kiwoom-cli 2.0.0__tar.gz → 2.1.0__tar.gz

{kiwoom_cli-2.0.0 → kiwoom_cli-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kiwoom-cli
-Version: 2.0.0
+Version: 2.1.0
 Summary: User-friendly CLI for the Kiwoom Securities REST API (키움증권)
 License: LicenseRef-kiwoom-cli-Source-Available-1.0
 Project-URL: Homepage, https://github.com/gejyn14/kiwoom-cli
@@ -26,7 +26,6 @@ Requires-Dist: tomli>=2.0; python_version < "3.11"
 Requires-Dist: tomli-w>=1.0
 Requires-Dist: keyring>=25.0
 Requires-Dist: websockets>=12.0
-Requires-Dist: cryptography>=42.0
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-httpx>=0.30; extra == "dev"
@@ -55,13 +54,13 @@ pip install kiwoom-cli
 ## 시작하기
 
 ```bash
-# 1. 초기 설정 (appkey, secretkey 입력 + 암호화 비밀번호 설정)
+# 1. 초기 설정 (appkey, secretkey 입력)
 kiwoom config setup
 
-# 2. 토큰 발급 (비밀번호 확인 후 발급)
+# 2. 토큰 발급
 kiwoom auth login
 
-# 3. 사용 (토큰 발급 후에는 비밀번호 불필요)
+# 3. 사용 (프롬프트 없음)
 kiwoom stock info 005930
 ```
 
@@ -87,7 +86,7 @@ export KIWOOM_DOMAIN="prod"       # prod 또는 mock
 export KIWOOM_ACCOUNT="1234567"   # 선택
 ```
 
-appkey/secretkey는 보안을 위해 환경변수를 지원하지 않습니다. 반드시 `kiwoom config setup`으로 암호화 저장하세요.
+appkey/secretkey는 보안을 위해 환경변수를 지원하지 않습니다. 반드시 `kiwoom config setup`으로 OS 키체인에 저장하세요.
 
 ### 멀티 프로필
 
@@ -472,7 +471,7 @@ eval (env _KIWOOM_COMPLETE=fish_source kiwoom)
 | 항목             | 값                                       |
 | ---------------- | ---------------------------------------- |
 | 설정 파일        | `~/.kiwoom/config.toml` (도메인, 계좌만) |
-| appkey/secretkey | OS 키체인 (암호화 저장)                  |
+| appkey/secretkey | OS 키체인                                |
 | 토큰             | OS 키체인                                |
 | 캐시 디렉터리    | `~/.kiwoom/cache/`                       |
 | 운영 도메인      | `https://api.kiwoom.com`                 |
@@ -487,18 +486,17 @@ eval (env _KIWOOM_COMPLETE=fish_source kiwoom)
 
 ## 보안
 
-인증정보(appkey, secretkey)는 **OS 키체인에 암호화되어 저장**됩니다. 파일로 존재하지 않으며, 비밀번호 없이는 복호화할 수 없습니다.
+모든 인증정보(appkey, secretkey, 토큰)는 **OS 키체인**(macOS Keychain / Windows Credential Manager / Linux Secret Service)에 저장됩니다. 파일로 존재하지 않으며, 키체인이 디스크 저장 시 암호화를 담당합니다. `gh`, `aws`, `docker` CLI와 동일한 모델입니다.
 
-| 항목               | 저장 방식          |            비밀번호 필요            |
-| ------------------ | ------------------ | :---------------------------------: |
-| appkey / secretkey | 암호화 + OS 키체인 | O (`config setup`, `auth login` 시) |
-| 토큰               | OS 키체인 (평문)   |           X (만료되는 값)           |
-| config.toml        | 도메인, 계좌번호만 |                  X                  |
+| 항목               | 저장 방식          | 프롬프트 |
+| ------------------ | ------------------ | :------: |
+| appkey / secretkey | OS 키체인          |    X     |
+| 토큰               | OS 키체인          |    X     |
+| config.toml        | 도메인, 계좌번호만 |    X     |
 
-- `config setup` 시 설정한 비밀번호로 appkey/secretkey를 암호화
-- `auth login/logout` 시 비밀번호 확인 후 키체인 접근
-- 토큰 발급 후 일반 명령어는 비밀번호 없이 사용
-- `keyring.get_password()`로 직접 접근해도 암호화된 값만 반환
+- 모든 명령어는 비밀번호/생체인증 프롬프트 없이 동작 (AI 에이전트·자동화 친화적)
+- 앱 자체 암호화 계층은 의도적으로 두지 않음 — 추가 계층은 명령마다 잠금 해제 프롬프트를 요구하게 되어 CLI 사용성을 해침
+- v2.0 이하에서 업그레이드한 경우: 암호화 저장소 형식이 제거되어 `kiwoom config setup`을 한 번 다시 실행해야 합니다
 
 ## License
 

{kiwoom_cli-2.0.0 → kiwoom_cli-2.1.0}/README.md

@@ -17,13 +17,13 @@ pip install kiwoom-cli
 ## 시작하기
 
 ```bash
-# 1. 초기 설정 (appkey, secretkey 입력 + 암호화 비밀번호 설정)
+# 1. 초기 설정 (appkey, secretkey 입력)
 kiwoom config setup
 
-# 2. 토큰 발급 (비밀번호 확인 후 발급)
+# 2. 토큰 발급
 kiwoom auth login
 
-# 3. 사용 (토큰 발급 후에는 비밀번호 불필요)
+# 3. 사용 (프롬프트 없음)
 kiwoom stock info 005930
 ```
 
@@ -49,7 +49,7 @@ export KIWOOM_DOMAIN="prod"       # prod 또는 mock
 export KIWOOM_ACCOUNT="1234567"   # 선택
 ```
 
-appkey/secretkey는 보안을 위해 환경변수를 지원하지 않습니다. 반드시 `kiwoom config setup`으로 암호화 저장하세요.
+appkey/secretkey는 보안을 위해 환경변수를 지원하지 않습니다. 반드시 `kiwoom config setup`으로 OS 키체인에 저장하세요.
 
