vrr/codeburn
2
0
Fork 0
mirror of https://github.com/AgentSeal/codeburn.git synced 2026-10-21 05:23:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

test(quota): write credential fixtures with private permissions

Browse source 
readSecureFile rejects a login file with group or world bits on POSIX,
which is right for a real login. The Grok and Z.ai fixtures were written
with default permissions, so on Linux the product refused them and six
assertions saw transientFailure or disconnected. Windows has no mode bits
to check, which is why the branch only ever passed there.
This commit is contained in:
iamtoruk 2026-09-02 14:28:08 -07:00
parent 0560d5a5bd
commit d1d922e741
2 changed files with 8 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

11
tests/quota-grok.test.ts
View file

@ -107,7 +107,8 @@ describe('Grok Build billing decoding', () => {
describe('Grok Build quota fetch', () => {
it('reuses one login for the quota and the plan name', async () => {
const credentialPath = path.join(root, 'auth.json')
await writeFile(credentialPath, JSON.stringify(authFile), 'utf8')
// A real login file is private to the user; readSecureFile rejects group or world bits on POSIX.
await writeFile(credentialPath, JSON.stringify(authFile), { encoding: 'utf8', mode: 0o600 })
const seen: { url: string; headers: Record<string, string> }[] = []
const result = await fetchGrokQuota({
@ -137,7 +138,7 @@ describe('Grok Build quota fetch', () => {
const credentialPath = path.join(root, 'auth.json')
await writeFile(credentialPath, JSON.stringify({
'https://auth.x.ai::p': { key: 'synthetic-oidc-token', expires_at: '2026-08-01T10:00:00Z' },
}), 'utf8')
}), { encoding: 'utf8', mode: 0o600 })
const result = await fetchGrokQuota({ credentialPath, now: () => NOW, fetch: neverFetch })
expect(result.quota.connection).toBe('terminalFailure')
@ -146,7 +147,7 @@ describe('Grok Build quota fetch', () => {
it('reports an unreadable login file as terminal and never fetches', async () => {
const credentialPath = path.join(root, 'auth.json')
await writeFile(credentialPath, 'not json', 'utf8')
await writeFile(credentialPath, 'not json', { encoding: 'utf8', mode: 0o600 })
const result = await fetchGrokQuota({ credentialPath, now: () => NOW, fetch: neverFetch })
expect(result.quota.connection).toBe('terminalFailure')
@ -155,7 +156,7 @@ describe('Grok Build quota fetch', () => {
it('maps the HTTP failures the way the menubar classifies them', async () => {
const credentialPath = path.join(root, 'auth.json')
await writeFile(credentialPath, JSON.stringify(authFile), 'utf8')
await writeFile(credentialPath, JSON.stringify(authFile), { encoding: 'utf8', mode: 0o600 })
const respond = async (status: number, headers: Record<string, string> = {}) => fetchGrokQuota({
credentialPath,
now: () => NOW,
@ -174,7 +175,7 @@ describe('Grok Build quota fetch', () => {
it('keeps the reading when only the plan lookup fails', async () => {
const credentialPath = path.join(root, 'auth.json')
await writeFile(credentialPath, JSON.stringify(authFile), 'utf8')
await writeFile(credentialPath, JSON.stringify(authFile), { encoding: 'utf8', mode: 0o600 })
const result = await fetchGrokQuota({
credentialPath,

3
tests/quota-zai.test.ts
View file

@ -92,7 +92,8 @@ describe('Z.ai credential discovery', () => {
it('falls back to the Pi login on disk', async () => {
const credentialPath = path.join(root, '.pi', 'agent', 'auth.json')
await mkdir(path.dirname(credentialPath), { recursive: true })
await writeFile(credentialPath, JSON.stringify({ zai: { key: 'pi-zai-key' } }), 'utf8')
// A real login file is private to the user; readSecureFile rejects group or world bits on POSIX.
await writeFile(credentialPath, JSON.stringify({ zai: { key: 'pi-zai-key' } }), { encoding: 'utf8', mode: 0o600 })
const seen: Record<string, string>[] = []
const result = await fetchZaiQuota({