tests/test_secret_broker.py

• store · function · L51-L52 — def store(tmp_path)
• broker · function · L56-L57 — def broker(store)
• _Unavailable · class · L60-L64 — class _Unavailable(MemoryBackend)
• available · method · L63-L64 — def available(self) -> bool
• _BrokenRoundTrip · class · L67-L75 — class _BrokenRoundTrip(MemoryBackend)
• get · method · L74-L75 — def get(self, namespace, scope, name)
• test_a_reference_leaks_nothing_about_the_secret · function · L83-L89 — def test_a_reference_leaks_nothing_about_the_secret()
• test_a_namespaced_reference_round_trips_without_a_path · function · L92-L96 — def test_a_namespaced_reference_round_trips_without_a_path(store)
• test_store_namespace_is_realpath_stable_and_copy_path_specific · function · L99-L109 — def test_store_namespace_is_realpath_stable_and_copy_path_specific(tmp_path)
• test_the_reference_does_not_depend_on_the_value · function · L112-L115 — def test_the_reference_does_not_depend_on_the_value(broker)
• test_split_ref_round_trips · function · L118-L122 — def test_split_ref_round_trips()
• test_malformed_references_are_rejected · function · L126-L128 — def test_malformed_references_are_rejected(bad)
• test_plaintext_is_not_mistaken_for_a_reference · function · L131-L135 — def test_plaintext_is_not_mistaken_for_a_reference()
• test_scope_and_name_are_constrained · function · L139-L142 — def test_scope_and_name_are_constrained(bad)
• test_a_multiline_secret_is_refused · function · L145-L149 — def test_a_multiline_secret_is_refused(broker)
• test_round_trip · function · L157-L159 — def test_round_trip(broker)
• test_delete_removes_it · function · L162-L165 — def test_delete_removes_it(broker)
• test_describe_reports_configured_without_the_value · function · L168-L173 — def test_describe_reports_configured_without_the_value(broker)
• test_describe_reports_absence · function · L176-L177 — def test_describe_reports_absence(broker)
• test_shared_system_backend_isolates_same_named_secrets_by_store · function · L181-L205 — def test_shared_system_backend_isolates_same_named_secrets_by_store(tmp_path)
• test_foreign_v2_and_ownerless_v1_refs_never_touch_system_backend · function · L209-L253 — def test_foreign_v2_and_ownerless_v1_refs_never_touch_system_backend(tmp_path)
• SpyBackend · class · L214-L225 — class SpyBackend(MemoryBackend)
• init · method · L215-L217 — def init(self)
• get · method · L219-L221 — def get(self, namespace, scope, name)
• delete · method · L223-L225 — def delete(self, namespace, scope, name)
• test_nested_profile_and_connector_foreign_refs_fail_closed · function · L257-L300 — def test_nested_profile_and_connector_foreign_refs_fail_closed(tmp_path)
• test_a_backend_that_cannot_round_trip_is_not_used · function · L308-L314 — def test_a_backend_that_cannot_round_trip_is_not_used(store)
• test_auto_fails_closed_rather_than_degrading_to_plaintext · function · L317-L329 — def test_auto_fails_closed_rather_than_degrading_to_plaintext(store)
• test_failing_closed_does_not_leak_a_secret_into_the_message · function · L332-L335 — def test_failing_closed_does_not_leak_a_secret_into_the_message(store)
• test_plaintext_remains_reachable_but_only_by_name · function · L338-L342 — def test_plaintext_remains_reachable_but_only_by_name(store)
• test_keychain_mode_fails_closed · function · L345-L348 — def test_keychain_mode_fails_closed(store)
• test_keychain_mode_accepts_a_working_backend · function · L351-L353 — def test_keychain_mode_accepts_a_working_backend(store)
• test_plaintext_mode_is_explicit_and_says_so · function · L356-L360 — def test_plaintext_mode_is_explicit_and_says_so(store)
• test_a_working_backend_is_preferred_over_plaintext · function · L363-L367 — def test_a_working_backend_is_preferred_over_plaintext(store)
• test_mode_rejects_garbage · function · L370-L372 — def test_mode_rejects_garbage(store)
• test_the_self_test_cleans_up_after_itself · function · L375-L378 — def test_the_self_test_cleans_up_after_itself()
• test_macos_keychain_account_contains_store_namespace · function · L382-L401 — def test_macos_keychain_account_contains_store_namespace(monkeypatch)
• fake_run · function · L388-L390 — def fake_run(argv, stdin=None, *, detach_from_tty=False)
• test_only_keychain_write_runs_detached_from_the_controlling_terminal · function · L405-L441 — def test_only_keychain_write_runs_detached_from_the_controlling_terminal(monkeypatch)
• fake_subprocess_run · function · L416-L421 — def fake_subprocess_run(argv, **kwargs)
• test_secret_service_attributes_contain_store_namespace · function · L445-L466 — def test_secret_service_attributes_contain_store_namespace(monkeypatch)
• fake_run · function · L451-L453 — def fake_run(argv, stdin=None)
