CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-11 23:49:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

test: memorable bridge tests pass on a runner that enforces file modes; scanner-proof key fixture

Browse Source 
- The consent-write-failure tests make the state dir read-only, which also
  blocked the bridge lock directory (exit 5 before the path under test);
  the locks dir is pre-created so only the consent write fails.
- The unreadable-store test leaves a 0600 directory behind (the policy
  script chmods the store path); cleanup restores the search bit and the
  suite's afterEach reopens directories before removing.
- The AWS-key-shaped fixture is built by concatenation, as every sibling
  test does, so the CI credential gate does not read it as a live key.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-09-09 04:32:56 +00:00
co-authored by Claude Fable 5.1
parent 73d1d77d60
commit 9cabb7cdbb
2 changed files with 28 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/gstack-memorable.test.ts
+3
View File
@@ -164,6 +164,7 @@ describe('enable', () => {
const roState = path.join(home, 'ro-state');
fs.mkdirSync(roState);
fs.writeFileSync(path.join(roState, 'config.yaml'), 'telemetry: off\n', { mode: 0o444 });
fs.mkdirSync(path.join(roState, 'locks')); // the bridge lock must still be takeable: only the consent write may fail
fs.chmodSync(roState, 0o555);
const ro = { GSTACK_HOME: roState, GSTACK_STATE_ROOT: roState, GSTACK_STATE_DIR: roState };
const r = run(['enable'], ro);
@@ -384,6 +385,7 @@ describe('enable/disable failure paths (coverage audit)', () => {
// state dir: gate already 'on' from an earlier enable, then made read-only
setGate('on');
writeSettings({ hooks: { UserPromptSubmit: [{ hooks: [{ type: 'command', command: `${canonical}/${HOOK_REL}`, timeout: 5 }] }] } });
fs.mkdirSync(path.join(env.GSTACK_HOME, 'locks'), { recursive: true }); // lock stays takeable; only the consent write fails
fs.chmodSync(path.join(env.GSTACK_HOME, 'config.yaml'), 0o444);
fs.chmodSync(env.GSTACK_HOME, 0o555);
const r = run(['enable']);
@@ -398,6 +400,7 @@ describe('enable/disable failure paths (coverage audit)', () => {
if (!canRevokeWrites()) return; // chmod is advisory here (win32, root, DAC-override containers)
setGate('on');
writeSettings({ hooks: { UserPromptSubmit: [{ hooks: [{ type: 'command', command: `${canonical}/${HOOK_REL}` }] }] } });
fs.mkdirSync(path.join(env.GSTACK_HOME, 'locks'), { recursive: true }); // lock stays takeable; only the consent write fails
fs.chmodSync(path.join(env.GSTACK_HOME, 'config.yaml'), 0o444);
fs.chmodSync(env.GSTACK_HOME, 0o555);
const r = run(['disable']);