Add a -f flag to overwrite, and update tests

5 files changed, 255 insertions, 22 deletions

diff --git a/internal/sym/dec.go b/internal/sym/dec.go
index 31c4ed0..086bd44 100644
--- a/internal/sym/dec.go
+++ b/internal/sym/dec.go
@@ -63,7 +63,20 @@ func Decrypt(w io.Writer, r io.Reader, password string) error {
 	return err
 }
 
-func DecryptFile(fileName string, password string) (err error) {
+type decryptOptions struct {
+	force bool
+}
+
+type DecryptFileOption interface {
+	decryptOpt(*decryptOptions)
+}
+
+func DecryptFile(fileName string, password string, options ...DecryptFileOption) (err error) {
+	opts := new(decryptOptions)
+	for _, o := range options {
+		o.decryptOpt(opts)
+	}
+
 	var outFileName string
 	if name, ok := strings.CutSuffix(fileName, ".enc"); ok {
 		outFileName = name
@@ -77,7 +90,13 @@ func DecryptFile(fileName string, password string) (err error) {
 		return err
 	}
 	defer fIn.Close()
-	fOut, err := os.Create(outFileName)
+	fileOpts := os.O_CREATE | os.O_WRONLY
+	if opts.force {
+		fileOpts |= os.O_TRUNC
+	} else {
+		fileOpts |= os.O_EXCL
+	}
+	fOut, err := os.OpenFile(outFileName, fileOpts, 0644)
 	if err != nil {
 		return err
 	}
@@ -88,7 +107,7 @@ func DecryptFile(fileName string, password string) (err error) {
 		}
 	}()
 	if err := Decrypt(fOut, fIn, password); err != nil {
-		return err
+		return fmt.Errorf("decrypt %q: %s", fileName, err)
 	}
 	return fOut.Close()
 }
diff --git a/internal/sym/enc.go b/internal/sym/enc.go
index 33ec7ca..18b7de7 100644
--- a/internal/sym/enc.go
+++ b/internal/sym/enc.go
@@ -3,6 +3,7 @@ package sym
 import (
 	"bufio"
 	"encoding/base64"
+	"fmt"
 	"io"
 	"os"
 )
@@ -68,17 +69,47 @@ func EncryptBase64(w io.Writer, r io.Reader, password string) error {
 	return bufWriter.Flush()
 }
 
-func EncryptFile(fileName string, password string, asciiOutput bool) (err error) {
+type encryptOptions struct {
+	asciiOutput bool
+	force       bool
+}
+
+type EncryptFileOption interface {
+	encryptOpt(*encryptOptions)
+}
+
+type encryptFileOptionFunc func(*encryptOptions)
+
+func (f encryptFileOptionFunc) encryptOpt(opts *encryptOptions) { f(opts) }
+
+func WithASCIIOutput(asciiOutput bool) EncryptFileOption {
+	return encryptFileOptionFunc(func(opts *encryptOptions) {
+		opts.asciiOutput = asciiOutput
+	})
+}
+
+func EncryptFile(fileName string, password string, options ...EncryptFileOption) (err error) {
+	opts := new(encryptOptions)
+	for _, o := range options {
+		o.encryptOpt(opts)
+	}
+
 	f, err := os.Open(fileName)
 	if err != nil {
 		return err
 	}
 	defer f.Close()
 	ext := ".enc"
-	if asciiOutput {
+	if opts.asciiOutput {
 		ext = ".enc.txt"
 	}
-	fOut, err := os.Create(fileName + ext)
+	fileOpts := os.O_CREATE | os.O_WRONLY
+	if opts.force {
+		fileOpts |= os.O_TRUNC
+	} else {
+		fileOpts |= os.O_EXCL
+	}
+	fOut, err := os.OpenFile(fileName+ext, fileOpts, 0644)
 	if err != nil {
 		return err
 	}
@@ -88,13 +119,13 @@ func EncryptFile(fileName string, password string, asciiOutput bool) (err error)
 			os.Remove(fOut.Name())
 		}
 	}()
-	if asciiOutput {
+	if opts.asciiOutput {
 		err = EncryptBase64(fOut, f, password)
 	} else {
 		err = EncryptBinary(fOut, f, password)
 	}
 	if err != nil {
-		return err
+		return fmt.Errorf("encrypt %q: %s", fileName, err)
 	}
 	return fOut.Close()
 }
diff --git a/internal/sym/oae.go b/internal/sym/oae.go
index 0ff9540..72fbf64 100644
--- a/internal/sym/oae.go
+++ b/internal/sym/oae.go
@@ -183,9 +183,6 @@ func (r *decryptingReader) fillBuf() error {
 	buf := r.buf.AvailableBuffer()[:encryptedSegmentSize]
 	n, err := io.ReadFull(r.r, buf)
 	if n == 0 {
-		if err == io.ErrUnexpectedEOF {
-			return io.EOF
-		}
 		return err
 	}
 	buf = buf[:n]
diff --git a/internal/sym/shared_options.go b/internal/sym/shared_options.go
new file mode 100644
index 0000000..74c3210
--- /dev/null
+++ b/internal/sym/shared_options.go
@@ -0,0 +1,20 @@
+package sym
+
+type Option interface {
+	EncryptFileOption
+	DecryptFileOption
+}
+
+type forceOption bool
+
+func (force forceOption) encryptOpt(opts *encryptOptions) {
+	opts.force = bool(force)
+}
+
+func (force forceOption) decryptOpt(opts *decryptOptions) {
+	opts.force = bool(force)
+}
+
+func Force(force bool) Option {
+	return forceOption(force)
+}
diff --git a/internal/sym/sym_test.go b/internal/sym/sym_test.go
index c5f136c..43f29fd 100644
--- a/internal/sym/sym_test.go
+++ b/internal/sym/sym_test.go
@@ -4,13 +4,43 @@ import (
 	"bytes"
 	"os"
 	"path/filepath"
+	"slices"
 	"testing"
 )
 
