Repository: google/exposure-notifications-server
Pull request #512 (2020-06-01 14:27:50)

Use noops in tests to avoid credential lookup
Fixes GH-510

google-prow-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/google/exposure-notifications-server/pull/512#" title="Author self-approved">sethvargo</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=google%2Fexposure-notifications-server).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/google/exposure-notifications-server/blob/master/OWNERS)~~ [sethvargo]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index cf39c14..5f79bb0 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -57,16 +57,6 @@ $ go test ./...
 You should run the presubmit checks before committing changes. The presubmit script
 is located at `scripts/presubmit.sh`.
 
-You can add a prepush hook by linking to the presubmit script to automatically
-run before pushing a branch to the remote GitHub repository. To add the
-presubmit script as a prepush hook, go to the root directory of the repository
-and type:
-
-```
-ln -s -f ../../scripts/presubmit.sh .git/hooks/pre-push
-chmod a+x .git/hooks/pre-push
-```
-
 ### Running locally
 
 These instructions use [Docker][docker] to run components locally. You may be
diff --git a/docs/deploying.md b/docs/deploying.md
index 93e7b9c..4337f4d 100644
--- a/docs/deploying.md
+++ b/docs/deploying.md
@@ -293,6 +293,7 @@ configurations are available:
 | ------------------ | ------------------- | -----------
 | Google Cloud KMS\* | `GOOGLE_CLOUD_KMS`  | Perform signing using Google Cloud KMS.
 | HashiCorp Vault    | `HASHICORP_VAULT`   | Perform signing using HashiCorp Vault.
+| Noop               | `NOOP`              | No keys are managed.
 
 \* default
 
@@ -307,6 +308,7 @@ following configurations are available:
 | Azure Key Vault         | `AZURE_KEY_VAULT`       | Resolve with Key Vault.
 | Google Secret Manager\* | `GOOGLE_SECRET_MANAGER` | Resolve with Secret Manager.
 | HashiCorp Vault         | `HASHICORP_VAULT`       | Resolve with Vault.
+| Noop                    | `NOOP`                  | No secrets are resolved.
 
 \* default
 
diff --git a/internal/secrets/noop.go b/internal/secrets/noop.go
new file mode 100644
index 0000000..0ac0d45
--- /dev/null
+++ b/internal/secrets/noop.go
@@ -0,0 +1,35 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package secrets
+
+import (
+	"context"
+	"fmt"
+)
+
+// Compile-time check to verify implements interface.
+var _ SecretManager = (*Noop)(nil)
+
+// Noop is a secret manager that does nothing and always returns an error.
+type Noop struct{}
+
+func NewNoop(ctx context.Context) (SecretManager, error) {
+	return &Noop{}, nil
+}
+
+// GetSecretValue implements secrets.
+func (n *Noop) GetSecretValue(_ context.Context, _ string) (string, error) {
+	return "", fmt.Errorf("noop cannot resolve secrets")
+}
diff --git a/internal/secrets/secrets.go b/internal/secrets/secrets.go
index ff74e3d..b40393d 100644
--- a/internal/secrets/secrets.go
+++ b/internal/secrets/secrets.go
@@ -29,6 +29,7 @@ const (
 	SecretManagerTypeAzureKeyVault        SecretManagerType = "AZURE_KEY_VAULT"
 	SecretManagerTypeGoogleSecretManager  SecretManagerType = "GOOGLE_SECRET_MANAGER"
 	SecretManagerTypeGoogleHashiCorpVault SecretManagerType = "HASHICORP_VAULT"
+	SecretManagerTypeNoop                 SecretManagerType = "NOOP"
 )
 
 // Config represents the config for a secret manager.
@@ -56,6 +57,8 @@ func SecretManagerFor(ctx context.Context, typ SecretManagerType) (SecretManager
 		return NewGoogleSecretManager(ctx)
 	case SecretManagerTypeGoogleHashiCorpVault:
 		return NewHashiCorpVault(ctx)
+	case SecretManagerTypeNoop:
+		return NewNoop(ctx)
 	}
 
 	return nil, fmt.Errorf("unknown secret manager type: %v", typ)
diff --git a/internal/signing/noop.go b/internal/signing/noop.go
new file mode 100644
index 0000000..c3ce545
--- /dev/null
+++ b/internal/signing/noop.go
@@ -0,0 +1,35 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package signing
+
+import (
+	"context"
+	"crypto"
+	"fmt"
+)
+
+// Compile-time check to verify implements interface.
+var _ KeyManager = (*Noop)(nil)
+
+// Noop is a key manager that does nothing and always returns an error.
+type Noop struct{}
+
+func NewNoop(ctx context.Context) (KeyManager, error) {
+	return &Noop{}, nil
+}
+
+func (n *Noop) NewSigner(ctx context.Context, keyID string) (crypto.Signer, error) {
+	return nil, fmt.Errorf("noop cannot sign")
+}
diff --git a/internal/signing/signing.go b/internal/signing/signing.go
index b359d72..95a99dd 100644
--- a/internal/signing/signing.go
+++ b/internal/signing/signing.go
@@ -27,6 +27,7 @@ type KeyManagerType string
 const (
 	KeyManagerTypeGoogleCloudKMS KeyManagerType = "GOOGLE_CLOUD_KMS"
 	KeyManagerTypeHashiCorpVault KeyManagerType = "HASHICORP_VAULT"
+	KeyManagerTypeNoop           KeyManagerType = "NOOP"
 )
 
