hansjone/oclaw
1
0
Fork 0
mirror of https://github.com/hansjone/oclaw.git synced 2026-10-13 04:40:44 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

test(uds-auth): assert credential generation relative to the seeded default (0.3.19)
Some checks are pending
ci / test (push) Waiting to run
Details
ci / test-postgresql (push) Waiting to run
Details

Browse source 
RolesStore.init() now seeds the default emergency password, so a fresh
store starts at generation 1. Two remediation-0310 tests hard-coded the
old absolute versions (3 and 1/2). Compare against the post-init
baseline instead; the queueing and failed-write behavior under test is
unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
oliver 2026-10-12 19:41:45 +08:00
parent f0b4b6cd74
commit dfdf298184
2 changed files with 8 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
uds-auth/package.json
View file

@ -1,6 +1,6 @@
{
"name": "uds-auth",
"version": "0.3.18",
"version": "0.3.19",
"description": "UDS authentication plugin for DeepSeek Harness — trusted single-instance access control (not strong multi-tenant isolation)",
"type": "module",
"main": "lib/index.js",

11
uds-auth/test/remediation-0310.test.js
View file

@ -108,16 +108,18 @@ test('password transactions queue set/set/clear and persist a restart-safe gener
const dir = await temporary(t), file = join(dir, 'roles.json')
const store = new RolesStore({ rolesFile: file })
await store.init()
// init() seeds the default emergency password, so assert relative to that baseline.
const base = store.getFallbackCredVersion()
await Promise.all([
store.setFallbackPassword('password-first-0310', ROLES.SUPER_ADMIN),
store.setFallbackPassword('password-second-0310', ROLES.SUPER_ADMIN),
store.clearFallbackPassword(ROLES.SUPER_ADMIN),
])
assert.equal(store.isFallbackEnabled(), false)
assert.equal(store.getFallbackCredVersion(), 3)
assert.equal(store.getFallbackCredVersion(), base + 3)
const reopened = new RolesStore({ rolesFile: file }); await reopened.init()
assert.equal(reopened.isFallbackEnabled(), false)
assert.equal(reopened.getFallbackCredVersion(), 3)
assert.equal(reopened.getFallbackCredVersion(), base + 3)
})
test('queued admin writes recheck the actor after a preceding demotion commits', async t => {
@ -140,6 +142,7 @@ test('failed credential write cannot resurrect an uncommitted peer; next queued
const file = join(await temporary(t), 'roles.json')
const store = new RolesStore({ rolesFile: file }); await store.init()
await store.setFallbackPassword('original-password-0310', ROLES.SUPER_ADMIN)
const durable = store.getFallbackCredVersion()
const originalFlush = store.flush.bind(store)
let start, finish
const started = new Promise(r => start = r), gate = new Promise(r => finish = r)
@ -152,12 +155,12 @@ test('failed credential write cannot resurrect an uncommitted peer; next queued
const failure = assert.rejects(first, /injected-write-failure/)
await started
const second = store.setFallbackPassword('committed-second-0310', ROLES.SUPER_ADMIN)
assert.equal(store.getFallbackCredVersion(), 1, 'readers see only the durable generation')
assert.equal(store.getFallbackCredVersion(), durable, 'readers see only the durable generation')
finish(); await failure; await second
assert.equal(await store.verifyFallbackAsync('uncommitted-password-0310', 'ip1'), false)
assert.equal(await store.verifyFallbackAsync('committed-second-0310', 'ip2'), true)
const again = new RolesStore({ rolesFile: file }); await again.init()
assert.equal(again.getFallbackCredVersion(), 2)
assert.equal(again.getFallbackCredVersion(), durable + 1)
assert.equal(await again.verifyFallbackAsync('committed-second-0310', 'ip3'), true)
})