v0.5.2-pre.007

ks-wallet/tests/legacy_characterization.rs

@@ -1,5 +1,5 @@
 // file: ks-wallet/tests/legacy_characterization.rs
-// version: 1
+// version: 2
 
 //! External characterization tests for the legacy Solana JSON wallet format.
 
@@ -69,6 +69,31 @@ async fn legacy_missing_file_preserves_current_error_contract() {
     assert_eq!(error.code(), "wallet_file_metadata_failed");
 }
 
+#[tokio::test]
+async fn legacy_errors_and_debug_do_not_disclose_local_path() {
+    let directory = tempfile::tempdir()
+        .unwrap_or_else(|error| panic!("temporary directory must exist: {error}"));
+    let canary_directory = directory.path().join("wallet-path-canary");
+    std::fs::create_dir_all(&canary_directory)
+        .unwrap_or_else(|error| panic!("canary directory must be created: {error}"));
+    let store = ks_wallet::TemporaryWalletStore::new(&canary_directory)
+        .unwrap_or_else(|error| panic!("unexpected store error: {error}"));
+    let debug = format!("{store:?}");
+    assert!(!debug.contains("wallet-path-canary"));
+    assert!(!debug.contains(canary_directory.to_string_lossy().as_ref()));
+    let alias = ks_wallet::WalletAlias::parse("missing-canary")
+        .unwrap_or_else(|error| panic!("unexpected alias error: {error}"));
+    let error = store
+        .load(alias)
+        .await
+        .err()
+        .unwrap_or_else(|| panic!("missing legacy wallet must fail"));
+    let message = error.to_string();
+    assert_eq!(error.code(), "wallet_file_metadata_failed");
+    assert!(!message.contains("wallet-path-canary"));
+    assert!(!message.contains(canary_directory.to_string_lossy().as_ref()));
+}
+
 #[tokio::test]
 async fn legacy_corrupted_json_and_short_keypair_are_distinct() {
     let directory = tempfile::tempdir()

ks-wallet/tests/native_password.rs

@@ -1,5 +1,5 @@
 // file: ks-wallet/tests/native_password.rs
-// version: 1
+// version: 2
 
 //! External password-protected native wallet lifecycle tests.
 
@@ -137,6 +137,45 @@ async fn native_creation_is_private_and_refuses_overwrite() {
     assert_eq!(handle.public_key(), public_key);
 }
 
+#[tokio::test]
+async fn concurrent_native_creation_has_one_winner_and_preserves_valid_destination() {
+    let directory = tempfile::tempdir()
+        .unwrap_or_else(|error| panic!("temporary directory must exist: {error}"));
+    make_directory_private(directory.path());
+    let left_manager = ks_wallet::WalletManager::new(directory.path())
+        .unwrap_or_else(|error| panic!("left manager must be created: {error}"));
+    let right_manager = ks_wallet::WalletManager::new(directory.path())
+        .unwrap_or_else(|error| panic!("right manager must be created: {error}"));
+    let alias = ks_wallet::WalletAlias::parse("concurrent-create")
+        .unwrap_or_else(|error| panic!("alias must be valid: {error}"));
+    let left_alias = alias.clone();
+    let right_alias = alias.clone();
+    let left = left_manager.create(left_alias, password("left-password"));
+    let right = right_manager.create(right_alias, password("right-password"));
+    let (left_result, right_result) = tokio::join!(left, right);
+    let (winner, loser_error) = match (left_result, right_result) {
+        (std::result::Result::Ok(wallet), std::result::Result::Err(error)) => (wallet, error),
+        (std::result::Result::Err(error), std::result::Result::Ok(wallet)) => (wallet, error),
+        (std::result::Result::Ok(_), std::result::Result::Ok(_)) => {
+            panic!("concurrent creation must not publish two wallets for one alias");
+        },
+        (std::result::Result::Err(_), std::result::Result::Err(_)) => {
+            panic!("exactly one concurrent creation must succeed");
+        },
+    };
+    assert_eq!(loser_error.code(), "wallet_native_already_exists");
+    let public_key = winner.public_key();
+    winner.lock();
+    let verifier = ks_wallet::WalletManager::new(directory.path())
+        .unwrap_or_else(|error| panic!("verification manager must be created: {error}"));
+    let handle = verifier
+        .lookup(&alias)
+        .await
+        .unwrap_or_else(|error| panic!("published wallet lookup must succeed: {error}"))
+        .unwrap_or_else(|| panic!("published wallet must exist"));
+    assert_eq!(handle.public_key(), public_key);
+}
+
 #[tokio::test]
 async fn authenticated_header_tampering_fails_before_signing_capability() {
     let directory = tempfile::tempdir()