Integration tests

Author: grahamgilbert

.flake8

@@ -0,0 +1,76 @@
+name: Tests
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+
+      - name: Run unit tests
+        run: go test -v ./...
+
+  integration-sqlite:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+
+      - name: Build cryptctl
+        run: go build -o cryptctl ./cmd/cryptctl/
+
+      - name: Generate encryption key
+        run: ./cryptctl gen-key > /tmp/test_key.txt
+
+      - name: Run SQLite integration tests
+        run: ./cryptctl integration-test -db sqlite -key-file /tmp/test_key.txt
+
+  integration-postgres:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:15
+        env:
+          POSTGRES_USER: crypt
+          POSTGRES_PASSWORD: crypt_test_password
+          POSTGRES_DB: crypt_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+
+      - name: Build cryptctl
+        run: go build -o cryptctl ./cmd/cryptctl/
+
+      - name: Generate encryption key
+        run: ./cryptctl gen-key > /tmp/test_key.txt
+
+      - name: Run PostgreSQL integration tests
+        run: |
+          ./cryptctl integration-test \
+            -db postgres \
+            -db-url "postgres://crypt:crypt_test_password@localhost:5432/crypt_test?sslmode=disable" \
+            -key-file /tmp/test_key.txt

.github/workflows/tests.yml

@@ -10,4 +10,9 @@ keyset
 *.db
 
 .vscode
-.gocache/*
+.gocache/*
+
+cryptctl
+crypt-server
+
+.claude/settings.local.json

.gitignore

@@ -0,0 +1,13 @@
+VERSION := $(shell cat VERSION)
+LDFLAGS := -ldflags "-X crypt-server/internal/app.Version=$(VERSION)"
+
+.PHONY: build clean test
+
+build:
+	go build $(LDFLAGS) -o crypt-server ./cmd/crypt-server
+
+test:
+	go test ./...
+
+clean:
+	rm -f crypt-server

Makefile

@@ -1,4 +1,4 @@
-Copyright 2012-2016 Graham Gilbert
+Copyright 2012-2026 Graham Gilbert
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at

NOTICE

@@ -68,7 +68,7 @@ All settings that would be entered into `settings.py` can also be passed into th
 
 - `EMAIL_SENDER` - The email address to send emaiil notifications from when secrets are requests and approved. Ensure this is verified if you are using SES. Does nothing unless `SEND_EMAIIL` is True.
 
-- `APPROVE_OWN` - By default, users with approval permissons can approve their own key requests. By setting this to False in settings.py (or by using the `APPROVE_OWN` environment variable with Docker), users cannot approve their own requests.
+- `APPROVE_OWN` - By default, users with approval permissions cannot approve their own key requests. Set this to `true` to allow users to approve their own requests.
 
 - `ALL_APPROVE` - By default, users need to be explicitly given approval permissions to approve key retrieval requests. By setting this to True in `settings.py`, all users are given this permission when they log in.
 

README.md

@@ -0,0 +1 @@
+4.0.0

VERSION

@@ -94,7 +94,7 @@ func main() {
 		logger.Fatalf("invalid session configuration: %v", err)
 	}
 	settings := app.Settings{
-		ApproveOwn:             envBool("APPROVE_OWN", true),
+		ApproveOwn:             envBool("APPROVE_OWN", false),
 		AllApprove:             envBool("ALL_APPROVE", false),
 		SessionTTL:             sessionTTL,
 		CookieSecure:           envBool("SESSION_COOKIE_SECURE", false),

cmd/crypt-server/main.go

@@ -76,8 +76,9 @@ func main() {
 		fmt.Fprintln(flag.CommandLine.Output(), "Usage: cryptctl <command>")
 		fmt.Fprintln(flag.CommandLine.Output(), "")
 		fmt.Fprintln(flag.CommandLine.Output(), "Commands:")
-		fmt.Fprintln(flag.CommandLine.Output(), "  gen-key         Generate a base64-encoded 32-byte FIELD_ENCRYPTION_KEY")
-		fmt.Fprintln(flag.CommandLine.Output(), "  import-fixture  Convert Django JSON fixtures into an encrypted migration export")
+		fmt.Fprintln(flag.CommandLine.Output(), "  gen-key           Generate a base64-encoded 32-byte FIELD_ENCRYPTION_KEY")
+		fmt.Fprintln(flag.CommandLine.Output(), "  import-fixture    Convert Django JSON fixtures into an encrypted migration export")
+		fmt.Fprintln(flag.CommandLine.Output(), "  integration-test  Run integration tests against a database")
 	}
 	flag.Parse()
 
@@ -97,6 +98,11 @@ func main() {
 			fmt.Fprintln(os.Stderr, err)
 			os.Exit(1)
 		}
+	case "integration-test":
+		if err := runIntegrationTest(os.Args[2:], os.Stdout); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
 	default:
 		fmt.Fprintf(os.Stderr, "unknown command: %s\n", flag.Arg(0))
 		flag.Usage()