// file: crates/ksp-config-lib/unit_tests/transport.rs // version: 10 #[test] fn fixture_transport_profile_maps_complete_runtime_contract() { let engine = fixture_engine(); let engine = match engine { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let environment = crate::ConfigEnvironment::from_maps(std::collections::BTreeMap::new(), std::collections::BTreeMap::new()); let resolved = engine.load_resolved_transport_config(std::option::Option::None, &environment); assert!(resolved.is_ok(), "fixture Transport Config should map: {resolved:?}"); let resolved = match resolved { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; assert_eq!(resolved.file_id().as_str(), crate::FILE_ID_STD_TRANSPORT); assert_eq!(resolved.profile_id(), "secret_test"); assert_eq!(resolved.selection_source(), crate::ConfigProfileSelectionSource::DefaultProfile); assert_eq!(resolved.settings().retry().max_retries(), 4); assert_eq!(resolved.settings().retry().initial_backoff(), std::time::Duration::from_millis(125)); assert_eq!(resolved.settings().retry().max_backoff(), std::time::Duration::from_millis(2500)); assert_eq!(resolved.settings().endpoints().len(), 1); let endpoint = &resolved.settings().endpoints()[0]; assert_eq!(endpoint.name(), "fixture_private"); assert_eq!(endpoint.provider().as_str(), "fixture-provider"); assert_eq!(endpoint.cluster().as_str(), "fixture-cluster"); assert_eq!(endpoint.url().as_str(), "https://fallback.invalid"); assert_eq!(endpoint.connect_timeout(), std::time::Duration::from_millis(750)); assert_eq!(endpoint.request_timeout(), std::time::Duration::from_millis(2500)); assert_eq!(endpoint.max_idle_connections_per_host(), std::option::Option::Some(3)); assert_eq!(endpoint.roles().len(), 1); let role = &endpoint.roles()[0]; assert_eq!(role.role().as_str(), "default"); assert!(role.enabled()); assert_eq!(role.priority(), 7); assert_eq!(role.request_kinds().len(), 1); assert!(role.request_kinds()[0].is_wildcard()); assert_eq!(role.limits().requests_per_second().map(std::num::NonZeroU32::get), std::option::Option::Some(9)); assert_eq!(role.limits().burst_capacity().map(std::num::NonZeroU32::get), std::option::Option::Some(12)); assert_eq!(role.limits().max_concurrent_requests().map(std::num::NonZeroU32::get), std::option::Option::Some(4)); assert_eq!(role.limits().pause_after_rate_limit(), std::option::Option::Some(std::time::Duration::from_millis(650))); assert!(resolved.grpc_settings().is_none(), "V2 fixture must remain Yellowstone gRPC-free"); let ws = resolved.ws_settings(); assert!(ws.is_some(), "V2 fixture should expose WebSocket settings"); if let std::option::Option::Some(ws) = ws { assert_eq!(ws.endpoints().len(), 2); let endpoint = &ws.endpoints()[0]; assert_eq!(endpoint.name(), "fixture_private_ws"); assert_eq!(endpoint.provider().as_str(), "fixture-provider"); assert_eq!(endpoint.cluster().as_str(), "fixture-cluster"); assert_eq!(endpoint.protocol(), ksp_onchain_transport_lib::WsProtocolKind::SolanaStandard); assert_eq!(endpoint.url().as_str(), "wss://fallback.invalid"); assert_eq!(endpoint.session().command_timeout(), std::time::Duration::from_millis(4500)); assert_eq!(endpoint.session().close_timeout(), std::time::Duration::from_millis(4000)); assert_eq!(endpoint.session().reconnect().max_retries(), 7); assert_eq!(endpoint.session().reconnect().initial_backoff(), std::time::Duration::from_millis(200)); assert_eq!(endpoint.session().reconnect().max_backoff(), std::time::Duration::from_millis(4000)); assert_eq!(endpoint.session().resubscribe(), ksp_onchain_transport_lib::WsResubscribePolicy::Never); assert_eq!(endpoint.session().command_queue_capacity(), 64); assert_eq!(endpoint.session().notification_queue_capacity(), 48); assert_eq!(endpoint.session().max_active_subscriptions(), 256); assert_eq!(endpoint.session().max_pending_requests(), 24); assert_eq!