From 8218fd584e4053848738a310258893e14c4ee10e Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Mon, 24 Aug 2026 15:27:06 +0200
Subject: TOFU host trust: SPKI fingerprint pinning, tests, forget-host

---
 tests/storage.rs | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 tests/storage.rs

(limited to 'tests/storage.rs')

diff --git a/tests/storage.rs b/tests/storage.rs
new file mode 100644
index 0000000..275d47d
--- /dev/null
+++ b/tests/storage.rs
@@ -0,0 +1,61 @@
+//! Tests for storage layers that already exist. These must PASS.
+
+use std::path::PathBuf;
+
+use zagan_bet::client_database;
+use zagan_bet::server_database;
+
+fn tmp_db(name: &str) -> (String, rusqlite::Connection) {
+    let path = PathBuf::from(env!("CARGO_TARGET_TMPDIR"))
+        .join(format!("storage-{name}.db"))
+        .to_string_lossy()
+        .into_owned();
+    let _ = std::fs::remove_file(&path);
+    let conn = rusqlite::Connection::open(&path).unwrap();
+    (path, conn)
+}
+
+#[test]
+fn client_credentials_roundtrip() {
+    let (_, conn) = tmp_db("creds");
+    client_database::init_db(&conn);
+
+    assert_eq!(client_database::get_credentials(&conn, "h1"), None);
+    client_database::save_credentials(&conn, "h1", "alice", "pw").unwrap();
+    assert_eq!(
+        client_database::get_credentials(&conn, "h1"),
+        Some(("alice".to_string(), "pw".to_string()))
+    );
+    // Overwrite works.
+    client_database::save_credentials(&conn, "h1", "alice", "pw2").unwrap();
+    assert_eq!(
+        client_database::get_credentials(&conn, "h1"),
+        Some(("alice".to_string(), "pw2".to_string()))
+    );
+}
+
+#[test]
+fn client_last_host_tracking() {
+    let (_, conn) = tmp_db("hosts");
+    client_database::init_db(&conn);
+
+    assert_eq!(client_database::get_last_host(&conn), None);
+    client_database::save_host(&conn, "example.com:9000");
+    assert_eq!(
+        client_database::get_last_host(&conn),
+        Some("example.com:9000".to_string())
+    );
+}
+
+#[test]
+fn server_user_registration_and_auth_lookup() {
+    let (_, conn) = tmp_db("users");
+    server_database::init_db(&conn);
+
+    server_database::add_user(&conn, "bob", "cafebabe").unwrap();
+    assert_eq!(
+        server_database::get_hashed_password(&conn, "bob"),
+        Some("cafebabe".to_string())
+    );
+    assert_eq!(server_database::get_hashed_password(&conn, "nobody"), None);
+}
-- 
cgit v1.2.3