 ### 멀티 프로필
 
@@ -434,7 +434,7 @@ eval (env _KIWOOM_COMPLETE=fish_source kiwoom)
 | 항목             | 값                                       |
 | ---------------- | ---------------------------------------- |
 | 설정 파일        | `~/.kiwoom/config.toml` (도메인, 계좌만) |
-| appkey/secretkey | OS 키체인 (암호화 저장)                  |
+| appkey/secretkey | OS 키체인                                |
 | 토큰             | OS 키체인                                |
 | 캐시 디렉터리    | `~/.kiwoom/cache/`                       |
 | 운영 도메인      | `https://api.kiwoom.com`                 |
@@ -449,18 +449,17 @@ eval (env _KIWOOM_COMPLETE=fish_source kiwoom)
 
 ## 보안
 
-인증정보(appkey, secretkey)는 **OS 키체인에 암호화되어 저장**됩니다. 파일로 존재하지 않으며, 비밀번호 없이는 복호화할 수 없습니다.
+모든 인증정보(appkey, secretkey, 토큰)는 **OS 키체인**(macOS Keychain / Windows Credential Manager / Linux Secret Service)에 저장됩니다. 파일로 존재하지 않으며, 키체인이 디스크 저장 시 암호화를 담당합니다. `gh`, `aws`, `docker` CLI와 동일한 모델입니다.
 
-| 항목               | 저장 방식          |            비밀번호 필요            |
-| ------------------ | ------------------ | :---------------------------------: |
-| appkey / secretkey | 암호화 + OS 키체인 | O (`config setup`, `auth login` 시) |
-| 토큰               | OS 키체인 (평문)   |           X (만료되는 값)           |
-| config.toml        | 도메인, 계좌번호만 |                  X                  |
+| 항목               | 저장 방식          | 프롬프트 |
+| ------------------ | ------------------ | :------: |
+| appkey / secretkey | OS 키체인          |    X     |
+| 토큰               | OS 키체인          |    X     |
+| config.toml        | 도메인, 계좌번호만 |    X     |
 
-- `config setup` 시 설정한 비밀번호로 appkey/secretkey를 암호화
-- `auth login/logout` 시 비밀번호 확인 후 키체인 접근
-- 토큰 발급 후 일반 명령어는 비밀번호 없이 사용
-- `keyring.get_password()`로 직접 접근해도 암호화된 값만 반환
+- 모든 명령어는 비밀번호/생체인증 프롬프트 없이 동작 (AI 에이전트·자동화 친화적)
+- 앱 자체 암호화 계층은 의도적으로 두지 않음 — 추가 계층은 명령마다 잠금 해제 프롬프트를 요구하게 되어 CLI 사용성을 해침
+- v2.0 이하에서 업그레이드한 경우: 암호화 저장소 형식이 제거되어 `kiwoom config setup`을 한 번 다시 실행해야 합니다
 
 ## License
 

{kiwoom_cli-2.0.0 → kiwoom_cli-2.1.0}/kiwoom_cli/__init__.py

@@ -1,3 +1,3 @@
 """Kiwoom Securities REST API CLI."""
 
-__version__ = "2.0.0"
+__version__ = "2.1.0"

{kiwoom_cli-2.0.0 → kiwoom_cli-2.1.0}/kiwoom_cli/config.py

@@ -1,10 +1,11 @@
 """Configuration management for Kiwoom CLI.
 
-Priority: environment variables > secure store (encrypted keychain) > config.toml
+Priority: environment variables > OS keychain > config.toml
 
-Sensitive credentials (appkey, secretkey, token) are encrypted with a
-password-derived key and stored in the OS keychain via SecureStore.
-Even direct keychain access (keyring.get_password) returns encrypted data.
+Credentials (appkey, secretkey, token) are stored directly in the OS
+keychain via keyring (macOS Keychain / Windows Credential Manager /
+Linux Secret Service). The keychain encrypts secrets at rest; no
+app-level password is required — commands never prompt.
 
 Non-sensitive settings (domain, account) remain in config.toml.
 
@@ -30,8 +31,6 @@ else:
 import keyring
 import tomli_w
 
-from .secure_store import SecureStore
-
 CONFIG_DIR = Path.home() / ".kiwoom"
 CONFIG_FILE = CONFIG_DIR / "config.toml"
 CACHE_DIR = CONFIG_DIR / "cache"
@@ -48,10 +47,6 @@ DEFAULT_CONFIG = {
     "profiles": {"default": {"domain": "mock", "account": ""}},
 }
 
-# Shared SecureStore instance
-store = SecureStore(KEYRING_SERVICE)
-
-
 def ensure_config_dir() -> None:
     CONFIG_DIR.mkdir(parents=True, exist_ok=True)
 
@@ -97,24 +92,70 @@ def get_domain(profile: str | None = None) -> str:
     return DOMAINS.get(key, DOMAINS["mock"])
 
 
+def is_legacy_encrypted() -> bool:
+    """True if the pre-v2.1 password-encrypted format is present in the keychain.
+
+    Keyring errors (locked/absent keychain in headless or CI environments) are
+    treated as "not legacy" so commands like --help never crash.
+    """
+    try:
+        return keyring.get_password(KEYRING_SERVICE, "_salt") is not None
+    except Exception:
+        return False
+
+
+def clear_legacy_sentinels() -> None:
+    """Remove the legacy SecureStore sentinels (_salt, _verify)."""
+    for key in ("_salt", "_verify"):
+        try:
+            keyring.delete_password(KEYRING_SERVICE, key)
+        except keyring.errors.PasswordDeleteError:
+            pass
+
+
+def purge_legacy_credentials() -> None:
+    """Delete legacy Fernet-encrypted appkey/secretkey entries for all profiles.
+
+    Tokens are untouched (they were always stored plaintext and remain valid).
+    """
+    for p in get_profiles():
+        for key in (f"{p}:appkey", f"{p}:secretkey"):
+            try:
+                keyring.delete_password(KEYRING_SERVICE, key)
+            except keyring.errors.PasswordDeleteError:
+                pass
+
+
+def is_configured(profile: str | None = None) -> bool:
+    """True if an appkey is stored for the profile (and not in legacy format)."""
+    if is_legacy_encrypted():
+        return False
+    p = resolve_profile(profile)
+    return keyring.get_password(KEYRING_SERVICE, f"{p}:appkey") is not None
+
+
 def get_appkey(profile: str | None = None) -> str:
+    if is_legacy_encrypted():
+        return ""
     p = resolve_profile(profile)
-    return store.get(f"{p}:appkey") or ""
+    return keyring.get_password(KEYRING_SERVICE, f"{p}:appkey") or ""
 
 
 def get_secretkey(profile: str | None = None) -> str:
+    if is_legacy_encrypted():
+        return ""
     p = resolve_profile(profile)
-    return store.get(f"{p}:secretkey") or ""
+    return keyring.get_password(KEYRING_SERVICE, f"{p}:secretkey") or ""
 
