derivepassphrase.git

tests/test_derivepassphrase_cli_export_vault.py   1) # SPDX-FileCopyrightText: 2025 Marco Ricci <software@the13thletter.info>

tests/test_derivepassphrase_exporter_cli.py       2) #

tests/test_derivepassphrase_cli_export_vault.py   3) # SPDX-License-Identifier: Zlib

tests/test_derivepassphrase_exporter_cli.py       4) 
tests/test_derivepassphrase_exporter_cli.py       5) from __future__ import annotations
tests/test_derivepassphrase_exporter_cli.py       6) 

tests/test_derivepassphrase_exporter_cli.py       7) import base64

tests/test_derivepassphrase_cli_export_vault.py   8) import contextlib

tests/test_derivepassphrase_exporter_cli.py       9) import json

tests/test_derivepassphrase_exporter_cli.py      10) from typing import TYPE_CHECKING

tests/test_derivepassphrase_exporter_cli.py      11) 
tests/test_derivepassphrase_exporter_cli.py      12) import click.testing

tests/test_derivepassphrase_cli_export_vault.py  13) import hypothesis

tests/test_derivepassphrase_exporter_cli.py      14) import pytest

tests/test_derivepassphrase_cli_export_vault.py  15) from hypothesis import strategies

tests/test_derivepassphrase_exporter_cli.py      16) 
tests/test_derivepassphrase_exporter_cli.py      17) import tests

tests/test_derivepassphrase_cli_export_vault.py  18) from derivepassphrase import cli
tests/test_derivepassphrase_cli_export_vault.py  19) from derivepassphrase.exporter import storeroom, vault_native

tests/test_derivepassphrase_exporter_cli.py      20) 
tests/test_derivepassphrase_exporter_cli.py      21) cryptography = pytest.importorskip('cryptography', minversion='38.0')
tests/test_derivepassphrase_exporter_cli.py      22) 

tests/test_derivepassphrase_cli_export_vault.py  23) from cryptography.hazmat.primitives import (  # noqa: E402
tests/test_derivepassphrase_cli_export_vault.py  24)     ciphers,
tests/test_derivepassphrase_cli_export_vault.py  25)     hashes,
tests/test_derivepassphrase_cli_export_vault.py  26)     hmac,
tests/test_derivepassphrase_cli_export_vault.py  27)     padding,
tests/test_derivepassphrase_cli_export_vault.py  28) )
tests/test_derivepassphrase_cli_export_vault.py  29) from cryptography.hazmat.primitives.ciphers import (  # noqa: E402
tests/test_derivepassphrase_cli_export_vault.py  30)     algorithms,
tests/test_derivepassphrase_cli_export_vault.py  31)     modes,
tests/test_derivepassphrase_cli_export_vault.py  32) )
tests/test_derivepassphrase_cli_export_vault.py  33) 

tests/test_derivepassphrase_exporter_cli.py      34) if TYPE_CHECKING:

tests/test_derivepassphrase_exporter_cli.py      35)     from collections.abc import Callable

tests/test_derivepassphrase_exporter_cli.py      36)     from typing import Any
tests/test_derivepassphrase_exporter_cli.py      37) 

tests/test_derivepassphrase_exporter_cli.py      38) 
tests/test_derivepassphrase_exporter_cli.py      39) class TestCLI:
tests/test_derivepassphrase_exporter_cli.py      40)     def test_200_path_parameter(self, monkeypatch: pytest.MonkeyPatch) -> None:
tests/test_derivepassphrase_exporter_cli.py      41)         runner = click.testing.CliRunner(mix_stderr=False)
tests/test_derivepassphrase_exporter_cli.py      42)         with tests.isolated_vault_exporter_config(
tests/test_derivepassphrase_exporter_cli.py      43)             monkeypatch=monkeypatch,
tests/test_derivepassphrase_exporter_cli.py      44)             runner=runner,
tests/test_derivepassphrase_exporter_cli.py      45)             vault_config=tests.VAULT_V03_CONFIG,
tests/test_derivepassphrase_exporter_cli.py      46)             vault_key=tests.VAULT_MASTER_KEY,
tests/test_derivepassphrase_exporter_cli.py      47)         ):
tests/test_derivepassphrase_exporter_cli.py      48)             monkeypatch.setenv('VAULT_KEY', tests.VAULT_MASTER_KEY)

tests/test_derivepassphrase_cli_export_vault.py  49)             result_ = runner.invoke(

tests/test_derivepassphrase_cli_export_vault.py  50)                 cli.derivepassphrase_export_vault,

tests/test_derivepassphrase_exporter_cli.py      51)                 ['VAULT_PATH'],
tests/test_derivepassphrase_exporter_cli.py      52)             )

tests/test_derivepassphrase_cli_export_vault.py  53)         result = tests.ReadableResult.parse(result_)

tests/test_derivepassphrase_exporter_cli.py      54)         assert result.clean_exit(empty_stderr=True), 'expected clean exit'
tests/test_derivepassphrase_exporter_cli.py      55)         assert json.loads(result.output) == tests.VAULT_V03_CONFIG_DATA

tests/test_derivepassphrase_exporter_cli.py      56) 
tests/test_derivepassphrase_exporter_cli.py      57)     def test_201_key_parameter(self, monkeypatch: pytest.MonkeyPatch) -> None:
tests/test_derivepassphrase_exporter_cli.py      58)         runner = click.testing.CliRunner(mix_stderr=False)
tests/test_derivepassphrase_exporter_cli.py      59)         with tests.isolated_vault_exporter_config(
tests/test_derivepassphrase_exporter_cli.py      60)             monkeypatch=monkeypatch,
tests/test_derivepassphrase_exporter_cli.py      61)             runner=runner,
tests/test_derivepassphrase_exporter_cli.py      62)             vault_config=tests.VAULT_V03_CONFIG,
tests/test_derivepassphrase_exporter_cli.py      63)         ):

tests/test_derivepassphrase_cli_export_vault.py  64)             result_ = runner.invoke(

tests/test_derivepassphrase_cli_export_vault.py  65)                 cli.derivepassphrase_export_vault,

tests/test_derivepassphrase_exporter_cli.py      66)                 ['-k', tests.VAULT_MASTER_KEY, '.vault'],
tests/test_derivepassphrase_exporter_cli.py      67)             )

