nordisk/gunnar-ui

crates/gunnar-ui-server/tests/no_unlock_helper.rs

//! **The local unlock helper is gone** (CRYPT-YUBI, owner 2026-10-26: "the
//! local helper: off with it"). The console opens an encrypted file with the
//! person's security key in the tab, or they use the Gunnar CLI; nothing in
//! gunnar-ui calls a helper on 127.0.0.1, names its routes, or tells anybody
//! to start one. A source scan, over every text file of the repository.

use std::path::{Path, PathBuf};

/// The helper's traces, spelled in pieces so this file does not match itself.
fn forbidden() -> Vec<String> {
    vec![
        ["/v1", "/unwrap"].concat(),
        ["/v1", "/pair"].concat(),
        ["127.0.0.1", ":7471"].concat(),
        ["gunnar", " unlock"].concat(),
        ["gunnar", "-unlock-port"].concat(),
        ["Decrypt in", " this browser"].concat(),
        ["http://127.0.0.1", ":*"].concat(),
    ]
}

fn walk(dir: &Path, out: &mut Vec<PathBuf>) {
    let Ok(entries) = std::fs::read_dir(dir) else { return };
    for e in entries.flatten() {
        let p = e.path();
        let name = e.file_name().to_string_lossy().into_owned();
        if p.is_dir() {
            if matches!(name.as_str(), "target" | ".git" | "node_modules" | "dist") {
                continue;
            }
            walk(&p, out);
        } else if !matches!(p.extension().and_then(|x| x.to_str()), Some("lock" | "png" | "webp" | "ico" | "woff2" | "wasm" | "gz")) {
            out.push(p);
        }
    }
}

#[test]
fn nothing_in_gunnar_ui_names_the_local_unlock_helper() {
    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
    let mut files = Vec::new();
    walk(&root, &mut files);
    assert!(files.len() > 100, "the scan found the repository ({} files)", files.len());
    let mut hits = Vec::new();
    for f in &files {
        let Ok(text) = std::fs::read_to_string(f) else { continue };
        for (n, line) in text.lines().enumerate() {
            for word in forbidden() {
                if line.contains(&word) {
                    hits.push(format!("{}:{}: {word}", f.strip_prefix(&root).unwrap_or(f).display(), n + 1));
                }
            }
        }
    }
    assert!(hits.is_empty(), "the local unlock helper is still named:\n{}", hits.join("\n"));
}