helm-external-secrets/providers/v1/keepersecurity/client_test.go

/*
Copyright © The ESO Authors

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package keepersecurity

import (
	"context"
	"errors"
	"fmt"
	"reflect"
	"testing"

	ksm "github.com/keeper-security/secrets-manager-go/core"
	corev1 "k8s.io/api/core/v1"

	esv1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1"
	"github.com/external-secrets/external-secrets/apis/externalsecrets/v1alpha1"
	"github.com/external-secrets/external-secrets/providers/v1/keepersecurity/fake"
	testingfake "github.com/external-secrets/external-secrets/runtime/testing/fake"
)

const (
	folderID               = "a8ekf031k"
	validExistingRecord    = "record0/login"
	invalidRecord          = "record5/login"
	outputRecord0          = "{\"title\":\"record0\",\"type\":\"login\",\"fields\":[{\"type\":\"login\",\"value\":[\"foo\"]},{\"type\":\"password\",\"value\":[\"bar\"]}],\"custom\":[{\"type\":\"host\",\"label\":\"host0\",\"value\":[{\"hostName\":\"mysql\",\"port\":\"3306\"}]}],\"files\":null}"
	outputRecord1          = "{\"title\":\"record1\",\"type\":\"login\",\"fields\":[{\"type\":\"login\",\"value\":[\"foo\"]},{\"type\":\"password\",\"value\":[\"bar\"]}],\"custom\":[{\"type\":\"host\",\"label\":\"host1\",\"value\":[{\"hostName\":\"mysql\",\"port\":\"3306\"}]}],\"files\":null}"
	outputRecord2          = "{\"title\":\"record2\",\"type\":\"login\",\"fields\":[{\"type\":\"login\",\"value\":[\"foo\"]},{\"type\":\"password\",\"value\":[\"bar\"]}],\"custom\":[{\"type\":\"host\",\"label\":\"host2\",\"value\":[{\"hostName\":\"mysql\",\"port\":\"3306\"}]}],\"files\":null}"
	outputRecordWithLabels = "{\"title\":\"recordWithLabels\",\"type\":\"login\",\"fields\":[{\"type\":\"login\",\"label\":\"username\",\"value\":[\"foo\"]},{\"type\":\"password\",\"label\":\"pass\",\"value\":[\"bar\"]}],\"custom\":[{\"type\":\"host\",\"label\":\"host0\",\"value\":[{\"hostName\":\"mysql\",\"port\":\"3306\"}]}],\"files\":null}"
	record0                = "record0"
	record1                = "record1"
	record2                = "record2"
	recordWithLabels       = "recordWithLabels"
	LoginKey               = "login"
	PasswordKey            = "password"
	HostKeyFormat          = "host%d"
	RecordNameFormat       = "record%d"
	UsernameLabel          = "username"
	PassLabel              = "pass"
)

