Repository: hashicorp/vault
File: builtin/logical/database/path_roles_test.go (Go)

Code before:

	// force NextVaultRotation to zero to simulate roles before 1.15.0
	role, err := b.StaticRole(context.Background(), storage, roleName)
	require.NoError(t, err)
	role.StaticAccount.NextVaultRotation = time.Time{}
	entry, err := logical.StorageEntryJSON(databaseStaticRolePath+roleName, role)
	require.NoError(t, err)
	if err := storage.Put(context.Background(), entry); err != nil {
		t.Fatal("failed to write role to storage", err)
	}

	// Confirm that NextVaultRotation is nil
	role, err = b.StaticRole(ctx, storage, roleName)
	require.NoError(t, err)
	require.Equal(t, role.StaticAccount.NextVaultRotation, time.Time{})

	// Repopulate queue to simulate restart
	b.populateQueue(ctx, storage)

	role, err = b.StaticRole(ctx, storage, roleName)
	require.NoError(t, err)
	require.NotEqual(t, role.StaticAccount.NextVaultRotation, time.Time{}) // Confirm next vault rotation has been updated in storage
	item, err = b.credRotationQueue.Pop()
	require.NoError(t, err)
	newPriority := item.Priority
	require.Equal(t, newPriority, firstPriority)
}

func createRole(t *testing.T, b *databaseBackend, storage logical.Storage, mockDB *mockNewDatabase, roleName string) {
	t.Helper()
	mockDB.On("UpdateUser", mock.Anything, mock.Anything).
		Return(v5.UpdateUserResponse{}, nil).
		Once()
	resp, err := b.HandleRequest(context.Background(), &logical.Request{
		Operation: logical.CreateOperation,
		Path:      "static-roles/" + roleName,
		Storage:   storage,
		Data: map[string]interface{}{
			"username":        roleName,
			"db_name":         "mockv5",
			"rotation_period": "86400s",
		},
	})
	if err != nil || (resp != nil && resp.IsError()) {
		t.Fatal(resp, err)
	}
}

func createRoleWithData(t *testing.T, b *databaseBackend, s logical.Storage, mockDB *mockNewDatabase, roleName string, data map[string]interface{}) {
	t.Helper()
	mockDB.On("UpdateUser", mock.Anything, mock.Anything).

Review comment (security):
So the `Priority` is guaranteed to be changed whenever the "role" is rotated? Meaning, new credentials are issued for the static role? There is no need to assert that the initial credentials have not been changed?

Code after:
		require.FailNow(t, "initial ttl should be set")
	} else {
		initialTTL, ok = v.(float64)
		if !ok {
			require.FailNow(t, "expected ttl to be an integer")
		}
	}

	updateStaticRoleWithData(t, b, storage, mockDB, roleName, map[string]interface{}{
		"username":        "hashicorp",
		"db_name":         "mockv5",
		"rotation_period": "20m",
	})

	resp = readStaticCred(t, b, storage, mockDB, roleName)
	var updatedTTL float64
	if v, ok := resp.Data["ttl"]; !ok || v == nil {
		require.FailNow(t, "expected ttl to be set after update")
	} else {
		updatedTTL, ok = v.(float64)
		if !ok {
			require.FailNow(t, "expected ttl to be a float64 after update")
		}
	}

	require.Greaterf(t, updatedTTL, initialTTL, "expected ttl to be greater than %f, actual value: %f",
		initialTTL, updatedTTL)
}

func createRole(t *testing.T, b *databaseBackend, storage logical.Storage, mockDB *mockNewDatabase, roleName string) {
	t.Helper()
	mockDB.On("UpdateUser", mock.Anything, mock.Anything).
		Return(v5.UpdateUserResponse{}, nil).
		Once()
	resp, err := b.HandleRequest(context.Background(), &logical.Request{
		Operation: logical.CreateOperation,
		Path:      "static-roles/" + roleName,
		Storage:   storage,
		Data: map[string]interface{}{
			"username":        roleName,
			"db_name":         "mockv5",
			"rotation_period": "86400s",
		},
	})
	if err != nil || (resp != nil && resp.IsError()) {
		t.Fatal(resp, err)
	}
}

func createRoleWithData(t *testing.T, b *databaseBackend, s logical.Storage, mockDB *mockNewDatabase, roleName string, data map[string]interface{}) {
	t.Helper()