(endpoint.session().max_message_size_bytes(), 33_554_432); assert_eq!(endpoint.session().max_frame_size_bytes(), 8_388_608); assert_eq!(endpoint.session().max_write_buffer_size_bytes(), 524_288); let helius = &ws.endpoints()[1]; assert_eq!(helius.name(), "fixture_helius_ws"); assert_eq!(helius.provider().as_str(), "helius"); assert_eq!(helius.cluster().as_str(), "mainnet-beta"); assert_eq!(helius.protocol(), ksp_onchain_transport_lib::WsProtocolKind::HeliusLaserStream); assert_eq!(helius.url().as_str(), "wss://mainnet.helius-rpc.com/?api-key=fixture-helius-key"); let _connect_future = ksp_onchain_transport_lib::HeliusLaserStreamWsSession::connect(helius.clone()); } } #[test] fn v1_transport_fixture_remains_backward_readable_and_http_only() { let engine = v1_fixture_engine(); let engine = match engine { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let environment = crate::ConfigEnvironment::from_maps(std::collections::BTreeMap::new(), std::collections::BTreeMap::new()); let resolved = engine.load_resolved_transport_config(std::option::Option::None, &environment); assert!(resolved.is_ok(), "strict Transport V1 fixture should remain readable: {resolved:?}"); if let std::result::Result::Ok(resolved) = resolved { assert_eq!(resolved.profile_id(), "legacy_http"); assert_eq!(resolved.settings().retry().max_retries(), 1); assert_eq!(resolved.settings().endpoints().len(), 1); assert_eq!(resolved.settings().endpoints()[0].url().as_str(), "https://legacy.invalid"); assert!(resolved.ws_settings().is_none(), "V1 must not invent WebSocket runtime settings"); assert!(resolved.grpc_settings().is_none(), "V1 must not invent Yellowstone gRPC runtime settings"); } } #[test] fn committed_transport_document_maps_default_and_explicit_profiles() { let engine = committed_engine(); let engine = match engine { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let environment = crate::ConfigEnvironment::from_maps(std::collections::BTreeMap::new(), std::collections::BTreeMap::new()); let default = engine.load_resolved_transport_config(std::option::Option::None, &environment); let mainnet = engine.load_resolved_transport_config(std::option::Option::Some("mainnet_public"), &environment); assert!(default.is_ok(), "committed default Transport profile should map: {default:?}"); assert!(mainnet.is_ok(), "committed explicit Transport profile should map: {mainnet:?}"); if let std::result::Result::Ok(default) = default { assert_eq!(default.profile_id(), "devnet_public"); assert_eq!(default.settings().endpoints()[0].cluster().as_str(), "devnet"); assert_eq!(default.settings().endpoints()[0].url().as_str(), "https://api.devnet.solana.com"); assert!(default.grpc_settings().is_none(), "Devnet profile must not invent a Yellowstone gRPC endpoint"); let ws = default.ws_settings(); assert!(ws.is_some(), "committed V3 Devnet profile should expose WebSocket settings"); if let std::option::Option::Some(ws) = ws { assert_eq!(ws.endpoints()[0].url().as_str(), "wss://api.devnet.solana.com"); assert_eq!(ws.endpoints()[0].protocol(), ksp_onchain_transport_lib::WsProtocolKind::SolanaStandard); } } if let std::result::Result::Ok(mainnet) = mainnet { assert_eq!(mainnet.profile_id(), "mainnet_public"); assert_eq!(mainnet.selection_source(), crate::ConfigProfileSelectionSource::Explicit); assert_eq!(mainnet.settings().endpoints()[0].cluster().as_str(), "mainnet-beta"); assert_eq!(mainnet.settings().endpoints()[0].url().as_str(), "https://api.mainnet-beta.solana.com"); assert!(mainnet.grpc_settings().is_none(), "generic Mainnet profile must stay distinct from the PublicNode gRPC profile"); let ws = mainnet.ws_settings(); assert!(ws.is_some(), "committed V3 Mainnet profile should expose WebSocket settings"); if let std::option::Option::Some(ws) = ws { assert_eq!