Joseph Doherty
0d874f91ee
Code-review follow-up on the CLI-40/41/44 branch. ISSUE 1 (all five, critical): the message-only scrub still leaked the server-echoed credential through the redacted error's structured reply accessor (.NET Reply/Statuses, Java reply()/protocolStatus(), Go MxAccessError.Reply via errors.As, Rust reply()/into_reply(), Python raw_reply). The redacted error now carries a scrubbed clone of the reply (protocol_status.message, diagnostic_message, statuses[].diagnostic_text), with per-language tests asserting the reply accessor no longer contains the credential. ISSUE 2 (Rust, critical): ensure_command_success routed MXACCESS_FAILURE to Error::Command (unlike the other four clients), bypassing attach_secrets and leaking via derived Debug/Display. MXACCESS_FAILURE now routes to Error::MxAccess, fixing the cross-client inconsistency. ISSUE 3 (Go, important): the CLI-44 terminal send was unconditionally non-blocking, dropping a genuine terminal error under a full buffer on the never-drop SubscribeEvents path. It is now reserved-slot-non-blocking only for the cancel-on-overflow path and blocking for the never-drop path. New shared fixture authenticate-user.echoed-credential-mxaccess-failure.reply.json wired into all five suites. Minors: whitespace-secret guard on .NET/Java redact helpers; Java preserves exception subtype on redaction; redaction-helper unit tests (Go/Java/.NET). Docs (ClientBehaviorFixtures.md, ClientLibrariesDesign.md) updated to make the structured-field claim true.
116 lines
5.7 KiB
JSON
116 lines
5.7 KiB
JSON
{
|
|
"schemaVersion": 1,
|
|
"fixtureSet": "mxaccess-gateway-client-behavior",
|
|
"contractName": "mxaccess-gateway",
|
|
"gatewayProtocolVersion": 3,
|
|
"workerProtocolVersion": 1,
|
|
"protoInputManifest": "clients/proto/proto-inputs.json",
|
|
"fixtures": [
|
|
{
|
|
"id": "command-reply.register.ok",
|
|
"category": "command_replies",
|
|
"messageType": "mxaccess_gateway.v1.MxCommandReply",
|
|
"path": "command-replies/register.ok.reply.json",
|
|
"expectation": "Successful command replies preserve protocol status, HRESULT, return value, status arrays, and method-specific output."
|
|
},
|
|
{
|
|
"id": "command-reply.write.mxaccess-failure",
|
|
"category": "command_replies",
|
|
"messageType": "mxaccess_gateway.v1.MxCommandReply",
|
|
"path": "command-replies/write.mxaccess-failure.reply.json",
|
|
"expectation": "MXAccess failures are data-bearing replies with HRESULT and status details, not transport failures."
|
|
},
|
|
{
|
|
"id": "command-reply.write.status-category-error-success-set",
|
|
"category": "command_replies",
|
|
"messageType": "mxaccess_gateway.v1.MxCommandReply",
|
|
"path": "command-replies/write.status-category-error-success-set.reply.json",
|
|
"expectation": "A status entry fails when its category is not MX_STATUS_CATEGORY_OK, even though the raw success member is non-zero."
|
|
},
|
|
{
|
|
"id": "command-reply.write.status-category-ok-success-zero",
|
|
"category": "command_replies",
|
|
"messageType": "mxaccess_gateway.v1.MxCommandReply",
|
|
"path": "command-replies/write.status-category-ok-success-zero.reply.json",
|
|
"expectation": "A status entry succeeds when its category is MX_STATUS_CATEGORY_OK, even though the raw success member is zero."
|
|
},
|
|
{
|
|
"id": "command-reply.write.hresult-s-false",
|
|
"category": "command_replies",
|
|
"messageType": "mxaccess_gateway.v1.MxCommandReply",
|
|
"path": "command-replies/write.hresult-s-false.reply.json",
|
|
"expectation": "A positive HRESULT such as S_FALSE (1) is a COM success code and does not fail the reply."