• test_migration_replaces_plaintext_with_a_reference · function · L474-L480 — def test_migration_replaces_plaintext_with_a_reference(store, broker)
• test_the_value_survives_migration · function · L483-L486 — def test_the_value_survives_migration(store, broker)
• test_migration_is_idempotent · function · L489-L495 — def test_migration_is_idempotent(store, broker)
• test_v1_system_reference_reports_reentry_without_backend_lookup · function · L499-L518 — def test_v1_system_reference_reports_reentry_without_backend_lookup(store)
• SpyBackend · class · L500-L507 — class SpyBackend(MemoryBackend)
• init · method · L501-L503 — def init(self)
• get · method · L505-L507 — def get(self, namespace, scope, name)
• test_revoked_v2_setting_is_reentry_required_not_already · function · L522-L532 — def test_revoked_v2_setting_is_reentry_required_not_already(store)
• test_an_unverifiable_write_leaves_the_plaintext_alone · function · L535-L547 — def test_an_unverifiable_write_leaves_the_plaintext_alone(store)
• test_one_bad_key_does_not_strand_the_others · function · L550-L562 — def test_one_bad_key_does_not_strand_the_others(store)
• _OnlyLlmBreaks · class · L551-L553 — class _OnlyLlmBreaks(MemoryBackend)
• get · method · L552-L553 — def get(self, namespace, scope, name)
• test_empty_settings_are_skipped · function · L565-L572 — def test_empty_settings_are_skipped(store, broker)
• test_a_fingerprint_is_not_the_secret · function · L575-L581 — def test_a_fingerprint_is_not_the_secret()
• test_get_secret_setting_reads_legacy_plaintext · function · L589-L592 — def test_get_secret_setting_reads_legacy_plaintext(store)
• test_v1_reference_still_resolves_db_local_plaintext_slot · function · L595-L600 — def test_v1_reference_still_resolves_db_local_plaintext_slot(store)
• test_get_secret_setting_resolves_a_reference · function · L603-L606 — def test_get_secret_setting_resolves_a_reference(store)
• test_set_secret_setting_records_only_a_reference · function · L609-L611 — def test_set_secret_setting_records_only_a_reference(store)
• test_clearing_a_secret_removes_it_from_the_store_too · function · L614-L620 — def test_clearing_a_secret_removes_it_from_the_store_too(store)
• test_set_secret_setting_refuses_to_record_an_unverifiable_write · function · L623-L628 — def test_set_secret_setting_refuses_to_record_an_unverifiable_write(store)
• test_missing_secret_reads_as_empty_not_as_the_reference · function · L631-L636 — def test_missing_secret_reads_as_empty_not_as_the_reference(store)
• test_a_revoked_secret_is_not_reported_as_configured · function · L639-L663 — def test_a_revoked_secret_is_not_reported_as_configured(store, tmp_path)
• _profiles · function · L671-L677 — def _profiles(store, tmp_path)
• test_a_new_profile_stores_only_a_reference · function · L680-L685 — def test_a_new_profile_stores_only_a_reference(store, tmp_path)
• test_the_profile_key_is_still_usable · function · L688-L691 — def test_the_profile_key_is_still_usable(store, tmp_path)
• test_activating_a_profile_copies_the_key_not_the_reference · function · L694-L700 — def test_activating_a_profile_copies_the_key_not_the_reference(store, tmp_path)
• test_legacy_plaintext_profile_keys_migrate · function · L703-L715 — def test_legacy_plaintext_profile_keys_migrate(store, tmp_path)
• test_profile_migration_is_idempotent · function · L718-L726 — def test_profile_migration_is_idempotent(store, tmp_path)
• test_legacy_profile_ref_is_reported_for_reentry_without_lookup · function · L730-L747 — def test_legacy_profile_ref_is_reported_for_reentry_without_lookup(store, tmp_path)
• test_revoked_v2_profile_ref_is_reported_for_reentry · function · L751-L765 — def test_revoked_v2_profile_ref_is_reported_for_reentry(store, tmp_path)
• test_a_legacy_profile_key_keeps_working_before_migration · function · L768-L771 — def test_a_legacy_profile_key_keeps_working_before_migration(store, tmp_path)
• test_deleting_a_profile_deletes_its_credential · function · L774-L781 — def test_deleting_a_profile_deletes_its_credential(store, tmp_path)
• test_clearing_a_profile_key_removes_it_from_the_store · function · L784-L790 — def test_clearing_a_profile_key_removes_it_from_the_store(store, tmp_path)
• test_replacing_a_profile_key_does_not_strand_the_old_one · function · L793-L797 — def test_replacing_a_profile_key_does_not_strand_the_old_one(store, tmp_path)
• _add_connector · function · L805-L812 — def _add_connector(store, env)
• test_connector_env_values_are_brokered · function · L815-L819 — def test_connector_env_values_are_brokered(store)
• test_every_env_value_is_brokered_not_just_the_credential_shaped_ones · function · L822-L828 — def test_every_env_value_is_brokered_not_just_the_credential_shaped_ones(store)