func TestClientDeleteSecret(t *testing.T) {
	type fields struct {
		ksmClient SecurityClient
		folderID  string
	}
	type args struct {
		ctx       context.Context
		remoteRef esv1.PushSecretRemoteRef
	}
	tests := []struct {
		name    string
		fields  fields
		args    args
		wantErr bool
	}{
		{
			name: "Delete valid secret",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					DeleteSecretsFn: func(recrecordUids []string) (map[string]string, error) {
						return map[string]string{
							record0: record0,
						}, nil
					},
					GetSecretsByTitleFn: func(recordTitle string) (records []*ksm.Record, err error) {
						return generateRecords()[:1], nil
					},
				},
				folderID: folderID,
			},
			args: args{
				context.Background(),
				&v1alpha1.PushSecretRemoteRef{
					RemoteKey: validExistingRecord,
				},
			},
			wantErr: false,
		},
		{
			name: "Delete secret with multiple matches by Name",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					DeleteSecretsFn: func(recrecordUids []string) (map[string]string, error) {
						return map[string]string{
							record0: record0,
						}, nil
					},
					GetSecretsByTitleFn: func(recordTitle string) (records []*ksm.Record, err error) {
						return []*ksm.Record{generateRecords()[0], generateRecords()[0]}, nil
					},
				},
				folderID: folderID,
			},
			args: args{
				context.Background(),
				&v1alpha1.PushSecretRemoteRef{
					RemoteKey: validExistingRecord,
				},
			},
			wantErr: true,
		},
		{
			name: "Delete non existing secret",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsByTitleFn: func(recordTitle string) (records []*ksm.Record, err error) {
						return nil, errors.New("failed")
					},
				},
				folderID: folderID,
			},
			args: args{
				context.Background(),
				&v1alpha1.PushSecretRemoteRef{
					RemoteKey: invalidRecord,
				},
			},
			wantErr: true,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			c := &Client{
				ksmClient: tt.fields.ksmClient,
				folderID:  tt.fields.folderID,
			}
			if err := c.DeleteSecret(tt.args.ctx, tt.args.remoteRef); (err != nil) != tt.wantErr {
				t.Errorf("DeleteSecret() error = %v, wantErr %v", err, tt.wantErr)
			}
		})
	}
}

func TestClientGetAllSecrets(t *testing.T) {
	type fields struct {
		ksmClient SecurityClient
		folderID  string
	}
	type args struct {
		ctx context.Context
		ref esv1.ExternalSecretFind
	}
	var path = "path_to_fail"
	tests := []struct {
		name    string
		fields  fields
		args    args
		want    map[string][]byte
		wantErr bool
	}{
		{
			name: "Tags not Implemented",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{},
				folderID:  folderID,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretFind{
					Tags: map[string]string{
						"xxx": "yyy",
					},
				},
			},
			wantErr: true,
		},
		{
			name: "Path not Implemented",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{},
				folderID:  folderID,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretFind{
					Path: &path,
				},
			},
			wantErr: true,
		},
		{
			name: "Get secrets with matching regex",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(strings []string) ([]*ksm.Record, error) {
						return generateRecords(), nil
					},
				},
				folderID: folderID,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretFind{
					Name: &esv1.FindName{
						RegExp: "record",
					},
				},
			},
			want: map[string][]byte{
				record0: []byte(outputRecord0),
				record1: []byte(outputRecord1),
				record2: []byte(outputRecord2),
			},
			wantErr: false,
		},
		{
			name: "Get 1 secret with matching regex",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(strings []string) ([]*ksm.Record, error) {
						return generateRecords(), nil
					},
				},
				folderID: folderID,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretFind{
					Name: &esv1.FindName{
						RegExp: record0,
					},
				},
			},
			want: map[string][]byte{
				record0: []byte(outputRecord0),
			},
			wantErr: false,
		},
		{
			name: "Get secrets with labels using matching regex",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(strings []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecordWithLabels()}, nil
					},
				},
				folderID: folderID,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretFind{
					Name: &esv1.FindName{
						RegExp: recordWithLabels,
					},
				},
			},
			want: map[string][]byte{
				recordWithLabels: []byte(outputRecordWithLabels),
			},
			wantErr: false,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			c := &Client{
				ksmClient: tt.fields.ksmClient,
				folderID:  tt.fields.folderID,
			}
			got, err := c.GetAllSecrets(tt.args.ctx, tt.args.ref)
			if (err != nil) != tt.wantErr {
				t.Errorf("GetAllSecrets() error = %v, wantErr %v", err, tt.wantErr)
				return
			}
			if !reflect.DeepEqual(got, tt.want) {
				t.Errorf("GetAllSecrets() got = %v, want %v", got, tt.want)
			}
		})
	}
}

