Files
zeekay 19fdf55ceb feat(auth): one key scheme, minted and read in one place
A key now opens with what it is allowed to touch. `pk-` is publishable and
safe in a browser; `sk-` is secret and never leaves a server. The five marks
it replaces all began `ph` -- the upstream's initials -- and they were the
last of its brand a customer read back to us, in every SDK snippet. No word
rule could reach them, because `ph` is not a word.

The marks were also not telling the truth. The constant said `phc_` while
every live project token said `hi_`, so the middleware that routes on the
constant matched no real token at all. Two spellings existed and one was
fiction. Minting now happens in exactly one function and reading in exactly
one, so a second spelling has nowhere to live.

`phx_` (personal) and `phs_` (project secret) both become `sk-`. The mark
now says only that a value is secret; which store holds it is settled by
asking. That was already how personal keys worked -- keys minted before the
marks carry none, so the store always decided -- and both secret resolvers
already returned None on a miss and fell through, so one shared extractor
replaces the two that could drift apart.

OAuth's access and refresh tokens stay distinguishable as `at-` and `rt-`,
because the parser tells them apart before either is looked up, and the
domain-verification token becomes `vt-` rather than keeping a sixth mint of
its own.

`bin/debrand --check` now refuses the marks as a shape, so a seventh cannot
be coined. Two rules that were about to rename things that are not ours to
spell are bounded: `Lemon` no longer eats `LemonSqueezy`, and the `hog_flow`
rules no longer reach a Postgres table, a Datastore table or a route.

Keys are stored hashed, so a mark cannot be rewritten in place: the three
live project tokens have to be reminted.
2026-08-08 19:42:44 -07:00

129 lines
5.3 KiB
Python

"""Tests for insightscli devex:feedback.
The framework's parametrized ``--help`` test already covers command wellformedness;
these guard the one thing it can't see — that a feedback submission still lands as a
well-formed ``insightscli_feedback`` event, so the feature can't silently stop reaching the
devex project on a refactor.
"""
from __future__ import annotations
from pathlib import Path
import pytest
from unittest.mock import patch
from click.testing import CliRunner
from insightscli_commands import feedback
@pytest.fixture
def isolated_config(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
# Keep get_anonymous_id() off the real ~/.config and pin a deterministic key.
monkeypatch.setenv("HOME", str(tmp_path))
monkeypatch.setenv("INSIGHTS_TELEMETRY_API_KEY", "pk-test")
monkeypatch.delenv("INSIGHTS_TELEMETRY_HOST", raising=False)
def test_send_posts_wellformed_feedback_event(isolated_config: None) -> None:
with patch.object(feedback.requests, "post") as post:
post.return_value.raise_for_status.return_value = None
ok, err = feedback._send("reset was slow", "bug", {"environment": "local", "is_agent": True})
assert ok and err == ""
url = post.call_args.args[0]
body = post.call_args.kwargs["json"]
assert url.endswith("/batch/")
assert body["api_key"] == "pk-test"
(event,) = body["batch"]
assert event["event"] == "insightscli_feedback"
assert event["distinct_id"]
props = event["properties"]
assert props["message"] == "reset was slow"
assert props["category"] == "bug"
assert props["environment"] == "local" and props["is_agent"] is True
# Feedback is anonymous — it must not create a person profile.
assert props["$process_person_profile"] is False
def test_opt_out_uses_ephemeral_distinct_id(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
# Feedback still sends under DO_NOT_TRACK (explicit action), but must not mint or
# persist a durable anonymous id on disk just to do it.
monkeypatch.setenv("HOME", str(tmp_path))
monkeypatch.setenv("DO_NOT_TRACK", "1")
monkeypatch.setenv("INSIGHTS_TELEMETRY_API_KEY", "pk-test")
with patch.object(feedback.requests, "post") as post:
post.return_value.raise_for_status.return_value = None
ok, _ = feedback._send("hi", None, {})
assert ok
assert post.call_args.kwargs["json"]["batch"][0]["distinct_id"] # a throwaway id is still sent
assert not feedback.telemetry.get_config_path().exists() # nothing persisted
def test_send_without_api_key_never_posts(monkeypatch: pytest.MonkeyPatch) -> None:
monkeypatch.setattr(feedback, "_endpoint", lambda: ("https://us.i.hanzo.ai", ""))
with patch.object(feedback.requests, "post") as post:
ok, err = feedback._send("hi", None, {})
assert ok is False
assert "no telemetry API key" in err
post.assert_not_called()
def test_send_returns_error_on_network_failure(isolated_config: None) -> None:
# A failed POST must surface as (False, msg) so the CLI exits non-zero, not crash.
with patch.object(feedback.requests, "post", side_effect=feedback.requests.exceptions.Timeout("boom")):
ok, err = feedback._send("hi", None, {})
assert ok is False
assert err
@pytest.mark.parametrize(
("answer", "should_send"),
[("y\n", True), ("n\n", False)],
ids=["confirm_sends", "decline_aborts"],
)
def test_interactive_confirm_gate(monkeypatch: pytest.MonkeyPatch, answer: str, should_send: bool) -> None:
# On a TTY, the preview's "Send?" prompt gates the send: 'n' must not transmit.
monkeypatch.setattr(feedback, "_stdin_is_tty", lambda: True)
ctx_calls: list[int] = []
monkeypatch.setattr(feedback, "_context_properties", lambda: (ctx_calls.append(1), {})[1])
sent: list[str] = []
monkeypatch.setattr(feedback, "_send", lambda msg, cat, ctx: (sent.append(msg), (True, ""))[1])
result = CliRunner().invoke(feedback.devex_feedback, ["the message"], input=answer)
assert result.exit_code == 0
assert bool(sent) is should_send
# Context collection can shell out / persist cache — it must only run when sending.
assert bool(ctx_calls) is should_send
@pytest.mark.parametrize(
("env_host", "manifest_host", "expected"),
[
("http://env.example", "http://manifest.example", "http://env.example"),
(None, "http://manifest.example", "http://manifest.example"),
(None, None, feedback._DEFAULT_HOST),
],
ids=["env_override_wins", "manifest_fallback", "default_host_fallback"],
)
def test_endpoint_host_precedence(
monkeypatch: pytest.MonkeyPatch, env_host: str | None, manifest_host: str | None, expected: str
) -> None:
if env_host is None:
monkeypatch.delenv("INSIGHTS_TELEMETRY_HOST", raising=False)
else:
monkeypatch.setenv("INSIGHTS_TELEMETRY_HOST", env_host)
monkeypatch.setenv("INSIGHTS_TELEMETRY_API_KEY", "pk-test")
# Omit the host key entirely when manifest_host is None so the `.get(..., default)`
# fallback is exercised, rather than storing an explicit None that shadows it.
telemetry_cfg: dict[str, str] = {"api_key": "pk-manifest"}
if manifest_host is not None:
telemetry_cfg["host"] = manifest_host
with patch.object(feedback, "get_manifest") as gm:
gm.return_value.config = {"telemetry": telemetry_cfg}
host, _ = feedback._endpoint()
assert host == expected