(ws.endpoints()[0].url().as_str(), "wss://api.mainnet-beta.solana.com"); } } } #[test] fn committed_v3_publicnode_profiles_map_provider_neutral_yellowstone_grpc_with_network_scoped_secret_x_tokens() { let engine = committed_engine(); let engine = match engine { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; for (profile_id, endpoint_name, cluster, url, environment_name, canary) in [ ( "publicnode_mainnet", "publicnode_solana_mainnet_yellowstone", "mainnet-beta", "https://solana-yellowstone-grpc.publicnode.com:443", "KSP_SECRET_PUBLICNODE_MAINNET_GRPC_X_TOKEN", "PUBLICNODE-MAINNET-GRPC-X-TOKEN-CANARY", ), ( "publicnode_testnet", "publicnode_solana_testnet_yellowstone", "testnet", "https://solana-testnet-yellowstone-grpc.publicnode.com:443", "KSP_SECRET_PUBLICNODE_TESTNET_GRPC_X_TOKEN", "PUBLICNODE-TESTNET-GRPC-X-TOKEN-CANARY", ), ] { let mut process = std::collections::BTreeMap::::new(); process.insert(environment_name.to_owned(), canary.to_owned()); let environment = crate::ConfigEnvironment::from_maps(process, std::collections::BTreeMap::new()); let resolved = engine.load_resolved_transport_config(std::option::Option::Some(profile_id), &environment); assert!(resolved.is_ok(), "committed PublicNode V3 profile {profile_id} should map from its network-scoped token: {resolved:?}"); let resolved = match resolved { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => continue, }; assert_eq!(resolved.profile_id(), profile_id); assert!(resolved.ws_settings().is_some()); let grpc = resolved.grpc_settings(); assert!(grpc.is_some(), "PublicNode profile {profile_id} should expose Yellowstone gRPC settings"); if let std::option::Option::Some(grpc) = grpc { assert_eq!(grpc.endpoints().len(), 1); let endpoint = &grpc.endpoints()[0]; assert_eq!(endpoint.name(), endpoint_name); assert_eq!(endpoint.provider().as_str(), "publicnode"); assert_eq!(endpoint.cluster().as_str(), cluster); assert_eq!(endpoint.url().as_str(), url); assert!(endpoint.url().uses_tls()); assert_eq!(endpoint.metadata().len(), 1); assert_eq!(endpoint.metadata()[0].key(), "x-token"); assert!(endpoint.metadata()[0].is_secret()); let endpoint_debug = format!("{endpoint:?}"); assert!(!endpoint_debug.contains(canary), "PublicNode {cluster} x-token must stay redacted from endpoint Debug"); assert_eq!(endpoint.session().connect_timeout(), std::time::Duration::from_millis(10_000)); assert_eq!(endpoint.session().unary_timeout(), std::time::Duration::from_millis(10_000)); assert_eq!(endpoint.session().close_timeout(), std::time::Duration::from_millis(5_000)); assert_eq!(endpoint.session().reconnect().max_retries(), 5); assert!(grpc.validate().is_ok(), "Config-produced Yellowstone gRPC settings should satisfy Transport validation"); let debug = format!("{grpc:?}"); assert!(!debug.contains("publicnode.com"), "Transport settings Debug must not expose gRPC endpoint URLs"); assert!(!debug.contains(canary), "Transport settings Debug must not expose the network-scoped PublicNode x-token"); } } } #[test] fn v3_grpc_metadata_separates_public_and_secret_provenance() { let engine = v3_fixture_engine(); let engine = match engine { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let canary = "grpc-secret-canary"; let mut process = std::collections::BTreeMap::::new(); process.insert("KSP_SECRET_GRPC_TOKEN".to_owned(), canary.to_owned()); process.insert("KSP_PUBLIC_GRPC_LABEL".to_owned(), "operator-public".to_owned()); let environment = crate::ConfigEnvironment::from_maps(process, std::collections::BTreeMap::new()); let resolved = engine.load_resolved_transport_config(std::option::Option::None, &environment); assert!(resolved.is_ok(), "V3 gRPC metadata fixture should map: {resolved:?}"); let resolved = match resolved { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let grpc = resolved.grpc_settings(); assert!