v0.2.6-pre.005

crates/ksp-app-wallet-desk/tests/desktop_contract.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-wallet-desk/tests/desktop_contract.rs
-// version: 4
+// version: 5
 
 //! Desktop build, shell and Config-status contract audits for Wallet Desk.
 
@@ -119,3 +119,27 @@ fn frontend_control_interactions_are_trace_logged_without_control_values() {
     assert!(main.contains("viewId: control.dataset.view"));
     assert!(!main.contains("control.value"));
 }
+
+#[test]
+fn pre_005_create_and_session_lifecycle_are_backend_owned() {
+    let root = app_root();
+    let state = read_text(root.join("src/app_state.rs").as_path());
+    let session = read_text(root.join("src/wallet_session.rs").as_path());
+    let tauri = read_text(root.join("src/tauri.rs").as_path());
+    let html = read_text(root.join("frontend/main.html").as_path());
+    let main = read_text(root.join("frontend/ts/main.ts").as_path());
+    assert!(state.contains("ksp_wallet_lib::create_wallet_file_v1"));
+    assert!(state.contains("WalletSession::Owner"));
+    assert!(state.contains("WalletSession::Locked"));
+    assert!(state.contains("std::mem::replace"));
+    assert!(session.contains("WalletCreateRequestDto"));
+    assert!(session.contains("WalletAuthorizedDto"));
+    assert!(tauri.contains("create_wallet"));
+    assert!(tauri.contains("deselect_wallet"));
+    assert!(tauri.contains("lock_wallet"));
+    assert!(html.contains("id=\"createWalletForm\""));
+    assert!(html.contains("id=\"createWalletOwnerPassword\""));
+    assert!(html.contains("id=\"createWalletViewPassword\""));
+    assert!(main.contains("clearCreateFormSensitiveInputs"));
+    assert!(main.contains("OWNER Wallet session rendered after creation"));
+}

crates/ksp-app-wallet-desk/tests/desktop_security.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-wallet-desk/tests/desktop_security.rs
-// version: 2
+// version: 3
 
 //! Static desktop security contracts for the Wallet Desk pre.002 shell.
 
@@ -46,3 +46,20 @@ fn locked_inventory_frontend_never_receives_protected_wallet_identity_fields() {
     assert!(!inventory.contains("notes:"));
     assert!(!inventory.contains("password:"));
 }
+
+#[test]
+fn create_passwords_are_request_only_and_protected_projection_is_purged() {
+    let root = app_root();
+    let session = read_text(root.join("src/wallet_session.rs").as_path());
+    let main = read_text(root.join("frontend/ts/main.ts").as_path());
+    let authorized = session.split("pub(crate) struct WalletAuthorizedDto").nth(1);
+    assert!(authorized.is_some());
+    let authorized = authorized.unwrap_or_default().split("}\n\n/// Create request").next().unwrap_or_default();
+    assert!(!authorized.contains("password"));
+    assert!(session[request_start..].contains("owner_password"));
+    assert!(session[request_start..].contains("view_password"));
+    assert!(main.contains("clearAuthorizedProjection"));
+    assert!(main.contains("clearCreateFormSensitiveInputs"));
+    assert!(!main.contains("frontendDebug(\"main\", request.ownerPassword"));
+    assert!(!main.contains("frontendTrace(\"main\", request.viewPassword"));
+}