• test_the_launcher_gets_real_values · function · L831-L836 — def test_the_launcher_gets_real_values(store)
• test_legacy_plaintext_connector_env_still_launches · function · L839-L843 — def test_legacy_plaintext_connector_env_still_launches(store)
• test_connector_env_migration · function · L846-L862 — def test_connector_env_migration(store)
• test_connector_env_migration_is_idempotent · function · L865-L869 — def test_connector_env_migration_is_idempotent(store)
• test_legacy_connector_ref_is_reported_for_reentry · function · L873-L889 — def test_legacy_connector_ref_is_reported_for_reentry(store)
• test_revoked_v2_connector_ref_is_reported_for_reentry · function · L893-L904 — def test_revoked_v2_connector_ref_is_reported_for_reentry(store)
• test_deleting_a_connector_deletes_its_env_secrets · function · L907-L911 — def test_deleting_a_connector_deletes_its_env_secrets(store)
• test_an_unresolvable_env_reference_is_not_passed_through · function · L914-L920 — def test_an_unresolvable_env_reference_is_not_passed_through(store)
• test_empty_env_is_untouched · function · L923-L926 — def test_empty_env_is_untouched(store)
• test_plaintext_backend_never_claims_to_be_secure · function · L934-L935 — def test_plaintext_backend_never_claims_to_be_secure(store)
• test_no_obfuscation_backend_exists · function · L938-L946 — def test_no_obfuscation_backend_exists()
• test_env_injection_reads_the_operators_variable · function · L954-L959 — def test_env_injection_reads_the_operators_variable(store, monkeypatch)
• test_env_injection_prefers_namespaced_value_then_legacy_global · function · L962-L978 — def test_env_injection_prefers_namespaced_value_then_legacy_global(store, monkeypatch)
• test_env_injection_writes_nothing_to_disk · function · L981-L990 — def test_env_injection_writes_nothing_to_disk(store, monkeypatch)
• test_env_injection_refuses_to_be_overwritten_by_the_app · function · L993-L1004 — def test_env_injection_refuses_to_be_overwritten_by_the_app(store, monkeypatch)
• test_a_fresh_server_can_opt_in_before_any_credential_exists · function · L1007-L1013 — def test_a_fresh_server_can_opt_in_before_any_credential_exists(store, monkeypatch)
• test_variable_names_are_predictable · function · L1016-L1026 — def test_variable_names_are_predictable(monkeypatch)
• test_separator_runs_cannot_name_two_different_variables · function · L1029-L1035 — def test_separator_runs_cannot_name_two_different_variables()
• test_auto_prefers_a_keychain_over_the_environment · function · L1038-L1047 — def test_auto_prefers_a_keychain_over_the_environment(store, monkeypatch)
• test_one_undescribable_profile_ref_does_not_strand_the_others · function · L1051-L1075 — def test_one_undescribable_profile_ref_does_not_strand_the_others(store, tmp_path)
• test_migration_failures_report_a_type_name_never_exception_text · function · L1079-L1100 — def test_migration_failures_report_a_type_name_never_exception_text(store, tmp_path)
• _env_broker · function · L1108-L1114 — def _env_broker(store, monkeypatch, **variables)
• test_an_injected_credential_resolves_with_no_row_at_all · function · L1117-L1127 — def test_an_injected_credential_resolves_with_no_row_at_all(store, monkeypatch)
• test_the_store_facade_resolves_it_too · function · L1130-L1136 — def test_the_store_facade_resolves_it_too(store, monkeypatch)
• test_every_settings_credential_is_addressable_this_way · function · L1139-L1145 — def test_every_settings_credential_is_addressable_this_way(store, monkeypatch)
• test_resolution_from_the_environment_still_writes_nothing · function · L1148-L1157 — def test_resolution_from_the_environment_still_writes_nothing(store, monkeypatch)
• test_a_row_still_wins_over_the_environment · function · L1160-L1167 — def test_a_row_still_wins_over_the_environment(store, monkeypatch)
• test_a_writable_backend_does_not_answer_for_an_empty_row · function · L1170-L1195 — def test_a_writable_backend_does_not_answer_for_an_empty_row(store)
• _DeleteSilentlyFails · class · L1179-L1181 — class _DeleteSilentlyFails(MemoryBackend)
• delete · method · L1180-L1181 — def delete(self, namespace, scope, name)
• test_the_namespaced_variable_the_ui_names_is_the_one_that_resolves · function · L1198-L1227 — def test_the_namespaced_variable_the_ui_names_is_the_one_that_resolves( store, monkeypatch )
• test_the_plain_variable_keeps_resolving_alongside_it · function · L1230-L1241 — def test_the_plain_variable_keeps_resolving_alongside_it(store, monkeypatch)
• test_a_key_outside_the_scope_table_is_not_guessed_at · function · L1244-L1253 — def test_a_key_outside_the_scope_table_is_not_guessed_at(store, monkeypatch)