okami.mom/albedo

git clone https://git.nkp.pet/okami.mom/albedo

Aly Raffaufrefactor(gleam): clean up code and enforce focused lint checksb585313

main
branchesmainall refs →
1.4 KiB40 linesraw
1// Private regular-file validation guards symlink and permissions attacks on MCP credentials.
2import gleam/dynamic
3import gleeunit/should
4
5@external(erlang, "albedo_skills_test_support", "fixture")
6fn fixture() -> #(String, String, String)
7
8@external(erlang, "albedo_skills_test_support", "write")
9fn write(base: String, path: String, contents: String) -> String
10
11@external(erlang, "albedo_skills_test_support", "chmod")
12fn chmod(base: String, path: String, mode: Int) -> Nil
13
14@external(erlang, "albedo_skills_test_support", "replace_with_symlink")
15fn link(base: String, source: String, path: String) -> Nil
16
17@external(erlang, "albedo_skills_test_support", "cleanup")
18fn cleanup(root: String) -> Nil
19
20@external(erlang, "albedo_mcp_credentials", "server_at")
21fn secret(home: String, name: String) -> Result(dynamic.Dynamic, String)
22
23pub fn credentials_require_private_regular_file_test() -> Nil {
24  let #(root, _, home) = fixture()
25  secret(home, "docs") |> should.be_ok
26  let _ =
27    write(
28      home,
29      "creds.json",
30      "{\"mcp\":{\"docs\":{\"bearerToken\":\"never-log\"}}}",
31    )
32  chmod(home, "creds.json", 420)
33  secret(home, "docs") |> should.be_error
34  chmod(home, "creds.json", 384)
35  secret(home, "docs") |> should.be_ok
36  let _ = write(home, "replacement", "{}")
37  link(home, "replacement", "creds.json")
38  secret(home, "docs") |> should.be_error
39  cleanup(root)
40}