 
 def set_appkey(value: str, profile: str | None = None) -> None:
     p = resolve_profile(profile)
-    store.set(f"{p}:appkey", value)
+    keyring.set_password(KEYRING_SERVICE, f"{p}:appkey", value)
 
 
 def set_secretkey(value: str, profile: str | None = None) -> None:
     p = resolve_profile(profile)
-    store.set(f"{p}:secretkey", value)
+    keyring.set_password(KEYRING_SERVICE, f"{p}:secretkey", value)
 
 
 def get_account(profile: str | None = None) -> str:
@@ -146,31 +187,22 @@ def set_default_profile(name: str) -> None:
 
 
 def migrate_from_plaintext() -> bool:
-    """Migrate plaintext credentials to encrypted secure store."""
+    """Migrate legacy plaintext credential locations into the keychain."""
     migrated = False
-    # Migrate from config.toml
+    # Migrate from config.toml [auth] section
     cfg = load_config()
     auth_section = cfg.get("auth", {})
     ak = auth_section.get("appkey", "")
     sk = auth_section.get("secretkey", "")
     if ak or sk:
         if ak:
-            store.set("default:appkey", ak)
+            keyring.set_password(KEYRING_SERVICE, "default:appkey", ak)
         if sk:
-            store.set("default:secretkey", sk)
+            keyring.set_password(KEYRING_SERVICE, "default:secretkey", sk)
         cfg.pop("auth", None)
         save_config(cfg)
         migrated = True
-    # Migrate from plain keyring (v0.4.0 format)
-    plain_ak = keyring.get_password(KEYRING_SERVICE, "appkey")
-    if plain_ak and not plain_ak.startswith("ey"):  # not already encrypted (base64 JSON)
-        store.set("default:appkey", plain_ak)
-        migrated = True
-    plain_sk = keyring.get_password(KEYRING_SERVICE, "secretkey")
-    if plain_sk and not plain_sk.startswith("ey"):
-        store.set("default:secretkey", plain_sk)
-        migrated = True
-    # Migrate token file to plain keyring
+    # Migrate token file to keyring
     token_file = CONFIG_DIR / "token"
     if token_file.exists():
         token = token_file.read_text().strip()

{kiwoom_cli-2.0.0 → kiwoom_cli-2.1.0}/kiwoom_cli/main.py

@@ -79,16 +79,23 @@ def cli(ctx, output_format, profile, no_color):
     ctx.obj["format"] = output_format
     ctx.obj["profile"] = profile
 
-    # Auto-migrate plaintext credentials to encrypted store
-    if config.store.is_initialized and config.migrate_from_plaintext():
+    # Auto-migrate plaintext credentials into the keychain
+    if config.migrate_from_plaintext():
         from .output import err_console
-        err_console.print("[yellow]인증정보를 암호화된 키체인으로 이전했습니다.[/]")
+        err_console.print("[yellow]인증정보를 키체인으로 이전했습니다.[/]")
 
     # Auto-migrate pre-profile config to profile-aware format
-    if config.store.is_initialized and config.migrate_to_profiles():
+    if config.migrate_to_profiles():
         from .output import err_console
         err_console.print("[yellow]프로필 형식으로 마이그레이션 완료.[/]")
 
+    # Legacy password-encrypted format: credentials must be re-entered
+    if config.is_legacy_encrypted():
+        from .output import err_console
+        err_console.print(
+            "[yellow]암호화 저장소 형식이 변경되었습니다. 'kiwoom config setup'으로 다시 설정하세요.[/]"
+        )
+
     if no_color:
         from rich.console import Console as RichConsole
         from . import output
@@ -112,16 +119,10 @@ def config_cmd():
 @click.option("--account", prompt="계좌번호 (없으면 Enter)", default="", help="계좌번호")
 def config_setup(profile: str, appkey: str, secretkey: str, domain: str, account: str):
     """초기 설정 (App Key, Secret Key, 도메인)."""
-    password = click.prompt("시스템 비밀번호 (인증정보 암호화에 사용)", hide_input=True)
-    if config.store.is_initialized:
-        if not config.store.unlock(password):
-            # Unlock failed — possibly old encryption format. Offer re-init.
-            if click.confirm("비밀번호 검증 실패. 암호화 저장소를 재설정하시겠습니까?"):
-                config.store.setup(password)
-            else:
-                raise SystemExit(1)
-    else:
-        config.store.setup(password)
+    if config.is_legacy_encrypted():
+        # Old password-encrypted entries are unusable — purge before writing new keys
+        config.purge_legacy_credentials()
+        config.clear_legacy_sentinels()
     config.set_appkey(appkey, profile=profile)
     config.set_secretkey(secretkey, profile=profile)
     cfg = config.load_config()
@@ -133,7 +134,7 @@ def config_setup(profile: str, appkey: str, secretkey: str, domain: str, account
     cfg.pop("auth", None)
     config.save_config(cfg)
     console.print(f"[green]설정 완료![/] (프로필: {profile})")
-    console.print("  App Key/Secret Key: [bold]암호화되어 키체인에 저장됨[/]")
+    console.print("  App Key/Secret Key: [bold]OS 키체인에 저장됨[/]")
     console.print(f"  도메인: [bold]{config.DOMAINS[domain]}[/]")
 
 
@@ -143,14 +144,14 @@ def config_show(ctx):
     """현재 설정 확인."""
     profile = config.resolve_profile(ctx.obj.get("profile") if ctx.obj else None)
     cfg = config.load_config()
-    initialized = config.store.is_initialized
+    configured = config.is_configured(profile)
     profile_cfg = cfg.get("profiles", {}).get(profile, {})
     console.print(f"  프로필: [bold]{profile}[/]")
     console.print(f"  설정 파일: {config.CONFIG_FILE}")
     console.print(f"  도메인: {profile_cfg.get('domain', 'mock')}")
-    console.print(f"  App Key: {'[dim]설정됨 (암호화)[/]' if initialized else '(미설정)'}")
+    console.print(f"  App Key: {'[dim]설정됨 (키체인)[/]' if configured else '(미설정)'}")
     console.print(f"  계좌번호: {profile_cfg.get('account', '(미설정)')}")
-    console.print(f"  보안: [bold]{'SecureStore 활성' if initialized else '미초기화'}[/]")
+    console.print(f"  보안: [bold]{'OS 키체인 저장' if configured else '미설정'}[/]")
 
