CyberCoveLLC/Triple-C
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 44 Wiki Activity

Stop the snapshot retry being an unconfirmed revoke, and unbrick legacy configs

Browse Source 
Three things, all reachable from a single credential-handling round.

**The "Retry snapshot cleanup" button deleted the token.** `clear_claude_token`
called `secure::delete_claude_oauth_token()` unconditionally; the `mode`
argument only changed the toast wording, so there was no sweep-only path on the
wire. The leftover panel rendered on `leftover !== null` alone and
`onAuthenticated` never cleared it, so the sequence revoke -> snapshot skipped
-> re-authenticate from the button directly above -> press the retry the panel
is still offering threw away the token acquired seconds earlier, announced by a
message about images. The deliberate Revoke needs a confirmation modal; this
needed nothing.

`sweep_claude_token_snapshots` is the honest primitive: it rewrites the images
and never touches the keychain. The images are the durable record, so the retry
re-derives its work from Docker and needs no stored token. Re-authenticating
now clears the panel, and the Authenticate button is disabled while a cleanup
runs — a sweep is a per-image inspect/create/commit/rmi over the Docker socket
and takes minutes.

**Sweep-first left the token live for that whole window.** The keychain delete
sat behind `list_images` plus the per-image loop, at bollard's 120s-per-request
default, while the UI said "Revoking...". A quit or crash in there and nothing
was revoked at all; worse, `has_claude_token` stayed true and
`shared_claude_auth` reads the keychain at container-*create* time, so a
project whose `SecretScrub` guard had already released could be started later
in the same sweep and be handed a fresh copy of the credential in its env.
Keychain-first now, and the comment that claimed "no window in which a scrubbed
image is re-poisoned" — true of images, silent about containers — is corrected.
The reorder's original justification (crash-mid-sweep recoverability) is what
the sweep-only command covers.

A keychain refusal no longer discards a scrub report, because nothing has been
swept yet, and both remedies stay on screen: Revoke, and the image sweep, which
is now offered in every state rather than only when nothing is stored.

**`update_project` validating every folder list bricked existing projects.** It
validated nothing until recently while `WorkspaceSection` saved `{paths}` on
every blur, so `projects.json` can hold a half-filled row, a mount name with a
space, a duplicate, or `/` as a host path. Any such project became entirely
unsavable — every Config toggle, every permission-mode change and
`useTerminal.ts`'s tab rename came back with a message about folders — and
refusing the save did not unmount anything. `validate_project_paths_update`
admits a row carried over verbatim from what is stored and holds a new or
edited row to every rule, which keeps the escalation closed: introducing a bad
value through this command is exactly what a non-carried-over row is. The
`/workspace/../tmp/claude-x` chain is the one exception and runs on every row
regardless, because a stored one is live data loss rather than untidy data.

`ssh_key_path` and `ca_cert_path` had no check at all; a filesystem root there
read-only bind-mounts the whole host at /tmp/.host-ssh. Refused on change, with
the same grandfathering.

