Add safe repository password rotation

internal/restic/restic_test.go

@@ -51,6 +51,42 @@ func TestBackupUsesPasswordFileAndStructuredArguments(t *testing.T) {
 	}
 }
 
+func TestChangePasswordUsesCurrentAndNewPasswordFiles(t *testing.T) {
+	dir := t.TempDir()
+	argsPath := filepath.Join(dir, "args")
+	currentPath := filepath.Join(dir, "current")
+	newPath := filepath.Join(dir, "new")
+	script := filepath.Join(dir, "restic")
+	body := fmt.Sprintf(`#!/bin/sh
+printf '%%s\n' "$@" > '%s'
+cat "$RESTIC_PASSWORD_FILE" > '%s'
+previous=''
+for value in "$@"; do
+  if [ "$previous" = "--new-password-file" ]; then
+    cat "$value" > '%s'
+  fi
+  previous="$value"
+done
+`, argsPath, currentPath, newPath)
+	if err := os.WriteFile(script, []byte(body), 0700); err != nil {
+		t.Fatal(err)
+	}
+	runner := &Runner{Binary: script, RuntimeDir: dir, Secrets: fakeSecrets{"password": "stored-old"}}
+	repo := model.Repository{Type: model.RepositoryLocal, Location: "/repo", PasswordRef: "password"}
+	if err := runner.ChangePassword(context.Background(), repo, "current-secret", "new-secret"); err != nil {
+		t.Fatal(err)
+	}
+	args, _ := os.ReadFile(argsPath)
+	if !strings.Contains(string(args), "key\npasswd\n--new-password-file") {
+		t.Fatalf("unexpected arguments: %s", args)
+	}
+	current, _ := os.ReadFile(currentPath)
+	newPassword, _ := os.ReadFile(newPath)
+	if string(current) != "current-secret" || string(newPassword) != "new-secret" {
+		t.Fatalf("password files current=%q new=%q", current, newPassword)
+	}
+}
+
 func TestBackupLimitsCPUForThisJob(t *testing.T) {
 	dir := t.TempDir()
 	envPath := filepath.Join(dir, "gomaxprocs")