+func mustWriteFile(t *testing.T, path string, content []byte) {
+	t.Helper()
+	if err := os.WriteFile(path, content, 0600); err != nil {
+		t.Fatalf("Failed to write test file: %s", err)
+	}
+}
+
+func mustReadFile(t *testing.T, path string) []byte {
+	t.Helper()
+	content, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("Failed to read file: %s", err)
+	}
+	return content
+}
+
+func mustRename(t *testing.T, src, dst string) {
+	t.Helper()
+	if err := os.Rename(src, dst); err != nil {
+		t.Fatalf("Failed to rename: %s", err)
+	}
+}
+
+func mustRemove(t *testing.T, path string) {
+	t.Helper()
+	if err := os.Remove(path); err != nil {
+		t.Fatalf("Failed to remove file: %s", err)
+	}
+}
+
 func TestEncryptDecrypt(t *testing.T) {
 	t.Parallel()
 
-	const password = "karp cache tidal mars fed rajah uses graze pobox flew"
 	buf := make([]byte, 10*1024*1024)
 	for i := range buf {
 		buf[i] = byte(i)
@@ -19,22 +49,22 @@ func TestEncryptDecrypt(t *testing.T) {
 		desc  string
 		ascii bool
 	}{{
-		desc:  "binary",
+		desc:  "Binary",
 		ascii: false,
 	}, {
-		desc:  "ascii",
+		desc:  "ASCII",
 		ascii: true,
 	}} {
 		t.Run(tc.desc, func(t *testing.T) {
 			t.Parallel()
 