tests/test_derivepassphrase_cli_export_vault.py  68)         result = tests.ReadableResult.parse(result_)

tests/test_derivepassphrase_exporter_cli.py      69)         assert result.clean_exit(empty_stderr=True), 'expected clean exit'
tests/test_derivepassphrase_exporter_cli.py      70)         assert json.loads(result.output) == tests.VAULT_V03_CONFIG_DATA

tests/test_derivepassphrase_exporter_cli.py      71) 
tests/test_derivepassphrase_exporter_cli.py      72)     @pytest.mark.parametrize(
tests/test_derivepassphrase_exporter_cli.py      73)         ['format', 'config', 'config_data'],
tests/test_derivepassphrase_exporter_cli.py      74)         [
tests/test_derivepassphrase_exporter_cli.py      75)             pytest.param(
tests/test_derivepassphrase_exporter_cli.py      76)                 'v0.2',
tests/test_derivepassphrase_exporter_cli.py      77)                 tests.VAULT_V02_CONFIG,
tests/test_derivepassphrase_exporter_cli.py      78)                 tests.VAULT_V02_CONFIG_DATA,
tests/test_derivepassphrase_exporter_cli.py      79)                 id='0.2',
tests/test_derivepassphrase_exporter_cli.py      80)             ),
tests/test_derivepassphrase_exporter_cli.py      81)             pytest.param(
tests/test_derivepassphrase_exporter_cli.py      82)                 'v0.3',
tests/test_derivepassphrase_exporter_cli.py      83)                 tests.VAULT_V03_CONFIG,
tests/test_derivepassphrase_exporter_cli.py      84)                 tests.VAULT_V03_CONFIG_DATA,
tests/test_derivepassphrase_exporter_cli.py      85)                 id='0.3',
tests/test_derivepassphrase_exporter_cli.py      86)             ),
tests/test_derivepassphrase_exporter_cli.py      87)             pytest.param(
tests/test_derivepassphrase_exporter_cli.py      88)                 'storeroom',
tests/test_derivepassphrase_exporter_cli.py      89)                 tests.VAULT_STOREROOM_CONFIG_ZIPPED,
tests/test_derivepassphrase_exporter_cli.py      90)                 tests.VAULT_STOREROOM_CONFIG_DATA,
tests/test_derivepassphrase_exporter_cli.py      91)                 id='storeroom',
tests/test_derivepassphrase_exporter_cli.py      92)             ),
tests/test_derivepassphrase_exporter_cli.py      93)         ],
tests/test_derivepassphrase_exporter_cli.py      94)     )
tests/test_derivepassphrase_exporter_cli.py      95)     def test_210_load_vault_v02_v03_storeroom(
tests/test_derivepassphrase_exporter_cli.py      96)         self,
tests/test_derivepassphrase_exporter_cli.py      97)         monkeypatch: pytest.MonkeyPatch,
tests/test_derivepassphrase_exporter_cli.py      98)         format: str,
tests/test_derivepassphrase_exporter_cli.py      99)         config: str | bytes,
tests/test_derivepassphrase_exporter_cli.py     100)         config_data: dict[str, Any],
tests/test_derivepassphrase_exporter_cli.py     101)     ) -> None:
tests/test_derivepassphrase_exporter_cli.py     102)         runner = click.testing.CliRunner(mix_stderr=False)
tests/test_derivepassphrase_exporter_cli.py     103)         with tests.isolated_vault_exporter_config(
tests/test_derivepassphrase_exporter_cli.py     104)             monkeypatch=monkeypatch,
tests/test_derivepassphrase_exporter_cli.py     105)             runner=runner,
tests/test_derivepassphrase_exporter_cli.py     106)             vault_config=config,
tests/test_derivepassphrase_exporter_cli.py     107)         ):

tests/test_derivepassphrase_cli_export_vault.py 108)             result_ = runner.invoke(

tests/test_derivepassphrase_cli_export_vault.py 109)                 cli.derivepassphrase_export_vault,

tests/test_derivepassphrase_exporter_cli.py     110)                 ['-f', format, '-k', tests.VAULT_MASTER_KEY, 'VAULT_PATH'],
tests/test_derivepassphrase_exporter_cli.py     111)             )

tests/test_derivepassphrase_cli_export_vault.py 112)         result = tests.ReadableResult.parse(result_)

tests/test_derivepassphrase_exporter_cli.py     113)         assert result.clean_exit(empty_stderr=True), 'expected clean exit'
tests/test_derivepassphrase_exporter_cli.py     114)         assert json.loads(result.output) == config_data

tests/test_derivepassphrase_exporter_cli.py     115) 
tests/test_derivepassphrase_exporter_cli.py     116)     # test_300_invalid_format is found in
tests/test_derivepassphrase_exporter_cli.py     117)     # tests.test_derivepassphrase_export::Test002CLI
tests/test_derivepassphrase_exporter_cli.py     118) 
tests/test_derivepassphrase_exporter_cli.py     119)     def test_301_vault_config_not_found(
tests/test_derivepassphrase_exporter_cli.py     120)         self,
tests/test_derivepassphrase_exporter_cli.py     121)         monkeypatch: pytest.MonkeyPatch,

tests/test_derivepassphrase_cli_export_vault.py 122)         caplog: pytest.LogCaptureFixture,

tests/test_derivepassphrase_exporter_cli.py     123)     ) -> None:
tests/test_derivepassphrase_exporter_cli.py     124)         runner = click.testing.CliRunner(mix_stderr=False)
tests/test_derivepassphrase_exporter_cli.py     125)         with tests.isolated_vault_exporter_config(
tests/test_derivepassphrase_exporter_cli.py     126)             monkeypatch=monkeypatch,
tests/test_derivepassphrase_exporter_cli.py     127)             runner=runner,
tests/test_derivepassphrase_exporter_cli.py     128)             vault_config=tests.VAULT_V03_CONFIG,
tests/test_derivepassphrase_exporter_cli.py     129)             vault_key=tests.VAULT_MASTER_KEY,
tests/test_derivepassphrase_exporter_cli.py     130)         ):

tests/test_derivepassphrase_cli_export_vault.py 131)             result_ = runner.invoke(

tests/test_derivepassphrase_cli_export_vault.py 132)                 cli.derivepassphrase_export_vault,