func TestClientGetSecret(t *testing.T) {
	type fields struct {
		ksmClient          SecurityClient
		folderID           string
		getByTitleFallback bool
	}
	type args struct {
		ctx context.Context
		ref esv1.ExternalSecretDataRemoteRef
	}
	tests := []struct {
		name    string
		fields  fields
		args    args
		want    []byte
		wantErr bool
		// wantNoSecretErr is asserted for every case, so a failure that is not a
		// missing record must not carry the sentinel either.
		wantNoSecretErr bool
	}{
		{
			name: "Get Secret with a property (no label)",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecords()[0]}, nil
					},
				},
				folderID:           folderID,
				getByTitleFallback: false,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key:      record0,
					Property: LoginKey,
				},
			},
			want:    []byte("foo"),
			wantErr: false,
		},
		{
			name: "Get Secret without property (no label)",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecords()[0]}, nil
					},
				},
				folderID:           folderID,
				getByTitleFallback: false,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key: record0,
				},
			},
			want:    []byte(outputRecord0),
			wantErr: false,
		},
		{
			name: "Get Secret with a property using label",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecordWithLabels()}, nil
					},
				},
				folderID:           folderID,
				getByTitleFallback: false,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key:      recordWithLabels,
					Property: UsernameLabel,
				},
			},
			want:    []byte("foo"),
			wantErr: false,
		},
		{
			name: "Get Secret with a property using type when label exists",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecordWithLabels()}, nil
					},
				},
				folderID:           folderID,
				getByTitleFallback: false,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key:      recordWithLabels,
					Property: LoginKey, // Try to access by type when label exists
				},
			},
			wantErr: true, // Should fail because label takes precedence
		},
		{
			name: "Get Secret without property (with labels)",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecordWithLabels()}, nil
					},
				},
				folderID:           folderID,
				getByTitleFallback: false,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key: recordWithLabels,
				},
			},
			want:    []byte(outputRecordWithLabels),
			wantErr: false,
		},
		{
			name: "Get secret with multiple matches by ID",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecords()[0], generateRecords()[0]}, nil
					},
				},
				folderID:           folderID,
				getByTitleFallback: false,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key: record0,
				},
			},
			want:    []byte(outputRecord0),
			wantErr: false,
		},
		{
			name: "Get secret by ID",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecords()[0], generateRecords()[0]}, nil
					},
				},
				folderID:           folderID,
				getByTitleFallback: false,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key: record0,
				},
			},
			want:    []byte(outputRecord0),
			wantErr: false,
		},
		{
			name: "Get secret by ID (with fallback)",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecords()[0], generateRecords()[0]}, nil
					},
				},
				folderID:           folderID,
				getByTitleFallback: true,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key: record0,
				},
			},
			want:    []byte(outputRecord0),
			wantErr: false,
		},
		{
			name: "Get non existing secret with client error",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return nil, errors.New("not found")
					},
				},
				folderID:           folderID,
				getByTitleFallback: false,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key: "record5",
				},
			},
			wantErr: true,
		},
		{
			name: "Get non existing secret",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{}, nil
					},
				},
				folderID:           folderID,
				getByTitleFallback: false,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key: "record5",
				},
			},
			wantErr:         true,
			wantNoSecretErr: true,
		},
		{
			name: "Get non existing secret with fallback",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{}, nil
					},
					GetSecretsByTitleFn: func(recordTitle string) ([]*ksm.Record, error) {
						return []*ksm.Record{}, nil
					},
				},
				folderID:           folderID,
				getByTitleFallback: true,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key: "record5",
				},
			},
			wantErr:         true,
			wantNoSecretErr: true,
		},
		{
			name: "Get valid secret with non existing property",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecords()[0]}, nil
					},
				},
				folderID:           folderID,
				getByTitleFallback: false,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key:      record0,
					Property: "invalid",
				},
			},
			wantErr: true,
		},
		{
			name: "Get secret by name",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						// Return empty list to trigger name lookup
						return []*ksm.Record{}, nil
					},
					GetSecretsByTitleFn: func(recordTitle string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecords()[0]}, nil
					},
				},
				folderID:           folderID,
				getByTitleFallback: true,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key: record0,
				},
			},
			want:    []byte(outputRecord0),
			wantErr: false,
		},
		{
			name: "Get secret by name with multiple matches",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						// Return empty list to trigger name lookup
						return []*ksm.Record{}, nil
					},
					GetSecretsByTitleFn: func(recordTitle string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecords()[0], generateRecords()[0]}, nil
					},
				},
				folderID:           folderID,
				getByTitleFallback: true,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key: record0,
				},
			},
			wantErr: true,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			c := &Client{
				ksmClient:          tt.fields.ksmClient,
				folderID:           tt.fields.folderID,
				getByTitleFallback: tt.fields.getByTitleFallback,
			}
			got, err := c.GetSecret(tt.args.ctx, tt.args.ref)
			if (err != nil) != tt.wantErr {
				t.Errorf("GetSecret() error = %v, wantErr %v", err, tt.wantErr)
				return
			}
			if isNoSecret := errors.Is(err, esv1.NoSecretErr); isNoSecret != tt.wantNoSecretErr {
				t.Errorf("GetSecret() errors.Is(err, NoSecretErr) = %v, want %v (err = %v)", isNoSecret, tt.wantNoSecretErr, err)
			}
			if !reflect.DeepEqual(got, tt.want) {
				t.Errorf("GetSecret() got = %v, want %v", got, tt.want)
			}
		})
	}
}

