e2e/desktop + cli tests: bearer auth token, not a password

The supervised-attach film passed EXECUTOR_AUTH_PASSWORD, a dead env the sidecar no longer reads (it reads EXECUTOR_AUTH_TOKEN and otherwise mints/loads the bearer from auth.json). Pin a real bearer instead. Fix two stale launchd/wrapper comments that still pointed the secret at service.key.

Rhys Sullivan committed 5 months ago

Commit 6f4f9911 parent d5ae77d2 files · +3 −3Browse files

Unified · Split

2 files

apps/cli/src/service.test.ts +2 −2
e2e/desktop/supervised-attach.test.ts +1 −1

apps/cli/src/service.test.ts+2−2

@@ -50,7 +50,7 @@ describe("service unit generation", () => { · 49 unmodified lines
50	50
51	51	it("never leaks the auth password into the unit", () => {
52	52	const plist = generateLaunchdPlist(launchdInput);
53		− // The secret lives in the 0600 service.key, never in the plist env.
	53	+ // No secret in the unit — the daemon reads the bearer from auth.json at boot.
54	54	expect(plist).not.toContain("EXECUTOR_AUTH_PASSWORD");
55	55	});
56	56
@@ -95,7 +95,7 @@ describe("service unit generation", () => { · 38 unmodified lines
95	95	'"C:\\Program Files\\Executor\\executor.exe" daemon run --foreground --port 4789',
96	96	);
97	97	expect(wrapper).toContain('1>> "C:\\Users\\x\\.executor\\logs\\daemon.log"');
98		− // The secret is never baked into the wrapper — the daemon reads service.key.
	98	+ // No secret in the wrapper — the daemon reads the bearer from auth.json at boot.
99	99	expect(wrapper).not.toContain("EXECUTOR_AUTH_PASSWORD");
100	100	});
101	101

e2e/desktop/supervised-attach.test.ts+1−1

@@ -106,7 +106,7 @@ const run = async (runDir: string) => { · 105 unmodified lines
106	106	EXECUTOR_DATA_DIR: dataDir,
107	107	EXECUTOR_PORT: String(port),
108	108	EXECUTOR_HOST: "127.0.0.1",
109		− EXECUTOR_AUTH_PASSWORD: "supervised-attach-film",
	109	+ EXECUTOR_AUTH_TOKEN: "supervised-attach-film",
110	110	EXECUTOR_CLIENT_DIR: clientDir,
111	111	});
112	112	daemon = started.child;