tests/test_derivepassphrase_exporter_cli.py     133)                 ['does-not-exist.txt'],
tests/test_derivepassphrase_exporter_cli.py     134)             )

tests/test_derivepassphrase_cli_export_vault.py 135)         result = tests.ReadableResult.parse(result_)

tests/test_derivepassphrase_exporter_cli.py     136)         assert result.error_exit(

tests/test_derivepassphrase_cli_export_vault.py 137)             error=(
tests/test_derivepassphrase_cli_export_vault.py 138)                 "Cannot parse 'does-not-exist.txt' "

tests/test_derivepassphrase_cli_export_vault.py 139)                 'as a valid vault-native config'

tests/test_derivepassphrase_cli_export_vault.py 140)             ),

tests/test_derivepassphrase_cli_export_vault.py 141)             record_tuples=caplog.record_tuples,

tests/test_derivepassphrase_exporter_cli.py     142)         ), 'expected error exit and known error message'
tests/test_derivepassphrase_exporter_cli.py     143)         assert tests.CANNOT_LOAD_CRYPTOGRAPHY not in result.stderr

tests/test_derivepassphrase_exporter_cli.py     144) 
tests/test_derivepassphrase_exporter_cli.py     145)     def test_302_vault_config_invalid(
tests/test_derivepassphrase_exporter_cli.py     146)         self,
tests/test_derivepassphrase_exporter_cli.py     147)         monkeypatch: pytest.MonkeyPatch,

tests/test_derivepassphrase_cli_export_vault.py 148)         caplog: pytest.LogCaptureFixture,

tests/test_derivepassphrase_exporter_cli.py     149)     ) -> None:
tests/test_derivepassphrase_exporter_cli.py     150)         runner = click.testing.CliRunner(mix_stderr=False)
tests/test_derivepassphrase_exporter_cli.py     151)         with tests.isolated_vault_exporter_config(
tests/test_derivepassphrase_exporter_cli.py     152)             monkeypatch=monkeypatch,
tests/test_derivepassphrase_exporter_cli.py     153)             runner=runner,
tests/test_derivepassphrase_exporter_cli.py     154)             vault_config='',
tests/test_derivepassphrase_exporter_cli.py     155)             vault_key=tests.VAULT_MASTER_KEY,
tests/test_derivepassphrase_exporter_cli.py     156)         ):

tests/test_derivepassphrase_cli_export_vault.py 157)             result_ = runner.invoke(

tests/test_derivepassphrase_cli_export_vault.py 158)                 cli.derivepassphrase_export_vault,

tests/test_derivepassphrase_exporter_cli.py     159)                 ['.vault'],
tests/test_derivepassphrase_exporter_cli.py     160)             )

tests/test_derivepassphrase_cli_export_vault.py 161)         result = tests.ReadableResult.parse(result_)

tests/test_derivepassphrase_exporter_cli.py     162)         assert result.error_exit(

tests/test_derivepassphrase_cli_export_vault.py 163)             error="Cannot parse '.vault' as a valid vault-native config",

tests/test_derivepassphrase_cli_export_vault.py 164)             record_tuples=caplog.record_tuples,

tests/test_derivepassphrase_exporter_cli.py     165)         ), 'expected error exit and known error message'
tests/test_derivepassphrase_exporter_cli.py     166)         assert tests.CANNOT_LOAD_CRYPTOGRAPHY not in result.stderr

tests/test_derivepassphrase_exporter_cli.py     167) 
tests/test_derivepassphrase_exporter_cli.py     168)     def test_403_invalid_vault_config_bad_signature(
tests/test_derivepassphrase_exporter_cli.py     169)         self,
tests/test_derivepassphrase_exporter_cli.py     170)         monkeypatch: pytest.MonkeyPatch,

tests/test_derivepassphrase_cli_export_vault.py 171)         caplog: pytest.LogCaptureFixture,

tests/test_derivepassphrase_exporter_cli.py     172)     ) -> None:
tests/test_derivepassphrase_exporter_cli.py     173)         runner = click.testing.CliRunner(mix_stderr=False)
tests/test_derivepassphrase_exporter_cli.py     174)         with tests.isolated_vault_exporter_config(
tests/test_derivepassphrase_exporter_cli.py     175)             monkeypatch=monkeypatch,
tests/test_derivepassphrase_exporter_cli.py     176)             runner=runner,
tests/test_derivepassphrase_exporter_cli.py     177)             vault_config=tests.VAULT_V02_CONFIG,
tests/test_derivepassphrase_exporter_cli.py     178)             vault_key=tests.VAULT_MASTER_KEY,
tests/test_derivepassphrase_exporter_cli.py     179)         ):

tests/test_derivepassphrase_cli_export_vault.py 180)             result_ = runner.invoke(

tests/test_derivepassphrase_cli_export_vault.py 181)                 cli.derivepassphrase_export_vault,

tests/test_derivepassphrase_exporter_cli.py     182)                 ['-f', 'v0.3', '.vault'],
tests/test_derivepassphrase_exporter_cli.py     183)             )

tests/test_derivepassphrase_cli_export_vault.py 184)         result = tests.ReadableResult.parse(result_)

tests/test_derivepassphrase_exporter_cli.py     185)         assert result.error_exit(

tests/test_derivepassphrase_cli_export_vault.py 186)             error="Cannot parse '.vault' as a valid vault-native config",

tests/test_derivepassphrase_cli_export_vault.py 187)             record_tuples=caplog.record_tuples,

tests/test_derivepassphrase_exporter_cli.py     188)         ), 'expected error exit and known error message'
tests/test_derivepassphrase_exporter_cli.py     189)         assert tests.CANNOT_LOAD_CRYPTOGRAPHY not in result.stderr

tests/test_derivepassphrase_exporter_cli.py     190) 
tests/test_derivepassphrase_exporter_cli.py     191)     def test_500_vault_config_invalid_internal(
tests/test_derivepassphrase_exporter_cli.py     192)         self,
tests/test_derivepassphrase_exporter_cli.py     193)         monkeypatch: pytest.MonkeyPatch,

tests/test_derivepassphrase_cli_export_vault.py 194)         caplog: pytest.LogCaptureFixture,

