sudo_test.go

package main

import (
	"encoding/json"
	"strings"
	"testing"
)

// TestSendSudoReplyApprovedKeepsPasswordOnWire: the live core pipe must still
// receive the password so sudo -S works. Only debug logging redacts it.
func TestSendSudoReplyApprovedKeepsPasswordOnWire(t *testing.T) {
	s := initialSession()
	wireCoreStub(s)
	p := newSudoPrompt("sudo-42", "sudo true")
	p.input.SetValue("hunter2-secret")
	s.pendingSudo = p

	s.sendSudoReply(p, true)

	select {
	case b := <-s.stdinCh:
		var m map[string]any
		if err := json.Unmarshal(b, &m); err != nil {
			t.Fatalf("unmarshal: %v", err)
		}
		if m["type"] != "sudo_reply" {
			t.Fatalf("type = %v", m["type"])
		}
		if m["request_id"] != "sudo-42" {
			t.Fatalf("request_id = %v", m["request_id"])
		}
		if m["approved"] != true {
			t.Fatalf("approved = %v", m["approved"])
		}
		if m["password"] != "hunter2-secret" {
			t.Fatalf("password must still be on the wire for sudo -S, got %v", m["password"])
		}
		// Must never appear as the redaction token on the live protocol pipe.
		if m["password"] == "[REDACTED]" {
			t.Fatal("live sudo_reply must not replace password with [REDACTED]")
		}
	default:
		t.Fatal("expected sudo_reply on stdinCh")
	}
	if s.pendingSudo != nil {
		t.Fatal("pendingSudo should be cleared after reply")
	}
	if p.input.Value() != "" {
		t.Fatalf("password must be wiped from the textinput after send, got %q", p.input.Value())
	}
}

// TestSendSudoReplyDeclineOmitsPassword: declined replies must not ship a
// password field (or an empty one) at all.
func TestSendSudoReplyDeclineOmitsPassword(t *testing.T) {
	s := initialSession()
	wireCoreStub(s)
	p := newSudoPrompt("sudo-99", "sudo rm -rf /")
	p.input.SetValue("should-not-travel")
	s.pendingSudo = p

	s.sendSudoReply(p, false)

	select {
	case b := <-s.stdinCh:
		var m map[string]any
		if err := json.Unmarshal(b, &m); err != nil {
			t.Fatalf("unmarshal: %v", err)
		}
		if m["type"] != "sudo_reply" {
			t.Fatalf("type = %v", m["type"])
		}
		if m["approved"] != false {
			t.Fatalf("approved = %v", m["approved"])
		}
		if _, ok := m["password"]; ok {
			t.Fatalf("declined sudo_reply must omit password, got %v", m["password"])
		}
		raw := string(b)
		if strings.Contains(raw, "should-not-travel") {
			t.Fatalf("declined reply leaked password bytes: %s", raw)
		}
	default:
		t.Fatal("expected sudo_reply on stdinCh")
	}
	if s.pendingSudo != nil {
		t.Fatal("pendingSudo should be cleared after decline")
	}
	if p.input.Value() != "" {
		t.Fatalf("password must be wiped from the textinput after decline, got %q", p.input.Value())
	}
}