Setting up Open CMIS TCK

tests/test_open_cmis_tck.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import http.client
 import json
+import os
 import subprocess
 import sys
 import threading
@@ -13,7 +14,11 @@ from tempfile import TemporaryDirectory
 
 from guide_board.discovery import discover_extensions
 from guide_board.execution import run_assessment
-from guide_board.planning import build_run_plan, validate_assessment_profile
+from guide_board.planning import (
+    build_run_plan,
+    validate_assessment_profile,
+    validate_target_profile,
+)
 from guide_board.retention import build_trend_summary
 from guide_board.service import ServiceHandle, start_service
 from open_cmis_tck.bootstrap import TCK_COORDINATE, check_runtime
@@ -74,6 +79,11 @@ class OpenCmisTckExtensionTests(unittest.TestCase):
         self.assertEqual(diagnostics["cmis_config"]["repository_id"], "compat-tck")
         self.assertEqual(diagnostics["cmis_config"]["auth_mode"], "anonymous")
 
+        authenticated = dict(target)
+        authenticated["credentials_ref"] = "env:CMIS_TCK_USER,CMIS_TCK_PASSWORD"
+        authenticated_diagnostics = validate_cmis_profile_config(authenticated, assessment)
+        self.assertEqual(authenticated_diagnostics["cmis_config"]["auth_mode"], "env")
+
         broken = dict(target)
         broken["endpoints"] = []
         broken_diagnostics = validate_cmis_profile_config(broken, assessment)
@@ -83,6 +93,17 @@ class OpenCmisTckExtensionTests(unittest.TestCase):
             broken_diagnostics["diagnostics"][0]["message"],
         )
 
+    def test_target_profile_templates_validate(self) -> None:
+        template_dir = ROOT / "profiles" / "targets" / "templates"
+        for name in [
+            "cmis-browser-anonymous.json",
+            "cmis-browser-basic-auth-env.json",
+            "cmis-browser-basic-auth-file.json",
+        ]:
+            with self.subTest(name=name):
+                profile = validate_target_profile(template_dir / name)
+                self.assertEqual(profile["subject_type"], "cmis-browser-binding-endpoint")
+
     def test_bootstrap_reports_local_tck_runtime_posture(self) -> None:
         with TemporaryDirectory() as temporary_directory:
             output = Path(temporary_directory) / "runtime-summary.json"
@@ -129,17 +150,65 @@ class OpenCmisTckExtensionTests(unittest.TestCase):
             self.assertEqual(completed.returncode, 0)
             self.assertEqual(result["result"], "skipped")
             self.assertIn(
-                "artifacts/open-cmis-tck/tck/repository-type/session.properties",
+                "artifacts/open-cmis-tck/tck/repository-type/session.properties.redacted",
                 result["artifact_refs"],
             )
             self.assertIn(
                 "org.apache.chemistry.opencmis.binding.spi.type=browser",
-                (artifact_dir / "session.properties").read_text(encoding="utf-8"),
+                (artifact_dir / "session.properties.redacted").read_text(encoding="utf-8"),
             )
             self.assertIn(
                 "org.apache.chemistry.opencmis.tck.tests.basics.BasicsTestGroup",
                 (artifact_dir / "groups.txt").read_text(encoding="utf-8"),
             )
+            self.assertFalse((artifact_dir / "session-private.properties").exists())
+
+    def test_console_adapter_uses_env_credentials_without_persisting_secret(self) -> None:
+        with TemporaryDirectory() as temporary_directory:
+            temp_root = Path(temporary_directory)
+            run_dir = temp_root / "run"
+            artifact_dir = run_dir / "artifacts" / "open-cmis-tck" / "tck" / "repository-type"
+            env = {
+                **os.environ,
+                "CMIS_TEST_USER": "alice",
+                "CMIS_TEST_PASSWORD": "secret-password",
+            }
+            completed = subprocess.run(
+                [
+                    sys.executable,
+                    str(ROOT / "adapters" / "opencmis_console_adapter.py"),
+                    "--browser-url",
+                    "http://127.0.0.1:8000/cmis/browser",
+                    "--repository-id",
+                    "local-test-repository",
+                    "--check-group",
+                    "repository-type",
+                    "--artifact-dir",
+                    str(artifact_dir),
+                    "--run-dir",
+                    str(run_dir),
+                    "--extension-path",
+                    str(ROOT),
+                    "--credentials-ref",
+                    "env:CMIS_TEST_USER,CMIS_TEST_PASSWORD",
+                    "--dry-run",
+                ],
+                capture_output=True,
+                text=True,
+                check=False,
+                env=env,
+            )
+            result = json.loads(completed.stdout)
+            redacted = (artifact_dir / "session.properties.redacted").read_text(
+                encoding="utf-8"
+            )
+
+            self.assertEqual(completed.returncode, 0)
+            self.assertEqual(result["result"], "skipped")
+            self.assertIn("org.apache.chemistry.opencmis.user=alice", redacted)
+            self.assertIn("org.apache.chemistry.opencmis.password=<redacted>", redacted)
+            self.assertNotIn("secret-password", redacted)
+            self.assertFalse((artifact_dir / "session-private.properties").exists())
 
     def test_runs_cmis_preflight_against_local_endpoint(self) -> None:
         server = HTTPServer(("127.0.0.1", 0), _CmisHandler)