Artifact [5f25a951c2]

Artifact 5f25a951c21c1fbc887ccc57c0af15a4bc71d92aa2ae007ff6401bbefd10dc40:

• File internal/api/account_test.go — part of check-in [86880118d5] at 2026-08-18 02:09:54 on branch trunk — account: manage identity through the API, and stop lying about why

  Six ops (account.list/add/passwd/delete/grant/revoke, admin) plus quarry accounts on top of them. Creating a login or granting someone read on a repository no longer needs shell access on the server.

  quarry account still opens OLTP directly and has to: the FIRST account must exist before any server runs or any admin exists to authenticate as. Everything after that is the API, so the CLI has no privileged path.

  The verifier never crosses the seam in either direction, and account.add /passwd scrub the password out of any error before it travels — an error is the one value that reaches a log, an HTTP body and a terminal at once.

  Verify returns a three-valued Decision instead of a bool. Denied and Insufficient are not the same thing and the wire has separate codes for them: an authenticated client short of a capability was being told 401 with a challenge, which invites it to retry the same password forever. Now 403, and deliberately without a challenge. A harness test pinned the old behaviour and was updated with the reason. (user: dmestas, size: 954) [annotate] [blame] [check-ins using]

package api

import (
	"errors"
	"strings"
	"testing"
)

// account.add and account.passwd are the two ops that take a plaintext
// password, and an error is the one value that reliably reaches a log,
// an HTTP body and a terminal at once. A store error that quotes what it
// was given must not carry the secret out with it.
func TestScrubRemovesTheSecret(t *testing.T) {
	err := errors.New(`oltp: rejected value "hunter2 correct horse" for account`)
	got := scrub(err, "hunter2 correct horse")

	if strings.Contains(got, "hunter2") {
		t.Fatalf("the password survived scrubbing: %q", got)
	}
	if !strings.Contains(got, "[redacted]") {
		t.Errorf("nothing marked as removed: %q", got)
	}
	if !strings.Contains(got, "oltp: rejected value") {
		t.Errorf("scrub destroyed the diagnostic: %q", got)
	}
	// An empty secret must not turn every error into redaction soup.
	if scrub(err, "") != err.Error() {
		t.Error("empty secret altered the message")
	}
}