From eb87ed542adbba81c07706b367fd6aecc94317f6 Mon Sep 17 00:00:00 2001
From: bigbes <bigbes@gmail.com>
Date: Sat, 8 Aug 2026 22:45:03 +0300
Subject: [PATCH] authz: bootstrap the tests from ecoretest

Drops the fernet key generation and the ed25519 seed both test files
were doing by hand, and the ini.File assembled around them. The keys are
constants now, which is what makes InitCrypto idempotent across the two
packages of this service that both call it.
---
 authz/authz_test.go    | 14 ++++++--------
 authz/identity_test.go | 32 ++++++--------------------------
 2 files changed, 12 insertions(+), 34 deletions(-)

diff --git a/authz/authz_test.go b/authz/authz_test.go
index b1a5eb2d5a4cd68a51c0614cfb2e7373f3316547..9cf5c09c1bb7e50488014eac2d8862a4be946761 100644
--- a/authz/authz_test.go
+++ b/authz/authz_test.go
@@ -13,7 +13,7 @@ import (
 
 	"sourcecraft.dev/bigbes/sr-ht-core/config"
 	"sourcecraft.dev/bigbes/sr-ht-core/crypto"
-	"github.com/vaughan0/go-ini"
+	"sourcecraft.dev/bigbes/sr-ht-ecore/ecoretest"
 
 	"sourcecraft.dev/bigbes/sr-ht-compare/core"
 )
@@ -43,14 +43,12 @@ func authNameFromRequest(t *testing.T, r *http.Request) string {
 }
 
 // ctxFor returns a context carrying config that points git.sr.ht's API origin at
-// url, reusing the crypto keys established in TestMain.
+// url — the ephemeral httptest server of the calling test — over the synthetic
+// instance whose keyset TestMain installed.
 func ctxFor(url string) context.Context {
-	conf := ini.File{
-		"sr.ht":         testConf.Section("sr.ht"),
-		"webhooks":      testConf.Section("webhooks"),
-		"compare.sr.ht": ini.Section{"origin": "http://localhost"},
-		"git.sr.ht":     ini.Section{"api-origin": url},
-	}
+	conf := ecoretest.Config("compare.sr.ht",
+		ecoretest.Set("git.sr.ht", "api-origin", url),
+	)
 	return config.Context(context.Background(), conf, "compare.sr.ht")
 }
 
diff --git a/authz/identity_test.go b/authz/identity_test.go
index fd6a637beb1f76bf9705ca1b5a52ce971c118d6b..6d6e8314ea4a04fdbb35ce50fa44dfa4bdd9152a 100644
--- a/authz/identity_test.go
+++ b/authz/identity_test.go
@@ -1,8 +1,6 @@
 package authz
 
 import (
-	"crypto/rand"
-	"encoding/base64"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -10,33 +8,15 @@ import (
 	"testing"
 
 	"sourcecraft.dev/bigbes/sr-ht-core/crypto"
-	"github.com/fernet/fernet-go"
-	"github.com/vaughan0/go-ini"
+	"sourcecraft.dev/bigbes/sr-ht-ecore/ecoretest"
 )
 
-// testConf holds the crypto keys shared by every test. api-origin is filled in
-// per-test (it points at an ephemeral httptest server).
-var testConf ini.File
-
-// TestMain synthesizes an in-memory config with a fresh Fernet network-key and
-// an ed25519 webhook seed, then runs crypto.InitCrypto so Encrypt/Decrypt work.
+// TestMain installs ecore's fixed test keyset into core-go's process-global
+// crypto, so Encrypt/Decrypt work offline. The keys are constants and the call
+// is idempotent, which is what lets this package and web/ both initialise
+// without the second rotating what the first sealed with.
 func TestMain(m *testing.M) {
-	var fk fernet.Key
-	if err := fk.Generate(); err != nil {
-		panic("generate fernet key: " + err.Error())
-	}
-	seed := make([]byte, 32)
-	if _, err := rand.Read(seed); err != nil {
-		panic("generate webhook seed: " + err.Error())
-	}
-
-	testConf = ini.File{
-		"sr.ht":         ini.Section{"network-key": fk.Encode()},
-		"webhooks":      ini.Section{"private-key": base64.StdEncoding.EncodeToString(seed)},
-		"compare.sr.ht": ini.Section{"origin": "http://localhost"},
-	}
-	crypto.InitCrypto(testConf)
-
+	ecoretest.InitCrypto()
 	os.Exit(m.Run())
 }