test: keychain upsert

Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>

Author: Benehiko

store/keychain/keychain_test.go

@@ -366,6 +366,52 @@ func TestKeychain(t *testing.T) {
 		require.ErrorContains(t, err, "i am failing on purpose")
 	})
 
+	t.Run("upsert inserts when credential does not exist", func(t *testing.T) {
+		ks := setupKeychain(t, nil)
+		id := store.MustParseID("com.test.test/test/upsert-insert")
+		creds := &mocks.MockCredential{
+			Username: "alice",
+			Password: "alice-password",
+		}
+		t.Cleanup(func() {
+			require.NoError(t, ks.Delete(context.Background(), id))
+		})
+		require.NoError(t, ks.Upsert(t.Context(), id, creds))
+
+		secret, err := ks.Get(t.Context(), id)
+		require.NoError(t, err)
+		actual := secret.(*mocks.MockCredential)
+		actual.Attributes = nil
+		assert.Equal(t, creds.Username, actual.Username)
+		assert.Equal(t, creds.Password, actual.Password)
+	})
+
+	t.Run("upsert overwrites an existing credential", func(t *testing.T) {
+		ks := setupKeychain(t, nil)
+		id := store.MustParseID("com.test.test/test/upsert-overwrite")
+		original := &mocks.MockCredential{
+			Username: "bob",
+			Password: "original-password",
+		}
+		t.Cleanup(func() {
+			require.NoError(t, ks.Delete(context.Background(), id))
+		})
+		require.NoError(t, ks.Save(t.Context(), id, original))
+
+		updated := &mocks.MockCredential{
+			Username: "bob",
+			Password: "updated-password",
+		}
+		require.NoError(t, ks.Upsert(t.Context(), id, updated))
+
+		secret, err := ks.Get(t.Context(), id)
+		require.NoError(t, err)
+		actual := secret.(*mocks.MockCredential)
+		actual.Attributes = nil
+		assert.Equal(t, updated.Username, actual.Username)
+		assert.Equal(t, updated.Password, actual.Password)
+	})
+
 	t.Run("set metadata error on getAllMetadata", func(t *testing.T) {
 		kc := setupKeychain(t, func(_ context.Context, _ store.ID) store.Secret {
 			return &mustUnmarshalError{}

store/posixage/store_test.go

@@ -656,6 +656,80 @@ func TestPOSIXAge(t *testing.T) {
 		assert.Equal(t, secret, storeSecret)
 	})
 
+	t.Run("upsert inserts when credential does not exist", func(t *testing.T) {
+		root, err := os.OpenRoot(t.TempDir())
+		require.NoError(t, err)
+		t.Cleanup(func() {
+			assert.NoError(t, root.Close())
+		})
+
+		masterKey := uuid.NewString()
+		s, err := New(root,
+			func(_ context.Context, _ store.ID) *mocks.MockCredential {
+				return &mocks.MockCredential{}
+			},
+			WithLogger(&testLogger{t}),
+			WithEncryptionCallbackFunc[EncryptionPassword](func(_ context.Context) ([]byte, error) {
+				return []byte(masterKey), nil
+			}),
+			WithDecryptionCallbackFunc[DecryptionPassword](func(_ context.Context) ([]byte, error) {
+				return []byte(masterKey), nil
+			}),
+		)
+		require.NoError(t, err)
+
+		secret := &mocks.MockCredential{
+			Username: uuid.NewString(),
+			Password: uuid.NewString(),
+		}
+		id := secrets.MustParseID("test/something/" + uuid.NewString())
+		require.NoError(t, s.Upsert(t.Context(), id, secret))
+
+		storeSecret, err := s.Get(t.Context(), id)
+		require.NoError(t, err)
+		assert.EqualValues(t, secret, storeSecret)
+	})
+
+	t.Run("upsert overwrites an existing credential", func(t *testing.T) {
+		root, err := os.OpenRoot(t.TempDir())
+		require.NoError(t, err)
+		t.Cleanup(func() {
+			assert.NoError(t, root.Close())
+		})
+
+		masterKey := uuid.NewString()
+		s, err := New(root,
+			func(_ context.Context, _ store.ID) *mocks.MockCredential {
+				return &mocks.MockCredential{}
+			},
+			WithLogger(&testLogger{t}),
+			WithEncryptionCallbackFunc[EncryptionPassword](func(_ context.Context) ([]byte, error) {
+				return []byte(masterKey), nil
+			}),
+			WithDecryptionCallbackFunc[DecryptionPassword](func(_ context.Context) ([]byte, error) {
+				return []byte(masterKey), nil
+			}),
+		)
+		require.NoError(t, err)
+
+		original := &mocks.MockCredential{
+			Username: uuid.NewString(),
+			Password: uuid.NewString(),
+		}
+		id := secrets.MustParseID("test/something/" + uuid.NewString())
+		require.NoError(t, s.Save(t.Context(), id, original))
+
+		updated := &mocks.MockCredential{
+			Username: uuid.NewString(),
+			Password: uuid.NewString(),
+		}
+		require.NoError(t, s.Upsert(t.Context(), id, updated))
+
+		storeSecret, err := s.Get(t.Context(), id)
+		require.NoError(t, err)
+		assert.EqualValues(t, updated, storeSecret)
+	})
+
 	t.Run("an error on encryption callbackFunc is propagated on save", func(t *testing.T) {
 		root, err := os.OpenRoot(t.TempDir())
 		require.NoError(t, err)