switchroom 0.18.31 → 0.18.33

package/telegram-plugin/tests/secret-detect-oauth-code.test.ts

@@ -98,10 +98,12 @@ describe('anthropic_oauth_code pattern — Channel A', () => {
 // ─── Channel B — context rule structural tests ────────────────────────────────
 
 describe('auth-flow context rule — Channel B (structural wiring in gateway.ts)', () => {
-  const src = readFileSync(
-    new URL('../gateway/gateway.ts', import.meta.url),
-    'utf8',
-  )
+  const src =
+    readFileSync(new URL('../gateway/gateway.ts', import.meta.url), 'utf8') +
+    '\n' +
+    // P7 PR-9 (#2996): the secret-detect pipeline intercept moved verbatim
+    // into gateway/inbound-interceptors.ts (interceptSecretDetectPipeline).
+    readFileSync(new URL('../gateway/inbound-interceptors.ts', import.meta.url), 'utf8')
 
   it('declares awaitingAuthCodeAt map and AUTH_CODE_CONTEXT_TTL_MS constant', () => {
     expect(src).toMatch(/const awaitingAuthCodeAt = new Map<string, number>/)
@@ -121,7 +123,7 @@ describe('auth-flow context rule — Channel B (structural wiring in gateway.ts)
 
   it('clears awaitingAuthCodeAt (delete) in the inbound handler when the flag is active', () => {
     // The inbound handler must call delete after reading the flag
-    expect(src).toMatch(/awaitingAuthCodeAt\.delete\(chat_id\)/)
+    expect(src).toMatch(/awaitingAuthCodeAt\.delete\((?:p\.)?chat_id\)/)
   })
 
   it('checks isAuthFlowContext in the secret-detect block (passphrase path)', () => {
@@ -145,8 +147,9 @@ describe('auth-flow context rule — Channel B (structural wiring in gateway.ts)
   })
 
   it('reaps awaitingAuthCodeAt in the TTL reaper alongside other pending-state maps', () => {
-    // The pendingStateReaper interval must sweep expired auth-code-context entries
-    const reaperIdx = src.indexOf('pendingStateReaper = setInterval')
+    // The pendingStateReaper interval must sweep expired auth-code-context entries.
+    // Anchor tolerates the #2996 P0c `isGatewayMain ? setInterval(...)` boot gate.
+    const reaperIdx = src.indexOf('pendingStateReaper = ')
     expect(reaperIdx).toBeGreaterThan(0)
     const reaperBlock = src.slice(reaperIdx, reaperIdx + 800)
     expect(reaperBlock).toMatch(/awaitingAuthCodeAt/)
@@ -154,7 +157,9 @@ describe('auth-flow context rule — Channel B (structural wiring in gateway.ts)
   })
 
   it('auth-flow context rule sits BEFORE recordInbound() and broadcast()', () => {
-    const contextIdx = src.indexOf('isAuthFlowContext')
+    // P7 PR-9: the context rule lives inside interceptSecretDetectPipeline;
+    // its gateway CALL SITE is the ordering anchor against the sinks.
+    const contextIdx = src.indexOf('await interceptSecretDetectPipeline(')
     const recordIdx = src.indexOf('recordInbound(', contextIdx)
     const broadcastIdx = src.indexOf('ipcServer.broadcast(inboundMsg)', contextIdx)
     expect(contextIdx).toBeGreaterThan(0)
@@ -190,8 +195,12 @@ describe('anthropic_oauth_code pattern — URL false-positive regression', () =>
 // Test 2: Blocker 1 sequencing — structural check that deleteMessage is called
 // inside the pendingReauthFlows intercept path, before setMessageReaction.
 describe('pendingReauthFlows intercept — deleteMessage sequencing (Blocker 1)', () => {
+  // P7 PR-7 (#2996): the reauth intercept body moved verbatim into
+  // gateway/inbound-interceptors.ts (interceptReauth); the redaction is the
+  // injected deps.redactAuthCode closure over redactAuthCodeMessage +
+  // redactAuthCodeApi (bound in gateway.ts). Same pins, new file owner.
   const src = readFileSync(
-    new URL('../gateway/gateway.ts', import.meta.url),
+    new URL('../gateway/inbound-interceptors.ts', import.meta.url),
     'utf8',
   )
 
