test: assert the Windows credentials-directory ACL - #70
Merged
Conversation
CredentialsDirectoryTests skipped its Windows case with the comment "Unix-only: Windows uses ACLs, verified via the file-perm integration path." No such path existed: grepping the test project for GetAccessControl, FileSystemAccessRule and DirectorySecurity returned zero hits. The comment was worse than none -- it told a reader coverage existed. So CredentialsDirectory.CreateWithWindowsAcl was asserted nowhere, and a regression in it -- wrong SID, inheritance left enabled, an ACE dropped -- would ship green on all three platforms. ACL hardening is one of the two reasons CLAUDE.md gives for keeping the Windows CI leg, and it is the stated security boundary for LocalFileCredentialEncryption. The new test asserts AreAccessRulesProtected, and that the rule set is exactly the current user and SYSTEM with FullControl/Allow. Asserting the whole set, rather than that our rule is present, is what catches an extra grant. The Unix test keeps its early-return guard rather than moving to Assert.SkipWhen: that branch is what lets the analyzer narrow the platform for the File.GetUnixFileMode calls below it (CA1416). Noted in place so the inconsistency with the new test does not read as an oversight. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #47.
The gap
CredentialsDirectoryTestsskipped its Windows case with:Grepping the whole test project for
GetAccessControl,FileSystemAccessRuleandDirectorySecurityreturned zero hits. No such path existed. The comment was worse than no comment — it told a reader coverage existed.CredentialsDirectory.CreateWithWindowsAcl— inheritance disabled, explicitFullControlfor the current user and SYSTEM only — was therefore asserted nowhere, while being the stated security boundary forLocalFileCredentialEncryptionand one of the two reasonsCLAUDE.mdgives for keeping the Windows CI leg.What it asserts
AreAccessRulesProtected— inheritance is off, so%USERPROFILE%ACEs do not reach here.Allow+FullControl.One deliberate inconsistency
The Unix test keeps its early-
returnguard instead of moving toAssert.SkipWhenlike the new Windows test. That branch is what lets the analyzer narrow the platform for theFile.GetUnixFileModecalls below it — converting it trips CA1416, whichTreatWarningsAsErrorsturns into a build failure. It is commented in place so it does not read as an oversight.Verification
Build clean, 404 tests (350 passed, 54 skipped), up from 402. The new test is skipped here and runs on CI's Windows leg — which is exactly the leg that existed for this and was not using it.
🤖 Generated with Claude Code