chef 10.28.2-x86-mingw32

data/spec/unit/data_bag_item_spec.rb

@@ -0,0 +1,280 @@
+#
+# Author:: Adam Jacob (<adam@opscode.com>)
+# Copyright:: Copyright (c) 2008 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+# 
+#     http://www.apache.org/licenses/LICENSE-2.0
+# 
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'spec_helper'
+require 'chef/data_bag_item'
+
+describe Chef::DataBagItem do
+  before(:each) do
+    @data_bag_item = Chef::DataBagItem.new
+  end
+
+  describe "initialize" do
+    it "should be a Chef::DataBagItem" do
+      @data_bag_item.should be_a_kind_of(Chef::DataBagItem)
+    end
+  end
+
+  describe "data_bag" do
+    it "should let you set the data_bag to a string" do
+      @data_bag_item.data_bag("clowns").should == "clowns"
+    end
+
+    it "should return the current data_bag type" do
+      @data_bag_item.data_bag "clowns"
+      @data_bag_item.data_bag.should == "clowns"
+    end
+
+    it "should not accept spaces" do
+      lambda { @data_bag_item.data_bag "clown masters" }.should raise_error(ArgumentError)
+    end
+
+    it "should throw an ArgumentError if you feed it anything but a string" do
+      lambda { @data_bag_item.data_bag Hash.new }.should raise_error(ArgumentError)
+    end
+  end
+
+  describe "raw_data" do
+    it "should let you set the raw_data with a hash" do
+      lambda { @data_bag_item.raw_data = { "id" => "octahedron" } }.should_not raise_error
+    end
+
+    it "should let you set the raw_data from a mash" do
+      lambda { @data_bag_item.raw_data = Mash.new({ "id" => "octahedron" }) }.should_not raise_error
+    end
+
+    it "should raise an exception if you set the raw data without a key" do
+      lambda { @data_bag_item.raw_data = { "monkey" => "pants" } }.should raise_error(ArgumentError)
+    end
+
+    it "should raise an exception if you set the raw data to something other than a hash" do
+      lambda { @data_bag_item.raw_data = "katie rules" }.should raise_error(ArgumentError)
+    end
+
+    it "should accept alphanum/-/_ for the id" do
+      lambda { @data_bag_item.raw_data = { "id" => "h1-_" } }.should_not raise_error(ArgumentError)
+    end
+
+    it "should raise an exception if the id contains anything but alphanum/-/_" do
+      lambda { @data_bag_item.raw_data = { "id" => "!@#" } }.should raise_error(ArgumentError)
+    end
+
+    it "should return the raw data" do
+      @data_bag_item.raw_data = { "id" => "highway_of_emptiness" }
+      @data_bag_item.raw_data.should == { "id" => "highway_of_emptiness" }
+    end
+
+    it "should be a Mash by default" do
+      @data_bag_item.raw_data.should be_a_kind_of(Mash)
+    end
+  end
+
+  describe "object_name" do
+    before(:each) do
+      @data_bag_item.data_bag("dreams")
+      @data_bag_item.raw_data = { "id" => "the_beatdown" }
+    end
+
+    it "should return an object name based on the bag name and the raw_data id" do
+      @data_bag_item.object_name.should == "data_bag_item_dreams_the_beatdown"
+    end
+  end
+
+  describe "class method object_name" do
+    it "should return an object name based based on the bag name and an id" do
+      Chef::DataBagItem.object_name("zen", "master").should == "data_bag_item_zen_master"
+    end
+  end
+
+  describe "when used like a Hash" do
+    before(:each) do
+      @data_bag_item.raw_data = { "id" => "journey", "trials" => "been through" }
+    end
+
+    it "responds to keys" do
+      @data_bag_item.keys.should include("id")
+      @data_bag_item.keys.should include("trials")
+    end
+
+    it "supports element reference with []" do
+      @data_bag_item["id"].should == "journey"
+    end
+
+    it "implements all the methods of Hash" do
+      methods = [:rehash, :to_hash, :[], :fetch, :[]=, :store, :default,
+      :default=, :default_proc, :index, :size, :length,
+      :empty?, :each_value, :each_key, :each_pair, :each, :keys, :values,
+      :values_at, :delete, :delete_if, :reject!, :clear,
+      :invert, :update, :replace, :merge!, :merge, :has_key?, :has_value?,
+      :key?, :value?]
