trocla 0.2.0 → 0.4.0

data/lib/trocla/util.rb

@@ -24,6 +24,7 @@ class Trocla
             'numeric'      => numeric,
             'hexadecimal'  => hexadecimal,
             'consolesafe'  => consolesafe,
+            'typesafe'     => typesafe,
           }
           h.each { |k, v| h[k] = v.uniq }
         end
@@ -50,6 +51,9 @@ class Trocla
       def numeric
         @numeric ||= ('0'..'9').to_a
       end
+      def typesafe
+        @typesafe ||= ('a'..'x').to_a - ['i'] - ['l'] + ('A'..'X').to_a - ['I'] - ['L'] + ('1'..'9').to_a
+      end
       def special_chars
         @special_chars ||= "*()&![]{}-".split(//)
       end

data/spec/spec_helper.rb

@@ -1,5 +1,6 @@
 $LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
 $LOAD_PATH.unshift(File.dirname(__FILE__))
+require 'jruby' if Object.const_defined?(:RUBY_ENGINE) and RUBY_ENGINE == 'jruby'
 require 'rspec'
 require 'rspec/pending_for'
 require 'yaml'
@@ -35,6 +36,11 @@ RSpec.shared_examples "encryption_basics" do
       expect(@trocla.get_password('some_pass', 'plain')).to eql('super secret')
     end
 
+    it "resets passwords" do
+      @trocla.set_password('some_pass', 'plain', 'super secret')
+      expect(@trocla.reset_password('some_pass', 'plain')).not_to eql('super secret')
+    end
+
   end
   describe 'deleting' do
     it "plain" do
@@ -225,7 +231,13 @@ RSpec.shared_examples 'store_validation' do |store|
 end
 
 def default_config
-  @default_config ||= YAML.load(File.read(File.expand_path(base_dir+'/lib/trocla/default_config.yaml')))
+  @default_config ||=  begin
+    config_path = [
+      File.expand_path(base_dir+'/lib/trocla/default_config.yaml'),
+      File.expand_path(File.dirname($LOADED_FEATURES.grep(/trocla.rb/)[0])+'/trocla/default_config.yaml'),
+    ].find { |p| File.exists?(p) }
+    YAML.load(File.read(config_path))
+  end
 end
 
 def test_config
@@ -282,3 +294,9 @@ end
 def remove_yaml_store
   File.unlink(trocla_yaml_file)
 end
+class Trocla::Formats::Sleep < Trocla::Formats::Base
+  def format(plain_password,options={})
+    sleep options['sleep'] ||= 0
+    (options['sleep'] + 1 ).times.collect{ plain_password }.join(' ')
+  end
+end

data/spec/trocla/formats/sshkey_spec.rb

@@ -0,0 +1,52 @@
+require File.expand_path(File.dirname(__FILE__) + '/../../spec_helper')
+
+describe "Trocla::Format::Sshkey" do
+
+  before(:each) do
+    expect_any_instance_of(Trocla).to receive(:read_config).and_return(test_config)
+    @trocla = Trocla.new
+  end
+
+  let(:sshkey_options) do
+    {
+      'type'    => 'rsa',
+      'bits'    => 4096,
+      'comment' => 'My ssh key'
+    }
+  end
+
+  describe "sshkey" do
+    it "is able to create an ssh keypair without options" do
+      sshkey = @trocla.password('my_ssh_keypair', 'sshkey', {})
+      expect(sshkey).to start_with('-----BEGIN RSA PRIVATE KEY-----')
+      expect(sshkey).to match(/ssh-/)
+    end
+
+    it "is able to create an ssh keypair with options" do
+      sshkey = @trocla.password('my_ssh_keypair', 'sshkey', sshkey_options)
+      expect(sshkey).to start_with('-----BEGIN RSA PRIVATE KEY-----')
+      expect(sshkey).to match(/ssh-/)
+      expect(sshkey).to end_with('My ssh key')
+    end
+
+    it 'supports fetching only the priv key' do
+      sshkey = @trocla.password('my_ssh_keypair', 'sshkey', { 'render' => {'privonly' => true }})
+      expect(sshkey).to start_with('-----BEGIN RSA PRIVATE KEY-----')
+      expect(sshkey).not_to match(/ssh-/)
+    end
+
+    it 'supports fetching only the pub key' do
+      sshkey = @trocla.password('my_ssh_keypair', 'sshkey', { 'render' => {'pubonly' => true }})
+      expect(sshkey).to start_with('ssh-rsa')
+      expect(sshkey).not_to match(/-----BEGIN RSA PRIVATE KEY-----/)
+    end
+
+    it "is able to create an ssh keypair with a passphrase" do
+      sshkey = @trocla.password('my_ssh_keypair', 'sshkey', { 'passphrase' => 'spec' })
+      expect(sshkey).to start_with('-----BEGIN RSA PRIVATE KEY-----')
+      expect(sshkey).to match(/ssh-/)
+    end
+
+  end
+
+end

