writeLog))
}
if fc.writeLog[0].Value != "hello" {
t.Errorf("value = %q, want %q", fc.writeLog[0].Value, "hello")
}
if fc.writeLog[0].Key != "test_key" {
t.Errorf("key = %q, want %q", fc.writeLog[0].Key, "test_key")
}
if fc.writeLog[0].Source != "poll:caldav" {
t.Errorf("source = %q, want %q", fc.writeLog[0].Source, "poll:caldav")
}
if fc.writeLog[0].Kind != "env" {
t.Errorf("kind = %q, want %q", fc.writeLog[0].Kind, "env")
}
})
t.Run("same value skips write", func(t *testing.T) {
fc := &fakeCore{
facts: map[string]ipc.Fact{
"test_key|poll:caldav": {Value: "hello"},
},
}
p := &poller{core: fc}
err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now)
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if len(fc.writeLog) != 0 {
t.Errorf("expected 0 writes, got %d", len(fc.writeLog))
}
})
t.Run("different value writes", func(t *testing.T) {
fc := &fakeCore{
facts: map[string]ipc.Fact{
"test_key|poll:caldav": {Value: "old"},
},
}
p := &poller{core: fc}
err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "new", now)
if err != nil {
t.Fatalf("unexpected error: %v", err)
}
if len(fc.writeLog) != 1 {
t.Fatalf("expected 1 write, got %d", len(fc.writeLog))
}
if fc.writeLog[0].Value != "new" {
t.Errorf("value = %q, want %q", fc.writeLog[0].Value, "new")
}
})
t.Run("read error other than ErrNoFact returns error", func(t *testing.T) {
fc := &fakeCore{readErr: fmt.Errorf("connection refused")}
p := &poller{core: fc}
err := p.writeIfChanged(ctx, "fail_key", "poll:caldav", "x", now)
if err == nil {
t.Fatal("expected error, got nil")
}
})
t.Run("write error returns error", func(t *testing.T) {
fc := &fakeCore{
facts: map[string]ipc.Fact{},
writeErr: fmt.Errorf("disk full"),
}
p := &poller{core: fc}
err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now)
if err == nil {
t.Fatal("expected error, got nil")
}
})
}
// ---------------------------------------------------------------------------
// Poll cycle test
// ---------------------------------------------------------------------------
func TestPollOnce(t *testing.T) {
now := time.Now().UTC()
start := now.Add(-2 * time.Hour).Truncate(time.Second)
end := now.Add(2 * time.Hour).Truncate(time.Second)
ical := fmt.Sprintf("BEGIN:VCALENDAR\nBEGIN:VEVENT\nDTSTART:%sT%sZ\nDTEND:%sT%sZ\nSUMMARY:Current meeting\nEND:VEVENT\nEND:VCALENDAR",
start.Format("20060102"), start.Format("150405"),
end.Format("20060102"), end.Format("150405"))
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
w.Write([]byte(ical))
}))
defer srv.Close()
fc := &fakeCore{}
p := &poller{
core: fc,
http: srv.Client(),
url: srv.URL,
}
p.pollOnce(context.Background())
if len(fc.writeLog) != 2 {
t.Fatalf("expected 2 writes (calendar_busy + calendar_event), got %d", len(fc.writeLog))
}
// First write: calendar_busy = "true"
busyReq := fc.writeLog[0]
if busyReq.Key != "calendar_busy" {
t.Errorf("first write key = %q, want %q", busyReq.Key, "calendar_busy")
}
if busyReq.Value != "true" {
t.Errorf("calendar_busy value = %q, want %q", busyReq.Value, "true")
}
if busyReq.Source != "poll:caldav" {
t.Errorf("source = %q, want %q", busyReq.Source, "poll:caldav")
}
if busyReq.Kind != "env" {
t.Errorf("kind = %q, want %q", busyReq.Kind, "env")
}
if busyReq.Ts.IsZero() {
t.Errorf("calendar_busy ts is zero")
}
// Second write: calendar_event_<date>_<summary> = "<summary> @ HH:MM-HH:MM".
// The iCal states the event in UTC and the fact is stamped on the owner's
// clock, so the expected key date and times are the local reading of it.
eventReq := fc.writeLog[1]
expectedKey := "calendar_event_" + start.Local().Format("20060102") + "_Current-meeting"
if eventReq.Key != expectedKey {
t.Errorf("event key = %q, want %q", eventReq.Key, expectedKey)
}
expectedVal := "Current meeting @ " + start.Local().Format("15:04") + "-" + end.Local().Format("15:04")
if eventReq.Value != expectedVal {
t.Errorf("event value = %q, want %q", eventReq.Value, expectedVal)
}
if eventReq.Source != "poll:caldav" {
t.Errorf("event source = %q, want %q", eventReq.Source, "poll:caldav")
}
if eventReq.Kind != "env" {
t.Errorf("event kind = %q, want %q", eventReq.Kind, "env")
}
if !eventReq.Ts.Equal(start) {
t.Errorf("event ts = %v, want %v", eventReq.Ts, start)
}
}