+      methods.each do |m|
+        @data_bag_item.should respond_to(m)
+      end
+    end
+
+  end
+
+  describe "to_hash" do
+    before(:each) do 
+      @data_bag_item.data_bag("still_lost")
+      @data_bag_item.raw_data = { "id" => "whoa", "i_know" => "kung_fu" }
+      @to_hash = @data_bag_item.to_hash
+    end
+
+    it "should return a hash" do
+      @to_hash.should be_a_kind_of(Hash)
+    end
+
+    it "should have the raw_data keys as top level keys" do
+      @to_hash["id"].should == "whoa"
+      @to_hash["i_know"].should == "kung_fu"
+    end
+
+    it "should have the chef_type of data_bag_item" do
+      @to_hash["chef_type"].should == "data_bag_item"
+    end
+
+    it "should have the data_bag set" do
+      @to_hash["data_bag"].should == "still_lost"
+    end
+  end
+
+  describe "when deserializing from JSON" do
+    before(:each) do
+      @data_bag_item.data_bag('mars_volta')
+      @data_bag_item.raw_data = { "id" => "octahedron", "snooze" => { "finally" => :world_will }}
+      @deserial = Chef::JSONCompat.from_json(@data_bag_item.to_json)
+    end
+
+    it "should deserialize to a Chef::DataBagItem object" do
+      @deserial.should be_a_kind_of(Chef::DataBagItem)
+    end
+
+    it "should have a matching 'data_bag' value" do
+      @deserial.data_bag.should == @data_bag_item.data_bag
+    end
+
+    it "should have a matching 'id' key" do
+      @deserial["id"].should == "octahedron"
+    end
+
+    it "should have a matching 'snooze' key" do
+      @deserial["snooze"].should == { "finally" => "world_will" }
+    end
+  end
+
+  describe "when converting to a string" do
+    it "converts to a string in the form data_bag_item[ID]" do
+      @data_bag_item['id'] = "heart of darkness"
+      @data_bag_item.to_s.should == 'data_bag_item[heart of darkness]'
+    end
+
+    it "inspects as data_bag_item[BAG, ID, RAW_DATA]" do
+      raw_data = {"id" => "heart_of_darkness", "author" => "Conrad"}
+      @data_bag_item.raw_data = raw_data
+      @data_bag_item.data_bag("books")
+
+      @data_bag_item.inspect.should == "data_bag_item[\"books\", \"heart_of_darkness\", #{raw_data.inspect}]"
+    end
+  end
+
+  describe "save" do
+    before do
+      @rest = mock("Chef::REST")
+      Chef::REST.stub!(:new).and_return(@rest)
+      @data_bag_item['id'] = "heart of darkness" 
+      raw_data = {"id" => "heart_of_darkness", "author" => "Conrad"}
+      @data_bag_item.raw_data = raw_data
+      @data_bag_item.data_bag("books")
+    end
+    it "should update the item when it already exists" do
+      @rest.should_receive(:put_rest).with("data/books/heart_of_darkness", @data_bag_item)
+      @data_bag_item.save
+    end
+
+    it "should create if the item is not found" do 
+      exception = mock("404 error", :code => "404")
+      @rest.should_receive(:put_rest).and_raise(Net::HTTPServerException.new("foo", exception))
+      @rest.should_receive(:post_rest).with("data/books", @data_bag_item)
+      @data_bag_item.save
+    end
+    describe "when whyrun mode is enabled" do
+      before do
+        Chef::Config[:why_run] = true
+      end
+      after do
+        Chef::Config[:why_run] = false
+      end
+      it "should not save" do
+        @rest.should_not_receive(:put_rest)
+        @rest.should_not_receive(:post_rest)
+        @data_bag_item.data_bag("books")
+        @data_bag_item.save
+      end
+    end
+
+    
+  end
+
+  describe "when loading" do
+    before do
+      @data_bag_item.raw_data = {"id" => "charlie", "shell" => "zsh", "ssh_keys" => %w{key1 key2}}
+      @data_bag_item.data_bag("users")
+    end
+
+    describe "from an API call" do
+      before do
+        @http_client = mock("Chef::REST")
+        Chef::REST.stub!(:new).and_return(@http_client)
+      end
+
+      it "converts raw data to a data bag item" do
+        @http_client.should_receive(:get_rest).with("data/users/charlie").and_return(@data_bag_item.to_hash)
