Add the -P param, bash completion script and improve the README.md

4 files changed, 155 insertions, 24 deletions

diff --git a/tests/conftest.py b/tests/conftest.py
index 1f70259..0770adb 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -1,5 +1,5 @@
 # etoolkit
-# Copyright (C) 2021 Simeon Simeonov
+# Copyright (C) 2021-2022 Simeon Simeonov
 
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -14,6 +14,8 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 """Common fixtures"""
+import json
+
 import pytest
 
 
@@ -23,8 +25,8 @@ def config_data():
     return {
         'general': {
             'MASTER_PASSWORD_HASH': (
-                'pbkdf2_sha256$100000$kFOQkAPtStZ/Ny/O4501ygHGQnqh5Y+ySxF9qVHr'
-                'iv8=$3BujuWzn3CfDnw4yiD9m3F+GjeW1MHHW40R/ThHNcn0='
+                'pbkdf2_sha256$100000$uYpZM1VfAGq0CDZL2duITs076CQj+hIFEgx+F4m'
+                'n80o=$h3PSPLCd37fP15zKdW4CBGn7CXE+q5UiydaF3vbeZHo='
             )
         },
         'instances': {
@@ -51,9 +53,26 @@ def config_data():
 
 
 @pytest.fixture
+def config_file(tmp_path, config_data):
+    """temporary config file for testing that includes config_data"""
+    cf = tmp_path / "etoolkit.json"
+    cf.write_text(json.dumps(config_data))
+    return str(cf)
+
+
+@pytest.fixture
+def non_random_bytes_32():
+    """always use the same bytes instead of os.urandom(32)"""
+    return (
+        b'\xb9\x8aY3U_\x00j\xb4\x086K\xd9\xdb\x88N'
+        b'\xcd;\xe8$#\xfa\x12\x05\x12\x0c~\x17\x89\xa7\xf3J'
+    )
+
+
+@pytest.fixture
 def password_hash():
-    """password hash for testing, corresponding to 'the very secret passwd'"""
+    """password hash for testing, corresponding to 'The very secret passwd'"""
     return (
-        'pbkdf2_sha256$100000$kFOQkAPtStZ/Ny/O4501ygHGQnqh5Y+ySxF9qVHr'
-        'iv8=$3BujuWzn3CfDnw4yiD9m3F+GjeW1MHHW40R/ThHNcn0='
+        'pbkdf2_sha256$100000$uYpZM1VfAGq0CDZL2duITs076CQj+hIFEgx+F4mn80o=$h3'
+        'PSPLCd37fP15zKdW4CBGn7CXE+q5UiydaF3vbeZHo='
     )
diff --git a/tests/test_cli.py b/tests/test_cli.py
index 1bd9be1..884e676 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -1,5 +1,5 @@
 # etoolkit
-# Copyright (C) 2021 Simeon Simeonov
+# Copyright (C) 2021-2022 Simeon Simeonov
 
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -14,12 +14,86 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 """Tests for the CLI (etoolkit.__main__"""
+import errno
+import os
+import unittest.mock
+
 import pytest
 
