bvandeusenandClaude Opus 5.5
79de8938b9
Module and test docstrings state what is pinned without the record number or step that introduced it. Incident accounts become the failure shape in the present tense: the pipefail head, the code_shapes import, the export order, the facet dialects, the cross-kind repeat, the write-once kind. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
48 lines
1.8 KiB
Python
48 lines
1.8 KiB
Python
"""Forge-connection tokens are stored sealed.
|
|
|
|
Migration 0122 seals the rows that existed before, with its OWN frozen copy of
|
|
the v1 key derivation (so a later edit to services/secrets.py can never change
|
|
what an old migration writes). That copy is only right while it agrees with
|
|
what the app opens today — which is what this pins. If secrets.py ever moves
|
|
to a v2 key, it must still open v1 values, and this test says so.
|
|
"""
|
|
import importlib.util
|
|
from pathlib import Path
|
|
from types import SimpleNamespace
|
|
from unittest.mock import patch
|
|
|
|
from scribe.services import secrets
|
|
from scribe.services.forge_connections import connection_token
|
|
|
|
_MIGRATION = Path(__file__).resolve().parents[1] / "alembic" / "versions" / "0122_seal_forge_tokens.py"
|
|
|
|
|
|
def _migration():
|
|
spec = importlib.util.spec_from_file_location("migration_0122", _MIGRATION)
|
|
module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
def test_what_the_migration_seals_the_app_opens():
|
|
sealed = _migration().seal_v1("gitea-read-token")
|
|
assert "gitea-read-token" not in sealed
|
|
assert secrets.unseal(sealed) == "gitea-read-token"
|
|
|
|
|
|
def test_a_row_reads_through_connection_token():
|
|
row = SimpleNamespace(token_sealed=secrets.seal("ghp_abc"))
|
|
assert connection_token(row) == "ghp_abc"
|
|
|
|
|
|
def test_a_row_sealed_under_another_key_reads_as_none():
|
|
row = SimpleNamespace(token_sealed=secrets.seal("ghp_abc"))
|
|
with patch.object(secrets.Config, "SECRET_KEY", "a-different-instance"):
|
|
assert connection_token(row) is None
|
|
|
|
|
|
def test_a_left_over_plain_text_token_is_not_used_as_one():
|
|
"""A value that never went through seal is refused, not passed to the
|
|
forge as if it were the token: a reader sees None, never the raw bytes."""
|
|
assert connection_token(SimpleNamespace(token_sealed="plain-text-token")) is None
|