func TestClientGetSecretMap(t *testing.T) {
	type fields struct {
		ksmClient SecurityClient
		folderID  string
	}
	type args struct {
		ctx context.Context
		ref esv1.ExternalSecretDataRemoteRef
	}
	tests := []struct {
		name            string
		fields          fields
		args            args
		want            map[string][]byte
		wantErr         bool
		wantNoSecretErr bool
	}{
		{
			name: "Get Secret with valid property (no label)",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecords()[0]}, nil
					},
				},
				folderID: folderID,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key:      record0,
					Property: LoginKey,
				},
			},
			want: map[string][]byte{
				LoginKey: []byte("foo"),
			},
			wantErr: false,
		},
		{
			name: "Get Secret without property (no label)",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecords()[0]}, nil
					},
				},
				folderID: folderID,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key: record0,
				},
			},
			want: map[string][]byte{
				LoginKey:                      []byte("foo"),
				PasswordKey:                   []byte("bar"),
				fmt.Sprintf(HostKeyFormat, 0): []byte("{\"hostName\":\"mysql\",\"port\":\"3306\"}"),
			},
			wantErr: false,
		},
		{
			name: "Get Secret with valid property using label",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecordWithLabels()}, nil
					},
				},
				folderID: folderID,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key:      recordWithLabels,
					Property: UsernameLabel,
				},
			},
			want: map[string][]byte{
				UsernameLabel: []byte("foo"),
			},
			wantErr: false,
		},
		{
			name: "Get Secret without property (with labels)",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecordWithLabels()}, nil
					},
				},
				folderID: folderID,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key: recordWithLabels,
				},
			},
			want: map[string][]byte{
				UsernameLabel:                 []byte("foo"),
				PassLabel:                     []byte("bar"),
				fmt.Sprintf(HostKeyFormat, 0): []byte("{\"hostName\":\"mysql\",\"port\":\"3306\"}"),
			},
			wantErr: false,
		},
		{
			// The API call itself fails here, so this must not be reported as a
			// missing record.
			name: "Get secret when the API call fails",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return nil, errors.New("keeper API unavailable")
					},
				},
				folderID: folderID,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key: "record5",
				},
			},
			wantErr: true,
		},
		{
			name: "Get non existing secret",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{}, nil
					},
				},
				folderID: folderID,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key: "record5",
				},
			},
			wantErr:         true,
			wantNoSecretErr: true,
		},
		{
			name: "Get Secret with invalid property",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsFn: func(filter []string) ([]*ksm.Record, error) {
						return []*ksm.Record{generateRecords()[0]}, nil
					},
				},
				folderID: folderID,
			},
			args: args{
				ctx: context.Background(),
				ref: esv1.ExternalSecretDataRemoteRef{
					Key:      record0,
					Property: "invalid",
				},
			},
			wantErr: true,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			c := &Client{
				ksmClient: tt.fields.ksmClient,
				folderID:  tt.fields.folderID,
			}
			got, err := c.GetSecretMap(tt.args.ctx, tt.args.ref)
			if (err != nil) != tt.wantErr {
				t.Errorf("GetSecretMap() error = %v, wantErr %v", err, tt.wantErr)
				return
			}
			if isNoSecret := errors.Is(err, esv1.NoSecretErr); isNoSecret != tt.wantNoSecretErr {
				t.Errorf("GetSecretMap() errors.Is(err, NoSecretErr) = %v, want %v (err = %v)", isNoSecret, tt.wantNoSecretErr, err)
			}
			if !reflect.DeepEqual(got, tt.want) {
				t.Errorf("GetSecretMap() got = %v, want %v", got, tt.want)
			}
		})
	}
}