 
 @config_cmd.command("set")
@@ -217,22 +218,13 @@ def auth_cmd():
     pass
 
 
-def _unlock_store() -> bool:
-    """Prompt for password and unlock the secure store."""
-    if not config.store.is_initialized:
-        console.print("[red]설정이 필요합니다. 먼저 실행: kiwoom config setup[/]")
-        return False
-    password = click.prompt("비밀번호", hide_input=True)
-    if not config.store.unlock(password):
-        console.print("[red]비밀번호가 일치하지 않습니다.[/]")
-        return False
-    return True
-
-
 @auth_cmd.command("login")
-def auth_login():
-    """접근토큰 발급 (비밀번호 확인 후 암호화된 인증정보 사용)."""
-    if not _unlock_store():
+@click.pass_context
+def auth_login(ctx):
+    """접근토큰 발급."""
+    profile = config.resolve_profile(ctx.obj.get("profile") if ctx.obj else None)
+    if not config.is_configured(profile):
+        console.print("[red]설정이 필요합니다. 먼저 실행: kiwoom config setup[/]")
         raise SystemExit(1)
     with KiwoomClient() as c:
         try:
@@ -246,9 +238,12 @@ def auth_login():
 
 
 @auth_cmd.command("logout")
-def auth_logout():
-    """접근토큰 폐기 (비밀번호 확인 필요)."""
-    if not _unlock_store():
+@click.pass_context
+def auth_logout(ctx):
+    """접근토큰 폐기."""
+    profile = config.resolve_profile(ctx.obj.get("profile") if ctx.obj else None)
+    if not config.is_configured(profile):
+        console.print("[red]설정이 필요합니다. 먼저 실행: kiwoom config setup[/]")
         raise SystemExit(1)
     with KiwoomClient() as c:
         try:
@@ -262,10 +257,10 @@ def auth_logout():
 @click.pass_context
 def auth_status(ctx):
     """토큰 상태 확인."""
-    if not config.store.is_initialized:
+    profile = config.resolve_profile(ctx.obj.get("profile") if ctx.obj else None)
+    if not config.is_configured(profile):
         console.print("[yellow]설정 필요.[/] 'kiwoom config setup' 으로 설정하세요.")
         return
-    profile = config.resolve_profile(ctx.obj.get("profile") if ctx.obj else None)
     import keyring as _kr
     has_token = _kr.get_password(config.KEYRING_SERVICE, f"{profile}:token") is not None
     console.print(f"  프로필: [bold]{profile}[/]")

{kiwoom_cli-2.0.0 → kiwoom_cli-2.1.0}/kiwoom_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kiwoom-cli
-Version: 2.0.0
+Version: 2.1.0
 Summary: User-friendly CLI for the Kiwoom Securities REST API (키움증권)
 License: LicenseRef-kiwoom-cli-Source-Available-1.0
 Project-URL: Homepage, https://github.com/gejyn14/kiwoom-cli
@@ -26,7 +26,6 @@ Requires-Dist: tomli>=2.0; python_version < "3.11"
 Requires-Dist: tomli-w>=1.0
 Requires-Dist: keyring>=25.0
 Requires-Dist: websockets>=12.0
-Requires-Dist: cryptography>=42.0
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-httpx>=0.30; extra == "dev"
@@ -55,13 +54,13 @@ pip install kiwoom-cli
 ## 시작하기
 
 ```bash
-# 1. 초기 설정 (appkey, secretkey 입력 + 암호화 비밀번호 설정)
+# 1. 초기 설정 (appkey, secretkey 입력)
 kiwoom config setup
 
-# 2. 토큰 발급 (비밀번호 확인 후 발급)
+# 2. 토큰 발급
 kiwoom auth login
 
-# 3. 사용 (토큰 발급 후에는 비밀번호 불필요)
+# 3. 사용 (프롬프트 없음)
 kiwoom stock info 005930
 ```
 
