amadan
auth e2e tests: CLI children can only reach the dir store
TestAuthCLI, TestAccountsCreateNeedsAnOwner, TestAccountsCreateWithOwnerFlag and TestAccountsCreateTrimsTheNameBeforeMinting now build the child env through carlosTestEnv with CARLOS_DEPLOYMENT_BUCKET and AWS_PROFILE blanked. openStore prefers an inherited CARLOS_DEPLOYMENT_BUCKET over CARLOS_DEPLOYMENT_DIR, so a shell exporting a real bucket and AWS credentials could have minted real accounts from these tests. Verified with CARLOS_DEPLOYMENT_BUCKET=nonexistent-bucket-xyz exported: all four pass against the dir store.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+14
−6
auth_e2e_test.go+14 −6
CI cancelled — superseded by a newer push — run details
CI log
=== gate === cd launchctx && go vet ./... && go test ./... -count=1 ok amadan.net/carlos/platform.git/launchctx 0.011s ? amadan.net/carlos/platform.git/launchctx/controlname [no test files] ? amadan.net/carlos/platform.git/launchctx/wireid [no test files] go vet ./... gofmt -l .: clean go test ./... -count=1 -timeout 30m amadan: job cancelled — a newer push superseded it
diff --git a/auth_e2e_test.go b/auth_e2e_test.go| index 995face88..465bdc06e 100644 |
| --- a/auth_e2e_test.go |
| +++ b/auth_e2e_test.go |
| @@ -48,10 +48,14 @@ func TestAuthCLI(t *testing.T) { |
| fc := newFakeConsole(t) |
| home := t.TempDir() |
| creds := filepath.Join(home, ".carlos", "credentials") |
| - env := append(os.Environ(), |
| + // carlosTestEnv, never os.Environ(): openStore prefers an inherited |
| + // CARLOS_DEPLOYMENT_BUCKET over any dir store, so blank it (and the AWS |
| + // profile) so no child can reach a real bucket. |
| + env := carlosTestEnv(t, |
| + "CARLOS_DEPLOYMENT_BUCKET=", |
| + "AWS_PROFILE=", |
| "CARLOS_CREDENTIALS="+creds, |
| "HOME="+home, |
| - "CARLOS_CONSOLE=", |
| ) |
| run := func(args ...string) (string, error) { |
| @@ -128,12 +132,13 @@ func TestAuthCLI(t *testing.T) { |
| func TestAccountsCreateNeedsAnOwner(t *testing.T) { |
| bin := buildCarlos(t) |
| tmp := t.TempDir() |
| - env := append(os.Environ(), |
| + env := carlosTestEnv(t, |
| + "CARLOS_DEPLOYMENT_BUCKET=", |
| + "AWS_PROFILE=", |
| "CARLOS_DEPLOYMENT_DIR="+filepath.Join(tmp, "store"), |
| "CARLOS_CREDENTIALS="+filepath.Join(tmp, "credentials"), |
| "CARLOS_DATA_DIR="+tmp, |
| "HOME="+tmp, |
| - "CARLOS_CONSOLE=", |
| ) |
| cmd := exec.Command(bin, "accounts", "create", "-name", "orphan") |
| cmd.Env = env |
| @@ -191,12 +196,13 @@ func TestAccountsCreateWithOwnerFlag(t *testing.T) { |
| tmp := t.TempDir() |
| storeDir := filepath.Join(tmp, "store") |
| cmd := exec.Command(bin, "accounts", "create", "-name", "kass", "-owner", "paul@keymail.dev") |
| - cmd.Env = append(os.Environ(), |
| + cmd.Env = carlosTestEnv(t, |
| + "CARLOS_DEPLOYMENT_BUCKET=", |
| + "AWS_PROFILE=", |
| "CARLOS_DEPLOYMENT_DIR="+storeDir, |
| "CARLOS_CREDENTIALS="+filepath.Join(tmp, "credentials"), |
| "CARLOS_DATA_DIR="+tmp, |
| "HOME="+tmp, |
| - "CARLOS_CONSOLE=", |
| ) |
| // pick() walks cwd ancestors for .carlos/config, so the subprocess must not run from the real checkout. |
| cmd.Dir = tmp |
| @@ -277,6 +283,8 @@ func TestAccountsCreateTrimsTheNameBeforeMinting(t *testing.T) { |
| storeDir := filepath.Join(tmp, "store") |
| cmd := exec.Command(bin, "accounts", "create", "-name", " kass ", "-owner", "paul@keymail.dev") |
| cmd.Env = carlosTestEnv(t, |
| + "CARLOS_DEPLOYMENT_BUCKET=", |
| + "AWS_PROFILE=", |
| "CARLOS_DEPLOYMENT_DIR="+storeDir, |
| "CARLOS_DATA_DIR="+tmp, |
| ) |