2 files changed, 12 insertions(+), 34 deletions(-)

M authz/authz_test.go
M authz/identity_test.go

@@ 13,7 13,7 @@ import (
 
 	"sourcecraft.dev/bigbes/sr-ht-core/config"
 	"sourcecraft.dev/bigbes/sr-ht-core/crypto"
-	"github.com/vaughan0/go-ini"
+	"sourcecraft.dev/bigbes/sr-ht-ecore/ecoretest"
 
 	"sourcecraft.dev/bigbes/sr-ht-compare/core"
 )


@@ 43,14 43,12 @@ func authNameFromRequest(t *testing.T, r *http.Request) string {
 }
 
 // ctxFor returns a context carrying config that points git.sr.ht's API origin at
-// url, reusing the crypto keys established in TestMain.
+// url — the ephemeral httptest server of the calling test — over the synthetic
+// instance whose keyset TestMain installed.
 func ctxFor(url string) context.Context {
-	conf := ini.File{
-		"sr.ht":         testConf.Section("sr.ht"),
-		"webhooks":      testConf.Section("webhooks"),
-		"compare.sr.ht": ini.Section{"origin": "http://localhost"},
-		"git.sr.ht":     ini.Section{"api-origin": url},
-	}
+	conf := ecoretest.Config("compare.sr.ht",
+		ecoretest.Set("git.sr.ht", "api-origin", url),
+	)
 	return config.Context(context.Background(), conf, "compare.sr.ht")
 }
 

@@ 1,8 1,6 @@
 package authz
 
 import (
-	"crypto/rand"
-	"encoding/base64"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"


@@ 10,33 8,15 @@ import (
 	"testing"
 
 	"sourcecraft.dev/bigbes/sr-ht-core/crypto"
-	"github.com/fernet/fernet-go"
-	"github.com/vaughan0/go-ini"
+	"sourcecraft.dev/bigbes/sr-ht-ecore/ecoretest"
 )
 
-// testConf holds the crypto keys shared by every test. api-origin is filled in
-// per-test (it points at an ephemeral httptest server).
-var testConf ini.File
-
-// TestMain synthesizes an in-memory config with a fresh Fernet network-key and
-// an ed25519 webhook seed, then runs crypto.InitCrypto so Encrypt/Decrypt work.
+// TestMain installs ecore's fixed test keyset into core-go's process-global
+// crypto, so Encrypt/Decrypt work offline. The keys are constants and the call
+// is idempotent, which is what lets this package and web/ both initialise
+// without the second rotating what the first sealed with.
 func TestMain(m *testing.M) {
-	var fk fernet.Key
-	if err := fk.Generate(); err != nil {
-		panic("generate fernet key: " + err.Error())
-	}
-	seed := make([]byte, 32)
-	if _, err := rand.Read(seed); err != nil {
-		panic("generate webhook seed: " + err.Error())
-	}
-
-	testConf = ini.File{
-		"sr.ht":         ini.Section{"network-key": fk.Encode()},
-		"webhooks":      ini.Section{"private-key": base64.StdEncoding.EncodeToString(seed)},
-		"compare.sr.ht": ini.Section{"origin": "http://localhost"},
-	}
-	crypto.InitCrypto(testConf)
-
+	ecoretest.InitCrypto()
 	os.Exit(m.Run())
 }