Initial Commit

packages/identity/auth/macos-keychain/tests/integration.test.ts

@@ -0,0 +1,77 @@
+// @integration — Darwin only. Skipped in CI; excluded from coverage.
+import { afterEach, describe, expect, it } from "@suaveplan/testing/runner";
+import { MacOSKeychainBridge } from "../src/index.js";
+
+const isDarwin = process.platform === "darwin";
+// Test files exempt from §13 banned-pattern .skip rule because the platform
+// guard is the documented way to skip Darwin-only integration in CI.
+const itDarwin = isDarwin ? it : it.skip;
+
+describe("MacOSKeychainBridge integration (real /usr/bin/security)", () => {
+    const SERVICE = "@suaveplan/macos-keychain.integration-test";
+    const ACCOUNT = "vitest-runner";
+    const bridge = new MacOSKeychainBridge();
+
+    afterEach(async () => {
+        if (!isDarwin) return;
+        try {
+            await bridge.deleteItem(SERVICE, ACCOUNT);
+        } catch {
+            // tolerate already-clean state
+        }
+    });
+
+    itDarwin("adds and finds an item", { timeout: 30_000 }, async () => {
+        await bridge.addItem({
+            service: SERVICE,
+            account: ACCOUNT,
+            password: "real-secret",
+        });
+        const item = await bridge.findItem(SERVICE, ACCOUNT);
+        expect(item.password).toBe("real-secret");
+    });
+
+    itDarwin(
+        "itemExists returns true after add and false after delete",
+        {
+            timeout: 30_000,
+        },
+        async () => {
+            await bridge.addItem({
+                service: SERVICE,
+                account: ACCOUNT,
+                password: "x",
+            });
+            expect(await bridge.itemExists(SERVICE, ACCOUNT)).toBe(true);
+            await bridge.deleteItem(SERVICE, ACCOUNT);
+            expect(await bridge.itemExists(SERVICE, ACCOUNT)).toBe(false);
+        }
+    );
+
+    itDarwin("updates the stored password", { timeout: 30_000 }, async () => {
+        await bridge.addItem({
+            service: SERVICE,
+            account: ACCOUNT,
+            password: "v1",
+        });
+        await bridge.updateItem(SERVICE, ACCOUNT, "v2");
+        const item = await bridge.findItem(SERVICE, ACCOUNT);
+        expect(item.password).toBe("v2");
+    });
+
+    itDarwin(
+        "listItems surfaces the added item",
+        {
+            timeout: 30_000,
+        },
+        async () => {
+            await bridge.addItem({
+                service: SERVICE,
+                account: ACCOUNT,
+                password: "list-me",
+            });
+            const entries = await bridge.listItems(SERVICE);
+            expect(entries.some((e) => e.account === ACCOUNT)).toBe(true);
+        }
+    );
+});