kleidos/test/support/ at main · jmrp.io/kleidos · Tangled

jmrp.io / kleidos

0

[READ-ONLY] Mirror of https://github.com/jmrplens/kleidos. Kleidos — Hardware BLE password manager for ESP32-S3 (M5StickC Plus2, StickS3, M5Stack Gray, T-Deck, Cardputer) jmrplens.github.io/kleidos/

0

kleidos / test / support /

at main 2 folders 7 files

José M. Requena Plens Add the WiFi-station store and NTP clock-sync backend 4d ago

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

4 days ago

test(vault): add native rekey characterization harness Bring the device-only VaultStore under the native Unity harness so the whole-vault rekey() orchestration can be characterized before refactoring. - test/support/fake_storage.h: shared in-memory LittleFS/VFS implementation plus minimal platform stubs (system, watchdog, crypto deriveKey, NvsStore) that VaultStore links against on the host. - test/support/shims/esp_log.h: native stand-in for <esp_log.h> so platform/logger.h parses off-target; added to the native include path. - vault/test_vault_rekey: provisions, saves credentials, rekeys under a new PIN and proves the new PIN round-trips every secret while the old PIN is rejected and staging trees are cleaned up. VaultStore is pulled into the suite via a dedicated amalgam TU (it stays out of the global build filter so other suites are unaffected). - Guard the rtos.h includes (and their rtos-typed decls) in crypto_task.h and watchdog.h under ESP_PLATFORM; device builds are unchanged. 515 native tests pass; a mutation that skips the rekey commit turns the new tests red, confirming they exercise the path.

1 month ago

device_profiles.h

feat(ui): add Phase 2 stateless reference components (ActionBar/Header/BrandMark/StatusChip) First catalog components on the Canvas + DeviceProfile foundation (plan/ui-library-modular-reimpl.md Phase 2). Stateless: props in -> draw via Canvas -> return, reading the orthogonal DeviceProfile for device adaptation. Purely additive — no existing screen/state/widget/ Canvas changed. - ActionBar (action_bar_component): affordance-driven footer hints. The same ActionBarProps render the device-correct presentation picked from the profile capabilities — 2-button A/B, 3-button A/B/C, CoreInk dial ^/O/v, keyboard key hints, touch bare labels. Mono1/e-paper path uses a top divider rule + cell inversion instead of the SURFACE fill + ACCENT hold-fill. - Header (header_component): title + subtitle + right-packed status cluster (battery %, BLE, WiFi, lock). Density/orientation-aware via LayoutContext; Mono1 uses a bottom divider rule, ink-only tokens. - BrandMark (brand_mark_component): credential brand badge. Reuses the brands::findBrand/drawBrand registry+atlas on device; falls back to a deterministic per-domain letter tile (host-testable). Mono1 outlines. - StatusChip (status_chip_component): self-sizing status pill using radius.pill (clamped), token color per ChipStyle, knockout/outline text. Tests (host, RecordingCanvas): 30 new cases across 4 suites, incl. the per-affordance ActionBar assertions (2btn/3btn/dial/keyboard/touch), the Mono1 branches, brand letter-fallback + deterministic color, and chip sizing/geometry. Shared per-variant DeviceProfile factories in test/support/device_profiles.h. Verified: fleet 5/5 -Werror (sticks3/gray/cardputer/tdeck/m5core_ink), native 720/720 (+30), pio check 3 pre-existing HIGH only, all guards + pre-commit pass.

1 month ago

fake_http_server.h

test(web): HTTP/OTA parser negatives Add 7 native Unity tests for AdminHttpRequest's MT-04 guard surface: oversized Content-Length, truncated body, receive timeout exhaustion, receive hard error, over-long URI (bounded + query stripped), over-long header value, and a positive-control round-trip. Extend fake_http_server.h additively with declaredContentLength and receiveOverride injection fields (nullopt default preserves existing behavior); test_admin_auth_runpolicy still green (1305 total pass). Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

2 weeks ago

fake_nimble_host_port.h

fix(ble): bond headroom so N4 eviction prompt governs (T8) Size the NimBLE keystore one slot above the app host limit (CONFIG_BT_NIMBLE_MAX_BONDS 4 -> 5) so a 5th distinct host completing pairing persists in the spare slot instead of overflowing the store. Overflow made NimBLE's default round-robin store_status_cb (ble_store_util_status_rr) call ble_gap_unpair_oldest_peer() and silently delete the oldest legitimate bond BEFORE the app's N4 deny-by-default eviction prompt could run, bypassing the T8 control (BLE-01). With headroom the store never overflows on the 5th pairing, the app's auth-drain sees count() >= kMaxHosts and arms the eviction prompt, and the oldest bond is evicted only on explicit approval (DENY unpairs the new candidate; the original four survive). store_status_cb is unchanged. Add kleidos::ble::bond::kNimbleStoreCapacity = kMaxHosts + 1 as the single C++ expression of the store size, bound to MYNEWT_VAL(BLE_STORE_MAX_BONDS) by static_asserts in nimble_host_raw.cpp so the sdkconfig and constant can never drift. The user-visible host limit stays 4; the spare slot is transient headroom for a pending candidate, not a 5th usable host. Add a native TDD regression suite (test_bond_eviction_headroom) that models NimBLE's round-robin overflow in FakeNimBleHostPort and asserts the oldest bond survives until the N4 prompt resolves, DENY unpairs the candidate, and APPROVE evicts the oldest. Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