tests/test_derivepassphrase_exporter_cli.py     195)     ) -> None:
tests/test_derivepassphrase_exporter_cli.py     196)         runner = click.testing.CliRunner(mix_stderr=False)
tests/test_derivepassphrase_exporter_cli.py     197)         with tests.isolated_vault_exporter_config(
tests/test_derivepassphrase_exporter_cli.py     198)             monkeypatch=monkeypatch,
tests/test_derivepassphrase_exporter_cli.py     199)             runner=runner,
tests/test_derivepassphrase_exporter_cli.py     200)             vault_config=tests.VAULT_V03_CONFIG,
tests/test_derivepassphrase_exporter_cli.py     201)             vault_key=tests.VAULT_MASTER_KEY,
tests/test_derivepassphrase_exporter_cli.py     202)         ):
tests/test_derivepassphrase_exporter_cli.py     203) 
tests/test_derivepassphrase_exporter_cli.py     204)             def _load_data(*_args: Any, **_kwargs: Any) -> None:
tests/test_derivepassphrase_exporter_cli.py     205)                 return None
tests/test_derivepassphrase_exporter_cli.py     206) 
tests/test_derivepassphrase_exporter_cli.py     207)             monkeypatch.setattr(cli, '_load_data', _load_data)

tests/test_derivepassphrase_cli_export_vault.py 208)             result_ = runner.invoke(

tests/test_derivepassphrase_cli_export_vault.py 209)                 cli.derivepassphrase_export_vault,

tests/test_derivepassphrase_exporter_cli.py     210)                 ['.vault'],
tests/test_derivepassphrase_exporter_cli.py     211)             )

tests/test_derivepassphrase_cli_export_vault.py 212)         result = tests.ReadableResult.parse(result_)

tests/test_derivepassphrase_exporter_cli.py     213)         assert result.error_exit(

tests/test_derivepassphrase_cli_export_vault.py 214)             error='Invalid vault config: ',
tests/test_derivepassphrase_cli_export_vault.py 215)             record_tuples=caplog.record_tuples,

tests/test_derivepassphrase_exporter_cli.py     216)         ), 'expected error exit and known error message'
tests/test_derivepassphrase_exporter_cli.py     217)         assert tests.CANNOT_LOAD_CRYPTOGRAPHY not in result.stderr

tests/test_derivepassphrase_exporter_cli.py     218) 
tests/test_derivepassphrase_exporter_cli.py     219) 
tests/test_derivepassphrase_exporter_cli.py     220) class TestStoreroom:
tests/test_derivepassphrase_exporter_cli.py     221)     @pytest.mark.parametrize(
tests/test_derivepassphrase_exporter_cli.py     222)         ['path', 'key'],
tests/test_derivepassphrase_exporter_cli.py     223)         [
tests/test_derivepassphrase_exporter_cli.py     224)             ('.vault', tests.VAULT_MASTER_KEY),
tests/test_derivepassphrase_exporter_cli.py     225)             ('.vault', None),
tests/test_derivepassphrase_exporter_cli.py     226)             (None, tests.VAULT_MASTER_KEY),
tests/test_derivepassphrase_exporter_cli.py     227)             (None, None),
tests/test_derivepassphrase_exporter_cli.py     228)         ],
tests/test_derivepassphrase_exporter_cli.py     229)     )
tests/test_derivepassphrase_exporter_cli.py     230)     def test_200_export_data_path_and_keys_type(
tests/test_derivepassphrase_exporter_cli.py     231)         self,
tests/test_derivepassphrase_exporter_cli.py     232)         monkeypatch: pytest.MonkeyPatch,
tests/test_derivepassphrase_exporter_cli.py     233)         path: str | None,
tests/test_derivepassphrase_exporter_cli.py     234)         key: str | None,
tests/test_derivepassphrase_exporter_cli.py     235)     ) -> None:
tests/test_derivepassphrase_exporter_cli.py     236)         runner = click.testing.CliRunner(mix_stderr=False)
tests/test_derivepassphrase_exporter_cli.py     237)         with tests.isolated_vault_exporter_config(
tests/test_derivepassphrase_exporter_cli.py     238)             monkeypatch=monkeypatch,
tests/test_derivepassphrase_exporter_cli.py     239)             runner=runner,
tests/test_derivepassphrase_exporter_cli.py     240)             vault_config=tests.VAULT_STOREROOM_CONFIG_ZIPPED,
tests/test_derivepassphrase_exporter_cli.py     241)             vault_key=tests.VAULT_MASTER_KEY,
tests/test_derivepassphrase_exporter_cli.py     242)         ):
tests/test_derivepassphrase_exporter_cli.py     243)             assert (
tests/test_derivepassphrase_exporter_cli.py     244)                 storeroom.export_storeroom_data(path, key)
tests/test_derivepassphrase_exporter_cli.py     245)                 == tests.VAULT_STOREROOM_CONFIG_DATA
tests/test_derivepassphrase_exporter_cli.py     246)             )
tests/test_derivepassphrase_exporter_cli.py     247) 
tests/test_derivepassphrase_exporter_cli.py     248)     def test_400_decrypt_bucket_item_unknown_version(self) -> None:
tests/test_derivepassphrase_exporter_cli.py     249)         bucket_item = (
tests/test_derivepassphrase_exporter_cli.py     250)             b'\xff' + bytes(storeroom.ENCRYPTED_KEYPAIR_SIZE) + bytes(3)
tests/test_derivepassphrase_exporter_cli.py     251)         )
tests/test_derivepassphrase_exporter_cli.py     252)         master_keys: storeroom.MasterKeys = {
tests/test_derivepassphrase_exporter_cli.py     253)             'encryption_key': bytes(storeroom.KEY_SIZE),
tests/test_derivepassphrase_exporter_cli.py     254)             'signing_key': bytes(storeroom.KEY_SIZE),
tests/test_derivepassphrase_exporter_cli.py     255)             'hashing_key': bytes(storeroom.KEY_SIZE),
tests/test_derivepassphrase_exporter_cli.py     256)         }

tests/test_derivepassphrase_exporter_cli.py     257)         with pytest.raises(ValueError, match='Cannot handle version 255'):