data/spec/trocla/formats/x509_spec.rb

@@ -42,9 +42,11 @@ describe "Trocla::Format::X509" do
       # default size
       # https://stackoverflow.com/questions/13747212/determine-key-size-from-public-key-pem-format
       expect(cert.public_key.n.num_bytes * 8).to eq(4096)
-      expect((Date.parse(cert.not_after.to_s) - Date.today).to_i).to eq(365)
+      expect((Date.parse(cert.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
       # it's a self signed cert and NOT a CA
-      expect(verify(cert,cert)).to be false
+      # Change of behavior on openssl side: https://github.com/openssl/openssl/issues/15146
+      validates_self_even_if_no_ca = Gem::Version.new(%x{openssl version}.split(' ')[1]) > Gem::Version.new('1.1.1g')
+      expect(verify(cert,cert)).to be validates_self_even_if_no_ca
 
       v = cert.extensions.find{|e| e.oid == 'basicConstraints' }.value
       expect(v).to eq('CA:FALSE')
@@ -60,7 +62,7 @@ describe "Trocla::Format::X509" do
       ca = OpenSSL::X509::Certificate.new(ca_str)
       # selfsigned?
       expect(ca.issuer.to_s).to eq(ca.subject.to_s)
-      expect((Date.parse(ca.not_after.to_s) - Date.today).to_i).to eq(365)
+      expect((Date.parse(ca.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
       expect(verify(ca,ca)).to be true
 
       v = ca.extensions.find{|e| e.oid == 'basicConstraints' }.value
@@ -69,6 +71,47 @@ describe "Trocla::Format::X509" do
       expect(ku).to match(/Certificate Sign/)
       expect(ku).to match(/CRL Sign/)
     end
+    it "is able to create a self signed cert without any keyUsage restrictions" do
+      cert_str = @trocla.password('my_shiny_selfsigned_without restrictions', 'x509', {
+        'CN'         => 'This is my self-signed certificate',
+        'key_usages' => [],
+      })
+      cert = OpenSSL::X509::Certificate.new(cert_str)
+      # selfsigned?
+      expect(cert.issuer.to_s).to eq(cert.subject.to_s)
+      # default size
+      # https://stackoverflow.com/questions/13747212/determine-key-size-from-public-key-pem-format
+      expect(cert.public_key.n.num_bytes * 8).to eq(4096)
+      expect((Date.parse(cert.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
+      # it's a self signed cert and NOT a CA, but has no keyUsage limitation
+      expect(verify(cert,cert)).to be true
+
+      v = cert.extensions.find{|e| e.oid == 'basicConstraints' }.value
+      expect(v).to_not eq('CA:TRUE')
+      expect(cert.extensions.find{|e| e.oid == 'keyUsage' }).to be_nil
+    end
+
+    it "is able to create a self signed cert with custom keyUsage restrictions" do
+      cert_str = @trocla.password('my_shiny_selfsigned_without restrictions', 'x509', {
+        'CN'         => 'This is my self-signed certificate',
+        'key_usages' => [ 'cRLSign', ],
+      })
+      cert = OpenSSL::X509::Certificate.new(cert_str)
+      # selfsigned?
+      expect(cert.issuer.to_s).to eq(cert.subject.to_s)
+      # default size
+      # https://stackoverflow.com/questions/13747212/determine-key-size-from-public-key-pem-format
+      expect(cert.public_key.n.num_bytes * 8).to eq(4096)
+      expect((Date.parse(cert.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
+      # it's a self signed cert and NOT a CA, as it's key is restricted to only CRL Sign
+      expect(verify(cert,cert)).to be false
+
+      v = cert.extensions.find{|e| e.oid == 'basicConstraints' }.value
+      expect(v).to_not eq('CA:TRUE')
+      ku = cert.extensions.find{|e| e.oid == 'keyUsage' }.value
+      expect(ku).to match(/CRL Sign/)
+      expect(ku).not_to match(/Certificate Sign/)
+    end
 
   end
   describe "x509 signed by a ca" do
@@ -80,7 +123,7 @@ describe "Trocla::Format::X509" do
       cert_str = @trocla.password('mycert', 'x509', cert_options)
       cert = OpenSSL::X509::Certificate.new(cert_str)
       expect(cert.issuer.to_s).to eq(@ca.subject.to_s)
-      expect((Date.parse(cert.not_after.to_s) - Date.today).to_i).to eq(365)
+      expect((Date.parse(cert.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
       expect(verify(@ca,cert)).to be true
 
       v = cert.extensions.find{|e| e.oid == 'basicConstraints' }.value
@@ -90,6 +133,30 @@ describe "Trocla::Format::X509" do
       expect(ku).not_to match(/CRL Sign/)
     end
 
