claude-multiacc 2.0.2 → 2.0.4

package/tests/test_codex_reset.py

@@ -0,0 +1,170 @@
+#!/usr/bin/env python3
+"""Sandboxed integration tests for automatic Codex usage-reset redemption."""
+
+from __future__ import annotations
+
+import base64
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import json
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import threading
+import time
+import unittest
+import uuid
+
+REPO = Path(__file__).resolve().parents[1]
+
+
+def jwt(claims: dict) -> str:
+    payload = base64.urlsafe_b64encode(json.dumps(claims).encode()).decode().rstrip("=")
+    return f"header.{payload}.signature"
+
+
+class ResetHandler(BaseHTTPRequestHandler):
+    def do_GET(self) -> None:  # noqa: N802 - BaseHTTPRequestHandler contract
+        state = self.server.state
+        if self.path == "/wham/usage":
+            state["usage_gets"] += 1
+            body = state["usage"]
+        elif self.path == "/wham/rate-limit-reset-credits":
+            state["credit_gets"] += 1
+            body = state["credits"]
+        else:
+            self.send_error(404)
+            return
+        encoded = json.dumps(body).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(encoded)))
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def do_POST(self) -> None:  # noqa: N802 - BaseHTTPRequestHandler contract
+        state = self.server.state
+        if self.path != "/wham/rate-limit-reset-credits/consume":
+            self.send_error(404)
+            return
+        length = int(self.headers.get("Content-Length") or 0)
+        state["posts"].append(json.loads(self.rfile.read(length)))
+        status, body = state["responses"].pop(0)
+        encoded = json.dumps(body).encode()
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(encoded)))
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def log_message(self, _format: str, *_args) -> None:
+        return
+
+
+class CodexResetIntegrationTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temp = tempfile.TemporaryDirectory(prefix="multiacc-reset-")
+        self.pool = Path(self.temp.name) / "pool"
+        account = self.pool / "acct-01"
+        account.mkdir(parents=True)
+        manifest = {"version": 1, "threshold": 90, "accounts": [
+            {"id": "acct-01", "email": "test@example.invalid", "home": "mac"}]}
+        (self.pool / "accounts.json").write_text(json.dumps(manifest), encoding="utf-8")
+        claims = {"exp": int(time.time()) + 86400,
+                  "https://api.openai.com/auth": {"chatgpt_account_id": "account-test"}}
+        auth = {"auth_mode": "chatgpt", "tokens": {
+            "access_token": jwt(claims), "refresh_token": "fake-refresh",
+            "account_id": "account-test"}}
+        (account / "auth.json").write_text(json.dumps(auth), encoding="utf-8")
+        self.server = ThreadingHTTPServer(("127.0.0.1", 0), ResetHandler)
+        self.server.state = {"usage_gets": 0, "credit_gets": 0, "posts": [],
+                             "usage": {}, "credits": {}, "responses": []}
+        self.thread = threading.Thread(target=self.server.serve_forever, daemon=True)
+        self.thread.start()
+
+    def tearDown(self) -> None:
+        self.server.shutdown()
+        self.server.server_close()
+        self.thread.join(timeout=5)
+        self.temp.cleanup()
+
+    def run_limits(self) -> subprocess.CompletedProcess:
+        base = f"http://127.0.0.1:{self.server.server_port}/wham"
+        env = os.environ.copy()
+        env.update({"CODEX_ACCOUNTS_ROOT": str(self.pool),
+                    "CODEX_MULTIACC_NO_SYNC": "1", "CODEX_MULTIACC_MIN_FETCH": "0",
+                    "CODEX_MULTIACC_AUTO_RESET": "1", "PYTHONDONTWRITEBYTECODE": "1",
+                    "CODEX_MULTIACC_USAGE_URL": f"{base}/usage"})
+        env.pop("CODEX_MULTIACC_RESET_CREDITS_URL", None)
+        env.pop("CODEX_MULTIACC_RESET_CONSUME_URL", None)
+        return subprocess.run([REPO / "bin/codex-accounts", "limits", "--force"],
