more logging

johnstcn · johnstcn · commit 7da597249f4b · 2023-09-15T11:37:00.000+01:00
diff --git a/enterprise/cli/server_dbcrypt_test.go b/enterprise/cli/server_dbcrypt_test.go
@@ -20,6 +20,9 @@ import (
 	"github.com/coder/coder/v2/pty/ptytest"
 )
 
+// TestServerDBCrypt tests end-to-end encryption, decryption, and deletion
+// of encrypted user data.
+//
 // nolint: paralleltest // use of t.Setenv
 func TestServerDBCrypt(t *testing.T) {
 	if !dbtestutil.WillUsePostgres() {
@@ -49,6 +52,7 @@ func TestServerDBCrypt(t *testing.T) {
 	})
 
 	// Populate the database with some unencrypted data.
+	t.Logf("Generating unencrypted data")
 	users := genData(t, db)
 
 	// Setup an initial cipher A
@@ -61,6 +65,7 @@ func TestServerDBCrypt(t *testing.T) {
 	require.NoError(t, err)
 
 	// Populate the database with some encrypted data using cipher A.
+	t.Logf("Generating data encrypted with cipher A")
 	newUsers := genData(t, cryptdb)
 
 	// Validate that newly created users were encrypted with cipher A
@@ -70,6 +75,7 @@ func TestServerDBCrypt(t *testing.T) {
 	users = append(users, newUsers...)
 
 	// Encrypt all the data with the initial cipher.
+	t.Logf("Encrypting all data with cipher A")
 	inv, _ := newCLI(t, "server", "dbcrypt", "rotate",
 		"--postgres-url", connectionURL,
 		"--new-key", base64.StdEncoding.EncodeToString([]byte(keyA)),
@@ -90,9 +96,7 @@ func TestServerDBCrypt(t *testing.T) {
 	cipherBA, err := dbcrypt.NewCiphers([]byte(keyB), []byte(keyA))
 	require.NoError(t, err)
 
-	// Generate some more encrypted data using the new cipher
-	users = append(users, genData(t, db)...)
-
+	t.Logf("Enrypting all data with cipher B")
 	inv, _ = newCLI(t, "server", "dbcrypt", "rotate",
 		"--postgres-url", connectionURL,
 		"--new-key", base64.StdEncoding.EncodeToString([]byte(keyB)),
@@ -110,6 +114,7 @@ func TestServerDBCrypt(t *testing.T) {
 	}
 
 	// Assert that we can revoke the old key.
+	t.Logf("Revoking cipher A")
 	err = db.RevokeDBCryptKey(ctx, cipherA[0].HexDigest())
 	require.NoError(t, err, "failed to revoke old key")
 
@@ -125,13 +130,15 @@ func TestServerDBCrypt(t *testing.T) {
 	require.Empty(t, oldKey.ActiveKeyDigest.String, "expected the old key to not be active")
 
 	// Revoking the new key should fail.
+	t.Logf("Attempting to revoke cipher B should fail as it is still in use")
 	err = db.RevokeDBCryptKey(ctx, cipherBA[0].HexDigest())
 	require.Error(t, err, "expected to fail to revoke the new key")
 	var pgErr *pq.Error
 	require.True(t, xerrors.As(err, &pgErr), "expected a pg error")
 	require.EqualValues(t, "23503", pgErr.Code, "expected a foreign key constraint violation error")
 
 	// Decrypt the data using only cipher B. This should result in the key being revoked.
+	t.Logf("Decrypting with cipher B")
 	inv, _ = newCLI(t, "server", "dbcrypt", "decrypt",
 		"--postgres-url", connectionURL,
 		"--keys", base64.StdEncoding.EncodeToString([]byte(keyB)),
@@ -160,6 +167,7 @@ func TestServerDBCrypt(t *testing.T) {
 	cipherC, err := dbcrypt.NewCiphers([]byte(keyC))
 	require.NoError(t, err)
 
+	t.Logf("Re-encrypting with cipher C")
 	inv, _ = newCLI(t, "server", "dbcrypt", "rotate",
 		"--postgres-url", connectionURL,
 		"--new-key", base64.StdEncoding.EncodeToString([]byte(keyC)),
@@ -177,6 +185,7 @@ func TestServerDBCrypt(t *testing.T) {
 	}
 
 	// Now delete all the encrypted data.
+	t.Logf("Deleting all encrypted data")
 	inv, _ = newCLI(t, "server", "dbcrypt", "delete",
 		"--postgres-url", connectionURL,
 		"--external-token-encryption-keys", base64.StdEncoding.EncodeToString([]byte(keyC)),