+        item = Chef::DataBagItem.load(:users, "charlie")
+        item.should be_a_kind_of(Chef::DataBagItem)
+        item.should == @data_bag_item
+      end
+
+      it "does not convert when a DataBagItem is returned from the API call" do
+        @http_client.should_receive(:get_rest).with("data/users/charlie").and_return(@data_bag_item)
+        item = Chef::DataBagItem.load(:users, "charlie")
+        item.should be_a_kind_of(Chef::DataBagItem)
+        item.should equal(@data_bag_item)
+      end
+    end
+
+    describe "in solo mode" do
+      before do
+        Chef::Config[:solo] = true
+      end
+
+      after do
+        Chef::Config[:solo] = false
+      end
+
+      it "converts the raw data to a data bag item" do
+        Chef::DataBag.should_receive(:load).with('users').and_return({'charlie' => @data_bag_item.to_hash})
+        item = Chef::DataBagItem.load('users', 'charlie')
+        item.should be_a_kind_of(Chef::DataBagItem)
+        item.should == @data_bag_item
+      end
+    end
+
+  end
+
+end

data/spec/unit/data_bag_spec.rb

@@ -0,0 +1,169 @@
+#
+# Author:: Adam Jacob (<adam@opscode.com>)
+# Copyright:: Copyright (c) 2008 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'spec_helper'
+require 'chef/data_bag'
+
+describe Chef::DataBag do
+  before(:each) do
+    @data_bag = Chef::DataBag.new
+  end
+
+  describe "initialize" do
+    it "should be a Chef::DataBag" do
+      @data_bag.should be_a_kind_of(Chef::DataBag)
+    end
+  end
+
+  describe "name" do
+    it "should let you set the name to a string" do
+      @data_bag.name("clowns").should == "clowns"
+    end
+
+    it "should return the current name" do
+      @data_bag.name "clowns"
+      @data_bag.name.should == "clowns"
+    end
+
+    it "should not accept spaces" do
+      lambda { @data_bag.name "clown masters" }.should raise_error(ArgumentError)
+    end
+
+    it "should throw an ArgumentError if you feed it anything but a string" do
+      lambda { @data_bag.name Hash.new }.should raise_error(ArgumentError)
+    end
+  end
+
+  describe "deserialize" do
+    before(:each) do
+      @data_bag.name('mars_volta')
+      @deserial = Chef::JSONCompat.from_json(@data_bag.to_json)
+    end
+
+    it "should deserialize to a Chef::DataBag object" do
+      @deserial.should be_a_kind_of(Chef::DataBag)
+    end
+
+    %w{
+      name
+    }.each do |t|
+      it "should match '#{t}'" do
+        @deserial.send(t.to_sym).should == @data_bag.send(t.to_sym)
+      end
+    end
+
+  end
+
+  describe "when saving" do 
+    before do
+      @data_bag.name('piggly_wiggly')
+      @rest = mock("Chef::REST")
+      Chef::REST.stub!(:new).and_return(@rest)
+    end
+
+    it "should update the data bag when it already exists" do
+      @rest.should_receive(:put_rest).with("data/piggly_wiggly", @data_bag) 
+      @data_bag.save
+    end
+
+    it "should create the data bag when it is not found" do 
+      exception = mock("404 error", :code => "404")
+      @rest.should_receive(:put_rest).and_raise(Net::HTTPServerException.new("foo", exception))
+      @rest.should_receive(:post_rest).with("data", @data_bag)
+      @data_bag.save
+    end 
+
+    describe "when whyrun mode is enabled" do
+      before do
+        Chef::Config[:why_run] = true
+      end
+      after do
+        Chef::Config[:why_run] = false
+      end
+      it "should not save" do
+        @rest.should_not_receive(:put_rest)
+        @rest.should_not_receive(:post_rest)
+        @data_bag.save
+      end
+    end
+
+  end
+  describe "when loading" do
+    describe "from an API call" do
+      before do
+        Chef::Config[:chef_server_url] = 'https://myserver.example.com'
+        @http_client = mock('Chef::REST')
+      end
+
+      it "should get the data bag from the server" do