@@ -87,7 +86,7 @@ export KIWOOM_DOMAIN="prod"       # prod 또는 mock
 export KIWOOM_ACCOUNT="1234567"   # 선택
 ```
 
-appkey/secretkey는 보안을 위해 환경변수를 지원하지 않습니다. 반드시 `kiwoom config setup`으로 암호화 저장하세요.
+appkey/secretkey는 보안을 위해 환경변수를 지원하지 않습니다. 반드시 `kiwoom config setup`으로 OS 키체인에 저장하세요.
 
 ### 멀티 프로필
 
@@ -472,7 +471,7 @@ eval (env _KIWOOM_COMPLETE=fish_source kiwoom)
 | 항목             | 값                                       |
 | ---------------- | ---------------------------------------- |
 | 설정 파일        | `~/.kiwoom/config.toml` (도메인, 계좌만) |
-| appkey/secretkey | OS 키체인 (암호화 저장)                  |
+| appkey/secretkey | OS 키체인                                |
 | 토큰             | OS 키체인                                |
 | 캐시 디렉터리    | `~/.kiwoom/cache/`                       |
 | 운영 도메인      | `https://api.kiwoom.com`                 |
@@ -487,18 +486,17 @@ eval (env _KIWOOM_COMPLETE=fish_source kiwoom)
 
 ## 보안
 
-인증정보(appkey, secretkey)는 **OS 키체인에 암호화되어 저장**됩니다. 파일로 존재하지 않으며, 비밀번호 없이는 복호화할 수 없습니다.
+모든 인증정보(appkey, secretkey, 토큰)는 **OS 키체인**(macOS Keychain / Windows Credential Manager / Linux Secret Service)에 저장됩니다. 파일로 존재하지 않으며, 키체인이 디스크 저장 시 암호화를 담당합니다. `gh`, `aws`, `docker` CLI와 동일한 모델입니다.
 
-| 항목               | 저장 방식          |            비밀번호 필요            |
-| ------------------ | ------------------ | :---------------------------------: |
-| appkey / secretkey | 암호화 + OS 키체인 | O (`config setup`, `auth login` 시) |
-| 토큰               | OS 키체인 (평문)   |           X (만료되는 값)           |
-| config.toml        | 도메인, 계좌번호만 |                  X                  |
+| 항목               | 저장 방식          | 프롬프트 |
+| ------------------ | ------------------ | :------: |
+| appkey / secretkey | OS 키체인          |    X     |
+| 토큰               | OS 키체인          |    X     |
+| config.toml        | 도메인, 계좌번호만 |    X     |
 
-- `config setup` 시 설정한 비밀번호로 appkey/secretkey를 암호화
-- `auth login/logout` 시 비밀번호 확인 후 키체인 접근
-- 토큰 발급 후 일반 명령어는 비밀번호 없이 사용
-- `keyring.get_password()`로 직접 접근해도 암호화된 값만 반환
+- 모든 명령어는 비밀번호/생체인증 프롬프트 없이 동작 (AI 에이전트·자동화 친화적)
+- 앱 자체 암호화 계층은 의도적으로 두지 않음 — 추가 계층은 명령마다 잠금 해제 프롬프트를 요구하게 되어 CLI 사용성을 해침
+- v2.0 이하에서 업그레이드한 경우: 암호화 저장소 형식이 제거되어 `kiwoom config setup`을 한 번 다시 실행해야 합니다
 
 ## License
 

{kiwoom_cli-2.0.0 → kiwoom_cli-2.1.0}/kiwoom_cli.egg-info/SOURCES.txt

@@ -9,7 +9,6 @@ kiwoom_cli/config.py
 kiwoom_cli/formatters.py
 kiwoom_cli/main.py
 kiwoom_cli/output.py
-kiwoom_cli/secure_store.py
 kiwoom_cli/streaming.py
 kiwoom_cli.egg-info/PKG-INFO
 kiwoom_cli.egg-info/SOURCES.txt
@@ -35,14 +34,15 @@ kiwoom_cli/commands/us/order_ops.py
 kiwoom_cli/commands/us/stock_ops.py
 tests/test_account.py
 tests/test_auth.py
+tests/test_auth_cli.py
 tests/test_cli.py
 tests/test_client.py
+tests/test_credentials.py
 tests/test_formatters.py
 tests/test_formatters_property.py
 tests/test_market.py
 tests/test_migration.py
 tests/test_order.py
-tests/test_secure_store.py
 tests/test_stock.py
 tests/test_us.py
 tests/test_us_account.py

{kiwoom_cli-2.0.0 → kiwoom_cli-2.1.0}/kiwoom_cli.egg-info/requires.txt

@@ -4,7 +4,6 @@ rich>=13.0
 tomli-w>=1.0
 keyring>=25.0
 websockets>=12.0
-cryptography>=42.0
 
 [:python_version < "3.11"]
 tomli>=2.0

{kiwoom_cli-2.0.0 → kiwoom_cli-2.1.0}/pyproject.toml

@@ -29,7 +29,6 @@ dependencies = [
     "tomli-w>=1.0",
     "keyring>=25.0",
     "websockets>=12.0",
-    "cryptography>=42.0",
 ]
 
 [project.optional-dependencies]

kiwoom_cli-2.1.0/tests/test_auth_cli.py

@@ -0,0 +1,97 @@
+"""CLI-level tests: no password prompts anywhere after keychain-only change."""
+
+from __future__ import annotations
+
+import keyring
+import pytest
+from click.testing import CliRunner
+
+from kiwoom_cli import config
+from kiwoom_cli.main import cli
+
+
+@pytest.fixture(autouse=True)
+def mem_keyring(monkeypatch):
+    data: dict[str, str] = {}
+    monkeypatch.setattr(keyring, "get_password", lambda svc, key: data.get(f"{svc}:{key}"))
+    monkeypatch.setattr(keyring, "set_password", lambda svc, key, val: data.__setitem__(f"{svc}:{key}", val))
+
+    def _delete(svc, key):
+        if f"{svc}:{key}" not in data:
+            raise keyring.errors.PasswordDeleteError(key)
+        del data[f"{svc}:{key}"]
+
+    monkeypatch.setattr(keyring, "delete_password", _delete)
+    return data
+
+
+@pytest.fixture(autouse=True)
+def isolated_config(tmp_path, monkeypatch):
+    monkeypatch.setattr(config, "CONFIG_DIR", tmp_path)
+    monkeypatch.setattr(config, "CONFIG_FILE", tmp_path / "config.toml")
+    return tmp_path
+
+
+def test_config_setup_no_password_prompt(mem_keyring):
+    """setup succeeds with only appkey/secretkey/domain/account inputs."""
+    runner = CliRunner()
+    result = runner.invoke(
+        cli,
+        ["config", "setup"],
+        input="my-appkey\nmy-secretkey\nmock\n\n",
+    )
+    assert result.exit_code == 0, result.output
+    assert "비밀번호" not in result.output
+    assert mem_keyring[f"{config.KEYRING_SERVICE}:default:appkey"] == "my-appkey"
+    assert mem_keyring[f"{config.KEYRING_SERVICE}:default:secretkey"] == "my-secretkey"
+
+
+def test_config_setup_purges_legacy_format(mem_keyring):
+    """setup clears _salt/_verify and old ciphertext entries."""
+    keyring.set_password(config.KEYRING_SERVICE, "_salt", "oldsalt")
+    keyring.set_password(config.KEYRING_SERVICE, "_verify", "oldverify")
+    keyring.set_password(config.KEYRING_SERVICE, "default:appkey", "gAAAA-cipher")
+
+    runner = CliRunner()
+    result = runner.invoke(
+        cli,
+        ["config", "setup"],
+        input="new-appkey\nnew-secretkey\nmock\n\n",
+    )
+    assert result.exit_code == 0, result.output
+    assert keyring.get_password(config.KEYRING_SERVICE, "_salt") is None
+    assert keyring.get_password(config.KEYRING_SERVICE, "_verify") is None
+    assert config.get_appkey(profile="default") == "new-appkey"
+
+
+def test_auth_login_no_password_prompt(monkeypatch, mem_keyring):
+    """auth login issues a token without any interactive prompt."""
+    from kiwoom_cli import client as client_mod
+
+    keyring.set_password(config.KEYRING_SERVICE, "default:appkey", "ak")
+    keyring.set_password(config.KEYRING_SERVICE, "default:secretkey", "sk")
+
+    monkeypatch.setattr(
+        client_mod.KiwoomClient, "issue_token", lambda self: "issued-token-value-12345"
+    )
+
+    runner = CliRunner()
+    result = runner.invoke(cli, ["auth", "login"], input="")
