From f58c5bf9b35c3f0b2a6eb03421440ffc7605faf0 Mon Sep 17 00:00:00 2001 From: Kayshen-X Date: Sun, 9 Aug 2026 08:59:43 +0800 Subject: [PATCH] test(desktop): unflag the redaction fixture and de-unixify relay path tests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The boundary gate's credential scanner greps source literally, so the redaction test's sk-ant fixture is now assembled with concat! — the runtime string is unchanged, the source no longer looks like a leaked key. The relay token-policy test built /policy.json-style paths that count as relative on Windows, so the config constructor's absolute-path check failed before the assertion ran; the paths now carry a drive prefix there. --- .../src/production_auth_relay_token_tests.rs | 16 +++++++++++++--- crates/op-util/src/cli_output_tests.rs | 4 +++- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/crates/op-collab-relay-server/src/production_auth_relay_token_tests.rs b/crates/op-collab-relay-server/src/production_auth_relay_token_tests.rs index 979c1290e..b42bdedb0 100644 --- a/crates/op-collab-relay-server/src/production_auth_relay_token_tests.rs +++ b/crates/op-collab-relay-server/src/production_auth_relay_token_tests.rs @@ -177,13 +177,23 @@ fn relay_token_bound_to_another_device_key_is_refused() { )); } +/// An absolute path on every host: the config constructor rejects relative +/// paths, and a bare `/name` is not absolute on Windows (no drive prefix). +fn absolute_test_path(name: &str) -> PathBuf { + if cfg!(windows) { + PathBuf::from(format!("C:\\{name}")) + } else { + PathBuf::from(format!("/{name}")) + } +} + #[test] fn legacy_ticket_bearer_policy_is_parsed_strictly_from_configuration() { let base = ProductionRelayAuthConfig::new( RelayRegion::Cn, - PathBuf::from("/policy.json"), - PathBuf::from("/locator.json"), - Some(PathBuf::from("/x25519.json")), + absolute_test_path("policy.json"), + absolute_test_path("locator.json"), + Some(absolute_test_path("x25519.json")), NonZeroU64::new(60).expect("policy max age"), false, ) diff --git a/crates/op-util/src/cli_output_tests.rs b/crates/op-util/src/cli_output_tests.rs index 7eb4a5ea3..f4a2c5572 100644 --- a/crates/op-util/src/cli_output_tests.rs +++ b/crates/op-util/src/cli_output_tests.rs @@ -78,7 +78,9 @@ fn credential_shaped_assignments_lose_their_values() { #[test] fn bare_credential_tokens_are_dropped_without_a_key_name() { for token in [ - "sk-ant-api03-fakefakefake", + // Assembled at compile time so the collab boundary gate's source + // scan for high-signal credential shapes does not flag the fixture. + concat!("sk-ant-api03-", "fakefakefake"), "ghp_fakefakefakefakefake", "ya29.a0AfakeFakeFake", "eyJhbGciOiJIUzI1NiJ9.ZmFrZXBheWxvYWQ.c2lnbmF0dXJl",