From 8de5cde87ee8a691e397ff7efea6f48bded71535 Mon Sep 17 00:00:00 2001
From: Dave Mihalcik <dmihalcik@virtru.com>
Date: Tue, 8 Sep 2026 16:21:26 -0400
Subject: [PATCH] fix(cli): reject extra inspect args and add stdin BATS
 coverage

Follow-up to review feedback on #3937 (dspx-2604-08-streamio):

- inspectDoc now sets Args = cobra.MaximumNArgs(1), so extra positional
  arguments (e.g. `otdfctl inspect a.tdf b.tdf`) are rejected instead of
  silently ignoring everything after the first path.
- Add BATS coverage for piping a TDF into `inspect` via stdin, and for the
  new extra-args rejection, in otdfctl/e2e/encrypt-decrypt.bats.

TestOpenSeekableSpoolsNonSeekableNamedFile in otdfctl/pkg/streamio was also
flagged as using syscall.Mkfifo, which is not portable to Windows; it
already guards with a runtime.GOOS == "windows" skip, so no change was
needed there.

Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>
---
 otdfctl/cmd/tdf/inspect.go       |  1 +
 otdfctl/e2e/encrypt-decrypt.bats | 14 ++++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/otdfctl/cmd/tdf/inspect.go b/otdfctl/cmd/tdf/inspect.go
index 7b8fd351de..e28e7980e8 100644
--- a/otdfctl/cmd/tdf/inspect.go
+++ b/otdfctl/cmd/tdf/inspect.go
@@ -106,6 +106,7 @@ func inspectRun(cmd *cobra.Command, args []string) {
 
 func InitInspectCommand() {
 	inspectDoc.GroupID = TDF
+	inspectDoc.Args = cobra.MaximumNArgs(1)
 
 	inspectDoc.PreRun = func(cmd *cobra.Command, args []string) {
 		// Set the json flag to true since we only support json output
diff --git a/otdfctl/e2e/encrypt-decrypt.bats b/otdfctl/e2e/encrypt-decrypt.bats
index 32b336e676..9c52c547d8 100755
--- a/otdfctl/e2e/encrypt-decrypt.bats
+++ b/otdfctl/e2e/encrypt-decrypt.bats
@@ -103,6 +103,20 @@ teardown_file(){
   ./otdfctl decrypt --host $HOST --tls-no-verify $DEBUG_LEVEL $WITH_CREDS $OUTFILE_TXT | grep "$SECRET_TEXT"
 }
 
+@test "inspect TDF3, one attribute, stdin" {
+  echo $SECRET_TEXT | ./otdfctl encrypt -o $OUT_TXT --host $HOST --tls-no-verify $DEBUG_LEVEL $WITH_CREDS -a $FQN
+
+  inspect_output=$(cat $OUTFILE_TXT | ./otdfctl --host $HOST --tls-no-verify $WITH_CREDS inspect)
+  assert_equal "$(echo "$inspect_output" | jq -r '.manifest.encryptionInformation.keyAccess | length')" "1"
+}
+
+@test "inspect rejects extra positional arguments" {
+  echo $SECRET_TEXT | ./otdfctl encrypt -o $OUT_TXT --host $HOST --tls-no-verify $DEBUG_LEVEL $WITH_CREDS -a $FQN
+
+  run sh -c "./otdfctl --host $HOST --tls-no-verify $WITH_CREDS inspect $OUTFILE_TXT extra-arg"
+  assert_failure
+}
+
 @test "allow traversal with mapped key uses definition when value missing" {
   local attr_name="attr-allow-traversal-${RANDOM}"
   local kas_name="kas-allow-traversal-${RANDOM}"