+    assert result.exit_code == 0, result.output
+    assert "비밀번호" not in result.output
+    assert "토큰 발급 완료" in result.output
+
+
+def test_auth_login_unconfigured_tells_user_to_setup(mem_keyring):
+    runner = CliRunner()
+    result = runner.invoke(cli, ["auth", "login"])
+    assert result.exit_code != 0
+    assert "config setup" in result.output
+
+
+def test_legacy_format_shows_resetup_notice(mem_keyring):
+    """Any command under legacy format prints the re-setup notice."""
+    keyring.set_password(config.KEYRING_SERVICE, "_salt", "oldsalt")
+    runner = CliRunner()
+    result = runner.invoke(cli, ["auth", "status"])
+    assert "kiwoom config setup" in result.output or "config setup" in result.output

kiwoom_cli-2.1.0/tests/test_credentials.py

@@ -0,0 +1,115 @@
+"""Tests for keyring-direct credential storage and legacy-format detection."""
+
+from __future__ import annotations
+
+import keyring
+import pytest
+
+from kiwoom_cli import config
+
+
+@pytest.fixture(autouse=True)
+def mem_keyring(monkeypatch):
+    """In-memory keyring backend, isolated per test."""
+    data: dict[str, str] = {}
+    monkeypatch.setattr(keyring, "get_password", lambda svc, key: data.get(f"{svc}:{key}"))
+    monkeypatch.setattr(keyring, "set_password", lambda svc, key, val: data.__setitem__(f"{svc}:{key}", val))
+
+    def _delete(svc, key):
+        if f"{svc}:{key}" not in data:
+            raise keyring.errors.PasswordDeleteError(key)
+        del data[f"{svc}:{key}"]
+
+    monkeypatch.setattr(keyring, "delete_password", _delete)
+    return data
+
+
+@pytest.fixture
+def isolated_config(tmp_path, monkeypatch):
+    monkeypatch.setattr(config, "CONFIG_DIR", tmp_path)
+    monkeypatch.setattr(config, "CONFIG_FILE", tmp_path / "config.toml")
+    return tmp_path
+
+
+def test_appkey_roundtrip_plain(isolated_config):
+    """set_appkey stores the exact input value; get_appkey returns it."""
+    config.set_appkey("my-app-key", profile="default")
+    assert keyring.get_password(config.KEYRING_SERVICE, "default:appkey") == "my-app-key"
+    assert config.get_appkey(profile="default") == "my-app-key"
+
+
+def test_secretkey_roundtrip_plain(isolated_config):
+    config.set_secretkey("my-secret", profile="default")
+    assert keyring.get_password(config.KEYRING_SERVICE, "default:secretkey") == "my-secret"
+    assert config.get_secretkey(profile="default") == "my-secret"
+
+
+def test_get_appkey_unset_returns_empty(isolated_config):
+    assert config.get_appkey(profile="default") == ""
+
+
+def test_is_legacy_encrypted_detects_salt(isolated_config):
+    assert config.is_legacy_encrypted() is False
+    keyring.set_password(config.KEYRING_SERVICE, "_salt", "abc123")
+    assert config.is_legacy_encrypted() is True
+
+
+def test_is_legacy_encrypted_false_when_keyring_unavailable(isolated_config, monkeypatch):
+    """Locked/absent keychain (headless, CI) must not crash — treat as not legacy."""
+
+    def _raise(svc, key):
+        raise RuntimeError("errSecInteractionNotAllowed")
+
+    monkeypatch.setattr(keyring, "get_password", _raise)
+    assert config.is_legacy_encrypted() is False
+
+
+def test_get_appkey_returns_empty_under_legacy_format(isolated_config):
+    """Fernet ciphertext must never be mistaken for a real key."""
+    keyring.set_password(config.KEYRING_SERVICE, "_salt", "abc123")
+    keyring.set_password(config.KEYRING_SERVICE, "default:appkey", "gAAAA-ciphertext")
+    assert config.get_appkey(profile="default") == ""
+    assert config.get_secretkey(profile="default") == ""
+
+
+def test_is_configured(isolated_config):
+    assert config.is_configured("default") is False
+    config.set_appkey("k", profile="default")
+    assert config.is_configured("default") is True
+
+
+def test_is_configured_false_under_legacy_format(isolated_config):
+    keyring.set_password(config.KEYRING_SERVICE, "default:appkey", "gAAAA-ciphertext")
+    keyring.set_password(config.KEYRING_SERVICE, "_salt", "abc123")
+    assert config.is_configured("default") is False
+
+
+def test_clear_legacy_sentinels(isolated_config):
+    keyring.set_password(config.KEYRING_SERVICE, "_salt", "s")
+    keyring.set_password(config.KEYRING_SERVICE, "_verify", "v")
+    config.clear_legacy_sentinels()
+    assert keyring.get_password(config.KEYRING_SERVICE, "_salt") is None
+    assert keyring.get_password(config.KEYRING_SERVICE, "_verify") is None
+    # Idempotent — no raise when already gone
+    config.clear_legacy_sentinels()
+
+
+def test_purge_legacy_credentials_deletes_all_profile_keys(isolated_config):
+    (isolated_config / "config.toml").write_text(
+        '[general]\ndefault_profile = "default"\n'
+        '[profiles.default]\ndomain = "mock"\n'
+        '[profiles.second]\ndomain = "prod"\n',
+        encoding="utf-8",
+    )
+    keyring.set_password(config.KEYRING_SERVICE, "default:appkey", "cipher1")
+    keyring.set_password(config.KEYRING_SERVICE, "default:secretkey", "cipher2")
+    keyring.set_password(config.KEYRING_SERVICE, "second:appkey", "cipher3")
+    keyring.set_password(config.KEYRING_SERVICE, "default:token", "tok")
+
+    config.purge_legacy_credentials()
+
+    assert keyring.get_password(config.KEYRING_SERVICE, "default:appkey") is None
+    assert keyring.get_password(config.KEYRING_SERVICE, "default:secretkey") is None
+    assert keyring.get_password(config.KEYRING_SERVICE, "second:appkey") is None
+    # Tokens were always plaintext — untouched
+    assert keyring.get_password(config.KEYRING_SERVICE, "default:token") == "tok"

{kiwoom_cli-2.0.0 → kiwoom_cli-2.1.0}/tests/test_migration.py

@@ -1,8 +1,8 @@
 """Tests for config migration functions.
 
 Covers migrate_from_plaintext() and migrate_to_profiles() in kiwoom_cli/config.py.
-These functions touch module globals (CONFIG_DIR, CONFIG_FILE, store) and the
-keyring backend, so we use monkeypatch to isolate file I/O.
+These functions touch module globals (CONFIG_DIR, CONFIG_FILE) and the keyring
+backend, so we use monkeypatch to isolate file I/O.
 """
 
 from __future__ import annotations
@@ -13,14 +13,26 @@ import pytest
 from kiwoom_cli import config
 
 
+@pytest.fixture(autouse=True)
+def mem_keyring(monkeypatch):
+    data: dict[str, str] = {}
+    monkeypatch.setattr(keyring, "get_password", lambda svc, key: data.get(f"{svc}:{key}"))
