v0.2.6-pre.010

crates/ksp-app-wallet-desk/tests/desktop_security.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-wallet-desk/tests/desktop_security.rs
-// version: 9
+// version: 10
 
 //! Static desktop security contracts for the Wallet Desk pre.002 shell.
 
@@ -171,7 +171,7 @@ fn owner_metadata_values_are_request_only_and_state_conflict_forces_reauthorizat
     let main = read_text(root.join("frontend/ts/main.ts").as_path());
     assert!(!metadata.contains("derive(Clone"));
     assert!(!metadata.contains("derive(Debug"));
-    assert!(state.contains("recover_owner_metadata_state_conflict"));
+    assert!(state.contains("recover_owner_state_conflict"));
     assert!(state.contains("inspect_locked_wallet_file_v1"));
     assert!(state.contains("ERROR_CODE_STATE_CONFLICT"));
     assert!(main.contains("isWalletStateConflict"));
@@ -183,3 +183,33 @@ fn owner_metadata_values_are_request_only_and_state_conflict_forces_reauthorizat
     assert!(!main.contains("window.confirm"));
     assert!(main.contains("new Modal(modalElement)"));
 }
+
+#[test]
+fn rotation_passwords_are_request_only_confirmed_frontend_side_and_never_logged() {
+    let root = app_root();
+    let security = read_text(root.join("src/wallet_security.rs").as_path());
+    let state = read_text(root.join("src/app_state.rs").as_path());
+    let main = read_text(root.join("frontend/ts/main.ts").as_path());
+    assert!(!security.contains("derive(Clone"));
+    assert!(!security.contains("derive(Debug"));
+    let request = security.split("pub(crate) struct WalletPasswordRotationRequestDto").nth(1);
+    assert!(request.is_some());
+    let fields = request
+        .unwrap_or_default()
+        .split("}\n")
+        .next()
+        .unwrap_or_default()
+        .lines()
+        .filter(|line| return line.trim_start().starts_with("pub(crate) "))
+        .collect::<std::vec::Vec<_>>()
+        .join("\n");
+    assert_eq!(fields.matches("password").count(), 1);
+    assert!(!fields.contains("confirm"));
+    assert!(state.contains("OwnerPassword::new(request.password)"));
+    assert!(state.contains("ViewPassword::new(request.password)"));
+    assert!(main.contains("password.value !== confirmation.value"));
+    assert!(main.contains("clearRotationSensitiveInputs"));
+    assert!(!main.contains("frontendDebug(\"main\", request.password"));
+    assert!(!main.contains("frontendTrace(\"main\", request.password"));
+    assert!(!main.contains("KSP_SECRET_WALLET_PASS_"));
+}