From 82d74529a1c2c5145163227ad1e0c843dd48348a Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 31 Oct 2026 13:31:03 -0700
Subject: Drop the auth stubs no check reaches

Every check replaces get_secret, the only caller of posix.sys.stat,
link and unlink, and nothing outside the harness calls preload.
---
 tests/extensions/harness.lua | 26 ++++++--------------------
 1 file changed, 6 insertions(+), 20 deletions(-)

(limited to 'tests/extensions')

diff --git a/tests/extensions/harness.lua b/tests/extensions/harness.lua
index 3df4719..16fcca2 100644
--- a/tests/extensions/harness.lua
+++ b/tests/extensions/harness.lua
@@ -113,7 +113,7 @@ end
 -- Loaders registered here win over any real module on the package path, so a
 -- test can hand a script a deterministic stand-in, or with a failing loader
 -- prove the script's fallback for a module that is not installed.
-function harness.preload(name, module)
+local function preload(name, module)
 	package.preload[name] = function()
 		return module
 	end
@@ -164,7 +164,7 @@ end
 
 -- The slice of the luaossl digest interface the avatar filters use.
 function harness.stub_digest()
-	harness.preload("openssl.digest", {
+	preload("openssl.digest", {
 		new = function(algorithm)
 			return {
 				final = function(self, text)
@@ -188,27 +188,13 @@ local function fake_crypt(password, setting)
 	return prefix .. password
 end
 
--- The slices of luaossl and luaposix the auth filters use. The link and
--- unlink stubs serve the secret creation path, which the auth checks bypass
--- by replacing get_secret, so they only have to exist.
+-- The slices of luaossl and luaposix the auth checks reach.
 function harness.stub_auth_modules()
 	local rand_counter = 0
-	harness.preload("posix.sys.stat", {
-		umask = function(mask)
-			return 18
-		end,
-	})
-	harness.preload("posix.unistd", {
+	preload("posix.unistd", {
 		crypt = fake_crypt,
-		link = function(from, to)
-			return nil
-		end,
-		unlink = function(path)
-			os.remove(path)
-			return 0
-		end,
 	})
-	harness.preload("openssl.rand", {
+	preload("openssl.rand", {
 		bytes = function(count)
 			local out = {}
 			for i = 1, count do
@@ -218,7 +204,7 @@ function harness.stub_auth_modules()
 			return table.concat(out)
 		end,
 	})
-	harness.preload("openssl.hmac", {
+	preload("openssl.hmac", {
 		new = function(key, algorithm)
 			return {
 				final = function(self, payload)
-- 
cgit