+    it 'supports fetching only the key' do
+      cert_str = @trocla.password('mycert', 'x509', cert_options.merge('render' => {'keyonly' => true }))
+      expect(cert_str).not_to match(/-----BEGIN CERTIFICATE-----/)
+      expect(cert_str).to match(/-----BEGIN RSA PRIVATE KEY-----/)
+    end
+    it 'supports fetching only the publickey' do
+      pkey_str = @trocla.password('mycert', 'x509', cert_options.merge('render' => {'publickeyonly' => true }))
+      expect(pkey_str).not_to match(/-----BEGIN CERTIFICATE-----/)
+      expect(pkey_str).to match(/-----BEGIN PUBLIC KEY-----/)
+    end
+    it 'supports fetching only the cert' do
+      cert_str = @trocla.password('mycert', 'x509', cert_options.merge('render' => {'certonly' => true }))
+      expect(cert_str).to match(/-----BEGIN CERTIFICATE-----/)
+      expect(cert_str).not_to match(/-----BEGIN RSA PRIVATE KEY-----/)
+    end
+    it 'supports fetching only the cert even a second time' do
+      cert_str = @trocla.password('mycert', 'x509', cert_options.merge('render' => {'certonly' => true }))
+      expect(cert_str).to match(/-----BEGIN CERTIFICATE-----/)
+      expect(cert_str).not_to match(/-----BEGIN RSA PRIVATE KEY-----/)
+      cert_str = @trocla.password('mycert', 'x509', cert_options.merge('render' => {'certonly' => true }))
+      expect(cert_str).to match(/-----BEGIN CERTIFICATE-----/)
+      expect(cert_str).not_to match(/-----BEGIN RSA PRIVATE KEY-----/)
+    end
+
     it 'does not simply increment the serial' do
       cert_str = @trocla.password('mycert', 'x509', cert_options)
       cert1 = OpenSSL::X509::Certificate.new(cert_str)
@@ -107,7 +174,7 @@ describe "Trocla::Format::X509" do
       }))
       cert = OpenSSL::X509::Certificate.new(cert_str)
       expect(cert.issuer.to_s).to eq(@ca.subject.to_s)
-      expect((Date.parse(cert.not_after.to_s) - Date.today).to_i).to eq(365)
+      expect((Date.parse(cert.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
       expect(verify(@ca,cert)).to be true
 
       expect(cert.extensions.find{|e| e.oid == 'basicConstraints' }.value).to eq('CA:TRUE')
@@ -123,7 +190,7 @@ describe "Trocla::Format::X509" do
       }))
       ca2 = OpenSSL::X509::Certificate.new(ca2_str)
       expect(ca2.issuer.to_s).to eq(@ca.subject.to_s)
-      expect((Date.parse(ca2.not_after.to_s) - Date.today).to_i).to eq(365)
+      expect((Date.parse(ca2.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
       pending_for(:engine => 'jruby',:reason => 'NameConstraints verification seem to be broken in jRuby: https://github.com/jruby/jruby/issues/3502') do
         expect(verify(@ca,ca2)).to be true
       end
@@ -143,7 +210,7 @@ describe "Trocla::Format::X509" do
       valid_cert = OpenSSL::X509::Certificate.new(valid_cert_str)
       expect(valid_cert.issuer.to_s).to eq(ca2.subject.to_s)
       expect(verify([@ca,ca2],valid_cert)).to be true
-      expect((Date.parse(valid_cert.not_after.to_s) - Date.today).to_i).to eq(365)
+      expect((Date.parse(valid_cert.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
 
       false_cert_str = @trocla.password('myfalseexamplecert','x509', {
         'subject'  => '/C=ZZ/O=Trocla Inc./CN=foo.example.net/emailAddress=example@example.com',
@@ -153,7 +220,7 @@ describe "Trocla::Format::X509" do
       false_cert = OpenSSL::X509::Certificate.new(false_cert_str)
       expect(false_cert.issuer.to_s).to eq(ca2.subject.to_s)
       expect(verify([@ca,ca2],false_cert)).to be false
-      expect((Date.parse(false_cert.not_after.to_s) - Date.today).to_i).to eq(365)
+      expect((Date.parse(false_cert.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
     end
 
     it 'supports simple name constraints for CAs with leading dots' do
@@ -163,7 +230,7 @@ describe "Trocla::Format::X509" do
       }))
       ca2 = OpenSSL::X509::Certificate.new(ca2_str)
       expect(ca2.issuer.to_s).to eq(@ca.subject.to_s)
-      expect((Date.parse(ca2.not_after.to_s) - Date.today).to_i).to eq(365)
+      expect((Date.parse(ca2.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
       pending_for(:engine => 'jruby',:reason => 'NameConstraints verification seem to be broken in jRuby: https://github.com/jruby/jruby/issues/3502') do
         expect(verify(@ca,ca2)).to be true
       end
@@ -180,14 +247,14 @@ describe "Trocla::Format::X509" do
       })
       valid_cert = OpenSSL::X509::Certificate.new(valid_cert_str)
       expect(valid_cert.issuer.to_s).to eq(ca2.subject.to_s)
-      expect((Date.parse(valid_cert.not_after.to_s) - Date.today).to_i).to eq(365)
+      expect((Date.parse(valid_cert.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
       # workaround broken openssl
-      if %x{openssl version} =~ /1\.0\.[2-9]/
-        expect(verify([@ca,ca2],valid_cert)).to be true
-      else
+      if Gem::Version.new(%x{openssl version}.split(' ')[1]) < Gem::Version.new('1.0.2')
         skip_for(:engine => 'ruby',:reason => 'NameConstraints verification is broken on older openssl versions https://rt.openssl.org/Ticket/Display.html?id=3562') do
           expect(verify([@ca,ca2],valid_cert)).to be true
         end
+      else
+        expect(verify([@ca,ca2],valid_cert)).to be true
       end
 