tests/test_derivepassphrase_exporter_cli.py     258)             storeroom.decrypt_bucket_item(bucket_item, master_keys)
tests/test_derivepassphrase_exporter_cli.py     259) 
tests/test_derivepassphrase_exporter_cli.py     260)     @pytest.mark.parametrize('config', ['xxx', 'null', '{"version": 255}'])
tests/test_derivepassphrase_exporter_cli.py     261)     def test_401_decrypt_bucket_file_bad_json_or_version(
tests/test_derivepassphrase_exporter_cli.py     262)         self,
tests/test_derivepassphrase_exporter_cli.py     263)         monkeypatch: pytest.MonkeyPatch,
tests/test_derivepassphrase_exporter_cli.py     264)         config: str,
tests/test_derivepassphrase_exporter_cli.py     265)     ) -> None:
tests/test_derivepassphrase_exporter_cli.py     266)         runner = click.testing.CliRunner(mix_stderr=False)
tests/test_derivepassphrase_exporter_cli.py     267)         master_keys: storeroom.MasterKeys = {
tests/test_derivepassphrase_exporter_cli.py     268)             'encryption_key': bytes(storeroom.KEY_SIZE),
tests/test_derivepassphrase_exporter_cli.py     269)             'signing_key': bytes(storeroom.KEY_SIZE),
tests/test_derivepassphrase_exporter_cli.py     270)             'hashing_key': bytes(storeroom.KEY_SIZE),
tests/test_derivepassphrase_exporter_cli.py     271)         }

tests/test_derivepassphrase_cli_export_vault.py 272)         with tests.isolated_vault_exporter_config(
tests/test_derivepassphrase_cli_export_vault.py 273)             monkeypatch=monkeypatch,
tests/test_derivepassphrase_cli_export_vault.py 274)             runner=runner,
tests/test_derivepassphrase_cli_export_vault.py 275)             vault_config=tests.VAULT_STOREROOM_CONFIG_ZIPPED,

tests/test_derivepassphrase_exporter_cli.py     276)         ):
tests/test_derivepassphrase_exporter_cli.py     277)             with open('.vault/20', 'w', encoding='UTF-8') as outfile:
tests/test_derivepassphrase_exporter_cli.py     278)                 print(config, file=outfile)

tests/test_derivepassphrase_exporter_cli.py     279)             with pytest.raises(ValueError, match='Invalid bucket file: '):

tests/test_derivepassphrase_exporter_cli.py     280)                 list(storeroom.decrypt_bucket_file('.vault/20', master_keys))
tests/test_derivepassphrase_exporter_cli.py     281) 
tests/test_derivepassphrase_exporter_cli.py     282)     @pytest.mark.parametrize(
tests/test_derivepassphrase_exporter_cli.py     283)         ['data', 'err_msg'],
tests/test_derivepassphrase_exporter_cli.py     284)         [
tests/test_derivepassphrase_exporter_cli.py     285)             ('{"version": 255}', 'bad or unsupported keys version header'),
tests/test_derivepassphrase_exporter_cli.py     286)             ('{"version": 1}\nAAAA\nAAAA', 'trailing data; cannot make sense'),
tests/test_derivepassphrase_exporter_cli.py     287)             ('{"version": 1}\nAAAA', 'cannot handle version 0 encrypted keys'),
tests/test_derivepassphrase_exporter_cli.py     288)         ],
tests/test_derivepassphrase_exporter_cli.py     289)     )
tests/test_derivepassphrase_exporter_cli.py     290)     def test_402_export_storeroom_data_bad_master_keys_file(
tests/test_derivepassphrase_exporter_cli.py     291)         self,
tests/test_derivepassphrase_exporter_cli.py     292)         monkeypatch: pytest.MonkeyPatch,
tests/test_derivepassphrase_exporter_cli.py     293)         data: str,
tests/test_derivepassphrase_exporter_cli.py     294)         err_msg: str,
tests/test_derivepassphrase_exporter_cli.py     295)     ) -> None:
tests/test_derivepassphrase_exporter_cli.py     296)         runner = click.testing.CliRunner(mix_stderr=False)

tests/test_derivepassphrase_cli_export_vault.py 297)         with tests.isolated_vault_exporter_config(
tests/test_derivepassphrase_cli_export_vault.py 298)             monkeypatch=monkeypatch,
tests/test_derivepassphrase_cli_export_vault.py 299)             runner=runner,
tests/test_derivepassphrase_cli_export_vault.py 300)             vault_config=tests.VAULT_STOREROOM_CONFIG_ZIPPED,
tests/test_derivepassphrase_cli_export_vault.py 301)             vault_key=tests.VAULT_MASTER_KEY,

tests/test_derivepassphrase_exporter_cli.py     302)         ):
tests/test_derivepassphrase_exporter_cli.py     303)             with open('.vault/.keys', 'w', encoding='UTF-8') as outfile:
tests/test_derivepassphrase_exporter_cli.py     304)                 print(data, file=outfile)
tests/test_derivepassphrase_exporter_cli.py     305)             with pytest.raises(RuntimeError, match=err_msg):
tests/test_derivepassphrase_exporter_cli.py     306)                 storeroom.export_storeroom_data()
tests/test_derivepassphrase_exporter_cli.py     307) 

tests/test_derivepassphrase_cli_export_vault.py 308)     @pytest.mark.parametrize(
tests/test_derivepassphrase_cli_export_vault.py 309)         ['zipped_config', 'error_text'],
tests/test_derivepassphrase_cli_export_vault.py 310)         [
tests/test_derivepassphrase_cli_export_vault.py 311)             pytest.param(
tests/test_derivepassphrase_cli_export_vault.py 312)                 tests.VAULT_STOREROOM_BROKEN_DIR_CONFIG_ZIPPED,
tests/test_derivepassphrase_cli_export_vault.py 313)                 'Object key mismatch',
tests/test_derivepassphrase_cli_export_vault.py 314)                 id='VAULT_STOREROOM_BROKEN_DIR_CONFIG_ZIPPED',
tests/test_derivepassphrase_cli_export_vault.py 315)             ),
tests/test_derivepassphrase_cli_export_vault.py 316)             pytest.param(
tests/test_derivepassphrase_cli_export_vault.py 317)                 tests.VAULT_STOREROOM_BROKEN_DIR_CONFIG_ZIPPED2,
tests/test_derivepassphrase_cli_export_vault.py 318)                 'Directory index is not actually an index',
tests/test_derivepassphrase_cli_export_vault.py 319)                 id='VAULT_STOREROOM_BROKEN_DIR_CONFIG_ZIPPED2',
tests/test_derivepassphrase_cli_export_vault.py 320)             ),
tests/test_derivepassphrase_cli_export_vault.py 321)             pytest.param(
tests/test_derivepassphrase_cli_export_vault.py 322)                 tests.VAULT_STOREROOM_BROKEN_DIR_CONFIG_ZIPPED3,
tests/test_derivepassphrase_cli_export_vault.py 323)                 'Directory index is not actually an index',
tests/test_derivepassphrase_cli_export_vault.py 324)                 id='VAULT_STOREROOM_BROKEN_DIR_CONFIG_ZIPPED3',
tests/test_derivepassphrase_cli_export_vault.py 325)             ),
tests/test_derivepassphrase_cli_export_vault.py 326)             pytest.param(
tests/test_derivepassphrase_cli_export_vault.py 327)                 tests.VAULT_STOREROOM_BROKEN_DIR_CONFIG_ZIPPED4,
tests/test_derivepassphrase_cli_export_vault.py 328)                 'Object key mismatch',
tests/test_derivepassphrase_cli_export_vault.py 329)                 id='VAULT_STOREROOM_BROKEN_DIR_CONFIG_ZIPPED4',
tests/test_derivepassphrase_cli_export_vault.py 330)             ),
tests/test_derivepassphrase_cli_export_vault.py 331)         ],
tests/test_derivepassphrase_cli_export_vault.py 332)     )

