From 2ff1c7d716d8edcaad475c5061a72504b1b40285 Mon Sep 17 00:00:00 2001 From: Mathias Grimm Date: Mon, 20 Jul 2026 14:58:36 -0300 Subject: [PATCH] Bake the published public CI token Config::PUBLIC_TOKEN carries the provisioned analyze-only token (public by design; the server enforces its scope). The test suite now binds Config with the fallback off so no test silently rides the baked token, and the Config unit tests construct it that way explicitly. Co-Authored-By: Claude Fable 5 --- app/Glimpse/Config.php | 2 +- tests/Feature/Glimpse/PublicTokenTest.php | 16 ++++++++++++++-- tests/Pest.php | 6 ++++++ tests/Unit/ConfigTest.php | 18 +++++++++--------- 4 files changed, 30 insertions(+), 12 deletions(-) diff --git a/app/Glimpse/Config.php b/app/Glimpse/Config.php index 338a67e..ac8651e 100644 --- a/app/Glimpse/Config.php +++ b/app/Glimpse/Config.php @@ -14,7 +14,7 @@ final class Config * process fills it in before tagging, and an empty value keeps the * fallback off. */ - private const PUBLIC_TOKEN = ''; + private const PUBLIC_TOKEN = '4|wbQrxtzJP89PXWn5Mku5fRUjBGLTnbB9javJhN9m5d9cb13f'; private readonly string $publicToken; diff --git a/tests/Feature/Glimpse/PublicTokenTest.php b/tests/Feature/Glimpse/PublicTokenTest.php index 66db005..bc017fc 100644 --- a/tests/Feature/Glimpse/PublicTokenTest.php +++ b/tests/Feature/Glimpse/PublicTokenTest.php @@ -26,10 +26,22 @@ ->and($config->usingPublicToken())->toBeFalse(); }); -test('without a baked public token the fallback stays off', function () { - $config = new Config; +test('an empty public token keeps the fallback off', function () { + $config = new Config(publicTokenOverride: ''); expect($config->token())->toBeNull() ->and($config->publicToken())->toBeNull() ->and($config->usingPublicToken())->toBeFalse(); }); + +test('the baked release token is a plausible Sanctum token when present', function () { + $baked = (new Config)->publicToken(); + + // Empty in the repository is allowed (the release guard enforces + // baking); when present it must look like id|secret. + if ($baked !== null) { + expect($baked)->toMatch('/^\d+\|\w{40,}$/'); + } + + expect(true)->toBeTrue(); +}); diff --git a/tests/Pest.php b/tests/Pest.php index e6b2329..c35b8ab 100644 --- a/tests/Pest.php +++ b/tests/Pest.php @@ -1,6 +1,7 @@ configHome); putenv('GLIMPSE_TOKEN'); putenv('GLIMPSE_API_URL'); + + // A real public token is baked into Config for releases. Tests + // must not silently fall back to it: run with the fallback off, + // and let tests that exercise it bind their own override. + $this->app->instance(Config::class, new Config(publicTokenOverride: '')); }) ->afterEach(function () { if ($this->originalCwd !== '') { diff --git a/tests/Unit/ConfigTest.php b/tests/Unit/ConfigTest.php index c09b31b..2906a60 100644 --- a/tests/Unit/ConfigTest.php +++ b/tests/Unit/ConfigTest.php @@ -4,18 +4,18 @@ describe('token', function () { test('returns null when nothing is configured', function () { - expect((new Config)->token())->toBeNull(); + expect((new Config(publicTokenOverride: ''))->token())->toBeNull(); }); test('reads the token from the config file', function () { - $config = new Config; + $config = new Config(publicTokenOverride: ''); $config->setToken('file-token'); expect($config->token())->toBe('file-token'); }); test('GLIMPSE_TOKEN env var beats the config file', function () { - $config = new Config; + $config = new Config(publicTokenOverride: ''); $config->setToken('file-token'); putenv('GLIMPSE_TOKEN=env-token'); @@ -28,19 +28,19 @@ describe('apiUrl', function () { test('defaults to the production API url', function () { - expect((new Config)->apiUrl())->toBe('https://glimpseimg.com/api'); + expect((new Config(publicTokenOverride: ''))->apiUrl())->toBe('https://glimpseimg.com/api'); }); test('GLIMPSE_API_URL env var overrides the default and trailing slashes are trimmed', function () { putenv('GLIMPSE_API_URL=https://glimpseimg.test/api/'); - expect((new Config)->apiUrl())->toBe('https://glimpseimg.test/api'); + expect((new Config(publicTokenOverride: ''))->apiUrl())->toBe('https://glimpseimg.test/api'); putenv('GLIMPSE_API_URL'); }); test('reads api_url from the config file', function () { - $config = new Config; + $config = new Config(publicTokenOverride: ''); mkdir(dirname($config->path()), 0700, true); file_put_contents($config->path(), json_encode(['api_url' => 'https://staging.glimpseimg.com/api'])); @@ -51,7 +51,7 @@ describe('setToken', function () { test('creates the config file under XDG_CONFIG_HOME with restrictive permissions', function () { - $config = new Config; + $config = new Config(publicTokenOverride: ''); $config->setToken('secret'); expect($config->path())->toBe($this->configHome.'/glimpse/config.json') @@ -60,7 +60,7 @@ }); test('preserves other config keys when updating the token', function () { - $config = new Config; + $config = new Config(publicTokenOverride: ''); mkdir(dirname($config->path()), 0700, true); file_put_contents($config->path(), json_encode(['api_url' => 'https://staging.glimpseimg.com/api'])); @@ -72,7 +72,7 @@ }); test('setting a null token removes it from the file', function () { - $config = new Config; + $config = new Config(publicTokenOverride: ''); $config->setToken('secret'); $config->setToken(null);