(grpc.is_some()); if let std::option::Option::Some(grpc) = grpc { let endpoint = &grpc.endpoints()[0]; assert_eq!(endpoint.metadata().len(), 2); assert_eq!(endpoint.metadata()[0].key(), "x-ksp-label"); assert!(!endpoint.metadata()[0].is_secret()); assert_eq!(endpoint.metadata()[1].key(), "x-ksp-token"); assert!(endpoint.metadata()[1].is_secret()); assert_eq!(endpoint.session().connect_timeout(), std::time::Duration::from_millis(4_500)); assert_eq!(endpoint.session().unary_timeout(), std::time::Duration::from_millis(7_000)); assert_eq!(endpoint.session().reconnect().max_retries(), 7); assert_eq!(endpoint.session().update_channel_capacity(), 32); } assert_eq!( resolved.effective().safe_value().pointer("/grpc_endpoints/0/metadata/0/value").and_then(serde_json::Value::as_str), std::option::Option::Some("operator-public") ); assert_eq!( resolved.effective().safe_value().pointer("/grpc_endpoints/0/secret_metadata/0/value").and_then(serde_json::Value::as_str), std::option::Option::Some("Bearer ********") ); let secret_provenance = resolved.effective().provenance_at("/grpc_endpoints/0/secret_metadata/0/value"); assert!(secret_provenance.is_some()); if let std::option::Option::Some(provenance) = secret_provenance { assert_eq!(provenance.len(), 2); assert_eq!(provenance[0], crate::ConfigValueProvenance::DocumentLiteral); assert_eq!(provenance[1].variable_name(), std::option::Option::Some("KSP_SECRET_GRPC_TOKEN")); } let debug = format!("{resolved:?}"); assert!(!debug.contains(canary)); assert!(debug.contains(crate::REDACTED_CONFIG_VALUE)); } #[test] fn v3_grpc_metadata_rejects_crossed_sensitivity_classes() { let engine = v3_fixture_engine(); let engine = match engine { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let mut process = std::collections::BTreeMap::::new(); process.insert("KSP_SECRET_GRPC_TOKEN".to_owned(), "secret-canary".to_owned()); process.insert("KSP_PUBLIC_GRPC_LABEL".to_owned(), "public-canary".to_owned()); let environment = crate::ConfigEnvironment::from_maps(process, std::collections::BTreeMap::new()); let public_from_secret = engine.load_resolved_transport_config(std::option::Option::Some("grpc_public_from_secret_invalid"), &environment); let secret_from_public = engine.load_resolved_transport_config(std::option::Option::Some("grpc_secret_from_public_invalid"), &environment); assert!(public_from_secret.is_err(), "public metadata must reject KSP_SECRET provenance"); assert!(secret_from_public.is_err(), "secret_metadata must reject non-secret environment provenance"); if let std::result::Result::Err(error) = public_from_secret { assert_eq!(error.code(), crate::ERROR_CODE_EFFECTIVE_CONFIG_INVALID); assert!(!format!("{error:?}").contains("secret-canary")); } if let std::result::Result::Err(error) = secret_from_public { assert_eq!(error.code(), crate::ERROR_CODE_EFFECTIVE_CONFIG_INVALID); assert!(!format!("{error:?}").contains("public-canary")); } } #[test] fn committed_v3_websocket_endpoint_preserves_v2_compatibility_constructor_without_polling() { let engine = committed_engine(); let engine = match engine { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let environment = crate::ConfigEnvironment::from_maps(std::collections::BTreeMap::new(), std::collections::BTreeMap::new()); let resolved = engine.load_resolved_transport_config(std::option::Option::Some("devnet_public"), &environment); assert!(resolved.is_ok(), "committed V3 Transport profile should map: {resolved:?}"); if let std::result::Result::Ok(resolved) = resolved { let (http, ws) = resolved.into_transport_settings(); assert_eq!(http.endpoints().len(), 1); assert!(ws.is_some(), "committed V3 Transport profile should expose WebSocket settings"); if let std::option::Option::Some(ws) = ws { assert!(ws.validate().is_ok(), "Config-produced WebSocket settings should satisfy Transport validation"); assert_eq!