From 3e9243817e800e3ce988cc42ff726f3ba32a255d Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 13 Mar 2026 18:54:43 +0000
Subject: [PATCH] test: harden secret file helper coverage

---
 src/infra/secret-file.test.ts | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/src/infra/secret-file.test.ts b/src/infra/secret-file.test.ts
index 788b4c75e23..ca7841891e5 100644
--- a/src/infra/secret-file.test.ts
+++ b/src/infra/secret-file.test.ts
@@ -4,6 +4,7 @@ import { afterEach, describe, expect, it } from "vitest";
 import { createTrackedTempDirs } from "../test-utils/tracked-temp-dirs.js";
 import {
   DEFAULT_SECRET_FILE_MAX_BYTES,
+  loadSecretFileSync,
   readSecretFileSync,
   tryReadSecretFileSync,
 } from "./secret-file.js";
@@ -16,6 +17,12 @@ afterEach(async () => {
 });
 
 describe("readSecretFileSync", () => {
+  it("rejects blank file paths", () => {
+    expect(() => readSecretFileSync("   ", "Gateway password")).toThrow(
+      "Gateway password file path is empty.",
+    );
+  });
+
   it("reads and trims a regular secret file", async () => {
     const dir = await createTempDir();
     const file = path.join(dir, "secret.txt");
@@ -56,6 +63,28 @@ describe("readSecretFileSync", () => {
     );
   });
 
+  it("rejects empty secret files after trimming", async () => {
+    const dir = await createTempDir();
+    const file = path.join(dir, "secret.txt");
+    await writeFile(file, " \n\t ", "utf8");
+
+    expect(() => readSecretFileSync(file, "Gateway password")).toThrow(
+      `Gateway password file at ${file} is empty.`,
+    );
+  });
+
+  it("exposes resolvedPath on non-throwing read failures", async () => {
+    const dir = await createTempDir();
+    const file = path.join(dir, "secret.txt");
+    await writeFile(file, " \n\t ", "utf8");
+
+    expect(loadSecretFileSync(file, "Gateway password")).toMatchObject({
+      ok: false,
+      resolvedPath: file,
+      message: `Gateway password file at ${file} is empty.`,
+    });
+  });
+
   it("returns undefined from the non-throwing helper for rejected files", async () => {
     const dir = await createTempDir();
     const target = path.join(dir, "target.txt");
@@ -67,4 +96,9 @@ describe("readSecretFileSync", () => {
       undefined,
     );
   });
+
+  it("returns undefined from the non-throwing helper for blank file paths", () => {
+    expect(tryReadSecretFileSync("   ", "Telegram bot token")).toBeUndefined();
+    expect(tryReadSecretFileSync(undefined, "Telegram bot token")).toBeUndefined();
+  });
 });