|
|
},
|
|
{
|
|
"id": "command-reply.write.hresult-e-fail",
|
|
"category": "command_replies",
|
|
"messageType": "mxaccess_gateway.v1.MxCommandReply",
|
|
"path": "command-replies/write.hresult-e-fail.reply.json",
|
|
"expectation": "A negative HRESULT fails the reply even when every status entry reports MX_STATUS_CATEGORY_OK."
|
|
},
|
|
{
|
|
"id": "command-reply.authenticate-user.echoed-credential",
|
|
"category": "command_replies",
|
|
"messageType": "mxaccess_gateway.v1.MxCommandReply",
|
|
"path": "command-replies/authenticate-user.echoed-credential.reply.json",
|
|
"expectation": "When a gateway/MXAccess diagnostic echoes the caller's credential back (OK envelope, negative HRESULT), the surfaced error redacts the exact secret from both the rendered message and the structured reply accessors."
|
|
},
|
|
{
|
|
"id": "command-reply.authenticate-user.echoed-credential-mxaccess-failure",
|
|
"category": "command_replies",
|
|
"messageType": "mxaccess_gateway.v1.MxCommandReply",
|
|
"path": "command-replies/authenticate-user.echoed-credential-mxaccess-failure.reply.json",
|
|
"expectation": "The same echoed-credential redaction holds when the reply is coded PROTOCOL_STATUS_CODE_MXACCESS_FAILURE, which every client routes to its MXAccess error type."
|
|
},
|
|
{
|
|
"id": "command-reply.authenticate-user.missing-payload",
|
|
"category": "command_replies",
|
|
"messageType": "mxaccess_gateway.v1.MxCommandReply",
|
|
"path": "command-replies/authenticate-user.missing-payload.reply.json",
|
|
"expectation": "An OK reply with neither the typed AuthenticateUser payload nor a return_value raises a typed malformed-reply error, never a proto3 default 0 and never an NRE."
|
|
},
|
|
{
|
|
"id": "command-reply.authenticate-user.return-value-only",
|
|
"category": "command_replies",
|
|
"messageType": "mxaccess_gateway.v1.MxCommandReply",
|
|
"path": "command-replies/authenticate-user.return-value-only.reply.json",
|
|
"expectation": "An OK reply missing the typed AuthenticateUser payload but carrying an int32 return_value falls back to the return_value (legacy-worker compatibility)."
|
|
},
|
|
{
|
|
"id": "event-stream.session-ordered",
|
|
"category": "event_streams",
|
|
"messageType": "mxaccess_gateway.v1.MxEvent",
|
|
"path": "event-streams/session-event-stream.json",
|
|
"expectation": "Clients preserve per-session event order and event family bodies exactly as emitted."
|
|
},
|
|
{
|
|
"id": "values.conversion-cases",
|
|
"category": "value_conversion",
|
|
"messageType": "mxaccess_gateway.v1.MxValue",
|
|
"path": "values/value-conversion-cases.json",
|
|
"expectation": "Clients expose typed projections and keep raw fallback metadata when conversion is incomplete."
|
|
},
|
|
{
|
|
"id": "statuses.conversion-cases",
|
|
"category": "status_conversion",
|
|
"messageType": "mxaccess_gateway.v1.MxStatusProxy",
|
|
"path": "statuses/status-conversion-cases.json",
|
|
"expectation": "Clients preserve every MXSTATUS_PROXY field, including raw category/source values."
|
|
},
|
|
{
|
|
"id": "auth.error-cases",
|
|
"category": "auth_errors",
|
|
"messageType": "client_behavior.v1.AuthErrorCase",
|
|
"path": "auth/auth-error-cases.json",
|
|
"expectation": "Clients map authentication and authorization failures distinctly and redact credentials."
|
|
},
|
|
{
|
|
"id": "timeout-cancel.expected-behavior",
|
|
"category": "timeout_cancel",
|
|
"messageType": "client_behavior.v1.TimeoutCancelCase",
|
|
"path": "timeout-cancel/timeout-cancel-cases.json",
|
|
"expectation": "Client cancellation stops waiting locally but does not imply an in-flight MXAccess COM call was aborted."
|
|
}
|
|
]
|
|
}
|