 import etoolkit
 from etoolkit.__main__ import main
 
 
+@unittest.mock.patch('os.urandom')
+@unittest.mock.patch('builtins.input')
+def test_decrypt(binput, urandom, capsys, non_random_bytes_32, config_file):
+    """Tests encryption via the CLI interface"""
+    urandom.return_value = non_random_bytes_32
+    binput.return_value = (
+        'enc-val$1$uYpZM1VfAGq0CDZL2duITs076CQj+'
+        'hIFEgx+F4mn80o=$xdF/1S+R2MGlEQMCOLG6OjEuzw=='
+    )
+    with unittest.mock.patch.dict(
+        os.environ, {'ETOOLKIT_MASTER_PASSWORD': 'the very secret passwd'}
+    ):
+        with pytest.raises(SystemExit) as exit_info:
+            main(['-c', f'{config_file}', '-d'])
+        assert exit_info.type == SystemExit
+        assert exit_info.value.code == 0
+        assert capsys.readouterr().out.strip() == 'Decrypted value: bar'
+
+
+@unittest.mock.patch('os.urandom')
+@unittest.mock.patch('builtins.input', lambda *args: 'bar')
+def test_encrypt_with_echo(urandom, capsys, non_random_bytes_32, config_file):
+    """Tests encryption via the CLI interface"""
+    urandom.return_value = non_random_bytes_32
+    with unittest.mock.patch.dict(
+        os.environ, {'ETOOLKIT_MASTER_PASSWORD': 'the very secret passwd'}
+    ):
+        with pytest.raises(SystemExit) as exit_info:
+            main(['-c', f'{config_file}', '-e', '-E'])
+        assert exit_info.type == SystemExit
+        assert exit_info.value.code == 0
+        assert capsys.readouterr().out.strip() == (
+            'Encrypted value: enc-val$1$uYpZM1VfAGq0CDZL2duITs076CQj+'
+            'hIFEgx+F4mn80o=$xdF/1S+R2MGlEQMCOLG6OjEuzw=='
+        )
+
+
+@unittest.mock.patch('os.urandom')
+@unittest.mock.patch('getpass.getpass', lambda *args: 'bar')
+def test_encrypt_without_echo(gpass, capsys, non_random_bytes_32, config_file):
+    """Tests encryption via the CLI interface"""
+    gpass.return_value = non_random_bytes_32
+    with unittest.mock.patch.dict(
+        os.environ, {'ETOOLKIT_MASTER_PASSWORD': 'the very secret passwd'}
+    ):
+        with pytest.raises(SystemExit) as exit_info:
+            main(['-c', f'{config_file}', '-e'])
+        assert exit_info.type == SystemExit
+        assert exit_info.value.code == 0
+        assert capsys.readouterr().out.strip() == (
+            'Encrypted value: enc-val$1$uYpZM1VfAGq0CDZL2duITs076CQj+'
+            'hIFEgx+F4mn80o=$xdF/1S+R2MGlEQMCOLG6OjEuzw=='
+        )
+
+
+def test_list(capsys, config_file):
+    """Tests list via the CLI interface"""
+    with pytest.raises(SystemExit) as exit_info:
+        main(['-l'])
+    assert exit_info.type == SystemExit
+    assert exit_info.value.code == errno.EIO
+    with pytest.raises(SystemExit) as exit_info:
+        main(['-c', f'{config_file}', '-l'])
+    assert exit_info.type == SystemExit
+    assert exit_info.value.code == 0
+    assert capsys.readouterr().out.strip() == (
+        f'default{os.linesep}dev{os.linesep}secret'
+    )
+
+
 def test_help(capsys):
     """Dummy test checking if the CLI is available at all"""
     with pytest.raises(SystemExit) as exit_info:
@@ -29,6 +103,27 @@ def test_help(capsys):
     assert capsys.readouterr().out.startswith('usage: etoolkit')
 
 
+@unittest.mock.patch('os.urandom')
+@unittest.mock.patch('getpass.getpass')
+def test_generate_master_password_hash(
+    gpass,
+    urandom,
+    capsys,
+    non_random_bytes_32,
+):
+    """Tests master password hash generation via the CLI interface"""
+    urandom.return_value = non_random_bytes_32
+    gpass.return_value = 'The very secret passwd'
+    with pytest.raises(SystemExit) as exit_info:
+        main(['--generate-master-password-hash'])
+    assert exit_info.type == SystemExit
+    assert exit_info.value.code == 0
+    assert capsys.readouterr().out.strip() == (
+        'Master password hash: pbkdf2_sha256$100000$uYpZM1VfAGq0CDZL2duITs076'
+        'CQj+hIFEgx+F4mn80o=$h3PSPLCd37fP15zKdW4CBGn7CXE+q5UiydaF3vbeZHo='
+    )
+
+
 def test_version(capsys):
     """Dummy test checking if the CLI is available at all"""
     with pytest.raises(SystemExit) as exit_info:
diff --git a/tests/test_envtoolkit_instance.py b/tests/test_envtoolkit_instance.py
index 2ffacd2..9061dc8 100644
--- a/tests/test_envtoolkit_instance.py
+++ b/tests/test_envtoolkit_instance.py
@@ -1,5 +1,5 @@
 # etoolkit
-# Copyright (C) 2021 Simeon Simeonov
+# Copyright (C) 2021-22 Simeon Simeonov
 
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -19,7 +19,7 @@ import pytest
 import etoolkit
 
 
-def test_instantiation(config_data, password_hash):
+def test_instantiation(config_data):
     """Tests for object instatiation"""
     with pytest.raises(etoolkit.EtoolkitInstanceError) as exc_info:
         instance = etoolkit.EtoolkitInstance('devv', config_data)
@@ -32,7 +32,9 @@ def test_instantiation(config_data, password_hash):
     assert 'DB_CONNECTION' not in instance.sensitive_env_variables
     assert 'PASSWORD' in instance.sensitive_env_variables
     assert instance.name == 'secret'
-    assert instance.master_password_hash == password_hash
+    assert instance.master_password_hash == (
+        config_data['general']['MASTER_PASSWORD_HASH']
+    )
     assert instance.master_password is None
 
 
diff --git a/tests/test_envtoolkit_instance_static.py b/tests/test_envtoolkit_instance_static.py
index d7ac857..73a5f36 100644
--- a/tests/test_envtoolkit_instance_static.py
+++ b/tests/test_envtoolkit_instance_static.py
@@ -1,5 +1,5 @@
 # etoolkit
-# Copyright (C) 2021 Simeon Simeonov
+# Copyright (C) 2021-2022 Simeon Simeonov
 