2 weeks ago

Harden the time core: atomic setDateTime, cached trust reads, UTC-exact TOTP epoch - F1: totp_epoch.h converts the RTC reading with the exact UTC civil-calendar converter (rtc::internal::dateTimeToEpoch) instead of local-time mktime; the native suite now pins hard-coded UTC vectors (1767225600 / 1783472461) so a local-time regression fails under a non-UTC host TZ instead of cancelling out. - F2: add rtc::setDateTime (one applyEpoch on the internal backend; one 7-byte I2C burst over regs 0x02..0x08 on the BM8563 via new IRtc::writeDateTime) and use it in setClockCommit and the admin portal handleSetTime (gmtime_r path removed). - F3: cache the NVS seed floor (internal) and the VL/integrity verdict (BM8563, ~1 s TTL via millis32, invalidated by every time write) so clockTrust() no longer opens an NVS handle / hits the I2C bus per UI frame; caches are atomics and never change what is returned. - F4: getValidTime reads through new rtc::getDateTime — one gettimeofday (internal) / one latched burst read (BM8563) — so date and time can no longer straddle a midnight rollover. - F5: correct the audit-log timestamp docs (UTC, not local; any trusted clock, not only BM8563) and refresh rtc-internal.md. Native 1626/1626; sticks3/gray/plus2/coreink debug builds clean under -Werror; variant/conditional/layout guards, doxygen and pio check green. Claude-Session: https://claude.ai/code/session_01U878bNJtg9bCvAMM8CFKqS

1 week ago

test(vault): native encrypted SD backup round-trip + tamper coverage (P0-02) Closes test gap P0-02 (plan/test-coverage-gaps-2026-07.md): SdVault::exportVaultEncrypted / importVaultEncrypted had zero native test coverage. This commit adds a full 6-test Unity suite under test/vault/test_sd_vault_encrypted/ using the amalgam-TU pattern: 1. Cross-device round-trip: export from device A (PIN A), import onto device B (PIN B); >=2 credentials and >=1 TOTP restored byte-identical; device B's own PIN verified intact post-import (meta not clobbered). 2. Wrong passphrase rejected (HMAC mismatch inside unwrapExport). 3. Tampered .kexp ciphertext byte rejected before decryption. 4. Passphrase shorter than kMinExportPassphraseLen rejected, no .kexp written. 5. Export returns false immediately when SD card is not mounted. 6. Import returns false immediately when no .kexp is present on SD. New files: test/support/fake_sd.h in-memory sdfatfs + SdCard stubs test/vault/test_sd_vault_encrypted/*.cpp test suite + amalgam TUs test/vault/test_sd_vault_encrypted/device_stubs.cpp OTA/audit/error stubs No production code changed. All 1377 native tests pass (baseline 1371 + 6 new). Claude-Session: https://claude.ai/code/session_01SLSU3WoYEyX1J7qWXxmyKo

2 weeks ago

test(sd_vault): cover copy/manifest/audit short-write branches Add a default-disabled short-write fault-injection seam to the shared in-memory file fake (g_shortWriteAfter, reset in fakefs::reset()): once armed, File::write() commits one byte short and returns a short count so callers guarded by `written != n` take their failure branch. Mirrors the existing g_failOpenWriteAfter seam and leaves every other suite untouched. Drive it from the sync suite to exercise copyLittleFsToSd() and writeManifest()'s short-write branches (truncated SD copy + unreadable manifest via exportVault, whose per-file failures are non-fatal) and copySdToLittleFs()'s branch (stageImport aborts and purges its staging). Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

1 week ago

recording_canvas.h

feat(ui): finalize 2-button text editors — fidelity, AA overlay focus box, slide animation Polish the CharWheel (carousel; color devices) and CharGrid (mono/e-paper) text editors to the approved mockups and fix the focus-box rendering + add selection animation. - Fidelity: enlarge the carousel selection box, add the wheel position dots, switch the chip row to "ABC abc 123 -_. DEL OK" (utility chips), drop the leading back cell; keep every grid glyph bright (box-only focus). - Focus box: replace the stacked-1px outline (which left the right/bottom border missing where neighbor cells overdrew it) with a single equal-weight AA stroke drawn as a TOP overlay after the glyphs. Adds a thickness parameter to ui::aa::strokeRoundRectAA + a Canvas::drawRoundRect(thickness) virtual — AA on color panels, concentric crisp outlines on Mono1/e-paper. - Animation: the selection slides via ui::Tween (Easing::InOutQuad, 150 ms, like the menu highlight / tab pill) — the grid box slides cell->cell, the carousel glyph ring slides through the fixed box; gated to color / Refresh::Instant, snaps on mono / e-paper. Native: 1040/1040. Builds: sticks3_debug, m5stack_gray. Verified on StickS3 (4-sided AA border on both editors + the cell/ring slide animation).

4 weeks ago