tests/test_derivepassphrase_exporter_cli.py     333)     def test_403_export_storeroom_data_bad_directory_listing(
tests/test_derivepassphrase_exporter_cli.py     334)         self,
tests/test_derivepassphrase_exporter_cli.py     335)         monkeypatch: pytest.MonkeyPatch,

tests/test_derivepassphrase_cli_export_vault.py 336)         zipped_config: bytes,
tests/test_derivepassphrase_cli_export_vault.py 337)         error_text: str,

tests/test_derivepassphrase_exporter_cli.py     338)     ) -> None:
tests/test_derivepassphrase_exporter_cli.py     339)         runner = click.testing.CliRunner(mix_stderr=False)

tests/test_derivepassphrase_cli_export_vault.py 340)         # Use parenthesized context manager expressions once Python 3.9
tests/test_derivepassphrase_cli_export_vault.py 341)         # becomes unsupported.
tests/test_derivepassphrase_cli_export_vault.py 342)         with contextlib.ExitStack() as stack:
tests/test_derivepassphrase_cli_export_vault.py 343)             stack.enter_context(
tests/test_derivepassphrase_cli_export_vault.py 344)                 tests.isolated_vault_exporter_config(
tests/test_derivepassphrase_cli_export_vault.py 345)                     monkeypatch=monkeypatch,
tests/test_derivepassphrase_cli_export_vault.py 346)                     runner=runner,
tests/test_derivepassphrase_cli_export_vault.py 347)                     vault_config=zipped_config,
tests/test_derivepassphrase_cli_export_vault.py 348)                     vault_key=tests.VAULT_MASTER_KEY,
tests/test_derivepassphrase_cli_export_vault.py 349)                 )
tests/test_derivepassphrase_cli_export_vault.py 350)             )
tests/test_derivepassphrase_cli_export_vault.py 351)             stack.enter_context(pytest.raises(RuntimeError, match=error_text))

tests/test_derivepassphrase_exporter_cli.py     352)             storeroom.export_storeroom_data()

tests/test_derivepassphrase_exporter_cli.py     353) 

tests/test_derivepassphrase_cli_export_vault.py 354)     def test_404_decrypt_keys_wrong_data_length(self) -> None:
tests/test_derivepassphrase_cli_export_vault.py 355)         payload = (

tests/test_derivepassphrase_cli_export_vault.py 356)             b"Any text here, as long as it isn't exactly 64 or 96 bytes long."

tests/test_derivepassphrase_cli_export_vault.py 357)         )
tests/test_derivepassphrase_cli_export_vault.py 358)         assert len(payload) not in frozenset({
tests/test_derivepassphrase_cli_export_vault.py 359)             2 * storeroom.KEY_SIZE,
tests/test_derivepassphrase_cli_export_vault.py 360)             3 * storeroom.KEY_SIZE,
tests/test_derivepassphrase_cli_export_vault.py 361)         })
tests/test_derivepassphrase_cli_export_vault.py 362)         key = b'DEADBEEFdeadbeefDeAdBeEfdEaDbEeF'
tests/test_derivepassphrase_cli_export_vault.py 363)         padder = padding.PKCS7(storeroom.IV_SIZE * 8).padder()
tests/test_derivepassphrase_cli_export_vault.py 364)         plaintext = bytearray(padder.update(payload))
tests/test_derivepassphrase_cli_export_vault.py 365)         plaintext.extend(padder.finalize())
tests/test_derivepassphrase_cli_export_vault.py 366)         iv = b'deadbeefDEADBEEF'
tests/test_derivepassphrase_cli_export_vault.py 367)         assert len(iv) == storeroom.IV_SIZE
tests/test_derivepassphrase_cli_export_vault.py 368)         encryptor = ciphers.Cipher(
tests/test_derivepassphrase_cli_export_vault.py 369)             algorithms.AES256(key), modes.CBC(iv)
tests/test_derivepassphrase_cli_export_vault.py 370)         ).encryptor()
tests/test_derivepassphrase_cli_export_vault.py 371)         ciphertext = bytearray(encryptor.update(plaintext))
tests/test_derivepassphrase_cli_export_vault.py 372)         ciphertext.extend(encryptor.finalize())
tests/test_derivepassphrase_cli_export_vault.py 373)         mac_obj = hmac.HMAC(key, hashes.SHA256())
tests/test_derivepassphrase_cli_export_vault.py 374)         mac_obj.update(iv)
tests/test_derivepassphrase_cli_export_vault.py 375)         mac_obj.update(ciphertext)
tests/test_derivepassphrase_cli_export_vault.py 376)         data = iv + bytes(ciphertext) + mac_obj.finalize()
tests/test_derivepassphrase_cli_export_vault.py 377)         with pytest.raises(
tests/test_derivepassphrase_cli_export_vault.py 378)             ValueError,
tests/test_derivepassphrase_cli_export_vault.py 379)             match=r'Invalid encrypted master keys payload',
tests/test_derivepassphrase_cli_export_vault.py 380)         ):
tests/test_derivepassphrase_cli_export_vault.py 381)             storeroom.decrypt_master_keys_data(
tests/test_derivepassphrase_cli_export_vault.py 382)                 data, {'encryption_key': key, 'signing_key': key}
tests/test_derivepassphrase_cli_export_vault.py 383)             )
tests/test_derivepassphrase_cli_export_vault.py 384)         with pytest.raises(
tests/test_derivepassphrase_cli_export_vault.py 385)             ValueError,
tests/test_derivepassphrase_cli_export_vault.py 386)             match=r'Invalid encrypted session keys payload',
tests/test_derivepassphrase_cli_export_vault.py 387)         ):
tests/test_derivepassphrase_cli_export_vault.py 388)             storeroom.decrypt_session_keys(
tests/test_derivepassphrase_cli_export_vault.py 389)                 data,
tests/test_derivepassphrase_cli_export_vault.py 390)                 {
tests/test_derivepassphrase_cli_export_vault.py 391)                     'hashing_key': key,
tests/test_derivepassphrase_cli_export_vault.py 392)                     'encryption_key': key,
tests/test_derivepassphrase_cli_export_vault.py 393)                     'signing_key': key,
tests/test_derivepassphrase_cli_export_vault.py 394)                 },
tests/test_derivepassphrase_cli_export_vault.py 395)             )
tests/test_derivepassphrase_cli_export_vault.py 396) 

