claude-multiacc 2.0.43 → 2.0.45

package/tests/test_token_identity_retry.py

@@ -0,0 +1,95 @@
+"""Identity checks must cover retry accounts and the token handed to the command."""
+
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import unittest
+
+import test_token_identity_integration as integration
+from test_token_identity_integration import IdentityHandler, RIGHT_TOKEN, WRONG_TOKEN
+
+RETRY_CLI = r'''#!/usr/bin/env python3
+import json, os, pathlib, sys
+args = sys.argv[1:]
+if args == ['--version']:
+    print('2.1.280')
+elif 'USER_IDENTITY_SENTINEL' not in args:
+    print('OK')
+else:
+    account = pathlib.Path(os.environ['CLAUDE_CONFIG_DIR']).name
+    wrong = os.environ.get('CLAUDE_CODE_OAUTH_TOKEN') == 'sk-ant-oat01-synthetic-wrong-organization'
+    with open(os.environ['IDENTITY_TEST_COMMANDS'], 'a') as handle:
+        handle.write(json.dumps({'account': account, 'wrong_token': wrong}) + '\n')
+    if account == os.environ.get('IDENTITY_TEST_FAIL_ACCOUNT'):
+        print('rate limit exceeded (429)', file=sys.stderr)
+        sys.exit(1)
+    print('served:' + account)
+'''
+
+
+class SwappingIdentityHandler(IdentityHandler):
+    def do_POST(self):  # noqa: N802 - HTTP handler contract
+        if self.headers.get("Authorization") == f"Bearer {RIGHT_TOKEN}":
+            self.server.swap_token.write_text(WRONG_TOKEN)
+        return super().do_POST()
+
+
+class TokenIdentityRetryTests(unittest.TestCase):
+    def fixture(self):
+        pool = integration.TokenIdentityIntegrationTests()
+        pool.setUp()
+        self.addCleanup(pool.tearDown)
+        (pool.fakebin / "claude").write_text(RETRY_CLI)
+        startup = Path(pool.temp.name) / "fixed-random.sh"
+        startup.write_text("unset RANDOM\nRANDOM=1\n")
+        pool.environ.update(CLAUDE_SHIM_RETRY="1", CLAUDE_MULTIACC_HEADROOM_BAND="0", BASH_ENV=str(startup))
+        return pool
+
+    def run_user(self, pool, **overrides):
+        return subprocess.run([str(integration.REPO / "bin/claude"), "-p", "USER_IDENTITY_SENTINEL"],
+                              cwd=pool.home, env={**pool.environ, **overrides}, stdin=subprocess.DEVNULL,
+                              capture_output=True, text=True, timeout=30, check=False)
+
+    def test_retry_skips_an_unchecked_wrong_token_before_sending_the_user_command(self):
+        pool = self.fixture()
+        (pool.account / ".credentials.json").write_text(pool.oauth)
+        wrong = pool.pool / "acct-02"
+        (wrong / ".credentials.json").unlink()
+        (wrong / "server.token").write_text(WRONG_TOKEN)
+        (wrong / ".server-token-verified").write_text(hashlib.sha256(WRONG_TOKEN.encode()).hexdigest())
+        profile = json.loads(json.dumps(pool.profile))
+        profile["oauthAccount"]["emailAddress"] = "control@example.invalid"
+        (wrong / ".claude.json").write_text(json.dumps(profile))
+        control = pool.pool / "acct-03"
+        control.mkdir()
+        (control / ".credentials.json").write_text(pool.oauth)
+        (control / "limits.json").write_bytes((wrong / "limits.json").read_bytes())
+        manifest = json.loads((pool.pool / "accounts.json").read_text())
+        manifest["accounts"].append({"id": "acct-03", "email": "third@example.invalid", "home": "mac"})
+        (pool.pool / "accounts.json").write_text(json.dumps(manifest))
+        result = self.run_user(pool, IDENTITY_TEST_FAIL_ACCOUNT="acct-01")
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        commands = [json.loads(line) for line in pool.commands.read_text().splitlines()]
+        self.assertEqual(commands, [{"account": "acct-01", "wrong_token": False},
+                                    {"account": "acct-03", "wrong_token": False}])
+        self.assertEqual(result.stdout.strip(), "served:acct-03")
+        self.assertGreater(pool.server.state["identity_calls"], 0)
+
+    def test_a_token_replaced_during_identity_check_is_never_sent_without_verification(self):
+        pool = self.fixture()
+        (pool.account / "server.token").write_text(RIGHT_TOKEN)
+        (pool.account / ".server-token-verified").write_text(hashlib.sha256(RIGHT_TOKEN.encode()).hexdigest())
+        pool.server.RequestHandlerClass = SwappingIdentityHandler
+        pool.server.swap_token = pool.account / "server.token"
+        result = self.run_user(pool)
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertEqual((pool.account / "server.token").read_text(), WRONG_TOKEN)
+        commands = [json.loads(line) for line in pool.commands.read_text().splitlines()]
+        self.assertEqual(len(commands), 1)
+        self.assertFalse(commands[0]["wrong_token"], commands)
+        self.assertIn(commands[0]["account"], {"acct-01", "acct-02"})
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_token_identity_sync.py

@@ -0,0 +1,139 @@
+"""Bootstrap token identity on the source and export only proven receipts."""
