Repository: hashicorp/vault
File: builtin/logical/database/rotation_test.go (Go)

Code before:
		}
	}
	time.Sleep(2 * time.Second)
	// We expect this WAL to have the latest createdAt timestamp
	walID, err := framework.PutWAL(ctx, storage, staticWALKey, wal)
	if err != nil {
		t.Fatal(err)
	}
	requireWALs(t, storage, 4)

	walMap, err := b.loadStaticWALs(ctx, storage)
	if err != nil {
		t.Fatal(err)
	}
	if len(walMap) != 1 || walMap["hashicorp"] == nil || walMap["hashicorp"].walID != walID {
		t.Fatal()
	}
	requireWALs(t, storage, 1)
}

// TestStaticRoleNextVaultRotationOnPopulate tests the case where
// a static role was created before the 1.15.0 release and the
// NextVaultRotation was not set. It ensures that the NextVaultRotation
// is set to the next rotation time when the role is read from storage
// and the queue is populated.
func TestStaticRoleNextVaultRotationOnPopulate(t *testing.T) {
	ctx := context.Background()
	b, storage, mockDB := getBackend(t)
	defer b.Cleanup(ctx)
	configureDBMount(t, storage)

	roleName := "hashicorp"
	data := map[string]interface{}{
		"username":        "hashicorp",
		"db_name":         "mockv5",
		"rotation_period": "10m",
	}

	createStaticRoleWithData(t, b, storage, mockDB, roleName, data)
	item, err := b.credRotationQueue.Pop()
	require.NoError(t, err)
	firstPriority := item.Priority

	// force NextVaultRotation to zero to simulate roles before 1.15.0
	role, err := b.StaticRole(context.Background(), storage, roleName)
	require.NoError(t, err)
	role.StaticAccount.NextVaultRotation = time.Time{}
	entry, err := logical.StorageEntryJSON(databaseStaticRolePath+roleName, role)
	require.NoError(t, err)
	if err := storage.Put(context.Background(), entry); err != nil {
		t.Fatal("failed to write role to storage", err)

Review comment (suggestion):
It would be great if you could format this as a table driven test. It would ensure that the tests are isolated from one another. It also makes it easier to read.

Code after:
		}
	}
	time.Sleep(2 * time.Second)
	// We expect this WAL to have the latest createdAt timestamp
	walID, err := framework.PutWAL(ctx, storage, staticWALKey, wal)
	if err != nil {
		t.Fatal(err)
	}
	requireWALs(t, storage, 4)

	walMap, err := b.loadStaticWALs(ctx, storage)
	if err != nil {
		t.Fatal(err)
	}
	if len(walMap) != 1 || walMap["hashicorp"] == nil || walMap["hashicorp"].walID != walID {
		t.Fatal()
	}
	requireWALs(t, storage, 1)
}

// TestStaticRoleNextVaultRotationOnRestart verifies that a static role created prior to Vault 1.15.0
// (when roles were created without NextVaultRotation set) is automatically assigned a valid
// NextVaultRotation when loaded from storage and the rotation queue is repopulated.
func TestStaticRoleNextVaultRotationOnRestart(t *testing.T) {
	ctx := context.Background()
	b, storage, mockDB := getBackend(t)
	defer b.Cleanup(ctx)
	configureDBMount(t, storage)

	roleName := "hashicorp"
	data := map[string]interface{}{
		"username":        "hashicorp",
		"db_name":         "mockv5",
		"rotation_period": "10m",
	}

	createRoleWithData(t, b, storage, mockDB, roleName, data)
	item, err := b.credRotationQueue.Pop()
	require.NoError(t, err)
	firstPriority := item.Priority
	role, err := b.StaticRole(context.Background(), storage, roleName)
	firstPassword := role.StaticAccount.Password
	require.NoError(t, err)

	// force NextVaultRotation to zero to simulate roles before 1.15.0
	role.StaticAccount.NextVaultRotation = time.Time{}
	entry, err := logical.StorageEntryJSON(databaseStaticRolePath+roleName, role)
	require.NoError(t, err)
	if err := storage.Put(context.Background(), entry); err != nil {
		t.Fatal("failed to write role to storage", err)
	}