 // Config defines configuration.
@@ -48,6 +49,8 @@ func KeyManagerFor(ctx context.Context, typ KeyManagerType) (KeyManager, error)
 		return NewGoogleCloudKMS(ctx)
 	case KeyManagerTypeHashiCorpVault:
 		return NewHashiCorpVault(ctx)
+	case KeyManagerTypeNoop:
+		return NewNoop(ctx)
 	}
 
 	return nil, fmt.Errorf("unknown key manager type: %v", typ)
diff --git a/internal/storage/noop_storage.go b/internal/storage/noop.go
similarity index 62%
rename from internal/storage/noop_storage.go
rename to internal/storage/noop.go
index b716671..4ca2e08 100644
--- a/internal/storage/noop_storage.go
+++ b/internal/storage/noop.go
@@ -17,19 +17,19 @@ package storage
 import "context"
 
 // Compile-time check to verify implements.
-var _ Blobstore = (*NoopBlobstore)(nil)
+var _ Blobstore = (*Noop)(nil)
 
-// NoopBlobstore is a blobstore that does nothing.
-type NoopBlobstore struct{}
+// Noop is a blobstore that does nothing.
+type Noop struct{}
 
-func NewNoopBlobstore(ctx context.Context) (Blobstore, error) {
-	return &NoopBlobstore{}, nil
+func NewNoop(ctx context.Context) (Blobstore, error) {
+	return &Noop{}, nil
 }
 
-func (s *NoopBlobstore) CreateObject(ctx context.Context, folder, filename string, contents []byte, cacheable bool) error {
+func (s *Noop) CreateObject(ctx context.Context, folder, filename string, contents []byte, cacheable bool) error {
 	return nil
 }
 
-func (s *NoopBlobstore) DeleteObject(ctx context.Context, folder, filename string) error {
+func (s *Noop) DeleteObject(ctx context.Context, folder, filename string) error {
 	return nil
 }
diff --git a/internal/storage/storage.go b/internal/storage/storage.go
index 05377d4..17f1be4 100644
--- a/internal/storage/storage.go
+++ b/internal/storage/storage.go
@@ -52,7 +52,7 @@ func BlobstoreFor(ctx context.Context, typ BlobstoreType) (Blobstore, error) {
 	case BlobstoreTypeFilesystem:
 		return NewFilesystemStorage(ctx)
 	case BlobstoreTypeNoop:
-		return NewNoopBlobstore(ctx)
+		return NewNoop(ctx)
 	default:
 		return nil, fmt.Errorf("unknown blob store: %v", typ)
 	}


Test patch:
diff --git a/internal/cleanup/cleanup_test.go b/internal/cleanup/cleanup_test.go
index 2947ce5..ba4fbcf 100644
--- a/internal/cleanup/cleanup_test.go
+++ b/internal/cleanup/cleanup_test.go
@@ -70,7 +70,7 @@ func TestNewExposureHandler(t *testing.T) {
 func TestNewExportHandler(t *testing.T) {
 	ctx := context.Background()
 	testDB := database.NewTestDatabase(t)
-	noopBlobstore, _ := storage.NewNoopBlobstore(ctx)
+	noopBlobstore, _ := storage.NewNoop(ctx)
 
 	testCases := []struct {
 		name string
diff --git a/internal/setup/setup_test.go b/internal/setup/setup_test.go
index 6319ad6..9b106a2 100644
--- a/internal/setup/setup_test.go
+++ b/internal/setup/setup_test.go
@@ -45,7 +45,7 @@ func (t *testSecretManagerConfig) DatabaseConfig() *database.Config {
 
 func (t *testSecretManagerConfig) SecretManagerConfig() *secrets.Config {
 	return &secrets.Config{
-		SecretManagerType: secrets.SecretManagerType("GOOGLE_SECRET_MANAGER"),
+		SecretManagerType: secrets.SecretManagerType("NOOP"),
 		SecretCacheTTL:    10 * time.Minute,
 	}
 }
@@ -60,7 +60,7 @@ func (t *testKeyManagerConfig) DatabaseConfig() *database.Config {
 
 func (t *testKeyManagerConfig) KeyManagerConfig() *signing.Config {
 	return &signing.Config{
-		KeyManagerType: signing.KeyManagerType("GOOGLE_CLOUD_KMS"),
+		KeyManagerType: signing.KeyManagerType("NOOP"),
 	}
 }
 
@@ -74,7 +74,7 @@ func (t *testBlobstoreConfig) DatabaseConfig() *database.Config {
 
 func (t *testBlobstoreConfig) BlobstoreConfig() *storage.Config {
 	return &storage.Config{
-		BlobstoreType: storage.BlobstoreType("GOOGLE_CLOUD_STORAGE"),
+		BlobstoreType: storage.BlobstoreType("NOOP"),
 	}
 }
 
@@ -150,8 +150,8 @@ func TestSetup(t *testing.T) {
 			t.Errorf("expected key manager to exist")
 		}
 
-		if _, ok := km.(*signing.GoogleCloudKMS); !ok {
-			t.Errorf("expected %T to be GoogleCloudKMS", km)
+		if _, ok := km.(*signing.Noop); !ok {
+			t.Errorf("expected %T to be Noop", km)
 		}
 	})
 
@@ -172,8 +172,8 @@ func TestSetup(t *testing.T) {
 			t.Errorf("expected blobstore to exist")
 		}
 
-		if _, ok := bs.(*storage.GoogleCloudStorage); !ok {
-			t.Errorf("expected %T to be GoogleCloudStorage", bs)
+		if _, ok := bs.(*storage.Noop); !ok {
+			t.Errorf("expected %T to be Noop", bs)
 		}
 	})