test(auth): date the deployed allowlist snapshot and assert per entry #11

Merged

jlxq0 merged 1 commit from test-deployed-allowlist-snapshot into main

2026-08-26 05:09:47 +00:00

jlxq0 commented

2026-08-26 04:59:22 +00:00

Owner

Closes #7.

What changed

deployed_allowlist_parses becomes two tests:

production_allowlist_snapshot_behaves — the snapshot, dated 2026-08-26,
with the kubectl command that reads the live value in the doc comment and
an explicit statement that the test cannot detect drift. It asserts per entry
and exercises the matcher rather than counting.
allowlist_accepts_the_shapes_we_support — the parsing assertions, making no
claim about production.

The snapshot was re-read off the running pod's container env on 2026-08-26 and
is unchanged at nine entries, identical to the literal. Production runs v0.1.2
at sha256:3d37a2eb….

Verified by mutation, not by inspection

Two mutations, each run with the pre-repair count-only test restored alongside
under the name mutation_control_old_deployed_allowlist_parses so the two can
be compared on the same mutation.

1. Substitute one entry inside the snapshot literal, count unchanged at nine
(cowork://oauth/callback → https://evil.example/callback, assertions left
untouched):

test mutation_control_old_deployed_allowlist_parses ... ok
test production_allowlist_snapshot_behaves ... FAILED
panicked at src/oauth_redirect.rs:360:13: should accept cowork://oauth/callback

That is the drift shape that mattered — a set that is the wrong set but still
the right size — and it is exactly what the old assertion could not see.

2. Break the matcher (loopback_matches_ignoring_port returns false
immediately):

test mutation_control_old_deployed_allowlist_parses ... ok
test production_allowlist_snapshot_behaves ... FAILED
panicked at src/oauth_redirect.rs:369:9:
  assertion failed: is_allowed_redirect_uri(&allowed, "http://localhost:49152/callback")

The first mutation I reached for was wrong and is worth recording: substituting
the entry everywhere in the file changed the assertion list along with the
literal, and the test stayed green. It has to be the literal alone.

What this still does not do

It cannot detect drift, and the doc comment says so in those words. The
deployment is not an input to a unit test, and the snapshot and the assertion
list are coupled by hand — editing both together stays green by construction.
What the test now pins is that the matcher behaves correctly against a shape
production really had, with a date saying how old that claim is.

Gates

cargo fmt --check, cargo clippy -D warnings, cargo test --all-features
(101 passed), cargo audit, cargo deny check bans licenses sources — all
green locally on rustc 1.98.0.

Closes #7. ## What changed `deployed_allowlist_parses` becomes two tests: - `production_allowlist_snapshot_behaves` — the snapshot, dated 2026-08-26, with the `kubectl` command that reads the live value in the doc comment and an explicit statement that the test cannot detect drift. It asserts per entry and exercises the matcher rather than counting. - `allowlist_accepts_the_shapes_we_support` — the parsing assertions, making no claim about production. The snapshot was re-read off the running pod's container env on 2026-08-26 and is unchanged at nine entries, identical to the literal. Production runs `v0.1.2` at `sha256:3d37a2eb…`. ## Verified by mutation, not by inspection Two mutations, each run with the pre-repair count-only test restored alongside under the name `mutation_control_old_deployed_allowlist_parses` so the two can be compared on the same mutation. **1. Substitute one entry inside the snapshot literal, count unchanged at nine** (`cowork://oauth/callback` → `https://evil.example/callback`, assertions left untouched): ```text test mutation_control_old_deployed_allowlist_parses ... ok test production_allowlist_snapshot_behaves ... FAILED panicked at src/oauth_redirect.rs:360:13: should accept cowork://oauth/callback ``` That is the drift shape that mattered — a set that is the wrong set but still the right size — and it is exactly what the old assertion could not see. **2. Break the matcher** (`loopback_matches_ignoring_port` returns `false` immediately): ```text test mutation_control_old_deployed_allowlist_parses ... ok test production_allowlist_snapshot_behaves ... FAILED panicked at src/oauth_redirect.rs:369:9: assertion failed: is_allowed_redirect_uri(&allowed, "http://localhost:49152/callback") ``` The first mutation I reached for was wrong and is worth recording: substituting the entry everywhere in the file changed the assertion list along with the literal, and the test stayed green. It has to be the literal alone. ## What this still does not do It cannot detect drift, and the doc comment says so in those words. The deployment is not an input to a unit test, and the snapshot and the assertion list are coupled by hand — editing both together stays green by construction. What the test now pins is that the matcher behaves correctly against a shape production really had, with a date saying how old that claim is. ## Gates `cargo fmt --check`, `cargo clippy -D warnings`, `cargo test --all-features` (101 passed), `cargo audit`, `cargo deny check bans licenses sources` — all green locally on `rustc 1.98.0`.

jlxq0 added 1 commit

2026-08-26 04:59:22 +00:00

test(auth): date the deployed allowlist snapshot and assert per entry

CI / cargo (pull_request) Successful in 47s

Details

CI / docker (pull_request) Successful in 1m11s

Details

8c883cd8fa

`deployed_allowlist_parses` declared its own input and asserted only that the
literal parsed to nine entries, under a doc comment calling it "the exact set
the deployment ships". The deployment was never an input, so no drift could
turn it red, and the same test in typst-mcp carried nine entries against a live
seven while staying green.

Split it in two. `production_allowlist_snapshot_behaves` keeps the snapshot,
dates it 2026-08-26, records the kubectl command that reads the live value, and
says in the doc comment that it cannot detect drift. It now asserts per entry
and exercises the matcher, so a substitution inside the snapshot fails where a
count could not. `allowlist_accepts_the_shapes_we_support` carries the parsing
assertions with no claim about production.

The snapshot was re-read off the running pod's container env on 2026-08-26 and
is unchanged at nine entries.

Closes #7

jlxq0 merged commit 4f1a403259 into main

2026-08-26 05:09:47 +00:00

jlxq0 deleted branch test-deployed-allowlist-snapshot

2026-08-26 05:09:48 +00:00

jlxq0 referenced this pull request from a commit

2026-08-26 05:09:49 +00:00

Merge pull request 'test(auth): date the deployed allowlist snapshot and assert per entry' (#11) from test-deployed-allowlist-snapshot into main