SemianiakaVY/openpencil
1
0
Fork 0
Code Issues Pull requests Actions 1 Packages Projects Releases Wiki Activity

test(desktop): align collab boundary self-test fixtures with the gate

Browse source 
The mutation self-test has been red since the pairing-code hardening
landed: five new gate anchors (PeerIdentityPolicy, cross-account
admission tests, guest confirmation coverage, VerifiedRelayTokenClaims)
were added without fixture counterparts, and the op-collab-host
extraction moved the runtime paths the fixtures still wrote to. Fixture
files now mirror the scanned layout (including a cfg(test)-pathed
admission_tests module), so all 57 mutation cases pass.
This commit is contained in:
Kayshen-X 2026-08-08 11:52:34 +08:00
parent b8e41fa3c6
commit 0eda62dee4
2 changed files with 33 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
tools/check-collab-security-boundaries-cases.sh
View file

@ -137,7 +137,7 @@ expect_failure "requires the credential transport codec workflow test" \
new_fixture desktop-renewal-vec-copy
printf '%s\n' \
'fn bad(ticket: Ticket) { let _ = ticket.expose().as_bytes().to_vec(); }' \
>> "$fixture_root/crates/op-host-desktop/src/collab_runtime/types.rs"
>> "$fixture_root/crates/op-collab-host/src/runtime/types.rs"
expect_failure "rejects ordinary Vec copies in desktop renewal commands" \
"desktop renewal commands must move OpaqueTicket"
@ -247,7 +247,7 @@ expect_failure "rejects compact bearer tokens in the smoke crate" \
"high-signal credential/private-key material detected"
new_fixture desktop-sensitive-file
: > "$fixture_root/crates/op-host-desktop/src/collab_runtime/runtime-ticket.token"
: > "$fixture_root/crates/op-collab-host/src/runtime/runtime-ticket.token"
expect_failure "rejects sensitive files in desktop collaboration integration" \
"sensitive key/token-shaped files are forbidden"

34
tools/check-collab-security-boundaries.test.sh
View file

@ -52,7 +52,8 @@ new_fixture() {
"$fixture_root/crates/op-editor-host-core/src/collab" \
"$fixture_root/crates/op-editor-ui/src" \
"$fixture_root/crates/op-host-native/src" \
"$fixture_root/crates/op-host-desktop/src/collab_runtime" \
"$fixture_root/crates/op-host-desktop/src" \
"$fixture_root/crates/op-collab-host/src/runtime/network" \
"$fixture_root/crates/op-host-services/src" \
"$fixture_root/crates/op-i18n/src" \
"$fixture_root/deploy/collab-relay" \
@ -561,6 +562,29 @@ EOF
fn presence_payload_limit_applies_to_encode_and_decode() {}
#[test]
fn oversized_snapshot_kind_cannot_raise_the_owner_inbound_ceiling() {}
EOF
cat > "$fixture_root/crates/op-collab-transport/src/admission.rs" <<'EOF'
pub enum PeerIdentityPolicy {
ThisAccount,
AnyIssuedAccount,
}
#[cfg(test)]
#[path = "admission_tests.rs"]
mod admission_tests;
EOF
cat > "$fixture_root/crates/op-collab-transport/src/admission_tests.rs" <<'EOF'
#[test]
fn any_issued_account_admits_a_foreign_subject_but_keeps_every_other_check() {}
#[test]
fn an_unpinned_join_without_confirmation_still_requires_this_account() {}
#[test]
fn an_unpinned_join_admits_a_foreign_account_only_behind_the_confirmation_gate() {}
EOF
cat > "$fixture_root/crates/op-auth-bridge/src/collab_relay_token.rs" <<'EOF'
pub struct VerifiedRelayTokenClaims;
EOF
cat > "$fixture_root/crates/op-collab-transport/src/config.rs" <<'EOF'
@ -733,16 +757,20 @@ EOF
pub const MAX_AVATAR_SOURCE_PIXELS: u64 = 1_048_576;
EOF
cat > "$fixture_root/crates/op-host-desktop/src/collab_runtime/types.rs" <<'EOF'
cat > "$fixture_root/crates/op-collab-host/src/runtime/types.rs" <<'EOF'
assert_not_impl_any!(OwnerNetworkCommand: Clone);
assert_not_impl_any!(GuestNetworkCommand: Clone);
assert_not_impl_any!(PeerNetworkCommand: Clone);
fn verification_commands_move_the_original_ticket_allocation() {}
EOF
cat > "$fixture_root/crates/op-host-desktop/src/collab_runtime/relay_bootstrap_tests.rs" <<'EOF'
cat > "$fixture_root/crates/op-collab-host/src/runtime/relay_bootstrap_tests.rs" <<'EOF'
#[test]
fn payload_rejects_exact_cross_region_key_reuse() {}
EOF
cat > "$fixture_root/crates/op-collab-host/src/runtime/network/owner.rs" <<'EOF'
fn admission_policy() { let _ = PeerIdentityPolicy::AnyIssuedAccount; }
EOF
ln -s "$script_dir/check-collab-security-boundaries.test.sh" \