samiandClaude Sonnet 5
2d36e9fef0
The last contract gap blocking an M1 definition-of-done item: CORE's "401
handled" has no return path without it, and B2a's sibling F2 was accepted in
proto-answers-m1.md but never actually landed.
download.provideAuth {taskId, username, password, save?} -> {ok}, exactly as
proposed there. Privileged and Unix-socket-only: a credential-bearing method
must never be reachable from the browser, which is the other half of the
promise event.auth.required's own description already makes ("never back
through this event, never into a log"). It answers the challenge; it does not
itself resume the task -- the daemon retries with the credential attached and
the ordinary event.task.state reports the task leaving retry_wait, the same
as any other state change.
save only tells the daemon whether to persist the credential in the Secret
Service for next time, or use it for this attempt alone -- it never touches
SQLite or a log either way, in keeping with CLAUDE.md's secrets rule.
Three fixtures: the success path, -32010 for a task that no longer exists
(credentials submitted for it are simply discarded), and -32003 confirming
the extension has no path to this method under any transport.
mockd gets a real handler rather than falling through to the generic fixture
responder: it validates the taskId exists (so the -32010 fixture is
replayable) and actually transitions the task out of retry_wait.
Minor bump, 1.1.0 -> 1.2.0: additive method, no existing type touched.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_012fgjnqFCS5h5L7gZTZo3rV
30 lines
1.2 KiB
JSON
30 lines
1.2 KiB
JSON
{
|
|
"name": "download.provideAuth \u2014 answer a 401 challenge and remember it",
|
|
"description": "The task was sitting in retry_wait after event.auth.required. This does not restart the transfer itself: the daemon retries with the credential attached and the task's state.transition to connecting/downloading happens on its own, reported the normal way through event.task.state.",
|
|
"transport": "uds",
|
|
"request": {
|
|
"jsonrpc": "2.0",
|
|
"id": 80,
|
|
"method": "download.provideAuth",
|
|
"params": {
|
|
"taskId": "$taskId",
|
|
"username": "svc-releases",
|
|
"password": "hunter2-not-a-real-password",
|
|
"save": true
|
|
}
|
|
},
|
|
"response": {
|
|
"jsonrpc": "2.0",
|
|
"id": 80,
|
|
"result": {
|
|
"ok": true
|
|
}
|
|
},
|
|
"assertions": [
|
|
"the password never appears in a log line, ever, on either side of this call",
|
|
"save true stores the credential in the Secret Service keyed by host and realm, not in SQLite",
|
|
"the task itself is not touched synchronously by this call \u2014 it moves out of retry_wait when the daemon's own retry succeeds, reported via event.task.state",
|
|
"this method is refused with -32003 over the WebSocket transport"
|
|
]
|
|
}
|