v0.2.6-pre.007

crates/ksp-app-wallet-desk/tests/desktop_security.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-wallet-desk/tests/desktop_security.rs
-// version: 6
+// version: 7
 
 //! Static desktop security contracts for the Wallet Desk pre.002 shell.
 
@@ -102,3 +102,27 @@ fn wallet_selection_does_not_auto_unlock_configured_secrets() {
     assert!(!selection.contains("unlock_wallet_view_configured"));
     assert!(!selection.contains("unlock_wallet_owner_configured"));
 }
+
+#[test]
+fn balance_refresh_never_accepts_pubkey_or_endpoint_url_from_frontend() {
+    let root = app_root();
+    let state = read_text(root.join("src/app_state.rs").as_path());
+    let tauri = read_text(root.join("src/tauri.rs").as_path());
+    let main = read_text(root.join("frontend/ts/main.ts").as_path());
+    let command_start = tauri.find("async fn refresh_wallet_balance");
+    assert!(command_start.is_some());
+    let command = &tauri[command_start.unwrap_or_default()..];
+    let command = command.split("#[tauri::command]").next().unwrap_or_default();
+    assert!(!command.contains("request:"));
+    assert!(!command.contains("pubkey"));
+    let refresh_start = main.find("async function refreshWalletBalance");
+    let refresh_end = main.find("function bindBalanceActions");
+    assert!(refresh_start.is_some());
+    assert!(refresh_end.is_some());
+    let refresh = &main[refresh_start.unwrap_or_default()..refresh_end.unwrap_or(main.len())];
+    assert!(refresh.contains("refresh_wallet_balance"));
+    assert!(!refresh.contains("pubkey"));
+    assert!(!main.contains("transportUrl"));
+    assert!(!main.contains("endpointUrl"));
+    assert!(state.contains("wallet.pubkey()"));
+}