       false_cert_str = @trocla.password('myfalseexamplecert','x509', {
@@ -196,7 +263,7 @@ describe "Trocla::Format::X509" do
       })
       false_cert = OpenSSL::X509::Certificate.new(false_cert_str)
       expect(false_cert.issuer.to_s).to eq(ca2.subject.to_s)
-      expect((Date.parse(false_cert.not_after.to_s) - Date.today).to_i).to eq(365)
+      expect((Date.parse(false_cert.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
       expect(verify([@ca,ca2],false_cert)).to be false
     end
 
@@ -206,7 +273,7 @@ describe "Trocla::Format::X509" do
       }))
       ca2 = OpenSSL::X509::Certificate.new(ca2_str)
       expect(ca2.issuer.to_s).to eq(@ca.subject.to_s)
-      expect((Date.parse(ca2.not_after.to_s) - Date.today).to_i).to eq(365)
+      expect((Date.parse(ca2.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
       expect(verify(@ca,ca2)).to be true
 
       cert2_str = @trocla.password('mycert', 'x509', {
@@ -216,7 +283,7 @@ describe "Trocla::Format::X509" do
       })
       cert2 = OpenSSL::X509::Certificate.new(cert2_str)
       expect(cert2.issuer.to_s).to eq(ca2.subject.to_s)
-      expect((Date.parse(cert2.not_after.to_s) - Date.today).to_i).to eq(365)
+      expect((Date.parse(cert2.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
       skip_for(:engine => 'jruby',:reason => 'Chained CA validation seems to be broken on jruby atm.') do
         expect(verify([@ca,ca2],cert2)).to be true
       end
@@ -247,11 +314,13 @@ describe "Trocla::Format::X509" do
       hash_match = (defined?(RUBY_ENGINE) &&RUBY_ENGINE == 'jruby') ? 'RSA-SHA1' : 'sha1WithRSAEncryption'
       expect(cert.signature_algorithm).to eq(hash_match)
       expect(cert.not_before).to be < Time.now
-      expect((Date.parse(cert.not_after.to_s) - Date.today).to_i).to eq(3650)
+      expect((Date.parse(cert.not_after.localtime.to_s) - Date.today).to_i).to eq(3650)
       # https://stackoverflow.com/questions/13747212/determine-key-size-from-public-key-pem-format
       expect(cert.public_key.n.num_bytes * 8).to eq(2048)
       expect(verify(@ca,cert)).to be true
-      expect(cert.extensions.find{|e| e.oid == 'subjectAltName' }.value).to eq('DNS:www.test, DNS:test, DNS:test1, DNS:test2, DNS:test3')
+      skip_for(:engine => 'jruby',:reason => 'subjectAltName represenation is broken in jruby-openssl -> https://github.com/jruby/jruby-openssl/pull/123') do
+        expect(cert.extensions.find{|e| e.oid == 'subjectAltName' }.value).to eq('DNS:www.test, DNS:test, DNS:test1, DNS:test2, DNS:test3')
+      end
 
       expect(cert.extensions.find{|e| e.oid == 'basicConstraints' }.value).to eq('CA:FALSE')
       ku = cert.extensions.find{|e| e.oid == 'keyUsage' }.value
@@ -267,7 +336,7 @@ describe "Trocla::Format::X509" do
       cert_str = @trocla.password('mycert', 'x509', co)
       cert = OpenSSL::X509::Certificate.new(cert_str)
       expect(cert.issuer.to_s).to eq(@ca.subject.to_s)
-      expect((Date.parse(cert.not_after.to_s) - Date.today).to_i).to eq(365)
+      expect((Date.parse(cert.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
       expect(verify(@ca,cert)).to be true
       expect(cert.extensions.find{|e| e.oid == 'subjectAltName' }).to be_nil
     end
@@ -288,8 +357,26 @@ describe "Trocla::Format::X509" do
         expect(cert.subject.to_s).not_to match(/#{field}=#{co[field]}/)
       end
       expect(cert.subject.to_s).not_to match(/(Email|emailAddress)=#{co['emailAddress']}/)
-      expect((Date.parse(cert.not_after.to_s) - Date.today).to_i).to eq(365)
+      expect((Date.parse(cert.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
       expect(verify(@ca,cert)).to be true
     end
+    it "is able to create a signed cert with custom keyUsage restrictions" do
+      cert_str = @trocla.password('mycert_without_restrictions', 'x509', cert_options.merge({
+        'CN'           => 'sign only test',
+        'key_usages' => [ ],
+      }))
+      cert = OpenSSL::X509::Certificate.new(cert_str)
+      # default size
+      # https://stackoverflow.com/questions/13747212/determine-key-size-from-public-key-pem-format
+      expect(cert.public_key.n.num_bytes * 8).to eq(4096)
+      expect((Date.parse(cert.not_after.localtime.to_s) - Date.today).to_i).to eq(365)
+      expect(cert.issuer.to_s).to eq(@ca.subject.to_s)
+      expect(verify(@ca,cert)).to be true
+
+      v = cert.extensions.find{|e| e.oid == 'basicConstraints' }.value
+      expect(v).to_not eq('CA:TRUE')
+      expect(cert.extensions.find{|e| e.oid == 'keyUsage' }).to be_nil
+    end
+
   end
 end

