fix: don't strip valid characters from secret data

juju/secrets.py

@@ -27,15 +27,10 @@ def create_secret_data(args):
     """
     data = {}
     for val in args:
-        # Remove any base64 padding ("=") before splitting the key=value.
-        stripped = val.rstrip(base64.b64encode(b"=").decode("utf-8"))
-        idx = stripped.find("=")
-        if idx < 1:
+        key, _, value = val.partition("=")
+        if not key or not value:
             raise ValueError(f"Invalid key value {val}")
 
-        key = stripped[0:idx]
-        value = stripped[idx + 1 :]
-
         # If the key doesn't have the #file suffix, then add it to the bag and continue.
         if not key.endswith(file_suffix):
             data[key] = value

tests/unit/test_secrets.py

@@ -11,18 +11,29 @@
 from juju.secrets import create_secret_data, read_secret_data
 
 
-class TestCreateSecretData(unittest.TestCase):
-    def test_bad_key(self):
+class TestCreateSecretData:
+    @pytest.mark.parametrize(
+        "keyval", ["foo", "=bar", "baz=", "f=bar", "ff=bar", "foo_bar=baz"]
+    )
+    def test_bad_key(self, keyval: str):
         with pytest.raises(ValueError):
-            create_secret_data(["foo"])
-        with pytest.raises(ValueError):
-            create_secret_data(["=bar"])
-
-    def test_good_key_values(self):
-        self.assertDictEqual(
-            create_secret_data(["foo=bar", "hello=world", "goodbye#base64=world"]),
-            {"foo": "YmFy", "hello": "d29ybGQ=", "goodbye": "world"},
-        )
+            create_secret_data([keyval])
+
+    @pytest.mark.parametrize(
+        "keyval,expected_key,expected_val",
+        [
+            ("foo=bar", "foo", "YmFy"),
+            ("hello=world", "hello", "d29ybGQ="),
+            ("goodbye#base64=world", "goodbye", "world"),
+            ("equalsign==", "equalsign", "PQ=="),
+            ("equalsign#base64=PQ==", "equalsign", "PQ=="),
+            ("pq-identity-theorem=P===Q", "pq-identity-theorem", "UD09PVE="),
+        ],
+    )
+    def test_goo_key_values(self, keyval: str, expected_key: str, expected_val: str):
+        actual = create_secret_data([keyval])
+        expected = {expected_key: expected_val}
+        assert actual == expected
 
     def test_key_content_too_large(self):
         with pytest.raises(ValueError):
@@ -50,15 +61,12 @@ def test_secret_key_from_file(self):
 
             data = create_secret_data(["key1=value1", f"key2#file={file_path}"])
 
-            self.assertDictEqual(
-                data,
-                {
-                    "key1": "dmFsdWUx",
-                    "key2": (
-                        "ICAgICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogICAgICAgICAgTUlJRllqQ0NBMHFnQXdJQkFnSVFLYVBORDlZZ2dJRzYrak9jZ21wazNEQU5CZ2txaGtpRzl3MEJBUXNGQURBegogICAgICAgICAgTVJ3d0dnWURWUVFLRXhOc2FXNTFlR052Ym5SaGFXNWxjbk11YjNKbk1STXdFUVlEVlFRRERBcDBhVzFBWld4MwogICAgICAgICAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ=="
-                    ),
-                },
-            )
+            assert data == {
+                "key1": "dmFsdWUx",
+                "key2": (
+                    "ICAgICAgICAgIC0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQogICAgICAgICAgTUlJRllqQ0NBMHFnQXdJQkFnSVFLYVBORDlZZ2dJRzYrak9jZ21wazNEQU5CZ2txaGtpRzl3MEJBUXNGQURBegogICAgICAgICAgTVJ3d0dnWURWUVFLRXhOc2FXNTFlR052Ym5SaGFXNWxjbk11YjNKbk1STXdFUVlEVlFRRERBcDBhVzFBWld4MwogICAgICAgICAgLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ=="
+                ),
+            }
 
 
 class TestReadSecretData(unittest.TestCase):