(ws.endpoints().len(), 1); let endpoint = ws.endpoints()[0].clone(); assert_eq!(endpoint.protocol(), ksp_onchain_transport_lib::WsProtocolKind::SolanaStandard); let _connect_future = ksp_onchain_transport_lib::WsSession::connect(endpoint); } } } #[test] fn transport_profile_preserves_global_and_profile_origin() { let engine = committed_engine(); let engine = match engine { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let file_id = crate::ConfigFileId::new(crate::FILE_ID_STD_TRANSPORT); let file_id = match file_id { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let profile = engine.load_resolved_profile(&file_id, std::option::Option::None); assert!(profile.is_ok(), "committed Transport profile should resolve: {profile:?}"); if let std::result::Result::Ok(profile) = profile { assert_eq!(profile.origin("retry"), std::option::Option::Some(crate::ConfigValueOrigin::Global)); assert_eq!(profile.origin("ws_defaults"), std::option::Option::Some(crate::ConfigValueOrigin::Global)); assert_eq!(profile.origin("grpc_defaults"), std::option::Option::Some(crate::ConfigValueOrigin::Global)); assert_eq!(profile.origin("endpoints"), std::option::Option::Some(crate::ConfigValueOrigin::Profile)); assert_eq!(profile.origin("ws_endpoints"), std::option::Option::Some(crate::ConfigValueOrigin::Profile)); assert_eq!(profile.origin("format_version"), std::option::Option::Some(crate::ConfigValueOrigin::Global)); } } #[test] fn composite_selected_transport_profile_preserves_composite_provenance() { let engine = committed_engine(); let engine = match engine { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let composite_file_id = crate::ConfigFileId::new(crate::FILE_ID_COMPOSITE_KSP_APP_WALLET_DESK); let composite_file_id = match composite_file_id { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let composite = engine.load_resolved_composite(&composite_file_id, std::option::Option::None); assert!(composite.is_ok(), "committed Wallet Desk composite should resolve: {composite:?}"); let composite = match composite { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let component = composite.component("transport"); assert!(component.is_some(), "Wallet Desk composite should contain Transport"); let component = match component { std::option::Option::Some(value) => value, std::option::Option::None => return, }; let environment = crate::ConfigEnvironment::from_maps(std::collections::BTreeMap::new(), std::collections::BTreeMap::new()); let resolved = engine.resolve_transport_config_profile(component.resolved(), &environment); assert!(resolved.is_ok(), "composite-selected Transport profile should map: {resolved:?}"); if let std::result::Result::Ok(resolved) = resolved { assert_eq!(resolved.profile_id(), "devnet_public"); assert_eq!(resolved.selection_source(), crate::ConfigProfileSelectionSource::Composite); assert_eq!(resolved.settings().endpoints()[0].cluster().as_str(), "devnet"); } } #[test] fn secret_transport_url_is_runtime_available_but_safe_projection_is_redacted() { let engine = fixture_engine(); let engine = match engine { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let canary = "https://secret-provider.invalid/?api-key=transport-secret-canary"; let mut process = std::collections::BTreeMap::::new(); process.insert("KSP_SECRET_TRANSPORT_TEST_URL".to_owned(), canary.to_owned()); let environment = crate::ConfigEnvironment::from_maps(process, std::collections::BTreeMap::new()); let resolved = engine.load_resolved_transport_config(std::option::Option::None, &environment); assert!(resolved.is_ok(), "secret Transport endpoint should map without being rejected: {resolved:?}"); let resolved = match resolved { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; assert_eq!(resolved.effective().sensitivity(), crate::ConfigSensitivity::Secret); assert_eq!