rewrite sops backend for secret generation and add tests

pkgs/clan-cli/tests/test_flake_with_core/flake.nix

@@ -11,6 +11,17 @@
       machines = {
         vm1 = { modulesPath, ... }: {
           imports = [ "${toString modulesPath}/virtualisation/qemu-vm.nix" ];
+          clan.networking.deploymentAddress = "__CLAN_DEPLOYMENT_ADDRESS__";
+          sops.age.keyFile = "__CLAN_SOPS_KEY_PATH__";
+
+          clanCore.secrets.testpassword = {
+            generator = ''
+              echo "secret1" > "$secrets/secret1"
+              echo "fact1" > "$facts/fact1"
+            '';
+            secrets.secret1 = { };
+            facts.fact1 = { };
+          };
         };
       };
     };

pkgs/clan-cli/tests/test_secrets_generate.py

@@ -0,0 +1,38 @@
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+import pytest
+from cli import Cli
+
+from clan_cli.machines.facts import machine_get_fact
+from clan_cli.secrets.folders import sops_secrets_folder
+from clan_cli.secrets.secrets import has_secret
+
+if TYPE_CHECKING:
+    from age_keys import KeyPair
+
+
+@pytest.mark.impure
+def test_upload_secret(
+    monkeypatch: pytest.MonkeyPatch,
+    test_flake_with_core: Path,
+    age_keys: list["KeyPair"],
+) -> None:
+    monkeypatch.chdir(test_flake_with_core)
+    monkeypatch.setenv("SOPS_AGE_KEY", age_keys[0].privkey)
+    cli = Cli()
+    cli.run(["secrets", "users", "add", "user1", age_keys[0].pubkey])
+    cli.run(["secrets", "generate", "vm1"])
+    has_secret("vm1-age.key")
+    has_secret("vm1-secret1")
+    fact1 = machine_get_fact("vm1", "fact1")
+    assert fact1 == "fact1\n"
+    age_key = sops_secrets_folder().joinpath("vm1-age.key").joinpath("secret")
+    secret1 = sops_secrets_folder().joinpath("vm1-secret1").joinpath("secret")
+    age_key_mtime = age_key.lstat().st_mtime_ns
+    secret1_mtime = secret1.lstat().st_mtime_ns
+
+    # test idempotency
+    cli.run(["secrets", "generate", "vm1"])
+    assert age_key.lstat().st_mtime_ns == age_key_mtime
+    assert secret1.lstat().st_mtime_ns == secret1_mtime

pkgs/clan-cli/tests/test_secrets_upload.py

@@ -0,0 +1,40 @@
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+import pytest
+from cli import Cli
+
+from clan_cli.ssh import HostGroup
+
+if TYPE_CHECKING:
+    from age_keys import KeyPair
+
+
+@pytest.mark.impure
+def test_upload_secret(
+    monkeypatch: pytest.MonkeyPatch,
+    test_flake_with_core: Path,
+    host_group: HostGroup,
+    age_keys: list["KeyPair"],
+) -> None:
+    monkeypatch.chdir(test_flake_with_core)
+    monkeypatch.setenv("SOPS_AGE_KEY", age_keys[0].privkey)
+
+    cli = Cli()
+    cli.run(["secrets", "users", "add", "user1", age_keys[0].pubkey])
+
+    cli.run(["secrets", "machines", "add", "vm1", age_keys[1].pubkey])
+    monkeypatch.setenv("SOPS_NIX_SECRET", age_keys[0].privkey)
+    cli.run(["secrets", "set", "vm1-age.key"])
+
+    flake = test_flake_with_core.joinpath("flake.nix")
+    host = host_group.hosts[0]
+    addr = f"{host.user}@{host.host}:{host.port}?StrictHostKeyChecking=no&UserKnownHostsFile=/dev/null&IdentityFile={host.key}"
+    new_text = flake.read_text().replace("__CLAN_DEPLOYMENT_ADDRESS__", addr)
+    sops_key = test_flake_with_core.joinpath("sops.key")
+    new_text = new_text.replace("__CLAN_SOPS_KEY_PATH__", str(sops_key))
+
+    flake.write_text(new_text)
+    cli.run(["secrets", "upload", "vm1"])
+    assert sops_key.exists()
+    assert sops_key.read_text() == age_keys[0].privkey