data/spec/trocla/util_spec.rb

@@ -36,6 +36,14 @@ describe "Trocla::Util" do
     end
   end
 
+  describe :typesafe_generator do
+    10.times.each do |i|
+      it "creates random typesafe password #{i}" do
+        expect(Trocla::Util.random_str(12, 'typesafe')).to match(/^[1-9a-hj-km-xA-HJ-KM-X]{12}$/)
+      end
+    end
+  end
+
   describe :salt do
     10.times.each do |i|
       it "contains only characters and numbers #{i}" do

data/spec/trocla_spec.rb

@@ -1,147 +1,274 @@
+# -- encoding : utf-8 --
 require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
 
 describe "Trocla" do
 
   before(:each) do
     expect_any_instance_of(Trocla).to receive(:read_config).and_return(test_config)
-    @trocla = Trocla.new
   end
-
-  describe "password" do
-    it "generates random passwords by default" do
-      expect(@trocla.password('random1','plain')).not_to eq(@trocla.password('random2','plain'))
+  context 'in normal usage with' do
+    before(:each) do
+      @trocla = Trocla.new
+      @trocla.password('init','plain')
     end
 
-    it "generates passwords of length #{default_config['options']['length']}" do
-      expect(@trocla.password('random1','plain').length).to eq(default_config['options']['length'])
-    end
+    describe "password" do
+      it "generates random passwords by default" do
+        expect(@trocla.password('random1','plain')).not_to eq(@trocla.password('random2','plain'))
+      end
+
+      it "generates passwords of length #{default_config['options']['length']}" do
+        expect(@trocla.password('random1','plain').length).to eq(default_config['options']['length'])
+      end
+
+      Trocla::Formats.all.each do |format|
+        describe "#{format} password format" do
+          it "retursn a password hashed in the #{format} format" do
+            expect(@trocla.password('some_test',format,format_options[format])).not_to be_empty
+          end
+
+          it "returns the same hashed for the #{format} format on multiple invocations" do
+            expect(round1=@trocla.password('some_test',format,format_options[format])).not_to be_empty
+            expect(@trocla.password('some_test',format,format_options[format])).to eq(round1)
+          end
 
-    Trocla::Formats.all.each do |format|
-      describe "#{format} password format" do
-        it "retursn a password hashed in the #{format} format" do
-          expect(@trocla.password('some_test',format,format_options[format])).not_to be_empty
+          it "also stores the plain password by default" do
+            pwd = @trocla.password('some_test','plain')
+            expect(pwd).not_to be_empty
+            expect(pwd.length).to eq(16)
+          end
         end
+      end
+
+      Trocla::Formats.all.reject{|f| f == 'plain' }.each do |format|
+        it "raises an exception if not a random password is asked but plain password is not present for format #{format}" do
+          expect{@trocla.password('not_random',format, 'random' => false)}.to raise_error(/Password must be present as plaintext/)
+        end
+      end
 
-        it "returns the same hashed for the #{format} format on multiple invocations" do
-          expect(round1=@trocla.password('some_test',format,format_options[format])).not_to be_empty
-          expect(@trocla.password('some_test',format,format_options[format])).to eq(round1)
+      describe 'with profiles' do
+        it 'raises an exception on unknown profile' do
+          expect{@trocla.password('no profile known','plain',
+            'profiles' => 'unknown_profile') }.to raise_error(/No such profile unknown_profile defined/)
+        end
+
+        it 'takes a profile and merge its options' do
+          pwd = @trocla.password('some_test','plain', 'profiles' => 'rootpw')
+          expect(pwd).not_to be_empty
+          expect(pwd.length).to eq(32)
+          expect(pwd).to_not match(/[={}\[\]\?%\*()&!]+/)
         end
 