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -24,14 +24,14 @@ import etoolkit
 @unittest.mock.patch('getpass.getpass')
 def test_confirm_password_prompt(getpass, password_hash):
     """Tests the static EtoolkitInstance.confirm_password_prompt method"""
-    getpass.return_value = 'the very secret passwd'
+    getpass.return_value = 'The very secret passwd'
     assert (
         etoolkit.EtoolkitInstance.confirm_password_prompt(password_hash)
-        == 'the very secret passwd'
+        == 'The very secret passwd'
     )
     assert (
         etoolkit.EtoolkitInstance.confirm_password_prompt(password_hash, False)
-        == 'the very secret passwd'
+        == 'The very secret passwd'
     )
 
 
@@ -39,10 +39,10 @@ def test_decrypt():
     """Tests the static EtoolkitInstance.decrypt method"""
     assert (
         etoolkit.EtoolkitInstance.decrypt(
-            'the very secret passwd',
+            'The very secret passwd',
             (
-                'enc-val$1$Y/TBb1F3siHTw6qZg9ERzZfA8PLPf2CwGSQLpu9jYWw=$FT5tS9'
-                'o+ABvsxogIXpJim16Gz5SVtV8='
+                'enc-val$1$/cXpEMoZrTlb9yokGhw8tLTSUkqnqJ4ZoAkurNgMYx'
+                'w=$1VdkSMcZnLRwLiu1M8VlYcbelwmiVNY='
             ),
         )
         == 'secret1'
@@ -51,11 +51,11 @@ def test_decrypt():
     # now test with modified edata
     with pytest.raises(etoolkit.EtoolkitInstanceError) as exc_info:
         edata = (
-            'enc-val$1$Y/TBb1F3siHTw6qZg9ERzZfA8PLPf2CwGSQLpu9jYWw=$FT5tS9'
-            'o+ABvsxogIXpJim17Gz5SVtV8='
+            'enc-val$1$/cXpEMoZrTlb9yokGhw8tLTSUkqnqJ5ZoAkurNgMYx'
+            'w=$1VdkSMcZnLRwLiu1M8VlYcbelwmiVNY='
         )
         etoolkit.EtoolkitInstance.decrypt(
-            'the very secret passwd', edata
+            'The very secret passwd', edata
         ) == 'secret1'
     assert exc_info.type is etoolkit.EtoolkitInstanceError
     assert exc_info.value.args[0] == f'Invalid tag when decrypting: {edata}'
@@ -70,17 +70,32 @@ def test_encrypt():
     assert edata != etoolkit.EtoolkitInstance.encrypt('foo', 'bar')
 
 
+@unittest.mock.patch('os.urandom')
+def test_encrypt_staticly(urandom, non_random_bytes_32):
+    """Tests the EtoolkitInstance.encrypt method always with the same salt"""
+    urandom.return_value = non_random_bytes_32
+    edata = etoolkit.EtoolkitInstance.encrypt('The very secret passwd', 'bar')
+    assert edata == (
+        'enc-val$1$uYpZM1VfAGq0CDZL2duITs076CQj+hIFEgx+F4mn80'
+        'o=$HjPFNv6xC5hbMrFc0L5lSkWdfQ=='
+    )
+    assert edata == etoolkit.EtoolkitInstance.encrypt(
+        'The very secret passwd',
+        'bar',
+    )
+
+
 def test_get_new_password_hash():
     """Tests the static EtoolkitInstance.get_new_password_hash method"""
     new_hash = etoolkit.EtoolkitInstance.get_new_password_hash(
-        'the very secret passwd'
+        'The very secret passwd'
     )
     # all pbkdf2 params are the same / hardcoded for the time being
     assert new_hash.startswith('pbkdf2_sha256$100000$')
     assert len(new_hash) == 110
     # the hash should always be different because of random salting
     assert new_hash != etoolkit.EtoolkitInstance.get_new_password_hash(
-        'the very secret passwd'
+        'The very secret passwd'
     )
 
 
@@ -95,8 +110,8 @@ def test_parse_value():
 def test_password_matches(password_hash):
     """Tests the static EtoolkitInstance.password_matches method"""
     assert etoolkit.EtoolkitInstance.password_matches(
-        'the very secret passwd', password_hash
+        'The very secret passwd', password_hash
     )
     assert not etoolkit.EtoolkitInstance.password_matches(
-        'the very secret passwdo', password_hash
+        'The very secret passwdo', password_hash
     )