(resolved.settings().endpoints()[0].url().as_str(), canary); let safe_url = resolved.effective().safe_value().pointer("/endpoints/0/url").and_then(serde_json::Value::as_str); assert_eq!(safe_url, std::option::Option::Some(crate::REDACTED_CONFIG_VALUE)); let debug = format!("{resolved:?}"); assert!(!debug.contains("transport-secret-canary")); assert!(debug.contains(crate::REDACTED_CONFIG_VALUE)); } #[test] fn secret_websocket_url_is_runtime_available_but_safe_projection_is_redacted() { let engine = fixture_engine(); let engine = match engine { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let canary = "wss://user:pass@secret-provider.invalid/path?api-key=transport-ws-secret-canary"; let mut process = std::collections::BTreeMap::::new(); process.insert("KSP_SECRET_TRANSPORT_TEST_WS_URL".to_owned(), canary.to_owned()); let environment = crate::ConfigEnvironment::from_maps(process, std::collections::BTreeMap::new()); let resolved = engine.load_resolved_transport_config(std::option::Option::None, &environment); assert!(resolved.is_ok(), "secret WebSocket endpoint should map without being exposed: {resolved:?}"); let resolved = match resolved { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let ws = resolved.ws_settings(); assert!(ws.is_some(), "V2 fixture should expose WebSocket settings"); if let std::option::Option::Some(ws) = ws { assert_eq!(ws.endpoints()[0].url().as_str(), canary); } let safe_url = resolved.effective().safe_value().pointer("/ws_endpoints/0/url").and_then(serde_json::Value::as_str); assert_eq!(safe_url, std::option::Option::Some(crate::REDACTED_CONFIG_VALUE)); let debug = format!("{resolved:?}"); assert!(!debug.contains("transport-ws-secret-canary")); assert!(!debug.contains("user:pass")); assert!(debug.contains(crate::REDACTED_CONFIG_VALUE)); } #[test] fn helius_laserstream_mainnet_and_devnet_api_key_map_to_protocol_and_safe_redaction() { let engine = fixture_engine(); let engine = match engine { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let canary = "helius-api-key-canary"; let mut process = std::collections::BTreeMap::::new(); process.insert("KSP_SECRET_HELIUS_API_KEY".to_owned(), canary.to_owned()); let environment = crate::ConfigEnvironment::from_maps(process, std::collections::BTreeMap::new()); let mainnet = engine.load_resolved_transport_config(std::option::Option::None, &environment); assert!(mainnet.is_ok(), "Helius mainnet WebSocket endpoint should map without exposing its API key: {mainnet:?}"); let mainnet = match mainnet { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let mainnet_ws = mainnet.ws_settings(); assert!(mainnet_ws.is_some(), "V2 fixture should expose mainnet WebSocket settings"); if let std::option::Option::Some(ws) = mainnet_ws { assert_eq!(ws.endpoints().len(), 2); let endpoint = &ws.endpoints()[1]; assert_eq!(endpoint.provider().as_str(), "helius"); assert_eq!(endpoint.cluster().as_str(), "mainnet-beta"); assert_eq!(endpoint.protocol(), ksp_onchain_transport_lib::WsProtocolKind::HeliusLaserStream); assert_eq!(endpoint.url().as_str(), "wss://mainnet.helius-rpc.com/?api-key=helius-api-key-canary"); } let mainnet_safe_url = mainnet.effective().safe_value().pointer("/ws_endpoints/1/url").and_then(serde_json::Value::as_str); assert_eq!(mainnet_safe_url, std::option::Option::Some("wss://mainnet.helius-rpc.com/?api-key=********")); let mainnet_provenance = mainnet.effective().provenance_at("/ws_endpoints/1/url"); assert!(mainnet_provenance.is_some(), "Helius mainnet endpoint URL should retain secret environment provenance"); if let std::option::Option::Some(provenance) = mainnet_provenance { assert_eq!(provenance.len(), 2); assert_eq!(provenance[0], crate::ConfigValueProvenance::DocumentLiteral); assert_eq!