-        it "also stores the plain password by default" do
-          pwd = @trocla.password('some_test','plain')
+        it 'is possible to combine profiles but first profile wins' do
+          pwd = @trocla.password('some_test1','plain', 'profiles' => ['rootpw','login'])
+          expect(pwd).not_to be_empty
+          expect(pwd.length).to eq(32)
+          expect(pwd).not_to match(/[={}\[\]\?%\*()&!]+/)
+        end
+        it 'is possible to combine profiles but first profile wins 2' do
+          pwd = @trocla.password('some_test2','plain', 'profiles' => ['login','mysql'])
           expect(pwd).not_to be_empty
           expect(pwd.length).to eq(16)
+          expect(pwd).not_to match(/[={}\[\]\?%\*()&!]+/)
+        end
+        it 'is possible to combine profiles but first profile wins 3' do
+          pwd = @trocla.password('some_test3','plain', 'profiles' => ['mysql','login'])
+          expect(pwd).not_to be_empty
+          expect(pwd.length).to eq(32)
+          expect(pwd).to match(/[+%\/@=\?_.,:]+/)
         end
       end
     end
 
-    Trocla::Formats.all.reject{|f| f == 'plain' }.each do |format|
-      it "raises an exception if not a random password is asked but plain password is not present for format #{format}" do
-        expect{@trocla.password('not_random',format, 'random' => false)}.to raise_error(/Password must be present as plaintext/)
-      end
-    end
+    describe "set_password" do
+      it "resets hashed passwords on a new plain password" do
+        expect(@trocla.password('set_test','mysql')).not_to be_empty
+        expect(@trocla.get_password('set_test','mysql')).not_to be_nil
+        expect(old_plain=@trocla.password('set_test','mysql')).not_to be_empty
 
-    describe 'with profiles' do
-      it 'raises an exception on unknown profile' do
-        expect{@trocla.password('no profile known','plain',
-          'profiles' => 'unknown_profile') }.to raise_error(/No such profile unknown_profile defined/)
+        expect(@trocla.set_password('set_test','plain','foobar')).not_to eq(old_plain)
+        expect(@trocla.get_password('set_test','mysql')).to be_nil
       end
 
-      it 'takes a profile and merge its options' do
-        pwd = @trocla.password('some_test','plain', 'profiles' => 'rootpw')
-        expect(pwd).not_to be_empty
-        expect(pwd.length).to eq(32)
-        expect(pwd).to_not match(/[={}\[\]\?%\*()&!]+/)
-      end
+      it "otherwise updates only the hash" do
+        expect(mysql = @trocla.password('set_test2','mysql')).not_to be_empty
+        expect(md5crypt = @trocla.password('set_test2','md5crypt')).not_to be_empty
+        expect(plain = @trocla.get_password('set_test2','plain')).not_to be_empty
 
-      it 'is possible to combine profiles but first profile wins' do
-        pwd = @trocla.password('some_test','plain', 'profiles' => ['rootpw','login'])
-        expect(pwd).not_to be_empty
-        expect(pwd.length).to eq(32)
-        expect(pwd).not_to match(/[={}\[\]\?%\*()&!]+/)
+        expect(new_mysql = @trocla.set_password('set_test2','mysql','foo')).not_to eql(mysql)
+        expect(@trocla.get_password('set_test2','mysql')).to eq(new_mysql)
+        expect(@trocla.get_password('set_test2','md5crypt')).to eq(md5crypt)
+        expect(@trocla.get_password('set_test2','plain')).to eq(plain)
       end
-      it 'is possible to combine profiles but first profile wins 2' do
-        pwd = @trocla.password('some_test','plain', 'profiles' => ['login','mysql'])
-        expect(pwd).not_to be_empty
-        expect(pwd.length).to eq(16)
-        expect(pwd).not_to match(/[={}\[\]\?%\*()&!]+/)
-      end
-      it 'is possible to combine profiles but first profile wins 3' do
-        pwd = @trocla.password('some_test','plain', 'profiles' => ['mysql','login'])
-        expect(pwd).not_to be_empty
-        expect(pwd.length).to eq(32)
-        expect(pwd).to match(/[+%\/@=\?_.,:]+/)
+
+      it 'is able to set password with umlauts and other UTF-8 charcters' do
+        expect(myumlaut = @trocla.set_password('set_test_umlaut','plain','Tütü')).to eql('Tütü')
+        expect(@trocla.get_password('set_test_umlaut','plain','Tütü')).to eql('Tütü')
       end
     end
-  end
 
-  describe "set_password" do
-    it "resets hashed passwords on a new plain password" do
-      expect(@trocla.password('set_test','mysql')).not_to be_empty
-      expect(@trocla.get_password('set_test','mysql')).not_to be_nil
-      expect(old_plain=@trocla.password('set_test','mysql')).not_to be_empty
+    describe "reset_password" do
+      it "resets a password" do
+        plain1 = @trocla.password('reset_pwd','plain')
+        plain2 = @trocla.reset_password('reset_pwd','plain')
 
-      expect(@trocla.set_password('set_test','plain','foobar')).not_to eq(old_plain)
-      expect(@trocla.get_password('set_test','mysql')).to be_nil
-    end
+        expect(plain1).not_to eq(plain2)
+      end
 