func TestClientPushSecret(t *testing.T) {
	secretKey := "secret-key"
	type fields struct {
		ksmClient SecurityClient
		folderID  string
	}
	type args struct {
		value []byte
		data  testingfake.PushSecretData
	}
	tests := []struct {
		name    string
		fields  fields
		args    args
		wantErr bool
	}{
		{
			name: "Invalid remote ref",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{},
				folderID:  folderID,
			},
			args: args{
				data: testingfake.PushSecretData{
					SecretKey: secretKey,
					RemoteKey: record0,
				},
				value: []byte("foo"),
			},
			wantErr: true,
		},
		{
			name: "Push new valid secret",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsByTitleFn: func(recordTitle string) (records []*ksm.Record, err error) {
						return generateRecords()[0:0], nil
					},
					CreateSecretWithRecordDataFn: func(recUID, folderUid string, recordData *ksm.RecordCreate) (string, error) {
						return "record5", nil
					},
				},
				folderID: folderID,
			},
			args: args{
				data: testingfake.PushSecretData{
					SecretKey: secretKey,
					RemoteKey: invalidRecord,
				},
				value: []byte("foo"),
			},
			wantErr: false,
		},
		{
			name: "Push existing valid secret",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsByTitleFn: func(recordTitle string) (records []*ksm.Record, err error) {
						return generateRecords()[0:1], nil
					},
					SaveFn: func(record *ksm.Record) error {
						return nil
					},
				},
				folderID: folderID,
			},
			args: args{
				data: testingfake.PushSecretData{
					SecretKey: secretKey,
					RemoteKey: validExistingRecord,
				},
				value: []byte("foo2"),
			},
			wantErr: false,
		},
		{
			name: "Unable to push new valid secret with multiple matches by Name",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsByTitleFn: func(recordTitle string) (records []*ksm.Record, err error) {
						return []*ksm.Record{generateRecords()[0], generateRecords()[0]}, nil
					},
				},
				folderID: folderID,
			},
			args: args{
				data: testingfake.PushSecretData{
					SecretKey: secretKey,
					RemoteKey: validExistingRecord,
				},
				value: []byte("foo"),
			},
			wantErr: true,
		},
		{
			name: "Unable to push new valid secret",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsByTitleFn: func(recordTitle string) (records []*ksm.Record, err error) {
						return nil, errors.New("NotFound")
					},
					CreateSecretWithRecordDataFn: func(recUID, folderUID string, recordData *ksm.RecordCreate) (string, error) {
						return "", errors.New("Unable to push")
					},
				},
				folderID: folderID,
			},
			args: args{
				data: testingfake.PushSecretData{
					SecretKey: secretKey,
					RemoteKey: invalidRecord,
				},
				value: []byte("foo"),
			},
			wantErr: true,
		},
		{
			name: "Push new secret fails without folderID",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretsByTitleFn: func(recordTitle string) (records []*ksm.Record, err error) {
						return generateRecords()[0:0], nil
					},
				},
				folderID: "",
			},
			args: args{
				data: testingfake.PushSecretData{
					SecretKey: secretKey,
					RemoteKey: invalidRecord,
				},
				value: []byte("foo"),
			},
			wantErr: true,
		},
		{
			name: "Unable to save existing valid secret",
			fields: fields{
				ksmClient: &fake.MockKeeperClient{
					GetSecretByTitleFn: func(recordTitle string) (*ksm.Record, error) {
						return generateRecords()[0], nil
					},
					GetSecretsByTitleFn: func(recordTitle string) (records []*ksm.Record, err error) {
						return generateRecords()[0:1], nil
					},
					SaveFn: func(record *ksm.Record) error {
						return errors.New("Unable to save")
					},
				},
				folderID: folderID,
			},
			args: args{
				data: testingfake.PushSecretData{
					SecretKey: secretKey,
					RemoteKey: validExistingRecord,
				},
				value: []byte("foo2"),
			},
			wantErr: true,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			c := &Client{
				ksmClient: tt.fields.ksmClient,
				folderID:  tt.fields.folderID,
			}
			s := &corev1.Secret{Data: map[string][]byte{secretKey: tt.args.value}}
			if err := c.PushSecret(context.Background(), s, tt.args.data); (err != nil) != tt.wantErr {
				t.Errorf("PushSecret() error = %v, wantErr %v", err, tt.wantErr)
			}
		})
	}
}