tests/test_derivepassphrase_cli_export_vault.py 397)     @tests.hypothesis_settings_coverage_compatible
tests/test_derivepassphrase_cli_export_vault.py 398)     @hypothesis.given(
tests/test_derivepassphrase_cli_export_vault.py 399)         data=strategies.binary(
tests/test_derivepassphrase_cli_export_vault.py 400)             min_size=storeroom.MAC_SIZE, max_size=storeroom.MAC_SIZE
tests/test_derivepassphrase_cli_export_vault.py 401)         ),
tests/test_derivepassphrase_cli_export_vault.py 402)     )
tests/test_derivepassphrase_cli_export_vault.py 403)     def test_405_decrypt_keys_invalid_signature(self, data: bytes) -> None:
tests/test_derivepassphrase_cli_export_vault.py 404)         key = b'DEADBEEFdeadbeefDeAdBeEfdEaDbEeF'
tests/test_derivepassphrase_cli_export_vault.py 405)         # Guessing a correct payload plus MAC would be a pre-image
tests/test_derivepassphrase_cli_export_vault.py 406)         # attack on the underlying hash function (SHA-256), i.e. is
tests/test_derivepassphrase_cli_export_vault.py 407)         # computationally infeasible, and the chance of finding one by
tests/test_derivepassphrase_cli_export_vault.py 408)         # such random sampling is astronomically tiny.
tests/test_derivepassphrase_cli_export_vault.py 409)         with pytest.raises(cryptography.exceptions.InvalidSignature):
tests/test_derivepassphrase_cli_export_vault.py 410)             storeroom.decrypt_master_keys_data(
tests/test_derivepassphrase_cli_export_vault.py 411)                 data, {'encryption_key': key, 'signing_key': key}
tests/test_derivepassphrase_cli_export_vault.py 412)             )
tests/test_derivepassphrase_cli_export_vault.py 413)         with pytest.raises(cryptography.exceptions.InvalidSignature):
tests/test_derivepassphrase_cli_export_vault.py 414)             storeroom.decrypt_session_keys(
tests/test_derivepassphrase_cli_export_vault.py 415)                 data,
tests/test_derivepassphrase_cli_export_vault.py 416)                 {
tests/test_derivepassphrase_cli_export_vault.py 417)                     'hashing_key': key,
tests/test_derivepassphrase_cli_export_vault.py 418)                     'encryption_key': key,
tests/test_derivepassphrase_cli_export_vault.py 419)                     'signing_key': key,
tests/test_derivepassphrase_cli_export_vault.py 420)                 },
tests/test_derivepassphrase_cli_export_vault.py 421)             )
tests/test_derivepassphrase_cli_export_vault.py 422) 

tests/test_derivepassphrase_exporter_cli.py     423) 
tests/test_derivepassphrase_exporter_cli.py     424) class TestVaultNativeConfig:
tests/test_derivepassphrase_exporter_cli.py     425)     @pytest.mark.parametrize(
tests/test_derivepassphrase_exporter_cli.py     426)         ['iterations', 'result'],
tests/test_derivepassphrase_exporter_cli.py     427)         [
tests/test_derivepassphrase_exporter_cli.py     428)             (100, b'6ede361e81e9c061efcdd68aeb768b80'),
tests/test_derivepassphrase_exporter_cli.py     429)             (200, b'bcc7d01e075b9ffb69e702bf701187c1'),
tests/test_derivepassphrase_exporter_cli.py     430)         ],
tests/test_derivepassphrase_exporter_cli.py     431)     )
tests/test_derivepassphrase_exporter_cli.py     432)     def test_200_pbkdf2_manually(self, iterations: int, result: bytes) -> None:

tests/test_derivepassphrase_exporter_cli.py     433)         assert (

tests/test_derivepassphrase_exporter_cli.py     434)             vault_native.VaultNativeConfigParser._pbkdf2(

tests/test_derivepassphrase_exporter_cli.py     435)                 tests.VAULT_MASTER_KEY.encode('utf-8'), 32, iterations
tests/test_derivepassphrase_exporter_cli.py     436)             )
tests/test_derivepassphrase_exporter_cli.py     437)             == result
tests/test_derivepassphrase_exporter_cli.py     438)         )

tests/test_derivepassphrase_exporter_cli.py     439) 

tests/test_derivepassphrase_exporter_cli.py     440)     def test_201_export_vault_native_data_no_arguments(
tests/test_derivepassphrase_exporter_cli.py     441)         self, monkeypatch: pytest.MonkeyPatch
tests/test_derivepassphrase_exporter_cli.py     442)     ) -> None:
tests/test_derivepassphrase_exporter_cli.py     443)         runner = click.testing.CliRunner(mix_stderr=False)
tests/test_derivepassphrase_exporter_cli.py     444)         with tests.isolated_vault_exporter_config(
tests/test_derivepassphrase_exporter_cli.py     445)             monkeypatch=monkeypatch,
tests/test_derivepassphrase_exporter_cli.py     446)             runner=runner,
tests/test_derivepassphrase_exporter_cli.py     447)             vault_config=tests.VAULT_V03_CONFIG,
tests/test_derivepassphrase_exporter_cli.py     448)             vault_key=tests.VAULT_MASTER_KEY,
tests/test_derivepassphrase_exporter_cli.py     449)         ):
tests/test_derivepassphrase_exporter_cli.py     450)             parsed_config = vault_native.export_vault_native_data(None)
tests/test_derivepassphrase_exporter_cli.py     451)         assert parsed_config == tests.VAULT_V03_CONFIG_DATA
tests/test_derivepassphrase_exporter_cli.py     452) 

