76 lines
3.2 KiB
Swift
76 lines
3.2 KiB
Swift
import Foundation
|
|
import Testing
|
|
|
|
@testable import Termind
|
|
|
|
@Suite(.serialized)
|
|
struct DataProtectionKeychainTests {
|
|
@Test
|
|
func persistedStorageNamesUseThisDevice() {
|
|
#expect(KeyStorage.thisDevice.rawValue == "thisDevice")
|
|
#expect(PasswordStorage.thisDevice.rawValue == "thisDevice")
|
|
#expect(KeyStorage(rawValue: "local" + "Keychain") == nil)
|
|
#expect(Identity(name: "", username: "").passwordStorage == .iCloudKeychain)
|
|
#expect(SSHKeyRef(label: "").storage == .iCloudKeychain)
|
|
}
|
|
|
|
@Test(arguments: [PasswordStorage.thisDevice, .iCloudKeychain])
|
|
func identityPasswordRoundTripUsesExactStorageClass(
|
|
_ storage: PasswordStorage
|
|
) throws {
|
|
let keychain = KeychainSecretStore()
|
|
let reference = "termind.password.\(UUID().uuidString)"
|
|
defer { try? keychain.removePassword(reference, storage: storage) }
|
|
|
|
try keychain.setString("secret", for: reference, storage: storage)
|
|
#expect(try keychain.string(for: reference, storage: storage) == "secret")
|
|
let other: PasswordStorage = storage == .thisDevice ? .iCloudKeychain : .thisDevice
|
|
#expect(try keychain.string(for: reference, storage: other) == nil)
|
|
}
|
|
@Test
|
|
func aiSecretsSurviveAcrossStoreInstances() {
|
|
let reference = "termind.ai.test.\(UUID().uuidString)"
|
|
let writer = AIStore()
|
|
defer { writer.setSecret(nil, for: reference) }
|
|
|
|
writer.setSecret("test-token", for: reference)
|
|
#expect(writer.secretStorageError == nil)
|
|
|
|
let reader = AIStore()
|
|
#expect(reader.secret(for: reference) == "test-token")
|
|
#expect(reader.secretStorageError == nil)
|
|
}
|
|
|
|
@Test(arguments: [KeyStorage.thisDevice, .iCloudKeychain])
|
|
func softwareKeyRoundTripUsesExactStorageClass(_ storage: KeyStorage) throws {
|
|
let keychain = KeychainSecretStore()
|
|
let reference = "termind.key.\(UUID().uuidString)"
|
|
let expected = StoredSSHKeyCredential.software(
|
|
SSHPrivateKeySecret(privateKey: "test-private-key", passphrase: "test-passphrase")
|
|
)
|
|
defer { try? keychain.removeKeyCredential(reference, storage: storage) }
|
|
|
|
try keychain.setKeyCredential(expected, for: reference, storage: storage)
|
|
#expect(try keychain.keyCredential(for: reference, storage: storage) == expected)
|
|
try keychain.removeKeyCredential(reference, storage: storage)
|
|
#expect(try keychain.keyCredential(for: reference, storage: storage) == nil)
|
|
}
|
|
|
|
@Test
|
|
func secureEnclaveHandleRoundTripIsDeviceBound() throws {
|
|
let keychain = KeychainSecretStore()
|
|
let reference = "termind.key.\(UUID().uuidString)"
|
|
let expected = StoredSSHKeyCredential.secureEnclave(
|
|
SecureEnclaveKeyCredential(dataRepresentation: Data("test-handle".utf8))
|
|
)
|
|
defer { try? keychain.removeKeyCredential(reference, storage: .secureEnclave) }
|
|
|
|
try keychain.setKeyCredential(expected, for: reference, storage: .secureEnclave)
|
|
#expect(
|
|
try keychain.keyCredential(for: reference, storage: .secureEnclave) == expected
|
|
)
|
|
try keychain.removeKeyCredential(reference, storage: .secureEnclave)
|
|
#expect(try keychain.keyCredential(for: reference, storage: .secureEnclave) == nil)
|
|
}
|
|
}
|