Artifact [8f238b7769]

Artifact 8f238b7769e78d7134f408298ebaf472d5c0fd136d904b6d87696a09a1b0af9b:

• File internal/oltp/legacy_secret_test.go — part of check-in [41b085ae25] at 2026-08-23 00:21:30 on branch trunk — caps phase 4: imported fossil users sign in, and the store path joins the wire path

  Authenticate accepts an imported §6.3 credential once and upgrades the account to argon2, dropping the imported secret; a wrong guess never consumes it. quarry users pull without --url now reads the store's own table (zit#124/#125) — no credential needed for a repo we already serve. Proven end to end against a real fossil: a user who existed only there signed into quarry with their original password. (user: dmestas, size: 710) [annotate] [blame] [check-ins using]

package oltp

import (
	"testing"

	"craftdesign.group/quarry/internal/xfer"
)

// The storage layer spells the §6.3 derivation itself so it need not
// depend on transport. This pins the two spellings together: if either
// drifts, imported users silently stop being able to sign in.
func TestLegacySecretMatchesXfer(t *testing.T) {
	for _, c := range []struct{ code, login, pw string }{
		{"abc", "alice", "pw"},
		{"009a9066cb5f58ce224def584946d2177d7607e9", "root", "rootpw"},
		{"", "", ""},
	} {
		if got, want := legacySecret(c.code, c.login, c.pw),
			xfer.SharedSecret(c.code, c.login, c.pw); got != want {
			t.Fatalf("derivations diverged for %q/%q: %q vs %q", c.code, c.login, got, want)
		}
	}
}