coolify/tests/Unit/RemoteSecretReferencesTest.php

<?php

use App\Support\RemoteSecretReferences;

test('detects references only for the vault namespace', function () {
    expect(RemoteSecretReferences::containsReference('{{vault.DB_PASSWORD}}'))->toBeTrue()
        ->and(RemoteSecretReferences::containsReference('{{doppler.KEY}}'))->toBeFalse()
        ->and(RemoteSecretReferences::containsReference('{{infisical.KEY}}'))->toBeFalse()
        ->and(RemoteSecretReferences::containsReference('{{ vault.KEY }}'))->toBeTrue()
        ->and(RemoteSecretReferences::containsReference('pre-{{vault.KEY}}-post'))->toBeTrue();
});

test('ignores the secret namespace, shared variables, and plain values', function () {
    expect(RemoteSecretReferences::containsReference('{{secret.KEY}}'))->toBeFalse()
        ->and(RemoteSecretReferences::containsReference('{{team.KEY}}'))->toBeFalse()
        ->and(RemoteSecretReferences::containsReference('{{project.KEY}}'))->toBeFalse()
        ->and(RemoteSecretReferences::containsReference('plain'))->toBeFalse()
        ->and(RemoteSecretReferences::containsReference('$OTHER_VAR'))->toBeFalse()
        ->and(RemoteSecretReferences::containsReference(null))->toBeFalse()
        ->and(RemoteSecretReferences::containsReference(''))->toBeFalse();
});

test('extracts unique referenced keys in order', function () {
    $value = 'a={{vault.A}} ignored={{doppler.B}} again={{vault.A}}';

    expect(RemoteSecretReferences::referencedKeys($value))->toBe(['A']);
});

test('substitutes references and leaves unknown keys untouched', function () {
    $secrets = ['A' => 'value-a'];

    expect(RemoteSecretReferences::substitute('x={{vault.A}} y={{vault.MISSING}}', $secrets))
        ->toBe('x=value-a y={{vault.MISSING}}');
});

test('reports missing keys', function () {
    expect(RemoteSecretReferences::missingKeys('{{vault.A}}-{{vault.B}}', ['A' => '1']))->toBe(['B'])
        ->and(RemoteSecretReferences::missingKeys('{{vault.A}}', ['A' => '1']))->toBe([]);
});