wehub-resource-sync
68 lines
2.7 KiB
Swift
68 lines
2.7 KiB
Swift
import Foundation
|
|
import Testing
|
|
@testable import CodexBarCore
|
|
|
|
struct CodexOAuthCredentialsStorePermissionsTests {
|
|
private enum PublishProbeError: Error, Equatable {
|
|
case stop
|
|
}
|
|
|
|
@Test
|
|
func `saving O auth credentials keeps auth json private`() throws {
|
|
#if os(macOS) || os(Linux)
|
|
let codexHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-oauth-permissions-\(UUID().uuidString)", isDirectory: true)
|
|
defer { try? FileManager.default.removeItem(at: codexHome) }
|
|
|
|
let credentials = CodexOAuthCredentials(
|
|
accessToken: "access-token",
|
|
refreshToken: "refresh-token",
|
|
idToken: "id-token",
|
|
accountId: "account-123",
|
|
lastRefresh: Date())
|
|
|
|
try CodexOAuthCredentialsStore.save(credentials, env: ["CODEX_HOME": codexHome.path])
|
|
|
|
let authURL = codexHome.appendingPathComponent("auth.json")
|
|
let attributes = try FileManager.default.attributesOfItem(atPath: authURL.path)
|
|
let permissions = try #require(attributes[.posixPermissions] as? NSNumber)
|
|
#expect(permissions.intValue & 0o777 == 0o600)
|
|
#else
|
|
#expect(Bool(true))
|
|
#endif
|
|
}
|
|
|
|
@Test
|
|
func `auth json is private before atomic publication`() throws {
|
|
#if os(macOS) || os(Linux)
|
|
let codexHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-oauth-staging-\(UUID().uuidString)", isDirectory: true)
|
|
defer { try? FileManager.default.removeItem(at: codexHome) }
|
|
try FileManager.default.createDirectory(at: codexHome, withIntermediateDirectories: true)
|
|
|
|
let authURL = codexHome.appendingPathComponent("auth.json")
|
|
let originalData = Data("original".utf8)
|
|
try originalData.write(to: authURL)
|
|
|
|
#expect(throws: PublishProbeError.stop) {
|
|
try CodexOAuthCredentialsStore._writePrivateFileForTesting(
|
|
Data("replacement".utf8),
|
|
to: authURL)
|
|
{ stagedURL in
|
|
let attributes = try FileManager.default.attributesOfItem(atPath: stagedURL.path)
|
|
let permissions = try #require(attributes[.posixPermissions] as? NSNumber)
|
|
#expect(permissions.intValue & 0o777 == 0o600)
|
|
#expect(try Data(contentsOf: authURL) == originalData)
|
|
throw PublishProbeError.stop
|
|
}
|
|
}
|
|
|
|
#expect(try Data(contentsOf: authURL) == originalData)
|
|
let entries = try FileManager.default.contentsOfDirectory(atPath: codexHome.path)
|
|
#expect(entries == ["auth.json"])
|
|
#else
|
|
#expect(Bool(true))
|
|
#endif
|
|
}
|
|
}
|