Tests are mutation-checked: reverting to sweep-first fails all four new Rust
ordering tests, pointing the retry back at `clear_claude_token` fails five
frontend tests, and validating an update in isolation fails the legacy-data
tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc
This commit is contained in:
shadow-test
2026-08-23 15:42:20 -07:00
co-authored by Claude Opus 5
parent ed91423666
commit 39934299f9
6 changed files with 910 additions and 166 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/src/components/settings/SharedAuthSettings.test.tsx
+155 -16
View File
@@ -6,14 +6,38 @@ import type { ClearTokenOutcome, Project } from "../../lib/types";
const hasClaudeToken = vi.fn();
const clearClaudeToken = vi.fn();
const sweepClaudeTokenSnapshots = vi.fn();
vi.mock("../../lib/tauri-commands", () => ({
hasClaudeToken: () => hasClaudeToken(),
clearClaudeToken: () => clearClaudeToken(),
sweepClaudeTokenSnapshots: () => sweepClaudeTokenSnapshots(),
acquireClaudeToken: vi.fn(),
submitClaudeTokenCode: vi.fn(),
}));
// Stood in for so a sign-in can be *completed* in a test. The panel's reaction
// to `onAuthenticated` is the subject of the H1 sequence below, and driving the
// real acquisition dialog to get there would test the dialog instead.
vi.mock("./ClaudeAuthModal", () => ({
default: ({
onAuthenticated,
onClose,
}: {
onAuthenticated: () => void;
onClose: () => void;
}) => (
<button
onClick={() => {
onAuthenticated();
onClose();
}}
>
finish sign-in
</button>
),
}));
vi.mock("@tauri-apps/api/event", () => ({ listen: vi.fn(async () => vi.fn()) }));
vi.mock("@tauri-apps/plugin-opener", () => ({ openUrl: vi.fn() }));
@@ -59,11 +83,22 @@ const running = (over: Partial<Project> = {}): Project => ({
...over,
});
/** A `ClearTokenOutcome` with nothing left behind, plus any overrides. */
const outcome = (over: Partial<ClearTokenOutcome> = {}): ClearTokenOutcome => ({
snapshots_scrubbed: [],
snapshots_failed: [],
snapshots_skipped: [],
snapshots_superseded: [],
docker_unavailable: null,
...over,
});
describe("SharedAuthSettings", () => {
beforeEach(() => {
vi.clearAllMocks();
projects = [];
hasClaudeToken.mockResolvedValue(false);
sweepClaudeTokenSnapshots.mockResolvedValue(outcome());
useAppState.setState({ toasts: [] });
});
@@ -251,19 +286,17 @@ describe("SharedAuthSettings", () => {
fireEvent.click(await screen.findByRole("button", { name: "Revoke token" }));
const retry = await screen.findByTestId("shared-auth-retry");
clearClaudeToken.mockResolvedValueOnce({
snapshots_scrubbed: ["triple-c-snapshot-p1:latest"],
snapshots_failed: [],
snapshots_skipped: [],
snapshots_superseded: [],
docker_unavailable: null,
});
sweepClaudeTokenSnapshots.mockResolvedValueOnce(
outcome({ snapshots_scrubbed: ["triple-c-snapshot-p1:latest"] }),
);
fireEvent.click(retry);
await waitFor(() =>
expect(screen.queryByTestId("shared-auth-leftover")).not.toBeInTheDocument(),
);
expect(clearClaudeToken).toHaveBeenCalledTimes(2);
// One revoke, one sweep — the retry must not be a second revoke.
expect(clearClaudeToken).toHaveBeenCalledTimes(1);
expect(sweepClaudeTokenSnapshots).toHaveBeenCalledTimes(1);
const toast = useAppState.getState().toasts.at(-1)!;
expect(toast.kind).toBe("success");
expect(toast.message).toMatch(/cleared from 1 snapshot image/i);
@@ -274,20 +307,14 @@ describe("SharedAuthSettings", () => {
// anything is in the keychain today, so the sweep cannot be gated on it.
projects = [running()];
hasClaudeToken.mockResolvedValue(false);
clearClaudeToken.mockResolvedValue({
snapshots_scrubbed: [],
snapshots_failed: [],
snapshots_skipped: [],
snapshots_superseded: [],
docker_unavailable: null,
});
render(<SharedAuthSettings />);
const sweep = await screen.findByTestId("shared-auth-sweep");
expect(screen.queryByRole("button", { name: "Revoke" })).not.toBeInTheDocument();
fireEvent.click(sweep);
await waitFor(() => expect(clearClaudeToken).toHaveBeenCalled());
await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalled());
expect(clearClaudeToken).not.toHaveBeenCalled();
const toast = useAppState.getState().toasts.at(-1)!;
expect(toast.kind).toBe("success");
expect(toast.message).toBe("No snapshot image is holding the token.");
@@ -300,4 +327,116 @@ describe("SharedAuthSettings", () => {
expect(toast.kind).toBe("success");
expect(screen.queryByTestId("shared-auth-leftover")).not.toBeInTheDocument();
});
// ── The retry must not be a revoke in disguise ───────────────────────────
// The sequence that shipped green: revoke, get a skipped image, re-authenticate
// from the button directly above the warning, then press the retry the warning
