v0.2.6-pre.018

crates/ksp-app-wallet-desk/tests/release_compliance.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-wallet-desk/tests/release_compliance.rs
-// version: 3
+// version: 4
 
 //! Release-wide deterministic compliance canaries for Wallet Desk.
 
@@ -181,3 +181,36 @@ fn wallet_desk_dependency_firewall_and_tauri_capabilities_are_minimal() {
     assert!(!capability_source.contains("dialog:"));
     assert!(!capability_source.contains("fs:"));
 }
+
+#[test]
+fn packaged_resources_include_only_registered_config_sources_and_schemas() {
+    let root = app_root();
+    let tauri_source = read_text(root.join("tauri.conf.json").as_path());
+    let tauri = serde_json::from_str::<serde_json::Value>(tauri_source.as_str());
+    assert!(tauri.is_ok(), "Wallet Desk Tauri config should parse");
+    let tauri = match tauri {
+        std::result::Result::Ok(value) => value,
+        std::result::Result::Err(_) => return,
+    };
+    let resources = tauri.pointer("/bundle/resources").and_then(serde_json::Value::as_object);
+    assert!(resources.is_some(), "Wallet Desk package must declare Config resources");
+    let resources = match resources {
+        std::option::Option::Some(value) => value,
+        std::option::Option::None => return,
+    };
+    assert_eq!(resources.len(), 8);
+    for (source, destination) in resources {
+        let destination = destination.as_str();
+        assert!(destination.is_some(), "resource destination must be textual");
+        let destination = match destination {
+            std::option::Option::Some(value) => value,
+            std::option::Option::None => continue,
+        };
+        assert!(source.starts_with("../../config/"));
+        assert!(destination.starts_with("config/"));
+        for forbidden in [".env", "wallets", "logs", "secret", "private"] {
+            assert!(!source.contains(forbidden), "mutable/secret runtime resource must not be bundled: {source}");
+            assert!(!destination.contains(forbidden), "mutable/secret runtime destination must not be bundled: {destination}");
+        }
+    }
+}