test for issue1198, err reading deleted secret

dependency/dependency_test.go

@@ -149,6 +149,16 @@ func (v *vaultServer) CreateSecret(path string, data map[string]interface{},
 	return err
 }
 
+// deleteSecret lets us delete keys as needed for tests
+func (v *vaultServer) deleteSecret(path string) error {
+	path = v.secretsPath + "/" + path
+	_, err := testClients.Vault().Logical().Delete(path)
+	if err != nil {
+		fmt.Println(err)
+	}
+	return err
+}
+
 func TestCanShare(t *testing.T) {
 	t.Parallel()
 

dependency/vault_read_test.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/vault/api"
+	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -325,6 +326,34 @@ func TestVaultReadQuery_Fetch_KVv2(t *testing.T) {
 		})
 	}
 
+	t.Run("read_deleted", func(t *testing.T) {
+		// only needed for KVv2 as KVv1 doesn't have metadata
+		path := "data/foo/zed"
+		// create and delete a secret
+		err = vault.CreateSecret(path, map[string]interface{}{
+			"zip": "zop",
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		err = vault.deleteSecret(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		// now look for entry with metadata but no data (deleted secret)
+		path = vault.secretsPath + "/" + path
+		d, err := NewVaultReadQuery(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, _, err = d.Fetch(clients, nil)
+		if err == nil {
+			t.Fatal("Nil received when error expected")
+		}
+		exp_err := fmt.Errorf("no secret exists at %s", path)
+		assert.Equal(t, exp_err, errors.Cause(err))
+	})
+
 	t.Run("stops", func(t *testing.T) {
 		d, err := NewVaultReadQuery(secretsPath + "/foo/bar")
 		if err != nil {