47 lines
1.7 KiB
Python
47 lines
1.7 KiB
Python
|
"""密钥安全存储单元测试。"""
|
||
|
|
from unittest.mock import patch
|
||
|
|
|
||
|
|
from app import secret_store
|
||
|
|
from app.secret_store import mask_secret, resolve_secret, store_secret
|
||
|
|
|
||
|
|
|
||
|
|
def test_mask_plaintext():
|
||
|
|
assert mask_secret("sk-abcdef123456") == "***3456"
|
||
|
|
assert mask_secret("abc") == "••••"
|
||
|
|
assert mask_secret("") == ""
|
||
|
|
|
||
|
|
|
||
|
|
def test_mask_keychain_ref():
|
||
|
|
assert mask_secret("keychain:yawen-workbench.providers:provider-1") == "•••• 钥匙串保管"
|
||
|
|
|
||
|
|
|
||
|
|
def test_store_without_keychain_returns_plaintext():
|
||
|
|
with patch.object(secret_store, "keychain_available", return_value=False):
|
||
|
|
result = store_secret("provider-1", "sk-secret")
|
||
|
|
assert result == "sk-secret" # 降级：DB 存明文（旧行为）
|
||
|
|
|
||
|
|
|
||
|
|
def test_store_with_keychain_writes_reference():
|
||
|
|
class FakeCompleted:
|
||
|
|
returncode = 0
|
||
|
|
with patch.object(secret_store, "keychain_available", return_value=True), \
|
||
|
|
patch.object(secret_store.subprocess, "run", return_value=FakeCompleted()) as run:
|
||
|
|
result = store_secret("provider-1", "sk-secret")
|
||
|
|
assert result == "keychain:yawen-workbench.providers:provider-1"
|
||
|
|
assert run.call_count == 2 # delete + add
|
||
|
|
|
||
|
|
|
||
|
|
def test_resolve_keychain_reference():
|
||
|
|
class FakeCompleted:
|
||
|
|
returncode = 0
|
||
|
|
stdout = "sk-real-secret\n"
|
||
|
|
with patch.object(secret_store, "keychain_available", return_value=True), \
|
||
|
|
patch.object(secret_store.subprocess, "run", return_value=FakeCompleted()):
|
||
|
|
assert resolve_secret("keychain:yawen-workbench.providers:provider-1",
|
||
|
|
"provider-1") == "sk-real-secret"
|
||
|
|
|
||
|
|
|
||
|
|
def test_resolve_plaintext_passthrough():
|
||
|
|
assert resolve_secret("sk-plain", "provider-1") == "sk-plain"
|
||
|
|
assert resolve_secret("", "provider-1") == ""
|