NK-WP-0049-T42: fix launcher preflight entry point; test the launcher path

The MFA launcher called m.preflight() but the module only exposed pi.preflight,
so its catch-all reported a generic preflight failure before any key prompt.
Add preflight() and execute the launcher's own snippet in the tests.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
This commit is contained in:
tegwick 2026-10-24 18:17:08 +02:00
parent 8058b80213
commit 9a3a84c99c
3 changed files with 28 additions and 1 deletions

View file

@ -29,6 +29,22 @@ print(json.dumps(out))
'''
def test_launcher_preflight_entry_point_exists_and_launcher_calls_it():
# The launcher swallows exceptions into one message; a missing attribute once hid here.
assert callable(m.preflight)
launcher = (ROOT / 'tools/bootstrap-recovery/run-isolated-privacyidea-mfa.sh').read_text()
assert 'isolated-privacyidea-mfa.py' in launcher and 'm.preflight()' in launcher
def test_launcher_preflight_snippet_passes_against_the_pinned_target():
import re
import subprocess
launcher = (ROOT / 'tools/bootstrap-recovery/run-isolated-privacyidea-mfa.sh').read_text()
snippet = re.search(r"python3 - <<'PY'\n(.*?)\nPY\n", launcher, re.S).group(1)
done = subprocess.run(['python3', '-c', snippet], cwd=ROOT, capture_output=True, text=True, timeout=120)
assert done.returncode == 0 and done.stdout.startswith('OK: exact bnt-lap001'), done.stdout + done.stderr
def test_wrong_code_keeps_shape_but_changes_value():
assert m.different_code('123456') == '123450'
assert m.different_code('123450') == '123451'