func generateRecords() []*ksm.Record {
	records := make([]*ksm.Record, 0, 3)
	for i := range 3 {
		var record ksm.Record
		if i == 0 {
			record = ksm.Record{
				Uid: fmt.Sprintf(RecordNameFormat, i),
				RecordDict: map[string]any{
					"type":      externalSecretType,
					"folderUID": folderID,
				},
			}
		} else {
			record = ksm.Record{
				Uid: fmt.Sprintf(RecordNameFormat, i),
				RecordDict: map[string]any{
					"type":      LoginType,
					"folderUID": folderID,
				},
			}
		}
		sec := fmt.Sprintf(
			"{\"title\":\"record%d\",\"type\":\"login\",\"fields\":[{\"type\":\"login\",\"value\":[\"foo\"]},{\"type\":\"password\",\"value\":[\"bar\"]}],\"custom\":[{\"type\":\"host\",\"label\":\"host%d\",\"value\":[{\"hostName\":\"mysql\",\"port\":\"3306\"}]}]}",
			i,
			i,
		)
		record.SetTitle(fmt.Sprintf(RecordNameFormat, i))
		record.SetStandardFieldValue(LoginKey, "foo")
		record.SetStandardFieldValue(PasswordKey, "bar")
		record.RawJson = sec
		records = append(records, &record)
	}

	return records
}

func generateRecordWithLabels() *ksm.Record {
	record := ksm.Record{
		Uid: recordWithLabels,
		RecordDict: map[string]any{
			"type":      externalSecretType,
			"folderUID": folderID,
		},
	}
	// Fields with labels - using label as key
	sec := fmt.Sprintf(
		"{\"title\":%q,\"type\":\"login\",\"fields\":[{\"type\":\"login\",\"label\":%q,\"value\":[\"foo\"]},{\"type\":\"password\",\"label\":%q,\"value\":[\"bar\"]}],\"custom\":[{\"type\":\"host\",\"label\":\"host0\",\"value\":[{\"hostName\":\"mysql\",\"port\":\"3306\"}]}]}",
		recordWithLabels,
		UsernameLabel,
		PassLabel,
	)
	record.SetTitle(recordWithLabels)
	record.SetStandardFieldValue(LoginKey, "foo")
	record.SetStandardFieldValue(PasswordKey, "bar")
	record.RawJson = sec
	return &record
}