(provenance[1].environment_source(), std::option::Option::Some(crate::ConfigEnvironmentSource::Process)); assert_eq!(provenance[1].variable_name(), std::option::Option::Some("KSP_SECRET_HELIUS_API_KEY")); } let devnet = engine.load_resolved_transport_config(std::option::Option::Some("helius_devnet"), &environment); assert!(devnet.is_ok(), "Helius devnet WebSocket endpoint should map without exposing its API key: {devnet:?}"); let devnet = match devnet { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let devnet_ws = devnet.ws_settings(); assert!(devnet_ws.is_some(), "V2 fixture should expose devnet WebSocket settings"); if let std::option::Option::Some(ws) = devnet_ws { assert_eq!(ws.endpoints().len(), 1); let endpoint = &ws.endpoints()[0]; assert_eq!(endpoint.provider().as_str(), "helius"); assert_eq!(endpoint.cluster().as_str(), "devnet"); assert_eq!(endpoint.protocol(), ksp_onchain_transport_lib::WsProtocolKind::HeliusLaserStream); assert_eq!(endpoint.url().as_str(), "wss://devnet.helius-rpc.com/?api-key=helius-api-key-canary"); let _connect_future = ksp_onchain_transport_lib::HeliusLaserStreamWsSession::connect(endpoint.clone()); } let devnet_safe_url = devnet.effective().safe_value().pointer("/ws_endpoints/0/url").and_then(serde_json::Value::as_str); assert_eq!(devnet_safe_url, std::option::Option::Some("wss://devnet.helius-rpc.com/?api-key=********")); let devnet_provenance = devnet.effective().provenance_at("/ws_endpoints/0/url"); assert!(devnet_provenance.is_some(), "Helius devnet endpoint URL should retain secret environment provenance"); if let std::option::Option::Some(provenance) = devnet_provenance { assert_eq!(provenance.len(), 2); assert_eq!(provenance[0], crate::ConfigValueProvenance::DocumentLiteral); assert_eq!(provenance[1].environment_source(), std::option::Option::Some(crate::ConfigEnvironmentSource::Process)); assert_eq!(provenance[1].variable_name(), std::option::Option::Some("KSP_SECRET_HELIUS_API_KEY")); } let mainnet_debug = format!("{mainnet:?}"); let devnet_debug = format!("{devnet:?}"); assert!(!mainnet_debug.contains(canary)); assert!(!devnet_debug.contains(canary)); assert!(mainnet_debug.contains(crate::REDACTED_CONFIG_VALUE)); assert!(devnet_debug.contains(crate::REDACTED_CONFIG_VALUE)); } #[test] fn transport_secret_url_provenance_uses_process_and_process_beats_dotenv() { let engine = fixture_engine(); let engine = match engine { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let mut process = std::collections::BTreeMap::::new(); process.insert("KSP_SECRET_TRANSPORT_TEST_URL".to_owned(), "https://process.invalid".to_owned()); let mut dotenv = std::collections::BTreeMap::::new(); dotenv.insert("KSP_SECRET_TRANSPORT_TEST_URL".to_owned(), "https://dotenv.invalid".to_owned()); let environment = crate::ConfigEnvironment::from_maps(process, dotenv); let resolved = engine.load_resolved_transport_config(std::option::Option::None, &environment); assert!(resolved.is_ok(), "secret Transport environment precedence should map: {resolved:?}"); let resolved = match resolved { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; assert_eq!(resolved.settings().endpoints()[0].url().as_str(), "https://process.invalid"); let provenance = resolved.effective().provenance_at("/endpoints/0/url"); assert!(provenance.is_some(), "endpoint URL should retain environment provenance"); if let std::option::Option::Some(provenance) = provenance { assert_eq!(provenance.len(), 1); assert_eq!(provenance[0].environment_source(), std::option::Option::Some(crate::ConfigEnvironmentSource::Process)); assert_eq!