chore: update tests

.github/workflows/test.yml

@@ -1,12 +1,24 @@
 name: Tests
 
-on: push
+on:
+  pull_request:
+  push:
+    branches:
+      - main
 
 jobs:
-  tests:
+  test:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        pg-version: ['13', '14', '15', '16', '17']
+
     steps:
-      - uses: actions/checkout@v2
-      - name: Run tests
-        run: |
-          ./test.sh 15
+    - uses: actions/checkout@v4
+    - uses: cachix/install-nix-action@v13
+      with:
+        nix_path: nixpkgs=channel:nixos-unstable
+    - name: Run tests
+      run: nix-shell --run "vault-with-pg-${{ matrix.pg-version }} make installcheck"
+    - if: ${{ failure() }}
+      run: cat regression.diffs

.gitignore

@@ -0,0 +1,6 @@
+results/
+regression.*
+*.o
+*.so
+*.bc
+*.dylib

nix/pgtap.nix

@@ -0,0 +1,33 @@
+{ lib, stdenv, fetchFromGitHub, postgresql, perl, perlPackages, which }:
+
+stdenv.mkDerivation rec {
+  pname = "pgtap";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "theory";
+    repo = "pgtap";
+    rev = "v${version}";
+    hash = "sha256-lb0PRffwo6J5a6Hqw1ggvn0cW7gPZ02OEcLPi9ineI8=";
+  };
+
+  nativeBuildInputs = [ postgresql perl perlPackages.TAPParserSourceHandlerpgTAP which ];
+
+  installPhase = ''
+    install -D {sql/pgtap--${version}.sql,pgtap.control} -t $out/share/postgresql/extension
+  '';
+
+  meta = with lib; {
+    description = "A unit testing framework for PostgreSQL";
+    longDescription = ''
+      pgTAP is a unit testing framework for PostgreSQL written in PL/pgSQL and PL/SQL.
+      It includes a comprehensive collection of TAP-emitting assertion functions,
+      as well as the ability to integrate with other TAP-emitting test frameworks.
+      It can also be used in the xUnit testing style.
+    '';
+    maintainers = with maintainers; [ samrose ];
+    homepage = "https://pgtap.org";
+    inherit (postgresql.meta) platforms;
+    license = licenses.mit;
+  };
+}

nix/withTmpDb.sh.in

@@ -23,6 +23,8 @@ chmod +x "$VAULT_GETKEY_SCRIPT_PATH"
 
 pg_ctl start -o "$options"
 
-psql -v ON_ERROR_STOP=1 -c "create extension supabase_vault cascade" -d postgres
+createdb contrib_regression
+
+psql -v ON_ERROR_STOP=1 -f test/fixtures.sql -d contrib_regression
 
 "$@"

shell.nix

@@ -23,6 +23,7 @@ mkShell {
       pgWithExt = { pg }: pg.withPackages (p: [
         (callPackage ./nix/pgsodium.nix { postgresql = pg; })
         (callPackage ./nix/supabase_vault.nix { postgresql = pg; })
+        (callPackage ./nix/pgtap.nix { postgresql = pg; })
       ]);
       extAll = map (x: callPackage ./nix/pgScript.nix { postgresql = pgWithExt { pg = x; }; }) supportedPgVersions;
     in

sql/supabase_vault--0.2.8--0.3.0.sql

@@ -63,6 +63,8 @@ SELECT s.id,
   s.updated_at
 FROM vault.secrets s;
 
+GRANT ALL ON vault.decrypted_secrets TO pgsodium_keyiduser;
+
 CREATE OR REPLACE FUNCTION vault.create_secret(
   new_secret text,
   new_name text = NULL,

test/expected/test.out

@@ -0,0 +1,102 @@
+select no_plan();
+ no_plan 
+---------
+(0 rows)
+
+do $$
+select vault.create_secret (
+	's3kr3t_k3y', 'a_name', 'this is the foo secret key');
+$$;
+ERROR:  syntax error at or near "select"
+LINE 2: select vault.create_secret (
+        ^
+SELECT results_eq(
+    $$
+    SELECT decrypted_secret = 's3kr3t_k3y', description = 'this is the foo secret key'
+    FROM vault.decrypted_secrets WHERE name = 'a_name';
+    $$,
+    $$VALUES (true, true)$$,
+    'can select from masking view with custom key');
+                           results_eq                            
+-----------------------------------------------------------------
+ not ok 1 - can select from masking view with custom key        +
+ # Failed test 1: "can select from masking view with custom key"+
+ #     Results differ beginning at row 1:                       +
+ #         have: NULL                                           +
+ #         want: (t,t)
+(1 row)
+
+SELECT lives_ok(
+	$test$
+	select vault.update_secret(
+	    (select id from vault.secrets where name = 'a_name'), new_name:='a_new_name',
+	    new_secret:='new_s3kr3t_k3y', new_description:='this is the bar key')
+	$test$,
+	'can update name, secret and description'
+	);
+                    lives_ok                    
+------------------------------------------------
+ ok 2 - can update name, secret and description
+(1 row)
+
+TRUNCATE vault.secrets;
+set role bob;
+do $$
+select vault.create_secret ('foo', 'bar', 'baz');
+$$;
+ERROR:  syntax error at or near "select"
+LINE 2: select vault.create_secret ('foo', 'bar', 'baz');
+        ^
+select results_eq(
+	$test$
+    SELECT (decrypted_secret COLLATE "default"), name, description FROM vault.decrypted_secrets
+    WHERE name = 'bar'
+    $test$,
+    $results$values ('foo', 'bar', 'baz')$results$,
+     'bob can query a secret');
+                results_eq                 
+-------------------------------------------
+ not ok 3 - bob can query a secret        +
+ # Failed test 3: "bob can query a secret"+
+ #     Results differ beginning at row 1: +
+ #         have: NULL                     +
+ #         want: (foo,bar,baz)
+(1 row)
+
+select lives_ok(
+	$test$
+	select vault.update_secret(
+    (select id from vault.secrets where name = 'bar'),
+    'fooz',
+    'barz',
+    'bazz')
+	$test$,
+     'bob can update a secret');
+            lives_ok            
+--------------------------------
+ ok 4 - bob can update a secret
+(1 row)
+
+select results_eq(
+    $test$
+    SELECT (decrypted_secret COLLATE "default"), name, description
+    FROM vault.decrypted_secrets
+    $test$,
+    $results$values ('fooz', 'barz', 'bazz')$results$,
+     'bob can query an updated secret');
+                     results_eq                     
+----------------------------------------------------
+ not ok 5 - bob can query an updated secret        +
+ # Failed test 5: "bob can query an updated secret"+
+ #     Results differ beginning at row 1:          +
+ #         have: NULL                              +
+ #         want: (fooz,barz,bazz)
+(1 row)
+
+select * from finish();
+                finish                
+--------------------------------------
+ 1..5
+ # Looks like you failed 3 tests of 5
+(2 rows)
+