@@ -201,7 +210,7 @@ describe('pendingReauthFlows intercept — deleteMessage sequencing (Blocker 1)'
     // `setMessageReaction(...)` literals, but #488 consolidated all 6
     // auth-code paste paths through `redactAuthCodeMessage`. The pin
     // is now: the intercept block must call the helper.
-    const interceptIdx = src.indexOf('// Auth-code intercept')
+    const interceptIdx = src.indexOf('export async function interceptReauth(')
     expect(interceptIdx).toBeGreaterThan(0)
 
     // Find the end of this intercept block — the next blank line after
@@ -214,7 +223,7 @@ describe('pendingReauthFlows intercept — deleteMessage sequencing (Blocker 1)'
     // (optionally cast, #623), now the gated `redactAuthCodeApi` adapter whose
     // reaction routes through the send gate + flood breaker (#3155). `msgId`
     // may be narrowed (`msgId ?? null`).
-    expect(window).toMatch(/redactAuthCodeMessage\((?:bot\.api|redactAuthCodeApi)(?:\s+as\s+\w+)?,\s*chat_id,\s*msgId(?:\s*\?\?\s*null)?(?:,\s*[^)]+)?\)/)
+    expect(window).toMatch(/deps\.redactAuthCode\(p\.chat_id,\s*p\.msgId(?:\s*\?\?\s*null)?\)/)
   })
 
   it('redaction lands AFTER the success/error reply renders', () => {
@@ -223,10 +232,10 @@ describe('pendingReauthFlows intercept — deleteMessage sequencing (Blocker 1)'
     // even if their original message disappears mid-render. Same
     // ordering the helper preserves — fire-and-forget redaction
     // happens after `await switchroomReply(...)`.
-    const interceptIdx = src.indexOf('// Auth-code intercept')
+    const interceptIdx = src.indexOf('export async function interceptReauth(')
     const window = src.slice(interceptIdx, interceptIdx + 2000)
-    const replyIdx = window.indexOf('switchroomReply(ctx,')
-    const redactIdx = window.indexOf('redactAuthCodeMessage(')
+    const replyIdx = window.indexOf('deps.switchroomReply(')
+    const redactIdx = window.indexOf('deps.redactAuthCode(')
     expect(replyIdx).toBeGreaterThan(0)
     expect(redactIdx).toBeGreaterThan(0)
     expect(replyIdx).toBeLessThan(redactIdx)
@@ -236,10 +245,12 @@ describe('pendingReauthFlows intercept — deleteMessage sequencing (Blocker 1)'
 // Test 3: Flag consumption — awaitingAuthCodeAt is NOT cleared on a non-detection
 // inbound (a stray "ok" within the 5-min window should not disarm Channel B).
 describe('awaitingAuthCodeAt flag — consumption only on actual detection', () => {
-  const src = readFileSync(
-    new URL('../gateway/gateway.ts', import.meta.url),
-    'utf8',
-  )
+  const src =
+    readFileSync(new URL('../gateway/gateway.ts', import.meta.url), 'utf8') +
+    '\n' +
+    // P7 PR-9 (#2996): the secret-detect pipeline intercept moved verbatim
+    // into gateway/inbound-interceptors.ts (interceptSecretDetectPipeline).
+    readFileSync(new URL('../gateway/inbound-interceptors.ts', import.meta.url), 'utf8')
 
   it('delete(chat_id) does NOT appear at the top of the isAuthFlowContext block (no early consume)', () => {
     // The old bug: delete fired unconditionally inside `if (isAuthFlowContext)`.
@@ -260,7 +271,7 @@ describe('awaitingAuthCodeAt flag — consumption only on actual detection', ()
     expect(fallbackIdx).toBeGreaterThan(0)
     // Within 400 chars after the comment, delete must appear
     const window = src.slice(fallbackIdx, fallbackIdx + 400)
-    expect(window).toMatch(/awaitingAuthCodeAt\.delete\(chat_id\)/)
+    expect(window).toMatch(/(?:deps\.)?awaitingAuthCodeAt\.delete\((?:p\.)?chat_id\)/)
   })
 
   it('awaitingAuthCodeAt.delete appears inside the no-passphrase hasHigh branch', () => {
@@ -271,7 +282,7 @@ describe('awaitingAuthCodeAt flag — consumption only on actual detection', ()
     const window = src.slice(noPpIdx, noPpIdx + 1200)
     // Conditional consume: only fires if isAuthFlowContext
     expect(window).toMatch(/if \(isAuthFlowContext\)/)
-    expect(window).toMatch(/awaitingAuthCodeAt\.delete\(chat_id\)/)
+    expect(window).toMatch(/(?:deps\.)?awaitingAuthCodeAt\.delete\((?:p\.)?chat_id\)/)
   })
 })