+        Chef::REST.should_receive(:new).with('https://myserver.example.com').and_return(@http_client)
+        @http_client.should_receive(:get_rest).with('data/foo')
+        Chef::DataBag.load('foo')
+      end
+
+      it "should return the data bag" do
+        Chef::REST.stub!(:new).and_return(@http_client)
+        @http_client.should_receive(:get_rest).with('data/foo').and_return({'bar' => 'https://myserver.example.com/data/foo/bar'})
+        data_bag = Chef::DataBag.load('foo')
+        data_bag.should == {'bar' => 'https://myserver.example.com/data/foo/bar'}
+      end
+    end
+
+    describe "in solo mode" do
+      before do
+        Chef::Config[:solo] = true
+        Chef::Config[:data_bag_path] = '/var/chef/data_bags'
+      end
+
+      after do
+        Chef::Config[:solo] = false
+      end
+
+      it "should get the data bag from the data_bag_path" do
+        File.should_receive(:directory?).with('/var/chef/data_bags').and_return(true)
+        Dir.should_receive(:glob).with('/var/chef/data_bags/foo/*.json').and_return([])
+        Chef::DataBag.load('foo')
+      end
+
+      it "should get the data bag from the data_bag_path by symbolic name" do
+        File.should_receive(:directory?).with('/var/chef/data_bags').and_return(true)
+        Dir.should_receive(:glob).with('/var/chef/data_bags/foo/*.json').and_return([])
+        Chef::DataBag.load(:foo)
+      end
+
+      it "should return the data bag" do
+        File.should_receive(:directory?).with('/var/chef/data_bags').and_return(true)
+        Dir.stub!(:glob).and_return(["/var/chef/data_bags/foo/bar.json", "/var/chef/data_bags/foo/baz.json"])
+        IO.should_receive(:read).with('/var/chef/data_bags/foo/bar.json').and_return('{"id": "bar", "name": "Bob Bar" }')
+        IO.should_receive(:read).with('/var/chef/data_bags/foo/baz.json').and_return('{"id": "baz", "name": "John Baz" }')
+        data_bag = Chef::DataBag.load('foo')
+        data_bag.should == { 'bar' => { 'id' => 'bar', 'name' => 'Bob Bar' }, 'baz' => { 'id' => 'baz', 'name' => 'John Baz' }}
+      end
+
+      it 'should raise an error if the configured data_bag_path is invalid' do
+        File.should_receive(:directory?).with('/var/chef/data_bags').and_return(false)
+
+        lambda {
+          Chef::DataBag.load('foo')
+        }.should raise_error Chef::Exceptions::InvalidDataBagPath, "Data bag path '/var/chef/data_bags' is invalid"
+      end
+
+    end
+  end
+
+end

data/spec/unit/encrypted_data_bag_item_spec.rb

@@ -0,0 +1,293 @@
+#
+# Author:: Seth Falcon (<seth@opscode.com>)
+# Copyright:: Copyright 2010-2011 Opscode, Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'spec_helper'
+require 'chef/encrypted_data_bag_item'
+
+module Version0Encryptor
+  def self.encrypt_value(plaintext_data, key)
+    data = plaintext_data.to_yaml
+
+    cipher = OpenSSL::Cipher::Cipher.new("aes-256-cbc")
+    cipher.encrypt
+    cipher.pkcs5_keyivgen(key)
+    encrypted_bytes = cipher.update(data)
+    encrypted_bytes << cipher.final
+    Base64.encode64(encrypted_bytes)
+  end
+end
+
+# Encryption/serialization code from Chef 11.
+class Version1Encryptor
+  ALGORITHM = "aes-256-cbc"
+
+  attr_reader :key
+  attr_reader :plaintext_data
+
+  # Create a new Encryptor for +data+, which will be encrypted with the given
+  # +key+.
+  #
+  # === Arguments:
+  # * data: An object of any type that can be serialized to json
+  # * key: A String representing the desired passphrase
+  # * iv: The optional +iv+ parameter is intended for testing use only. When
+  # *not* supplied, Encryptor will use OpenSSL to generate a secure random
+  # IV, which is what you want.
+  def initialize(plaintext_data, key, iv=nil)
+    @plaintext_data = plaintext_data
+    @key = key
+    @iv = iv && Base64.decode64(iv)
+  end
+
+  # Returns a wrapped and encrypted version of +plaintext_data+ suitable for
+  # using as the value in an encrypted data bag item.