 			fileName := filepath.Join(t.TempDir(), "file")
-			if err := os.WriteFile(fileName, buf, 0600); err != nil {
-				t.Fatalf("Failed to write test file: %s", err)
-			}
-			if err := EncryptFile(fileName, password, tc.ascii); err != nil {
+			mustWriteFile(t, fileName, buf)
+			const password = "karp cache tidal mars fed rajah uses graze pobox flew"
+			if err := EncryptFile(fileName, password, WithASCIIOutput(tc.ascii)); err != nil {
 				t.Fatalf("EncryptFile failed: %s", err)
 			}
+			mustRemove(t, fileName)
 			ext := ".enc"
 			if tc.ascii {
 				ext = ".enc.txt"
@@ -42,13 +72,149 @@ func TestEncryptDecrypt(t *testing.T) {
 			if err := DecryptFile(fileName+ext, password); err != nil {
 				t.Fatalf("DecryptFile failed: %s", err)
 			}
-			gotContents, err := os.ReadFile(fileName)
-			if err != nil {
-				t.Fatalf("Failed to read file: %s", err)
-			}
+			gotContents := mustReadFile(t, fileName)
 			if !bytes.Equal(gotContents, buf) {
 				t.Errorf("contents differ")
 			}
 		})
 	}
 }
+
+func TestEncryptFile_Force(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		desc    string
+		force   bool
+		wantErr bool
+	}{{
+		desc:    "OutputExists",
+		force:   false,
+		wantErr: true,
+	}, {
+		desc:    "Force",
+		force:   true,
+		wantErr: false,
+	}} {
+		t.Run(tc.desc, func(t *testing.T) {
+			t.Parallel()
+
+			fileName := filepath.Join(t.TempDir(), "file")
+			mustWriteFile(t, fileName, []byte("test file content"))
+			mustWriteFile(t, fileName+".enc", []byte("file already exists"))
+			err := EncryptFile(fileName, "asdf", Force(tc.force))
+			if gotErr := err != nil; gotErr != tc.wantErr {
+				t.Errorf("EncryptFile(force=%t) returned returned error %v when output file exists, want error? %t", tc.force, err, tc.wantErr)
+			}
+		})
+	}
+}
+
+func TestDecryptFile_Force(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		desc    string
+		force   bool
+		wantErr bool
+	}{{
+		desc:    "OutputExists",
+		force:   false,
+		wantErr: true,
+	}, {
+		desc:    "Force",
+		force:   true,
+		wantErr: false,
+	}} {
+		t.Run(tc.desc, func(t *testing.T) {
+			t.Parallel()
+
+			const password = "asdf"
+			fileName := filepath.Join(t.TempDir(), "file")
+			mustWriteFile(t, fileName, []byte("test file content"))
+			if err := EncryptFile(fileName, password); err != nil {
+				t.Fatalf("Failed to encrypt file: %s", err)
+			}
+			err := DecryptFile(fileName+".enc", password, Force(tc.force))
+			if gotErr := err != nil; gotErr != tc.wantErr {
+				t.Errorf("DecryptFile(force=%t) returned returned error %v when output file exists, want error? %t", tc.force, err, tc.wantErr)
+			}
+		})
+	}
+}
+
+func TestDecrypt_BadFileFormat(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		desc        string
+		fileContent []byte
+	}{{
+		desc:        "Empty",
+		fileContent: nil,
+	}, {
+		desc:        "Short",
+		fileContent: []byte{0x80},
+	}, {
+		desc:        "BadHeader",
+		fileContent: []byte{0x80, 'a', 's', 'd', 'f'},
+	}, {
+		desc:        "BadFormat",
+		fileContent: []byte("bad file format"),
+	}, {
+		desc:        "BadContent",
+		fileContent: []byte("\x80symasdfasdf"),
+	}, {
+		desc:        "BadContentLong",
+		fileContent: slices.Concat([]byte("\x80sym"), bytes.Repeat([]byte("asdf"), 100)),
+	}} {
+		t.Run(tc.desc, func(t *testing.T) {
+			t.Parallel()
+
+			fileName := filepath.Join(t.TempDir(), "file")
+			mustWriteFile(t, fileName, tc.fileContent)
+			err := DecryptFile(fileName, "asdf")
+			if err == nil {
+				t.Errorf("DecryptFile succeeded for incorrect file format, want error")
+			}
+		})
+	}
+}
+
+func TestDecryptFile_WeirdName(t *testing.T) {
+	t.Parallel()
+
+	const password = "asdf"
+	fileContent := []byte("file content")
+	fileName := filepath.Join(t.TempDir(), "file")
+	mustWriteFile(t, fileName, fileContent)
+	if err := EncryptFile(fileName, password); err != nil {
+		t.Fatalf("EncryptFile failed: %s", err)
+	}
+	mustRename(t, fileName+".enc", fileName+".encrypted")
+	if err := DecryptFile(fileName+".encrypted", password); err != nil {
+		t.Fatalf("DecryptFile failed: %s", err)
+	}
+	gotContents := mustReadFile(t, fileName+".encrypted.dec")
+	if !bytes.Equal(gotContents, fileContent) {
+		t.Errorf("contents differ")
+	}
+}
+
+func TestEncryptFile_NotFound(t *testing.T) {
+	t.Parallel()
+
+	err := EncryptFile("my-nonexistent-file.txt", "asdf")
+	if err == nil {
+		t.Fatal("EncryptFile succeeded for nonexistent file, want error")
+	}
+}
+
+func TestDecryptFile_NotFound(t *testing.T) {
+	t.Parallel()
+
+	err := DecryptFile("my-nonexistent-file.txt", "asdf")
+	if err == nil {
+		t.Fatal("DecryptFile succeeded for nonexistent file, want error")
+	}
+}