v0.2.6-pre.006

crates/ksp-app-wallet-desk/tests/desktop_contract.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-wallet-desk/tests/desktop_contract.rs
-// version: 5
+// version: 6
 
 //! Desktop build, shell and Config-status contract audits for Wallet Desk.
 
@@ -141,5 +141,34 @@ fn pre_005_create_and_session_lifecycle_are_backend_owned() {
     assert!(html.contains("id=\"createWalletOwnerPassword\""));
     assert!(html.contains("id=\"createWalletViewPassword\""));
     assert!(main.contains("clearCreateFormSensitiveInputs"));
-    assert!(main.contains("OWNER Wallet session rendered after creation"));
+    assert!(main.contains("Authorized Wallet session rendered"));
+}
+
+#[test]
+fn pre_006_unlock_surface_is_explicit_backend_owned_and_supports_view_owner() {
+    let root = app_root();
+    let state = read_text(root.join("src/app_state.rs").as_path());
+    let secrets = read_text(root.join("src/wallet_secrets.rs").as_path());
+    let session = read_text(root.join("src/wallet_session.rs").as_path());
+    let tauri = read_text(root.join("src/tauri.rs").as_path());
+    let html = read_text(root.join("frontend/main.html").as_path());
+    let main = read_text(root.join("frontend/ts/main.ts").as_path());
+    assert!(state.contains("open_wallet_view_file_v1"));
+    assert!(state.contains("open_wallet_owner_file_v1"));
+    assert!(state.contains("WalletSession::PrivilegedOperation"));
+    assert!(state.contains("WalletSession::View"));
+    assert!(secrets.contains("environment_report"));
+    assert!(secrets.contains("reveal_effective_environment_value"));
+    assert!(secrets.contains("normalize_wallet_secret_label"));
+    assert!(session.contains("WalletUnlockRequestDto"));
+    assert!(tauri.contains("unlock_wallet_view_manual"));
+    assert!(tauri.contains("unlock_wallet_owner_manual"));
+    assert!(tauri.contains("unlock_wallet_view_configured"));
+    assert!(tauri.contains("unlock_wallet_owner_configured"));
+    assert!(html.contains("id=\"unlockViewManual\""));
+    assert!(html.contains("id=\"unlockOwnerManual\""));
+    assert!(html.contains("id=\"unlockViewConfigured\""));
+    assert!(html.contains("id=\"unlockOwnerConfigured\""));
+    assert!(main.contains("beginFrontendUnlock"));
+    assert!(main.contains("configuredSecretCandidateCount"));
 }

crates/ksp-app-wallet-desk/tests/desktop_security.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-wallet-desk/tests/desktop_security.rs
-// version: 4
+// version: 5
 
 //! Static desktop security contracts for the Wallet Desk pre.002 shell.
 
@@ -66,3 +66,37 @@ fn create_passwords_are_request_only_and_protected_projection_is_purged() {
     assert!(!main.contains("frontendDebug(\"main\", request.ownerPassword"));
     assert!(!main.contains("frontendTrace(\"main\", request.viewPassword"));
 }
+
+#[test]
+fn unlock_passwords_and_config_secret_names_never_cross_rust_to_frontend() {
+    let root = app_root();
+    let session = read_text(root.join("src/wallet_session.rs").as_path());
+    let main = read_text(root.join("frontend/ts/main.ts").as_path());
+    let html = read_text(root.join("frontend/main.html").as_path());
+    let authorized = session.split("pub(crate) struct WalletAuthorizedDto").nth(1);
+    assert!(authorized.is_some());
+    let authorized = authorized.unwrap_or_default().split("}\n\n/// Create request").next().unwrap_or_default();
+    assert!(!authorized.contains("password"));
+    let unlock_request = session.find("pub(crate) struct WalletUnlockRequestDto");
+    assert!(unlock_request.is_some());
+    assert!(session[unlock_request.unwrap_or_default()..].contains("password: String"));
+    assert!(main.contains("clearUnlockSensitiveInputs"));
+    assert!(!main.contains("KSP_SECRET_WALLET_PASS_"));
+    assert!(!html.contains("KSP_SECRET_WALLET_PASS_"));
+    assert!(!main.contains("variableName"));
+    assert!(!main.contains("effectiveSource"));
+}
+
+#[test]
+fn wallet_selection_does_not_auto_unlock_configured_secrets() {
+    let root = app_root();
+    let main = read_text(root.join("frontend/ts/main.ts").as_path());
+    let selection_start = main.find("async function selectWallet");
+    let selection_end = main.find("function bindWalletTableSelection");
+    assert!(selection_start.is_some());
+    assert!(selection_end.is_some());
+    let selection = &main[selection_start.unwrap_or_default()..selection_end.unwrap_or(main.len())];
+    assert!(selection.contains("select_wallet"));
+    assert!(!selection.contains("unlock_wallet_view_configured"));
+    assert!(!selection.contains("unlock_wallet_owner_configured"));
+}