+                              capture_output=True, text=True, env=env, timeout=20, check=False)
+
+    def test_redeems_at_five_percent_remaining_once(self) -> None:
+        now = int(time.time())
+        self.server.state["usage"] = {"plan_type": "pro", "rate_limit": {
+            "allowed": True, "primary_window": {"used_percent": 95,
+                "limit_window_seconds": 18000, "reset_at": now + 3600}},
+            "rate_limit_reset_credits": {"available_count": 2}}
+        self.server.state["credits"] = {"available_count": 2, "credits": [
+            {"id": "later", "status": "available", "expires_at": "2026-09-02T00:00:00Z"},
+            {"id": "sooner", "status": "available", "expires_at": "2026-09-01T00:00:00Z"}]}
+        self.server.state["responses"] = [(200, {"code": "reset", "windows_reset": 2})]
+        result = self.run_limits()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("usage reset redeemed automatically at 95% used", result.stdout)
+        self.assertEqual(len(self.server.state["posts"]), 1)
+        request = self.server.state["posts"][0]
+        self.assertEqual(request["credit_id"], "sooner")
+        uuid.UUID(request["redeem_request_id"])
+        state = json.loads((self.pool / "acct-01/.usage-reset.json").read_text())
+        self.assertEqual(state["state"], "complete")
+        marker = self.pool / "acct-01/.limited"
+        self.assertFalse(marker.exists())
+        marker.write_text(f"{now + 3600}\nreason=client-rate-limit\n", encoding="utf-8")
+        (self.pool / "acct-01/.usage-reset.json").unlink()
+        self.server.state["responses"] = [(200, {"code": "already_redeemed"})]
+        result = self.run_limits()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertFalse(marker.exists())
+        self.assertEqual(self.server.state["posts"][0]["redeem_request_id"],
+                         self.server.state["posts"][1]["redeem_request_id"])
+        self.run_limits()
+        self.assertEqual(len(self.server.state["posts"]), 2)
+
+    def test_does_not_redeem_above_five_percent_remaining(self) -> None:
+        now = int(time.time())
+        self.server.state["usage"] = {"rate_limit": {"allowed": True,
+            "primary_window": {"used_percent": 94, "limit_window_seconds": 18000,
+                               "reset_at": now + 3600}},
+            "rate_limit_reset_credits": {"available_count": 1}}
+        result = self.run_limits()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(self.server.state["credit_gets"], 0)
+        self.assertEqual(self.server.state["posts"], [])
+        self.assertFalse((self.pool / "acct-01/.usage-reset.json").exists())
+
+    def test_retries_a_lost_response_with_the_same_idempotency_key(self) -> None:
+        now = int(time.time())
+        self.server.state["usage"] = {"rate_limit": {"allowed": False,
+            "limit_reached": True, "primary_window": {"used_percent": 100,
+                "limit_window_seconds": 604800, "reset_at": now + 86400}},
+            "rate_limit_reset_credits": {"available_count": 1}}
+        self.server.state["credits"] = {"available_count": 1, "credits": []}
+        self.server.state["responses"] = [
+            (500, {"error": "response lost"}),
+            (200, {"code": "already_redeemed", "windows_reset": 2})]
+        first = self.run_limits()
+        self.assertIn("retry is idempotent", first.stdout)
+        self.assertEqual(json.loads((self.pool / "acct-01/.usage-reset.json").read_text())
+                         ["state"], "pending")
+        second = self.run_limits()
+        self.assertEqual(second.returncode, 0, second.stderr)
+        self.assertEqual(len(self.server.state["posts"]), 2)
+        keys = [request["redeem_request_id"] for request in self.server.state["posts"]]
+        self.assertEqual(keys[0], keys[1])
+        self.assertEqual(self.server.state["credit_gets"], 1)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_keychain.py

@@ -0,0 +1,204 @@
+#!/usr/bin/env python3
+"""Unit tests for lib/keychain.py and its audit/report integration.