+
+import json
+import unittest
+
+import test_token_identity_integration as integration
+from test_token_identity_integration import IdentityHandler, RIGHT_TOKEN
+
+UNKNOWN_TOKEN = "sk-ant-oat01-synthetic-no-identity-header"
+RSYNC_RECORDER = r'''#!/usr/bin/env python3
+import json, os, pathlib, sys
+files = []
+for argument in sys.argv[1:]:
+    if argument.startswith('--files-from='):
+        files.extend(pathlib.Path(argument.split('=', 1)[1]).read_text().splitlines())
+    elif not argument.startswith('-') and pathlib.Path(argument).is_file():
+        path = pathlib.Path(argument)
+        files.append(path.parent.name + '/' + path.name)
+with open(os.environ['IDENTITY_TEST_TRANSFERS'], 'a') as handle:
+    handle.write(json.dumps(files) + '\n')
+'''
+
+
+class OptionalHeaderHandler(IdentityHandler):
+    def do_POST(self):  # noqa: N802 - HTTP handler contract
+        if self.headers.get("Authorization") == f"Bearer {UNKNOWN_TOKEN}":
+            self.rfile.read(int(self.headers.get("Content-Length") or 0))
+            self.server.state["identity_calls"] += 1
+            return self._send(200, {"content": [{"type": "text", "text": "OK"}]})
+        return super().do_POST()
+
+
+class TokenIdentitySyncTests(unittest.TestCase):
+    def fixture(self):
+        pool = integration.TokenIdentityIntegrationTests()
+        pool.setUp()
+        self.addCleanup(pool.tearDown)
+        (pool.account / ".credentials.json").write_text(pool.oauth)
+        pool.server.RequestHandlerClass = OptionalHeaderHandler
+        pool.transfers = pool.home / "transfers.jsonl"
+        pool.environ["IDENTITY_TEST_TRANSFERS"] = str(pool.transfers)
+        for name, body in (("rsync", RSYNC_RECORDER), ("ssh", "#!/bin/sh\nexit 0\n")):
+            path = pool.fakebin / name
+            path.write_text(body)
+            path.chmod(0o755)
+        return pool
+
+    def export_candidates(self, pool):
+        # Only the remote-sync command is Mac-gated; shim tests need the native OS's stat flags.