// is still offering. One command was behind both, so that press deleted the
// token acquired seconds earlier — no confirmation, and a toast that mentioned
// only images. The deliberate Revoke needs a modal; this needed nothing.
it("does not leave a stale cleanup panel over a freshly acquired token", async () => {
projects = [running()];
// Stored when the panel mounts, gone after the revoke, stored again once
// the sign-in finishes.
hasClaudeToken
.mockResolvedValueOnce(true)
.mockResolvedValueOnce(false)
.mockResolvedValue(true);
clearClaudeToken.mockResolvedValue(
outcome({ snapshots_skipped: ["triple-c-snapshot-p1:latest: busy"] }),
);
render(<SharedAuthSettings />);
fireEvent.click(await screen.findByRole("button", { name: "Revoke" }));
fireEvent.click(await screen.findByRole("button", { name: "Revoke token" }));
await screen.findByTestId("shared-auth-leftover");
// Re-authenticate from the button above the warning.
fireEvent.click(await screen.findByRole("button", { name: "Authenticate" }));
fireEvent.click(await screen.findByRole("button", { name: "finish sign-in" }));
await screen.findByRole("button", { name: "Revoke" });
expect(screen.queryByTestId("shared-auth-leftover")).not.toBeInTheDocument();
expect(screen.queryByTestId("shared-auth-retry")).not.toBeInTheDocument();
// The images can still be cleaned up — and doing so does not spend the new
// token.
fireEvent.click(screen.getByTestId("shared-auth-sweep"));
await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalled());
expect(clearClaudeToken).toHaveBeenCalledTimes(1);
});
it("sends the retry to the sweep-only command, never to the revoke", async () => {
projects = [running()];
hasClaudeToken.mockResolvedValueOnce(true).mockResolvedValue(false);
clearClaudeToken.mockResolvedValue(
outcome({ snapshots_skipped: ["triple-c-snapshot-p1:latest: busy"] }),
);
sweepClaudeTokenSnapshots.mockResolvedValue(
outcome({ snapshots_skipped: ["triple-c-snapshot-p1:latest: busy"] }),
);
render(<SharedAuthSettings />);
fireEvent.click(await screen.findByRole("button", { name: "Revoke" }));
fireEvent.click(await screen.findByRole("button", { name: "Revoke token" }));
const retry = await screen.findByTestId("shared-auth-retry");
fireEvent.click(retry);
await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalledTimes(1));
fireEvent.click(await screen.findByTestId("shared-auth-retry"));
await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalledTimes(2));
// However many times it is pressed, the keychain is touched exactly once —
// by the revoke the user confirmed.
expect(clearClaudeToken).toHaveBeenCalledTimes(1);
// …and a retry that still finds a busy project says so without ever
// claiming a token was removed.
const toast = useAppState.getState().toasts.at(-1)!;
expect(toast.message).not.toMatch(/keychain/i);
});
it("will not start a sign-in while a cleanup is still running", async () => {
// A sweep is a per-image inspect/create/commit/rmi over the Docker socket
// and runs for minutes. Acquiring a token inside that window races the
// rewrite that is meant to be removing one.
projects = [running()];
hasClaudeToken.mockResolvedValue(false);
sweepClaudeTokenSnapshots.mockReturnValue(new Promise(() => {}));
render(<SharedAuthSettings />);
const authenticate = await screen.findByRole("button", { name: "Authenticate" });
expect(authenticate).toBeEnabled();
fireEvent.click(await screen.findByTestId("shared-auth-sweep"));
await waitFor(() =>
expect(screen.getByRole("button", { name: "Authenticate" })).toBeDisabled(),
);
});
// ── A keychain that refuses the delete has to leave something to press ───
it("keeps both remedies on screen when the keychain refuses the delete", async () => {
projects = [running()];
hasClaudeToken.mockResolvedValue(true);
clearClaudeToken.mockRejectedValue("the keychain is locked");
render(<SharedAuthSettings />);
fireEvent.click(await screen.findByRole("button", { name: "Revoke" }));
fireEvent.click(await screen.findByRole("button", { name: "Revoke token" }));
await waitFor(() =>
expect(useAppState.getState().toasts.length).toBeGreaterThan(0),
);
const toast = useAppState.getState().toasts[0];
expect(toast.kind).toBe("error");
expect(toast.detail).toMatch(/still stored/i);
// The token is still there, so Revoke is still the retry for it — and the
// images, which the failed delete says nothing about, have their own sweep.
await screen.findByRole("button", { name: "Revoke" });
const sweep = screen.getByTestId("shared-auth-sweep");
fireEvent.click(sweep);
await waitFor(() => expect(sweepClaudeTokenSnapshots).toHaveBeenCalled());
});
});