Drop stale keychain scope source test
This commit is contained in:
parent
d98a749737
commit
c98becd044
1 changed files with 0 additions and 146 deletions
|
|
@ -1,146 +0,0 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Regression test: socket password keychain entries are scoped per debug instance."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import subprocess
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
def get_repo_root() -> Path:
|
||||
result = subprocess.run(
|
||||
["git", "rev-parse", "--show-toplevel"],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=False,
|
||||
)
|
||||
if result.returncode == 0:
|
||||
return Path(result.stdout.strip())
|
||||
return Path.cwd()
|
||||
|
||||
|
||||
def require(content: str, needle: str, message: str, failures: list[str]) -> None:
|
||||
if needle not in content:
|
||||
failures.append(message)
|
||||
|
||||
|
||||
def reject(content: str, needle: str, message: str, failures: list[str]) -> None:
|
||||
if needle in content:
|
||||
failures.append(message)
|
||||
|
||||
|
||||
def main() -> int:
|
||||
repo_root = get_repo_root()
|
||||
cli_path = repo_root / "CLI" / "cmux.swift"
|
||||
settings_path = repo_root / "Sources" / "SocketControlSettings.swift"
|
||||
|
||||
missing = [str(path) for path in (cli_path, settings_path) if not path.exists()]
|
||||
if missing:
|
||||
print("FAIL: missing expected files:")
|
||||
for path in missing:
|
||||
print(f"- {path}")
|
||||
return 1
|
||||
|
||||
cli = cli_path.read_text(encoding="utf-8")
|
||||
settings = settings_path.read_text(encoding="utf-8")
|
||||
failures: list[str] = []
|
||||
|
||||
require(
|
||||
cli,
|
||||
"static func resolve(explicit: String?, socketPath: String) -> String?",
|
||||
"CLI resolver must accept socketPath to determine scoped keychain service",
|
||||
failures,
|
||||
)
|
||||
require(
|
||||
cli,
|
||||
"private static func keychainServices(socketPath: String) -> [String]",
|
||||
"CLI must derive keychain services from socket context",
|
||||
failures,
|
||||
)
|
||||
require(
|
||||
cli,
|
||||
'return ["\\(service).\\(scope)"]',
|
||||
"CLI should use only the scoped keychain service when scope is present",
|
||||
failures,
|
||||
)
|
||||
require(
|
||||
cli,
|
||||
"URL(fileURLWithPath: socketPath).lastPathComponent",
|
||||
"CLI scope detection should parse the socket file name",
|
||||
failures,
|
||||
)
|
||||
require(
|
||||
cli,
|
||||
"kSecUseAuthenticationContext as String: authContext",
|
||||
"CLI keychain lookup must fail fast without interactive keychain prompts",
|
||||
failures,
|
||||
)
|
||||
require(
|
||||
cli,
|
||||
"SocketPasswordResolver.resolve(explicit: socketPasswordArg, socketPath: socketPath)",
|
||||
"CLI run path must pass socketPath into password resolution",
|
||||
failures,
|
||||
)
|
||||
|
||||
require(
|
||||
settings,
|
||||
"private static func keychainScope(environment: [String: String]) -> String?",
|
||||
"App keychain store should compute a scoped keychain namespace",
|
||||
failures,
|
||||
)
|
||||
require(
|
||||
settings,
|
||||
"environment[SocketControlSettings.launchTagEnvKey]",
|
||||
"App keychain scope should prioritize CMUX_TAG",
|
||||
failures,
|
||||
)
|
||||
require(
|
||||
settings,
|
||||
"URL(fileURLWithPath: socketPath).lastPathComponent",
|
||||
"App keychain scope should parse the socket file name",
|
||||
failures,
|
||||
)
|
||||
require(
|
||||
settings,
|
||||
"private static func keychainService(environment: [String: String]) -> String",
|
||||
"App keychain service should be derived from environment scope",
|
||||
failures,
|
||||
)
|
||||
require(
|
||||
settings,
|
||||
'return "\\(service).\\(scope)"',
|
||||
"App keychain service should append the scoped suffix",
|
||||
failures,
|
||||
)
|
||||
require(
|
||||
settings,
|
||||
"kSecAttrService as String: keychainService(environment: environment)",
|
||||
"App keychain queries should use mode-specific scoped service",
|
||||
failures,
|
||||
)
|
||||
require(
|
||||
settings,
|
||||
"return try? loadPassword(environment: environment)",
|
||||
"configuredPassword should read keychain from matching scoped service",
|
||||
failures,
|
||||
)
|
||||
|
||||
reject(
|
||||
settings,
|
||||
"private static var baseQuery: [String: Any]",
|
||||
"Legacy global baseQuery should not remain as a static unscoped property",
|
||||
failures,
|
||||
)
|
||||
|
||||
if failures:
|
||||
print("FAIL: keychain scope regression(s) detected")
|
||||
for failure in failures:
|
||||
print(f"- {failure}")
|
||||
return 1
|
||||
|
||||
print("PASS: socket password keychain service is scoped by tagged debug instance")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
Loading…
Add table
Add a link
Reference in a new issue