-    it "otherwise updates only the hash" do
-      expect(mysql = @trocla.password('set_test2','mysql')).not_to be_empty
-      expect(md5crypt = @trocla.password('set_test2','md5crypt')).not_to be_empty
-      expect(plain = @trocla.get_password('set_test2','plain')).not_to be_empty
+      it "does not reset other formats" do
+        expect(mysql = @trocla.password('reset_pwd2','mysql')).not_to be_empty
+        expect(md5crypt1 = @trocla.password('reset_pwd2','md5crypt')).not_to be_empty
 
-      expect(new_mysql = @trocla.set_password('set_test2','mysql','foo')).not_to eql(mysql)
-      expect(@trocla.get_password('set_test2','mysql')).to eq(new_mysql)
-      expect(@trocla.get_password('set_test2','md5crypt')).to eq(md5crypt)
-      expect(@trocla.get_password('set_test2','plain')).to eq(plain)
-    end
-  end
+        expect(md5crypt2 = @trocla.reset_password('reset_pwd2','md5crypt')).not_to be_empty
+        expect(md5crypt2).not_to eq(md5crypt1)
 
-  describe "reset_password" do
-    it "resets a password" do
-      plain1 = @trocla.password('reset_pwd','plain')
-      plain2 = @trocla.reset_password('reset_pwd','plain')
+        expect(@trocla.get_password('reset_pwd2','mysql')).to eq(mysql)
+      end
+    end
 
-      expect(plain1).not_to eq(plain2)
+    describe "search_key" do
+      it "search a specific key" do
+        keys = ['search_key','search_key1','key_search','key_search2']
+        keys.each do |k|
+          @trocla.password(k,'plain')
+        end
+        expect(@trocla.search_key('search_key1').length).to eq(1)
+      end
+      it "ensure search regex is ok" do
+        keys = ['search_key2','search_key3','key_search2','key_search4']
+        keys.each do |k|
+          @trocla.password(k,'plain')
+        end
+        expect(@trocla.search_key('key').length).to eq(4)
+        expect(@trocla.search_key('^search').length).to eq(2)
+        expect(@trocla.search_key('ch.*3').length).to eq(1)
+        expect(@trocla.search_key('ch.*[3-4]$').length).to eq(2)
+        expect(@trocla.search_key('ch.*1')).to be_nil
+      end
     end
 
-    it "does not reset other formats" do
-      expect(mysql = @trocla.password('reset_pwd2','mysql')).not_to be_empty
-      expect(md5crypt1 = @trocla.password('reset_pwd2','md5crypt')).not_to be_empty
+    describe "list_format" do
+      it "list available formats for key" do
+        formats = ['plain','mysql']
+        formats.each do |f|
+          @trocla.password('list_key',f)
+        end
+        expect(@trocla.available_format('list_key')).to eq(formats)
+      end
+      it "no return if key doesn't exist" do
+        expect(@trocla.available_format('list_key1')).to be_nil
+      end
+    end
 
-      expect(md5crypt2 = @trocla.reset_password('reset_pwd2','md5crypt')).not_to be_empty
-      expect(md5crypt2).not_to eq(md5crypt1)
+    describe "delete_password" do
+      it "deletes all passwords if no format is given" do
+        expect(@trocla.password('delete_test1','mysql')).not_to be_nil
+        expect(@trocla.get_password('delete_test1','plain')).not_to be_nil
 
-      expect(@trocla.get_password('reset_pwd2','mysql')).to eq(mysql)
-    end
-  end
+        @trocla.delete_password('delete_test1')
+        expect(@trocla.get_password('delete_test1','plain')).to be_nil
+        expect(@trocla.get_password('delete_test1','mysql')).to be_nil
+      end
 
-  describe "delete_password" do
-    it "deletes all passwords if no format is given" do
-      expect(@trocla.password('delete_test1','mysql')).not_to be_nil
-      expect(@trocla.get_password('delete_test1','plain')).not_to be_nil
+      it "deletes only a given format" do
+        expect(@trocla.password('delete_test2','mysql')).not_to be_nil
+        expect(@trocla.get_password('delete_test2','plain')).not_to be_nil
 
-      @trocla.delete_password('delete_test1')
-      expect(@trocla.get_password('delete_test1','plain')).to be_nil
-      expect(@trocla.get_password('delete_test1','mysql')).to be_nil
-    end
+        @trocla.delete_password('delete_test2','plain')
+        expect(@trocla.get_password('delete_test2','plain')).to be_nil
+        expect(@trocla.get_password('delete_test2','mysql')).not_to be_nil
+      end
 
-    it "deletes only a given format" do
-      expect(@trocla.password('delete_test2','mysql')).not_to be_nil
-      expect(@trocla.get_password('delete_test2','plain')).not_to be_nil
+      it "deletes only a given non-plain format" do
+        expect(@trocla.password('delete_test3','mysql')).not_to be_nil
+        expect(@trocla.get_password('delete_test3','plain')).not_to be_nil
 
