Hinotobi
ca31ab2a80
* Secure Codex OAuth credential writes * fix: publish Codex auth with private permissions --------- Co-authored-by: Peter Steinberger <steipete@gmail.com>
32 lines
1.1 KiB
Swift
32 lines
1.1 KiB
Swift
import Foundation
|
|
import Testing
|
|
@testable import CodexBarCore
|
|
|
|
@Suite
|
|
struct CodexOAuthCredentialsStoreLinuxTests {
|
|
@Test
|
|
func saveKeepsAuthJSONPrivate() throws {
|
|
#if os(macOS) || os(Linux)
|
|
let codexHome = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("codex-oauth-permissions-\(UUID().uuidString)", isDirectory: true)
|
|
defer { try? FileManager.default.removeItem(at: codexHome) }
|
|
|
|
let credentials = CodexOAuthCredentials(
|
|
accessToken: "access-token",
|
|
refreshToken: "refresh-token",
|
|
idToken: "id-token",
|
|
accountId: "account-123",
|
|
lastRefresh: Date())
|
|
|
|
try CodexOAuthCredentialsStore.save(credentials, env: ["CODEX_HOME": codexHome.path])
|
|
|
|
let authURL = codexHome.appendingPathComponent("auth.json")
|
|
let attributes = try FileManager.default.attributesOfItem(atPath: authURL.path)
|
|
let permissions = try #require(attributes[.posixPermissions] as? NSNumber)
|
|
#expect(permissions.intValue & 0o777 == 0o600)
|
|
#else
|
|
#expect(Bool(true))
|
|
#endif
|
|
}
|
|
}
|