+
+Runs everywhere: a fake `security` on PATH serves generic-password items from a
+temp dir, and CLAUDE_MULTIACC_KEYCHAIN=1 forces the lookup on off-macOS. Nothing
+here can ever touch a real keychain — the fake shadows /usr/bin/security.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+REPO = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(REPO / 'lib'))
+
+FAKE_SECURITY = r'''#!/usr/bin/env bash
+KC="${FAKE_KEYCHAIN_DIR:-/nonexistent-keychain}"
+cmd="${1:-}"; shift || true
+svc=""; acct=""; want_pw=0; hexdata=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -s) svc="$2"; shift 2 ;;
+    -a) acct="$2"; shift 2 ;;
+    -w) want_pw=1; shift ;;
+    -X) hexdata="$2"; shift 2 ;;
+    *) shift ;;
+  esac
+done
+case "$cmd" in
+  find-generic-password)
+    [ -f "$KC/$svc" ] || exit 44
+    if [ "$want_pw" = "1" ]; then
+      [ -n "${FAKE_KEYCHAIN_LOCKED:-}" ] && exit 36
+      cat "$KC/$svc"; exit 0
+    fi
+    a="tester"; [ -f "$KC/$svc.acct" ] && a="$(cat "$KC/$svc.acct")"
+    printf 'attributes:\n    "acct"<blob>="%s"\n' "$a"
+    printf '    "mdat"<timedate>=0x00  "20260828043137Z\\000"\n'
+    printf '    "svce"<blob>="%s"\n' "$svc"
+    exit 0 ;;
+  add-generic-password)
+    [ -n "${FAKE_KEYCHAIN_LOCKED:-}" ] && exit 36
+    mkdir -p "$KC"
+    printf '%s' "$hexdata" | python3 -c 'import sys;sys.stdout.buffer.write(bytes.fromhex(sys.stdin.read().strip()))' > "$KC/$svc"
+    printf '%s' "${acct:-tester}" > "$KC/$svc.acct"
+    exit 0 ;;
+  delete-generic-password)
+    [ -f "$KC/$svc" ] || exit 44
+    rm -f "$KC/$svc" "$KC/$svc.acct"; exit 0 ;;
+  *) exit 1 ;;
+esac
+'''
+
+DOC = {'claudeAiOauth': {'accessToken': 'sk-ant-oat01-x', 'refreshToken': 'r',
+                         'expiresAt': 9999999999999,
+                         'refreshTokenExpiresAt': 9999999999999}}
+
+
+class KeychainTests(unittest.TestCase):
+    def setUp(self):
+        self.work = tempfile.TemporaryDirectory()
+        work = Path(self.work.name)
+        fakebin = work / 'bin'
+        fakebin.mkdir()
+        tool = fakebin / 'security'
+        tool.write_text(FAKE_SECURITY)
+        tool.chmod(0o755)
+        self.kcdir = work / 'keychain'
+        self.saved = {k: os.environ.get(k) for k in
+                      ('PATH', 'CLAUDE_MULTIACC_KEYCHAIN', 'FAKE_KEYCHAIN_DIR',
+                       'FAKE_KEYCHAIN_LOCKED')}
+        os.environ['PATH'] = f"{fakebin}:{os.environ['PATH']}"
+        os.environ['CLAUDE_MULTIACC_KEYCHAIN'] = '1'
+        os.environ['FAKE_KEYCHAIN_DIR'] = str(self.kcdir)
+        os.environ.pop('FAKE_KEYCHAIN_LOCKED', None)
+        # (re)load with the fake in place
+        import importlib
+        import keychain
+        self.keychain = importlib.reload(keychain)
+        self.root = work / 'accounts'
+        (self.root / 'acct-01').mkdir(parents=True)
+        (self.root / 'acct-01' / 'tmp').mkdir(exist_ok=True)
+
+    def tearDown(self):
+        for key, value in self.saved.items():
+            if value is None:
+                os.environ.pop(key, None)
+            else:
+                os.environ[key] = value
+        self.work.cleanup()
+
+    # -- the layout facts this whole feature stands on ------------------------------
+    def test_service_name_matches_the_client(self):
+        # Observed live 2026-08-28 (Claude Code 2.1.250, my-mini): this config dir's
+        # login sat under exactly this service. The hash input is the PATH STRING as
+        # the client received it — no realpath, no trailing slash.
