test(ble,crypto): GATT descriptor fuzz + conn-param boundary + crypto KAT determinism (P2-14/P1-11)
P2-14 — test/ble/test_gatt_fuzz_ext/: 28 tests in two sections.
Section 1 (9 tests): GATT descriptor access behavioral tests for the three
descriptor callbacks (accessReportRefInput, accessReportRefOutput, accessPresFormat)
in nimble_host_raw.cpp. Inline copies verify correct static payloads ({0x01,0x01},
{0x01,0x02}, 7-byte battery PresFormat) and that no callback dereferences om_data
on a WRITE op. Three source-scan assertions confirm the production callbacks are
safe in the same way.
Section 2 (19 tests): conn-param boundary fuzz extending test_conn_params_policy
with exact floor/ceiling values for each E6 parameter (interval 6/60, latency 30,
timeout 100/600), one-unit over/under boundary cases, zero-value edge cases
(zero interval, zero timeout, all-zeros tuple), UINT16_MAX adversarial inputs,
and clampToPolicy idempotency for renegotiate cases.
MTU negotiation skipped: s_mtu is written directly in the BLE_GAP_EVENT_MTU
handler with no pure policy function — device-only.
P1-11 — test/crypto/test_crypto_selftest/: 6 tests.
cryptoSelftest::run() is guarded by #ifdef ESP_PLATFORM (uses
platform/serial_transport.h + psa/crypto.h headers); the run()/runAndReport()
functions are device-only — HIL route is the CRYPTOKAT serial command
(qa/tests/hardware/test_crypto.py).
This suite pins the native PSA backend: PBKDF2-HMAC-SHA256 RFC 7914 §11 KAT
(exact expected bytes), HMAC-SHA256 RFC 4231 TC1 KAT (exact expected bytes),
and determinism assertions for both primitives plus AES-CBC vault envelope
round-trip. Guards the "no HW-SHA flakiness on host" contract.
P2-15 assessed: tabbed_vault_view.cpp / stick_vault_view.cpp pure-logic
candidates (clampUp/clampDown, scrollWindowTop) are already covered by
test_two_button_nav and test_menu_list_component. wrapMono uses
display::setFont/textWidth — not natively testable. TOTP display text is
hardcoded. Route to HIL/screenshot-tested, no new seam needed.
Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo
fix(test): configure clangd and clang-tidy for native test tree (#3)
* fix(test): configure clangd and clang-tidy for native test tree
- Generate compile_commands.json from pio run -e native -t compiledb
so clangd resolves src/ headers in test files without errors.
- Fix .clangd PathMatch regex (relative path, not absolute) and add
-I.pio/build/native/unity_config so unity_config.h resolves.
- Remove overly broad Remove: -I* that was stripping all added paths.
- Add -Wno-format-security and UnusedIncludes: None to test block.
- Add test/.clang-tidy that inherits the root config and:
- Allows test_* functions to use snake_case (FunctionIgnoredRegexp)
- Disables cert-err33-c, cert-dcl50-cpp,
cppcoreguidelines-pro-type-cstyle-cast,
bugprone-argument-comment, bugprone-misplaced-widening-cast,
bugprone-implicit-widening-of-multiplication-result,
misc-unused-using-decls — all false positives in test context.
- Add /* intentionally empty */ comment to all empty setUp()/tearDown()
bodies (28 files) to suppress SonarLint c:S1186.
- Fix test_vault_task: change relative include ../../src/vault/vault_task.h
to vault/vault_task.h (consistent with all other test files; -Isrc
already in compile flags).
- Reorganise test/ into a module-mirroring subtree layout:
test/ble/, test/crypto/, test/hal/, test/ota/, test/platform/,
test/states/, test/totp/, test/ui/, test/vault/, test/web/
(old flat directories removed).
- Add sonar-project.properties exclusion e4: suppress c:S1186 on
test/**/*.cpp at SonarCloud level.
All 468 native unit tests pass (pio test -e native).
* fix(clangd): add -DESP_PLATFORM to global CompileFlags
All Kleidos targets are ESP32/ESP32-S3 (framework = espidf), so
ESP_PLATFORM is always defined at compile time. Without this flag in
the clangd config, the language server was activating #else branches
inside #ifdef ESP_PLATFORM blocks, hiding device code and showing
false diagnostics for src/ files.
The test/** fragment already has Remove: -DESP_PLATFORM, so native
unit-test files continue to compile without the flag.
* revert(clangd): remove incorrect -DESP_PLATFORM from global CompileFlags
Adding -DESP_PLATFORM globally caused 'too many errors' in src/ files
because compile_commands.json was generated from the native env and
lacked all ESP-IDF/Xtensa include paths.
The correct fix is to generate compile_commands.json from a device env:
./scripts/generate_compiledb.sh sticks3
This populates the DB with proper -DESP_PLATFORM and all IDF includes
for every src/ translation unit. The symlink at the project root then
points clangd to the right compilation context.