+    monkeypatch.setattr(keyring, "set_password", lambda svc, key, val: data.__setitem__(f"{svc}:{key}", val))
+
+    def _delete(svc, key):
+        if f"{svc}:{key}" not in data:
+            raise keyring.errors.PasswordDeleteError(key)
+        del data[f"{svc}:{key}"]
+
+    monkeypatch.setattr(keyring, "delete_password", _delete)
+    return data
+
+
 @pytest.fixture
 def isolated_config(tmp_path, monkeypatch):
-    """Redirect config.CONFIG_DIR/CONFIG_FILE to tmp_path and init store."""
+    """Redirect config.CONFIG_DIR/CONFIG_FILE to tmp_path."""
     monkeypatch.setattr(config, "CONFIG_DIR", tmp_path)
     monkeypatch.setattr(config, "CONFIG_FILE", tmp_path / "config.toml")
-    # Reset store state and initialize with a fresh salt
-    config.store._key = None
-    config.store.setup("testpw")
     return tmp_path
 
 
@@ -33,8 +45,8 @@ def _write_toml(path, content: str) -> None:
 # ============================================================
 
 
-def test_migrate_from_plaintext_moves_toml_auth_to_store(isolated_config):
-    """config.toml [auth] section is encrypted into store and removed from TOML."""
+def test_migrate_from_plaintext_moves_toml_auth_to_keyring(isolated_config):
+    """config.toml [auth] section moves into keyring and is removed from TOML."""
     _write_toml(
         isolated_config / "config.toml",
         '[auth]\nappkey = "plain-key"\nsecretkey = "plain-secret"\n',
@@ -43,22 +55,12 @@ def test_migrate_from_plaintext_moves_toml_auth_to_store(isolated_config):
     result = config.migrate_from_plaintext()
 
     assert result is True
-    assert config.store.get("default:appkey") == "plain-key"
-    assert config.store.get("default:secretkey") == "plain-secret"
+    assert keyring.get_password(config.KEYRING_SERVICE, "default:appkey") == "plain-key"
+    assert keyring.get_password(config.KEYRING_SERVICE, "default:secretkey") == "plain-secret"
     cfg = config.load_config()
     assert "auth" not in cfg
 
 
-def test_migrate_from_plaintext_moves_plain_keyring_keys(isolated_config):
-    """Plain (unencrypted) keyring entries are re-stored encrypted."""
-    keyring.set_password(config.KEYRING_SERVICE, "appkey", "plain-xyz")
-
-    result = config.migrate_from_plaintext()
-
-    assert result is True
-    assert config.store.get("default:appkey") == "plain-xyz"
-
-
 def test_migrate_from_plaintext_moves_token_file(isolated_config):
     """~/.kiwoom/token file is moved into keyring and deleted."""
     token_file = isolated_config / "token"
@@ -124,7 +126,6 @@ def test_migrate_to_profiles_skips_if_profiles_exist(isolated_config):
 
 def test_migrate_to_profiles_renames_bare_keyring_keys(isolated_config):
     """Bare keyring keys (appkey/secretkey/token) renamed to default:-prefixed."""
-    # Write pre-profile config.toml (without [profiles] section) so migration runs
     _write_toml(
         isolated_config / "config.toml",
         '[general]\ndomain = "mock"\n',

kiwoom_cli-2.0.0/kiwoom_cli/secure_store.py

@@ -1,133 +0,0 @@
-"""Secure credential store with system password verification.
-
-Credentials are encrypted with a key derived from the system password,
-then stored in the OS keychain. Even if keychain is accessed directly
-(e.g. via keyring.get_password), the values are encrypted and useless
-without the system password.
-
-Usage:
-    store = SecureStore("my-app")
-    store.setup("password123")          # Initialize with system password
-    store.set("appkey", "secret-value") # Encrypt + store in keychain
-    store.unlock("password123")         # Unlock for this session
-    value = store.get("appkey")         # Decrypt + return
-"""
-
-from __future__ import annotations
-
-import base64
-import hashlib
-import secrets
-
-import keyring
-from cryptography.fernet import Fernet, InvalidToken
-
-
-class SecureStoreError(Exception):
-    pass
-
-
-class SecureStoreLocked(SecureStoreError):
-    pass
-
-
-class SecureStore:
-    """Encrypted credential store backed by OS keychain.
-
-    Values are encrypted with Fernet (AES-128-CBC + HMAC) keyed by a
-    password-derived key. The encryption key never touches disk — it exists
-    only in memory after unlock.
-    """
-
-    def __init__(self, service: str):
-        self.service = service
-        self._key: bytes | None = None
-
-    @property
-    def is_initialized(self) -> bool:
-        """Check if store has been set up (salt exists)."""
-        return keyring.get_password(self.service, "_salt") is not None
-
-    @property
-    def is_unlocked(self) -> bool:
-        return self._key is not None
-
-    def setup(self, password: str) -> None:
-        """Initialize the store with a password. Generates a new salt."""
-        salt = secrets.token_hex(32)
-        keyring.set_password(self.service, "_salt", salt)
-        self._key = self._derive_key(password, salt)
-        # Store a verification token to check password correctness later
-        verify = self._encrypt(b"kiwoom-cli-verify")
-        keyring.set_password(self.service, "_verify", verify)
-
-    def unlock(self, password: str) -> bool:
-        """Unlock the store for this session. Returns True if password is correct."""
-        salt = keyring.get_password(self.service, "_salt")
-        if not salt:
-            raise SecureStoreError("Store not initialized. Run: kiwoom config setup")
-        self._key = self._derive_key(password, salt)
-        # Verify password correctness
-        verify = keyring.get_password(self.service, "_verify")
-        if not verify:
-            return False
-        try:
-            decrypted = self._decrypt(verify)
-            if decrypted != b"kiwoom-cli-verify":
-                self._key = None
-                return False
-            return True
-        except (InvalidToken, Exception):
-            self._key = None
-            return False
-
-    def lock(self) -> None:
-        """Lock the store, clearing the encryption key from memory."""
-        self._key = None
-
-    def set(self, name: str, value: str) -> None:
-        """Encrypt and store a credential."""
-        if not self._key:
-            raise SecureStoreLocked("Store is locked. Call unlock() first.")
-        encrypted = self._encrypt(value.encode("utf-8"))
-        keyring.set_password(self.service, name, encrypted)
-
-    def get(self, name: str) -> str | None:
-        """Retrieve and decrypt a credential."""