+  def for_encrypted_item
+    {
+      "encrypted_data" => encrypted_data,
+      "iv" => Base64.encode64(iv),
+      "version" => 1,
+      "cipher" => ALGORITHM
+    }
+  end
+
+  # Generates or returns the IV.
+  def iv
+    # Generated IV comes from OpenSSL::Cipher::Cipher#random_iv
+    # This gets generated when +openssl_encryptor+ gets created.
+    openssl_encryptor if @iv.nil?
+    @iv
+  end
+
+  # Generates (and memoizes) an OpenSSL::Cipher::Cipher object and configures
+  # it for the specified iv and encryption key.
+  def openssl_encryptor
+    @openssl_encryptor ||= begin
+      encryptor = OpenSSL::Cipher::Cipher.new(ALGORITHM)
+      encryptor.encrypt
+      @iv ||= encryptor.random_iv
+      encryptor.iv = @iv
+      encryptor.key = Digest::SHA256.digest(key)
+      encryptor
+    end
+  end
+
+  # Encrypts and Base64 encodes +serialized_data+
+  def encrypted_data
+    @encrypted_data ||= begin
+      enc_data = openssl_encryptor.update(serialized_data)
+      enc_data << openssl_encryptor.final
+      Base64.encode64(enc_data)
+    end
+  end
+
+  # Wraps the data in a single key Hash (JSON Object) and converts to JSON.
+  # The wrapper is required because we accept values (such as Integers or
+  # Strings) that do not produce valid JSON when serialized without the
+  # wrapper.
+  def serialized_data
+    Chef::JSONCompat.to_json(:json_wrapper => plaintext_data)
+  end
+end
+
+
+describe Chef::EncryptedDataBagItem::Decryptor do
+  context "when decrypting a version 1 (JSON+aes-256-cbc+random iv) encrypted value" do
+    before do
+      @encryptor = Version1Encryptor.new({"foo" => "bar"}, "passwd")
+      @encrypted_value = @encryptor.for_encrypted_item
+
+      @decryptor = Chef::EncryptedDataBagItem::Decryptor.for(@encrypted_value, "passwd")
+    end
+
+    it "selects the correct strategy for version 1" do
+      @decryptor.should be_a_kind_of Chef::EncryptedDataBagItem::Decryptor::Version1Decryptor
+    end
+
+    it "decrypts the encrypted value" do
+      @decryptor.decrypted_data.should == {"json_wrapper" => {"foo" => "bar"}}.to_json
+    end
+
+    it "unwraps the encrypted data and returns it" do
+      @decryptor.for_decrypted_item.should == {"foo" => "bar"}
+    end
+
+    context "and the provided key is incorrect" do
+      before do
+        @decryptor = Chef::EncryptedDataBagItem::Decryptor.for(@encrypted_value, "wrong-passwd")
+      end
+
+      it "raises a sensible error" do
+        lambda { @decryptor.for_decrypted_item }.should raise_error(Chef::EncryptedDataBagItem::DecryptionFailure)
+      end
+    end
+
+    context "and the cipher is not supported" do
+      before do
+        @encrypted_value["cipher"] = "aes-256-foo"
+      end
+
+      it "raises a sensible error" do
+        lambda { @decryptor.for_decrypted_item }.should raise_error(Chef::EncryptedDataBagItem::UnsupportedCipher)
+      end
+    end
+
+  end
+
+  context "when decrypting a version 0 (YAML+aes-256-cbc+no iv) encrypted value" do
+    before do
+      @encrypted_value = Version0Encryptor.encrypt_value({"foo" => "bar"}, "passwd")
+
+      @decryptor = Chef::EncryptedDataBagItem::Decryptor.for(@encrypted_value, "passwd")
+    end
+
+    it "selects the correct strategy for version 0" do
+      @decryptor.should be_a_kind_of(Chef::EncryptedDataBagItem::Decryptor::Version0Decryptor)
+    end
+
+    it "decrypts the encrypted value" do
+      @decryptor.for_decrypted_item.should == {"foo" => "bar"}
+    end
+  end
+end
+
+describe Chef::EncryptedDataBagItem do
+  before(:each) do
+    @secret = "abc123SECRET"
+    @plain_data = {
+      "id" => "item_name",
+      "greeting" => "hello",
+      "nested" => { "a1" => [1, 2, 3], "a2" => { "b1" => true }}
+    }
+    @enc_data = Chef::EncryptedDataBagItem.encrypt_data_bag_item(@plain_data,