tests/test_derivepassphrase_exporter_cli.py     453)     @pytest.mark.parametrize(
tests/test_derivepassphrase_exporter_cli.py     454)         ['parser_class', 'config', 'result'],
tests/test_derivepassphrase_exporter_cli.py     455)         [
tests/test_derivepassphrase_exporter_cli.py     456)             pytest.param(

tests/test_derivepassphrase_exporter_cli.py     457)                 vault_native.VaultNativeV02ConfigParser,

tests/test_derivepassphrase_exporter_cli.py     458)                 tests.VAULT_V02_CONFIG,
tests/test_derivepassphrase_exporter_cli.py     459)                 tests.VAULT_V02_CONFIG_DATA,
tests/test_derivepassphrase_exporter_cli.py     460)                 id='0.2',
tests/test_derivepassphrase_exporter_cli.py     461)             ),
tests/test_derivepassphrase_exporter_cli.py     462)             pytest.param(

tests/test_derivepassphrase_exporter_cli.py     463)                 vault_native.VaultNativeV03ConfigParser,

tests/test_derivepassphrase_exporter_cli.py     464)                 tests.VAULT_V03_CONFIG,
tests/test_derivepassphrase_exporter_cli.py     465)                 tests.VAULT_V03_CONFIG_DATA,
tests/test_derivepassphrase_exporter_cli.py     466)                 id='0.3',
tests/test_derivepassphrase_exporter_cli.py     467)             ),
tests/test_derivepassphrase_exporter_cli.py     468)         ],
tests/test_derivepassphrase_exporter_cli.py     469)     )
tests/test_derivepassphrase_exporter_cli.py     470)     def test_300_result_caching(
tests/test_derivepassphrase_exporter_cli.py     471)         self,
tests/test_derivepassphrase_exporter_cli.py     472)         monkeypatch: pytest.MonkeyPatch,

tests/test_derivepassphrase_exporter_cli.py     473)         parser_class: type[vault_native.VaultNativeConfigParser],

tests/test_derivepassphrase_exporter_cli.py     474)         config: str,
tests/test_derivepassphrase_exporter_cli.py     475)         result: dict[str, Any],
tests/test_derivepassphrase_exporter_cli.py     476)     ) -> None:
tests/test_derivepassphrase_exporter_cli.py     477)         def null_func(name: str) -> Callable[..., None]:
tests/test_derivepassphrase_exporter_cli.py     478)             def func(*_args: Any, **_kwargs: Any) -> None:  # pragma: no cover
tests/test_derivepassphrase_exporter_cli.py     479)                 msg = f'disallowed and stubbed out function {name} called'
tests/test_derivepassphrase_exporter_cli.py     480)                 raise AssertionError(msg)

tests/test_derivepassphrase_exporter_cli.py     481) 

tests/test_derivepassphrase_exporter_cli.py     482)             return func
tests/test_derivepassphrase_exporter_cli.py     483) 
tests/test_derivepassphrase_exporter_cli.py     484)         runner = click.testing.CliRunner(mix_stderr=False)
tests/test_derivepassphrase_exporter_cli.py     485)         with tests.isolated_vault_exporter_config(
tests/test_derivepassphrase_exporter_cli.py     486)             monkeypatch=monkeypatch,
tests/test_derivepassphrase_exporter_cli.py     487)             runner=runner,
tests/test_derivepassphrase_exporter_cli.py     488)             vault_config=config,
tests/test_derivepassphrase_exporter_cli.py     489)         ):

tests/test_derivepassphrase_exporter_cli.py     490)             parser = parser_class(
tests/test_derivepassphrase_exporter_cli.py     491)                 base64.b64decode(config), tests.VAULT_MASTER_KEY
tests/test_derivepassphrase_exporter_cli.py     492)             )

tests/test_derivepassphrase_exporter_cli.py     493)             assert parser() == result
tests/test_derivepassphrase_exporter_cli.py     494)             # Now stub out all functions used to calculate the above result.

tests/test_derivepassphrase_exporter_cli.py     495)             monkeypatch.setattr(
tests/test_derivepassphrase_exporter_cli.py     496)                 parser, '_parse_contents', null_func('_parse_contents')
tests/test_derivepassphrase_exporter_cli.py     497)             )
tests/test_derivepassphrase_exporter_cli.py     498)             monkeypatch.setattr(
tests/test_derivepassphrase_exporter_cli.py     499)                 parser, '_derive_keys', null_func('_derive_keys')
tests/test_derivepassphrase_exporter_cli.py     500)             )
tests/test_derivepassphrase_exporter_cli.py     501)             monkeypatch.setattr(
tests/test_derivepassphrase_exporter_cli.py     502)                 parser, '_check_signature', null_func('_check_signature')
tests/test_derivepassphrase_exporter_cli.py     503)             )
tests/test_derivepassphrase_exporter_cli.py     504)             monkeypatch.setattr(
tests/test_derivepassphrase_exporter_cli.py     505)                 parser, '_decrypt_payload', null_func('_decrypt_payload')
tests/test_derivepassphrase_exporter_cli.py     506)             )

tests/test_derivepassphrase_exporter_cli.py     507)             assert parser() == result

tests/test_derivepassphrase_exporter_cli.py     508)             super_call = vault_native.VaultNativeConfigParser.__call__

tests/test_derivepassphrase_exporter_cli.py     509)             assert super_call(parser) == result

tests/test_derivepassphrase_exporter_cli.py     510) 
tests/test_derivepassphrase_exporter_cli.py     511)     def test_400_no_password(self) -> None:
tests/test_derivepassphrase_exporter_cli.py     512)         with pytest.raises(ValueError, match='Password must not be empty'):