-        if not self._key:
-            raise SecureStoreLocked("Store is locked. Call unlock() first.")
-        encrypted = keyring.get_password(self.service, name)
-        if encrypted is None:
-            return None
-        try:
-            return self._decrypt(encrypted).decode("utf-8")
-        except Exception:
-            return None
-
-    def delete(self, name: str) -> None:
-        """Delete a credential."""
-        try:
-            keyring.delete_password(self.service, name)
-        except keyring.errors.PasswordDeleteError:
-            pass
-
-    def _derive_key(self, password: str, salt: str) -> bytes:
-        """Derive encryption key from password + salt using PBKDF2."""
-        raw = hashlib.pbkdf2_hmac(
-            "sha256",
-            password.encode("utf-8"),
-            salt.encode("utf-8"),
-            iterations=100_000,
-            dklen=32,
-        )
-        return base64.urlsafe_b64encode(raw)
-
-    def _encrypt(self, data: bytes) -> str:
-        """Encrypt data with the derived key."""
-        assert self._key is not None
-        return Fernet(self._key).encrypt(data).decode("ascii")
-
-    def _decrypt(self, token: str) -> bytes:
-        """Decrypt data with the derived key."""
-        assert self._key is not None
-        return Fernet(self._key).decrypt(token.encode("ascii"))

kiwoom_cli-2.0.0/tests/test_secure_store.py

@@ -1,137 +0,0 @@
-"""Tests for SecureStore encrypted credential storage."""
-from kiwoom_cli.secure_store import SecureStore, SecureStoreError, SecureStoreLocked
-import pytest
-
-
-@pytest.fixture
-def store_data():
-    """Shared in-memory dict used by the store fixture."""
-    return {}
-
-
-@pytest.fixture
-def store(monkeypatch, store_data):
-    """Create a SecureStore with an in-memory keyring backend."""
-    import keyring
-    store = SecureStore("test-service")
-    monkeypatch.setattr(keyring, "get_password", lambda svc, key: store_data.get(f"{svc}:{key}"))
-    monkeypatch.setattr(keyring, "set_password", lambda svc, key, val: store_data.__setitem__(f"{svc}:{key}", val))
-    monkeypatch.setattr(keyring, "delete_password", lambda svc, key: store_data.pop(f"{svc}:{key}", None))
-    return store
-
-def test_setup_and_unlock(store):
-    store.setup("mypassword")
-    assert store.is_initialized
-    store.lock()
-    assert not store.is_unlocked
-    assert store.unlock("mypassword")
-    assert store.is_unlocked
-
-def test_wrong_password(store):
-    store.setup("correct")
-    store.lock()
-    assert not store.unlock("wrong")
-
-def test_set_get_roundtrip(store):
-    store.setup("pass123")
-    store.set("appkey", "secret-value-123")
-    store.set("secretkey", "another-secret")
-    assert store.get("appkey") == "secret-value-123"
-    assert store.get("secretkey") == "another-secret"
-
-def test_locked_access_raises(store):
-    store.setup("pass")
-    store.set("key", "val")
-    store.lock()
-    with pytest.raises(SecureStoreLocked):
-        store.get("key")
-    with pytest.raises(SecureStoreLocked):
-        store.set("key", "val2")
-
-def test_get_nonexistent_returns_none(store):
-    store.setup("pass")
-    assert store.get("nonexistent") is None
-
-def test_delete(store):
-    store.setup("pass")
-    store.set("key", "val")
-    store.delete("key")
-    assert store.get("key") is None
-
-
-# ============================================================
-#  Additional strict coverage
-# ============================================================
-
-
-def test_roundtrip_utf8_value(store):
-    """UTF-8 Korean text and emoji values survive encryption roundtrip."""
-    store.setup("pass")
-    value = "비밀번호🔒테스트"
-    store.set("utf8_key", value)
-    assert store.get("utf8_key") == value
-
-
-def test_roundtrip_large_value(store):
-    """8 KB value survives roundtrip."""
-    store.setup("pass")
-    value = "A" * 8192
-    store.set("large_key", value)
-    assert store.get("large_key") == value
-
-
-def test_delete_nonexistent_is_noop(store):
-    """Deleting a nonexistent key does not raise."""
-    store.setup("pass")
-    store.delete("never_set")  # should not raise
-
-
-def test_persistence_across_instances(monkeypatch, store_data):
-    """Data stored in one instance is decryptable by a fresh instance with same password."""
-    import keyring
-    monkeypatch.setattr(keyring, "get_password", lambda svc, key: store_data.get(f"{svc}:{key}"))
-    monkeypatch.setattr(keyring, "set_password", lambda svc, key, val: store_data.__setitem__(f"{svc}:{key}", val))
-    monkeypatch.setattr(keyring, "delete_password", lambda svc, key: store_data.pop(f"{svc}:{key}", None))
-
-    store_a = SecureStore("persist-test")
-    store_a.setup("shared-pw")
-    store_a.set("shared_key", "shared-value")
-
-    store_b = SecureStore("persist-test")
-    assert store_b.unlock("shared-pw") is True
-    assert store_b.get("shared_key") == "shared-value"
-
-
-def test_resetup_changes_encryption_key(store):
-    """Calling setup() twice with different passwords changes the salt."""
-    store.setup("password-one")
-    store.set("k", "v1")
-    original_value = store.get("k")
-
-    # Re-setup with different password generates new salt
-    store.setup("password-two")
-    # Old ciphertext can no longer be decrypted (new key, different salt)
-    # _verify will work because it was re-encrypted, but old "k" won't
-    assert store.get("k") is None or store.get("k") != original_value
-
-
-def test_unlock_before_setup_raises(store):
-    """Calling unlock() on un-initialized store raises SecureStoreError."""
-    with pytest.raises(SecureStoreError):
-        store.unlock("anything")
-
-
-def test_delete_swallows_keyring_error(monkeypatch, store_data):
-    """PasswordDeleteError from keyring.delete_password is silently caught."""
-    import keyring
-    import keyring.errors
-
-    def failing_delete(svc, key):
-        raise keyring.errors.PasswordDeleteError("simulated")
-
-    monkeypatch.setattr(keyring, "get_password", lambda svc, key: store_data.get(f"{svc}:{key}"))
-    monkeypatch.setattr(keyring, "set_password", lambda svc, key, val: store_data.__setitem__(f"{svc}:{key}", val))
-    monkeypatch.setattr(keyring, "delete_password", failing_delete)
-
-    store = SecureStore("test-service")
-    store.delete("anything")  # should not raise