16 Commits

Include renames

Author	SHA1	Message	Date
zarzet	70a2a92558	fix: resolve backend and test analyzer diagnostics	2026-09-06 16:14:57 +07:00
zarzet	0e71003e12	test: decouple app fixtures from extension identities	2026-09-06 16:03:11 +07:00
zarzet	fdb4a0eaa5	fix(auth): preserve shared signed-session challenge identity	2026-09-06 02:33:42 +07:00
zarzet	e931d5e2b0	refactor(core): reduce generated and duplicate code	2026-08-30 11:57:47 +07:00
zarzet	fd74240c24	perf(extensions): coalesce signed session lifecycle	2026-08-29 23:47:34 +07:00
zarzet	63d29d2ed4	fix(security): validate extension callback state	2026-08-29 18:53:33 +07:00
zarzet	cab1af1828	fix(download): restore reliable provider fallback retries	2026-08-29 03:19:38 +07:00
zarzet	66928e259d	fix(session): enforce provider retry modes	2026-07-30 13:31:54 +07:00
zarzet	113ad7ed9b	fix(session): block challenged session generations	2026-07-30 13:09:42 +07:00
zarzet	177a176218	fix(session): honor canonical gateway error contracts	2026-07-30 12:59:48 +07:00
zarzet	169a811162	fix(session): coordinate verification across parallel downloads	2026-07-30 11:39:37 +07:00
zarzet	c4abbf8743	fix(verification): recover signed-session bootstrap failures	2026-07-26 11:09:18 +07:00
zarzet	685392f073	fix(download): accelerate verified extension resumes	2026-07-23 09:56:39 +07:00
zarzet	b4f66ff4eb	chore(backend): align merged test file and fd stubs with lint conventions	2026-07-10 10:25:12 +07:00
zarzet	b1f8224310	test(extensions): skip POSIX permission assertion on Windows ... The signed-session test from #462 asserts the session file is 0600, but Windows does not preserve Unix permission bits, so the suite failed on Windows dev machines while passing in CI.	2026-07-10 10:24:25 +07:00
Amix	fc2818dd97	test(extensions): add coverage for signed session HMAC auth flow (#462) ... extension_signed_session.go implements the HMAC-signed session scheme extensions use to authenticate against their own backends (namespace scoping, on-disk persistence, rolling-key signing, expiry/refresh, and the grant exchange flow), but had zero direct or indirect test coverage. Adds table-driven tests for the pure helpers (namespace sanitization, config defaults, time parsing, URL building, Retry-After parsing, record scope normalization) plus runtime-backed tests using a mocked http.RoundTripper for the stateful flows: file persistence round-trips, status/clear, grant exchange and refresh, 401-triggered session revocation, and unauthenticated fetches surfacing the verification URL. The centerpiece is TestDoSignedSessionRequestSignature, which recomputes the rolling-key HMAC signature server-side from the request headers the client actually sent, the same way a real backend would validate it, to catch any accidental regression in the signing scheme itself (field order, rolling-key derivation, or header names).	2026-07-10 10:11:12 +07:00