+                                                                 @secret)
+  end
+
+  describe "encrypting" do
+
+    it "uses version 0 encryption/serialization" do
+      @enc_data["greeting"].should == Version0Encryptor.encrypt_value(@plain_data["greeting"], @secret)
+    end
+
+    it "should not encrypt the 'id' key" do
+      @enc_data["id"].should == "item_name"
+    end
+
+    it "should encrypt 'greeting'" do
+      @enc_data["greeting"].should_not == @plain_data["greeting"]
+    end
+
+    it "should encrypt 'nested'" do
+      nested = @enc_data["nested"]
+      nested.class.should == String
+      nested.should_not == @plain_data["nested"]
+    end
+
+    it "from_plain_hash" do
+      eh1 = Chef::EncryptedDataBagItem.from_plain_hash(@plain_data, @secret)
+      eh1.class.should == Chef::EncryptedDataBagItem
+    end
+  end
+
+  shared_examples_for "a decrypted data bag item" do
+
+    it "doesn't try to decrypt 'id'" do
+      @eh["id"].should == @plain_data["id"]
+    end
+
+    it "decrypts 'greeting'" do
+      @eh["greeting"].should == @plain_data["greeting"]
+    end
+
+    it "decrypts 'nested'" do
+      @eh["nested"].should == @plain_data["nested"]
+    end
+
+    it "decrypts everyting via to_hash" do
+      @eh.to_hash.should == @plain_data
+    end
+
+    it "handles missing keys gracefully" do
+      @eh["no-such-key"].should be_nil
+    end
+  end
+
+  describe "decrypting" do
+    before(:each) do
+      @enc_data = Chef::EncryptedDataBagItem.encrypt_data_bag_item(@plain_data,
+                                                                   @secret)
+      @eh = Chef::EncryptedDataBagItem.new(@enc_data, @secret)
+    end
+
+    it_behaves_like "a decrypted data bag item"
+  end
+
+  describe "when decrypting a version 1 (Chef 11.x) data bag item" do
+    before do
+      @enc_data = @plain_data.inject({}) do |encrypted, (key, value)|
+        if key == "id"
+          encrypted["id"] = value
+        else
+          encrypted[key] = Version1Encryptor.new(value, @secret).for_encrypted_item
+        end
+        encrypted
+      end
+      @eh = Chef::EncryptedDataBagItem.new(@enc_data, @secret)
+    end
+
+    it_behaves_like "a decrypted data bag item"
+  end
+
+  describe "loading" do
+    it "should defer to Chef::DataBagItem.load" do
+      Chef::DataBagItem.stub(:load).with(:the_bag, "my_codes").and_return(@enc_data)
+      edbi = Chef::EncryptedDataBagItem.load(:the_bag, "my_codes", @secret)
+      edbi["greeting"].should == @plain_data["greeting"]
+    end
+  end
+
+  describe "load_secret" do
+    it "should read from the default path" do
+      default_path = "/etc/chef/encrypted_data_bag_secret"
+      ::File.stub(:exists?).with(default_path).and_return(true)
+      IO.stub(:read).with(default_path).and_return("opensesame")
+      Chef::EncryptedDataBagItem.load_secret().should == "opensesame"
+    end
+
+    it "should read from Chef::Config[:encrypted_data_bag_secret]" do
+      path = "/var/mysecret"
+      Chef::Config[:encrypted_data_bag_secret] = path
+      ::File.stub(:exists?).with(path).and_return(true)
+      IO.stub(:read).with(path).and_return("opensesame")
+      Chef::EncryptedDataBagItem.load_secret().should == "opensesame"
+    end
+
+    it "should read from a specified path" do
+      path = "/var/mysecret"
+      ::File.stub(:exists?).with(path).and_return(true)
+      IO.stub(:read).with(path).and_return("opensesame")
+      Chef::EncryptedDataBagItem.load_secret(path).should == "opensesame"
+    end
+
+    it "should read from a URL" do
+      path = "http://www.opscode.com/"
+      fake_file = StringIO.new("opensesame")
+      Kernel.stub(:open).with(path).and_return(fake_file)
+      Chef::EncryptedDataBagItem.load_secret(path).should == "opensesame"
+    end
+  end
+end