+        uname = pool.fakebin / "uname"
+        uname.write_text("#!/bin/sh\necho Darwin\n")
+        uname.chmod(0o755)
+        manifest = json.loads((pool.pool / "accounts.json").read_text())
+        manifest.update(server="fixture@peer.invalid", server_root="/fixture/pool", server_repo="/fixture/repo")
+        for aid, token, email in (("acct-02", UNKNOWN_TOKEN, "control@example.invalid"),
+                                   ("acct-03", RIGHT_TOKEN, "matching@example.invalid")):
+            account = pool.pool / aid
+            account.mkdir(exist_ok=True)
+            (account / "server.token").write_text(token)
+            (account / ".credentials.json").write_text(pool.oauth)
+            profile = json.loads(json.dumps(pool.profile))
+            profile["oauthAccount"]["emailAddress"] = email
+            (account / ".claude.json").write_text(json.dumps(profile))
+            (account / "limits.json").write_bytes((pool.account / "limits.json").read_bytes())
+            if aid == "acct-03":
+                manifest["accounts"].append({"id": aid, "email": email, "home": "mac"})
+        (pool.pool / "accounts.json").write_text(json.dumps(manifest))
+
+    def exported_receipts(self, pool):
+        entries = [entry for line in pool.transfers.read_text().splitlines() for entry in json.loads(line)]
+        self.assertFalse(any(entry.endswith("/.credentials.json") for entry in entries), entries)
+        return {entry for entry in entries if entry.endswith("/.server-token-identity.json")}
+
+    def test_local_source_sync_checks_tokens_even_with_a_working_oauth_login(self):
+        pool = self.fixture()
+        self.assertEqual(pool.identity()["state"], "unknown")
+        synced = pool.run_cli("claude-accounts", "sync", "--no-server")
+        self.assertEqual(synced.returncode, 0, synced.stdout + synced.stderr)
+        self.assertEqual(pool.identity()["state"], "mismatch")
+        self.assertEqual(pool.server.state["identity_calls"], 1)
+        self.assertFalse(pool.transfers.exists())
+        selected = pool.run_cli()
+        self.assertEqual(selected.returncode, 0, selected.stdout + selected.stderr)
+        self.assertEqual(json.loads(selected.stdout)["account"], "acct-01")
+        self.assertFalse(json.loads(selected.stdout)["token"])
+
+    def test_verify_bootstraps_token_identity_and_reports_the_healthy_oauth_pass(self):
+        pool = self.fixture()
+        self.assertEqual(pool.identity()["state"], "unknown")
+        verified = pool.run_cli("claude-accounts", "verify")
+        self.assertEqual(verified.returncode, 0, verified.stdout + verified.stderr)
+        self.assertIn("acct-01 test@example.invalid: PASS", verified.stdout)
+        self.assertIn("portable setup-token belongs to a different organization", verified.stdout)
+        self.assertEqual(pool.identity()["state"], "mismatch")
+        commands = [json.loads(line) for line in pool.commands.read_text().splitlines()]
+        self.assertTrue(commands)
+        self.assertFalse(any(command["token"] for command in commands))
+
+    def test_both_distribution_paths_export_match_and_mismatch_but_never_unknown(self):
+        from claude_token_identity import cached_identity
+        pool = self.fixture()
+        self.export_candidates(pool)
+        expected = {"acct-01/.server-token-identity.json", "acct-03/.server-token-identity.json"}
+        for command in ("limits-distribute-now", "sync"):
+            with self.subTest(command=command):
+                pool.transfers.write_text("")
+                sent = pool.run_cli("claude-accounts", command)
+                self.assertEqual(sent.returncode, 0, sent.stdout + sent.stderr)
+                self.assertEqual(self.exported_receipts(pool), expected)
+                self.assertEqual(pool.identity()["state"], "mismatch")
+                self.assertEqual(cached_identity(str(pool.pool / "acct-02"))["state"], "unknown")
+                self.assertEqual(cached_identity(str(pool.pool / "acct-03"))["state"], "match")
+
+    def test_profile_conflict_does_not_export_the_underlying_unknown_receipt(self):
+        from claude_token_identity import RECEIPT, cached_identity, check_identity
+        pool = self.fixture()
+        self.export_candidates(pool)
+        account = pool.pool / "acct-02"
+        unknown = check_identity(str(account), endpoint=pool.environ["CLAUDE_MULTIACC_TOKEN_IDENTITY_URL"])
+        self.assertEqual(unknown["state"], "unknown")
+        receipt = (account / RECEIPT).read_bytes()
+        profile = json.loads((account / ".claude.json").read_text())
+        profile["oauthAccount"]["emailAddress"] = "different-profile@example.invalid"
+        (account / ".claude.json").write_text(json.dumps(profile))
+        computed = cached_identity(str(account))
+        self.assertEqual(computed["state"], "mismatch")
+        self.assertFalse(computed["cached"])
+        expected = {"acct-01/.server-token-identity.json", "acct-03/.server-token-identity.json"}
+        for command in ("limits-distribute-now", "sync"):
+            with self.subTest(command=command):
+                pool.transfers.write_text("")
+                sent = pool.run_cli("claude-accounts", command)
+                self.assertEqual(sent.returncode, 0, sent.stdout + sent.stderr)
+                self.assertEqual(self.exported_receipts(pool), expected)
+                self.assertEqual((account / RECEIPT).read_bytes(), receipt)
+
+
+if __name__ == "__main__":
+    unittest.main()