-      @trocla.delete_password('delete_test2','plain')
-      expect(@trocla.get_password('delete_test2','plain')).to be_nil
-      expect(@trocla.get_password('delete_test2','mysql')).not_to be_nil
+        @trocla.delete_password('delete_test3','mysql')
+        expect(@trocla.get_password('delete_test3','mysql')).to be_nil
+        expect(@trocla.get_password('delete_test3','plain')).not_to be_nil
+      end
     end
 
-    it "deletes only a given non-plain format" do
-      expect(@trocla.password('delete_test3','mysql')).not_to be_nil
-      expect(@trocla.get_password('delete_test3','plain')).not_to be_nil
+    context 'concurrent access' do
+      context 'on expensive flagged formats' do
+        before(:each) do
+          expect(Trocla::Formats).to receive(:[]).with('sleep').at_least(:once).and_return(Trocla::Formats::Sleep)
+          expect(Trocla::Formats::Sleep).to receive(:expensive?).at_least(:once).and_return(true)
+          expect(Trocla::Formats).to receive(:available?).with('sleep').at_least(:once).and_return(true)
+        end
+        it 'should not overwrite a value if it takes longer' do
+          t1 = Thread.new{ @trocla.password('threadpwd','sleep','sleep' => 4) }
+          t2 = Thread.new{ @trocla.password('threadpwd','sleep','sleep' => 1) }
+          pwd1 = t1.value
+          pwd2 = t2.value
+          real_value = @trocla.password('threadpwd','sleep')
+          # as t2 finished first this should win
+          expect(pwd1).to eql(pwd2)
+          expect(real_value).to eql(pwd1)
+          expect(real_value).to eql(pwd2)
+        end
+      end
+      context 'on inexpensive flagged formats' do
+        before(:each) do
+          expect(Trocla::Formats).to receive(:[]).with('sleep').at_least(:once).and_return(Trocla::Formats::Sleep)
+          expect(Trocla::Formats::Sleep).to receive(:expensive?).at_least(:once).and_return(false)
+          expect(Trocla::Formats).to receive(:available?).with('sleep').at_least(:once).and_return(true)
+        end
+        it 'should not overwrite a value if it takes longer' do
+          t1 = Thread.new{ @trocla.password('threadpwd_inexp','sleep','sleep' => 4) }
+          t2 = Thread.new{ @trocla.password('threadpwd_inexp','sleep','sleep' => 1) }
+          pwd1 = t1.value
+          pwd2 = t2.value
+          real_value = @trocla.password('threadpwd_inexp','sleep')
+          # as t2 finished first but the format is inexpensive it gets overwritten
+          expect(pwd1).not_to eql(pwd2)
+          expect(real_value).to eql(pwd1)
+          expect(real_value).not_to eql(pwd2)
+        end
+      end
+      context 'real world example' do
+        it 'should store the quicker one' do
+          t1 = Thread.new{ @trocla.password('threadpwd_real','bcrypt','cost' => 17) }
+          t2 = Thread.new{ @trocla.password('threadpwd_real','bcrypt') }
+          pwd1 = t1.value
+          pwd2 = t2.value
+          real_value = @trocla.password('threadpwd_real','bcrypt')
+          # t2 should still win but both should be the same
+          expect(pwd1).to eql(pwd2)
+          expect(real_value).to eql(pwd1)
+          expect(real_value).to eql(pwd2)
+        end
+        it 'should store the quicker one test 2' do
+          t1 = Thread.new{ @trocla.password('my_shiny_selfsigned_ca', 'x509', {
+            'CN'        => 'This is my self-signed certificate',
+            'become_ca' => false,
+          }) }
+          t2 = Thread.new{ @trocla.password('my_shiny_selfsigned_ca', 'x509', {
+            'CN'        => 'This is my self-signed certificate',
+            'become_ca' => false,
+          }) }
+          cert1 = t1.value
+          cert2 = t2.value
+          real_value = @trocla.password('my_shiny_selfsigned_ca','x509')
+          # t2 should still win but both should be the same
+          expect(cert1).to eql(cert2)
+          expect(real_value).to eql(cert1)
+          expect(real_value).to eql(cert2)
+        end
+      end
+    end
 
-      @trocla.delete_password('delete_test3','mysql')
-      expect(@trocla.get_password('delete_test3','mysql')).to be_nil
-      expect(@trocla.get_password('delete_test3','plain')).not_to be_nil
+  end
+  context 'with .open' do
+    it 'closes the connection with a block' do
+      expect_any_instance_of(Trocla::Stores::Memory).to receive(:close)
+      Trocla.open{|t|
+        t.password('plain_open','plain')
+      }
+    end
+    it 'keeps the connection without a block' do
+      expect_any_instance_of(Trocla::Stores::Memory).not_to receive(:close)
+      Trocla.open.password('plain_open','plain')
     end
   end