(provenance[0].variable_name(), std::option::Option::Some("KSP_SECRET_TRANSPORT_TEST_URL")); } } #[test] fn invalid_secret_transport_url_is_effective_config_error_without_secret_leak() { let engine = fixture_engine(); let engine = match engine { std::result::Result::Ok(value) => value, std::result::Result::Err(_) => return, }; let canary = "transport-invalid-secret-canary"; let mut process = std::collections::BTreeMap::::new(); process.insert("KSP_SECRET_TRANSPORT_TEST_URL".to_owned(), canary.to_owned()); let environment = crate::ConfigEnvironment::from_maps(process, std::collections::BTreeMap::new()); let resolved = engine.load_resolved_transport_config(std::option::Option::None, &environment); assert!(resolved.is_err(), "invalid secret-derived endpoint URL must fail effective mapping"); if let std::result::Result::Err(error) = resolved { assert_eq!(error.code(), crate::ERROR_CODE_EFFECTIVE_CONFIG_INVALID); let debug = format!("{error:?}"); assert!(!debug.contains(canary)); assert!(error.context().iter().any(|item| -> bool { return item.key() == "transport_error_code" && item.value() == "invalid_settings"; })); } } fn fixture_engine() -> ksp_core_lib::Result { let workspace = workspace_root(); let fixture_root = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("unit_tests/fixtures"); let bootstrap = crate::ConfigBootstrapOptions::from_paths(fixture_root, workspace.join("config/schemas")); let bootstrap = match bootstrap { std::result::Result::Ok(value) => value, std::result::Result::Err(error) => return std::result::Result::Err(error), }; let registry = crate::ConfigFileRegistry::defaults(); let registry = match registry { std::result::Result::Ok(value) => value, std::result::Result::Err(error) => return std::result::Result::Err(error), }; return std::result::Result::Ok(crate::ConfigDocumentEngine::new(bootstrap, registry)); } fn v1_fixture_engine() -> ksp_core_lib::Result { let workspace = workspace_root(); let fixture_root = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("unit_tests/fixtures_v1"); let bootstrap = crate::ConfigBootstrapOptions::from_paths(fixture_root, workspace.join("config/schemas")); let bootstrap = match bootstrap { std::result::Result::Ok(value) => value, std::result::Result::Err(error) => return std::result::Result::Err(error), }; let registry = crate::ConfigFileRegistry::defaults(); let registry = match registry { std::result::Result::Ok(value) => value, std::result::Result::Err(error) => return std::result::Result::Err(error), }; return std::result::Result::Ok(crate::ConfigDocumentEngine::new(bootstrap, registry)); } fn v3_fixture_engine() -> ksp_core_lib::Result { let workspace = workspace_root(); let fixture_root = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("unit_tests/fixtures_v3"); let bootstrap = crate::ConfigBootstrapOptions::from_paths(fixture_root, workspace.join("config/schemas")); let bootstrap = match bootstrap { std::result::Result::Ok(value) => value, std::result::Result::Err(error) => return std::result::Result::Err(error), }; let registry = crate::ConfigFileRegistry::defaults(); let registry = match registry { std::result::Result::Ok(value) => value, std::result::Result::Err(error) => return std::result::Result::Err(error), }; return std::result::Result::Ok(crate::ConfigDocumentEngine::new(bootstrap, registry)); } fn committed_engine() -> ksp_core_lib::Result { let workspace = workspace_root(); let bootstrap = crate::ConfigBootstrapOptions::from_paths(workspace.join("config"), workspace.join("config/schemas")); let bootstrap = match bootstrap { std::result::Result::Ok(value) => value, std::result::Result::Err(error) => return std::result::Result::Err(error), }; let registry = crate::ConfigFileRegistry::defaults(); let registry = match registry { std::result::Result::Ok(value) => value, std::result::Result::Err(error) => return std::result::Result::Err(error), }; return std::result::Result::Ok(crate::ConfigDocumentEngine::new(bootstrap, registry)); } fn workspace_root() -> std::path::PathBuf { return std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../.."); }