Carried over from #6, which merged with this open. Filing it because a request in a closed PR thread is easy to lose.
What is missing
#6's description reports 39 assertions across three Lua harnesses that stub the SDK — 15 on the token store (migration, the no-URL case, a refusing keychain, per-server isolation, trailing-slash equivalence), 10 on the server store, 14 on filename matching and the merge modes. It also credits them with catching two bugs before they shipped: the empty-key migration, and a guard calling normalize from the wrong module.
git ls-tree on the merged branch returns no test files, and no .gitignore excludes them. The harnesses exist only on the author's machine.
Why it matters more here than usual
The code they cover is a one-way migration of an unrecoverable credential. PicPeak shows an API token exactly once; TokenStore.get moves it to the keychain and clears the plaintext copy. One of the two bugs those harnesses caught — migrating under an empty key, then clearing the prefs copy — would have signed users out holding a token they could never see again.
That code now has no regression guard that anyone else can run. The repo has no CI, so committing them would not gate anything; the value is that a reviewer can run them and the next change to TokenStore has something to break.
Ask
Push the three harnesses as they are. No rework, no runner, no CI wiring — the files already exist and already pass. A plain lua tests/token_store_test.lua in the README is enough to say how to run them.
If they are awkward to extract from a local scratch setup, say so and I will write a minimal harness for TokenStore alone — that is the file that most needs one.
Carried over from #6, which merged with this open. Filing it because a request in a closed PR thread is easy to lose.
What is missing
#6's description reports 39 assertions across three Lua harnesses that stub the SDK — 15 on the token store (migration, the no-URL case, a refusing keychain, per-server isolation, trailing-slash equivalence), 10 on the server store, 14 on filename matching and the merge modes. It also credits them with catching two bugs before they shipped: the empty-key migration, and a guard calling
normalizefrom the wrong module.git ls-treeon the merged branch returns no test files, and no.gitignoreexcludes them. The harnesses exist only on the author's machine.Why it matters more here than usual
The code they cover is a one-way migration of an unrecoverable credential. PicPeak shows an API token exactly once;
TokenStore.getmoves it to the keychain and clears the plaintext copy. One of the two bugs those harnesses caught — migrating under an empty key, then clearing the prefs copy — would have signed users out holding a token they could never see again.That code now has no regression guard that anyone else can run. The repo has no CI, so committing them would not gate anything; the value is that a reviewer can run them and the next change to
TokenStorehas something to break.Ask
Push the three harnesses as they are. No rework, no runner, no CI wiring — the files already exist and already pass. A plain
lua tests/token_store_test.luain the README is enough to say how to run them.If they are awkward to extract from a local scratch setup, say so and I will write a minimal harness for
TokenStorealone — that is the file that most needs one.