james.maesandClaude Opus 4.7
1b2f067376
- Split config into LaunchSnapshot (frozen security keys: ollama, applescript, toolBlocklist, confirmationPolicy, logging) and PerTurnSnapshot (mutable: provider, tts, stt, featureFlags) per SEC-05 - OllamaConfig.init(from:) rejects non-localhost hosts at decode time with ConfigError.invalidOllamaHost (AGENT-05) - AppleScriptPolicy has no skipAllowlist/bypass/regex field (SEC-08); reflection test ConfigSplitTests.test_noSkipAllowlistKey enforces - FeatureFlags lives in PerTurnSnapshot only (OBS-05); reflection test LaunchSnapshotTests.test_featureFlagsNotInLaunchSnapshot enforces - SchemaMigrator: currentVersion=1, v1->v1 pass-through, future versions throw ConfigError.futureSchema - ConfigLoader.loadSnapshots: peek schemaVersion, migrate, decode both snapshots; wraps DecodingError into ConfigError.malformed - ConfigStore actor holds launch + streams perTurn updates (file- watcher wiring is Plan 03 scope) - Bundled default-config.json resource - Tests: 15/15 pass covering all behaviors listed in the plan - Deletes Plan 01 placeholders Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
15 lines
598 B
Swift
15 lines
598 B
Swift
import XCTest
|
|
@testable import Config
|
|
|
|
final class ApiKeyNotInConfigTests: XCTestCase {
|
|
func test_apiKeyNotInConfigJSON() throws {
|
|
let launch = try ConfigTestFixtures.launch()
|
|
let encoded = try JSONEncoder().encode(launch)
|
|
let json = String(data: encoded, encoding: .utf8)!.lowercased()
|
|
for forbidden in ["apikey", "\"api_key\"", "anthropic_key", "\"key\"", "sk-ant-"] {
|
|
XCTAssertFalse(json.contains(forbidden),
|
|
"LaunchSnapshot JSON encoding contains forbidden field '\(forbidden)' — SEC-01 violation")
|
|
}
|
|
}
|
|
}
|