954b8c1f3e
Pre-public-launch cleanup. 17 files touched. Grep verification confirms
only Tier 4 (intentional GTM attribution) remains: README + docs/PHILOSOPHY
credit to Denis Parfionovich / KeiLab.
## Tier 1 — INFRA-LEAKS (4 targets, 1 file)
- _blocks/ci-forgejo-actions.md: Tailscale IPs 100.91.246.53 removed,
kgl-runner-01 → my-runner-01, SSH fingerprint line deleted, Forgejo
topology description generalised to "private interface"
## Tier 2 — PATENT-FLAG PROSE (4 files, ~10 edits)
- _manifests/kei-{modal-runner,ml-implementer,infra-implementer}.toml:
"proprietary/non-public-deploy" → "private/non-public-deploy"
- _blocks/ci-forgejo-actions.md: RULE 0.1 sensitive IP references softened
to generic "sensitive IP / compliance / air-gap" framing
## Tier 3 — INTERNAL PROJECT NAMES (8 files)
- kei-provision/tests/backend_smoke.rs: kgl-* fixtures → test-srv-*/test-vultr
- kei-auth/tests/integration.rs: project: "kgl" → "demo"
- kei-memory/src/coaccess.rs: "PROJECT-C/Genesis" origin → "in-house implementation"
- _primitives/{tomd.sh,README.md}: PROJECT-D provenance removed
- _bridges/README.md: PROJECT-D cross-ref line deleted
- skills/site-create/: keiagent/fal.ai → generic AI-asset generator
- skills/self-audit/: hardcoded project paths → ~/Projects/my-project
- skills/compose-solution/: hardcoded ~/Projects/PROJECT-E →
${KEISEI_BUNDLE_PATH:-} env-conditional lookup
- skills/sleep-setup/: forgejo.example.com → forgejo.example.com
## Phase 2 — Regenerated 3 root .md (Option B manual)
Assembler invocation blocked by sandbox; fell back to manual Edit on
kei-ml-implementer.md + kei-infra-implementer.md + kei-modal-runner.md
with same Tier-2 replacements as their source manifests.
## Known residual (Phase 3 pending user decision)
Git history still contains 619+ patent-term hits (pre-rewrite). Filter-repo
on /tmp/keisei-mirror.git prepared by separate agent; force-push
pending user approval because `genesis-scan` / `genesis-leak-guard` are
intentional kit features — naive rewrite would break them.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
52 lines
1.7 KiB
Rust
52 lines
1.7 KiB
Rust
use kei_auth::schema::open_memory;
|
|
use kei_auth::scopes::Scope;
|
|
use kei_auth::tokens::{issue, revoke, verify};
|
|
|
|
const KEY: &[u8] = b"test-key-must-not-be-used-in-production";
|
|
|
|
#[test]
|
|
fn issue_and_verify() {
|
|
let conn = open_memory().unwrap();
|
|
let tok = issue(&conn, "alice", "demo", Scope::Write, 3600, KEY).unwrap();
|
|
let out = verify(&conn, &tok, KEY).unwrap();
|
|
assert_eq!(out.user_id, "alice");
|
|
assert_eq!(out.project, "demo");
|
|
assert_eq!(out.scope, Scope::Write);
|
|
}
|
|
|
|
#[test]
|
|
fn revoke_blocks_verify() {
|
|
let conn = open_memory().unwrap();
|
|
let tok = issue(&conn, "bob", "x", Scope::Read, 3600, KEY).unwrap();
|
|
assert_eq!(revoke(&conn, &tok).unwrap(), 1);
|
|
assert!(verify(&conn, &tok, KEY).is_err());
|
|
}
|
|
|
|
#[test]
|
|
fn expired_token_rejected() {
|
|
let conn = open_memory().unwrap();
|
|
let tok = issue(&conn, "carol", "x", Scope::Read, -10, KEY).unwrap();
|
|
let err = verify(&conn, &tok, KEY);
|
|
assert!(err.is_err(), "expired must fail");
|
|
}
|
|
|
|
#[test]
|
|
fn scope_check_admin_implies_write() {
|
|
assert!(Scope::Admin.allows(Scope::Write));
|
|
assert!(Scope::Admin.allows(Scope::Read));
|
|
assert!(Scope::Write.allows(Scope::Read));
|
|
assert!(!Scope::Read.allows(Scope::Write));
|
|
assert!(!Scope::Write.allows(Scope::Admin));
|
|
}
|
|
|
|
#[test]
|
|
fn tampered_token_rejected() {
|
|
let conn = open_memory().unwrap();
|
|
let tok = issue(&conn, "dave", "x", Scope::Read, 3600, KEY).unwrap();
|
|
let mut chars: Vec<char> = tok.chars().collect();
|
|
// flip one char in the signature
|
|
let last = chars.len() - 1;
|
|
chars[last] = if chars[last] == 'A' { 'B' } else { 'A' };
|
|
let tampered: String = chars.into_iter().collect();
|
|
assert!(verify(&conn, &tampered, KEY).is_err());
|
|
}
|