+        self.assertEqual(
+            self.keychain.service_name('/Users/gas/.claude-accounts/acct-16'),
+            'Claude Code-credentials-4219e2b1')
+
+    def test_absent_then_present_roundtrip(self):
+        d = str(self.root / 'acct-01')
+        self.assertEqual(self.keychain.probe(d)['state'], 'absent')
+        self.assertTrue(self.keychain.write(d, DOC, account='gas'))
+        res = self.keychain.probe(d)
+        self.assertEqual(res['state'], 'present')
+        self.assertEqual(res['doc'], DOC)
+        # -U update path keeps a single item and the account name it was made with
+        doc2 = {'claudeAiOauth': dict(DOC['claudeAiOauth'], accessToken='sk-ant-oat01-y')}
+        self.assertTrue(self.keychain.write(d, doc2))
+        again = self.keychain.probe(d)
+        self.assertEqual(again['doc']['claudeAiOauth']['accessToken'], 'sk-ant-oat01-y')
+        self.assertTrue(self.keychain.delete(d))
+        self.assertEqual(self.keychain.probe(d)['state'], 'absent')
+        self.assertTrue(self.keychain.delete(d))     # deleting a missing item is fine
+
+    def test_locked_is_distinguished_from_absent(self):
+        d = str(self.root / 'acct-01')
+        self.keychain.write(d, DOC, account='tester')
+        os.environ['FAKE_KEYCHAIN_LOCKED'] = '1'
+        res = self.keychain.probe(d)
+        self.assertEqual(res['state'], 'locked')
+        self.assertIsNone(res['doc'])
+        self.assertEqual(res['account'], 'tester')
+        self.assertGreater(self.keychain.item_mtime(d), 0)
+        # an id with NO item is still absent, not locked
+        self.assertEqual(self.keychain.probe(d + '-other')['state'], 'absent')
+
+    def test_corrupt_item(self):
+        d = str(self.root / 'acct-01')
+        svc = self.keychain.service_name(d)
+        self.kcdir.mkdir(exist_ok=True)
+        (self.kcdir / svc).write_text('not json at all')
+        self.assertEqual(self.keychain.probe(d)['state'], 'corrupt')
+
+    def test_kill_switch(self):
+        d = str(self.root / 'acct-01')
+        self.keychain.write(d, DOC)
+        os.environ['CLAUDE_MULTIACC_KEYCHAIN'] = '0'
+        self.assertFalse(self.keychain.enabled())
+        self.assertEqual(self.keychain.probe(d)['state'], 'absent')
+        os.environ['CLAUDE_MULTIACC_KEYCHAIN'] = '1'
+
+    # -- audit + report integration --------------------------------------------------
+    def _manifest(self):
+        (self.root / 'accounts.json').write_text(json.dumps({
+            'version': 1, 'server': 'root@203.0.113.1',
+            'server_root': '/root/.claude-accounts',
+            'server_repo': '/root/claude-multiacc', 'threshold': 90,
+            'accounts': [{'id': 'acct-01', 'email': 'kc@test', 'home': 'mac',
+                          'added_at': '2026-08-28T00:00:00Z'}]}))
+
+    def test_audit_sees_a_keychain_login(self):
+        import audit
+        self._manifest()
+        d = str(self.root / 'acct-01')
+        self.assertEqual(
+            audit.audit_account(str(self.root), {'id': 'acct-01', 'email': 'kc@test',
+                                                 'home': 'mac'}, machine='mac')['state'],
+            'missing')
+        self.keychain.write(d, DOC)
+        row = audit.audit_account(str(self.root), {'id': 'acct-01', 'email': 'kc@test',
+                                                   'home': 'mac'}, machine='mac')
+        self.assertEqual((row['state'], row['store']), ('ok', 'keychain'))
+        os.environ['FAKE_KEYCHAIN_LOCKED'] = '1'
+        row = audit.audit_account(str(self.root), {'id': 'acct-01', 'email': 'kc@test',
+                                                   'home': 'mac'}, machine='mac')
+        self.assertEqual(row['state'], 'locked')
+        self.assertEqual(row['label'], 'KEYCHAIN LOCKED')
+        os.environ.pop('FAKE_KEYCHAIN_LOCKED', None)
+
+    def test_report_class_and_status(self):
+        self._manifest()
+        d = str(self.root / 'acct-01')
+        self.keychain.write(d, DOC)
+        out = subprocess.run(
+            [sys.executable, str(REPO / 'lib' / 'report.py'), str(self.root),
+             'claude', 'mac', 'list'],
+            capture_output=True, text=True, check=True, env=os.environ.copy())
+        row = json.loads(out.stdout)['accounts'][0]
+        self.assertEqual(row['status'], 'active')
+        self.assertEqual(row['credential_class'], 'machine-local')
+        self.assertEqual(row['credentials']['oauth_store'], 'keychain')
+        self.assertEqual(row['credentials']['keychain'], 'readable')
+        env = dict(os.environ, FAKE_KEYCHAIN_LOCKED='1')
+        out = subprocess.run(
+            [sys.executable, str(REPO / 'lib' / 'report.py'), str(self.root),
+             'claude', 'mac', 'list'],
+            capture_output=True, text=True, check=True, env=env)
+        row = json.loads(out.stdout)['accounts'][0]
+        self.assertEqual(row['status'], 'locked')
+        self.assertEqual(row['credential_class'], 'machine-local')
+        self.assertFalse(row['selectable'])
+        self.assertFalse(row['needs_login'])
+
+
+if __name__ == '__main__':
+    unittest.main()