🧪 [testing improvement] Add unit tests for saveAccessToken in KeystoreAccessTokenStore - #58
🧪 [testing improvement] Add unit tests for saveAccessToken in KeystoreAccessTokenStore#58SayanthRock wants to merge 1 commit into
Conversation
…kenStore Implemented mock-based unit tests for the `saveAccessToken` function in `KeystoreAccessTokenStore` to increase coverage of the authentication logic. The tests verify successful encryption and saving to SharedPreferences, correct Keystore fallback key generation, and handle edge cases like blank tokens. Robolectric sdk configurations were updated to support the testing of Keystore builder classes. Co-authored-by: SayanthRock <202829406+SayanthRock@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
🤖 CodeAnt AI — Review Status
|
|
Warning Review limit reached
Next review available in: 12 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
codeant-ai
Bot
added
the
size:M
![ai-coding-guardrails[bot]](https://avatars.githubusercontent.com/in/1202546?s=60&v=4){kind=small}
There was a problem hiding this comment.
Nice work! 😎
I didn't find anything of concern
Risk: 🟢 Low
Risk analysis
This PR adds unit tests for the saveAccessToken function in KeystoreAccessTokenStore, covering encryption logic, key generation, and input validation. Since the change only introduces tests without modifying production code, it has no forward-looking impact on security, data integrity, blast radius, reversibility, operational risk, or existing test coverage.
Think our bots are missing some context? Add custom requirements or guardrails in our management console
ai-coding-guardrails
Bot
added
the
zenable/risk:low
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| val testIv = ByteArray(12) { 1 } | ||
| val testEncryptedData = ByteArray(16) { 2 } | ||
| every { mockCipher.iv } returns testIv | ||
| every { mockCipher.doFinal(any()) } returns testEncryptedData |
There was a problem hiding this comment.
Suggestion: The encryption test stubs doFinal with a fixed result for any input, so it would pass even if saveAccessToken encrypted the wrong bytes or an empty array. Capture the argument passed to doFinal and assert that it equals the UTF-8 bytes of the supplied token. [incomplete implementation]
Severity Level: Major ⚠️
- ❌ Encryption regression can pass authentication storage tests.
- ⚠️ Token plaintext handling is not validated.
- ⚠️ Login persistence coverage gives false confidence.Steps of Reproduction ✅
1. The production login flow calls `accessTokenStore.saveAccessToken(accessToken)` from
`feature-auth/src/main/java/com/sayanthrock/rockreleasehub/feature/auth/AuthViewModel.kt:49-54`
after GitHub authentication succeeds.
2. `KeystoreAccessTokenStore.saveAccessToken()` currently converts the supplied token to
UTF-8 bytes at
`core-network/src/main/java/com/sayanthrock/rockreleasehub/core/network/auth/AccessTokenStore.kt:57-64`
and passes those bytes to `Cipher.doFinal`.
3. The new happy-path test invokes `store.saveAccessToken("test_token")` at
`KeystoreAccessTokenStoreTest.kt:119`, but stubs `mockCipher.doFinal(any())` at line 116,
accepting any plaintext argument and always returning the same ciphertext.
4. Change the production call at `AccessTokenStore.kt:63` to pass an empty array or
unrelated bytes; the test still produces the same payload at lines 127-129 and passes,
demonstrating that it does not verify encryption of `test_token`.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** core-network/src/test/java/com/sayanthrock/rockreleasehub/core/network/auth/KeystoreAccessTokenStoreTest.kt
**Line:** 116:116
**Comment:**
*Incomplete Implementation: The encryption test stubs `doFinal` with a fixed result for any input, so it would pass even if `saveAccessToken` encrypted the wrong bytes or an empty array. Capture the argument passed to `doFinal` and assert that it equals the UTF-8 bytes of the supplied token.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix|
|
||
| // Assert | ||
| verify { mockKeyStore.getKey("rock_release_hub_github_oauth_key", null) } | ||
| verify { mockKeyGenerator.init(any<java.security.spec.AlgorithmParameterSpec>()) } |
There was a problem hiding this comment.
Suggestion: The test only verifies that init receives some AlgorithmParameterSpec; it does not inspect the generated KeyGenParameterSpec. Consequently, incorrect security parameters such as a non-AES algorithm, missing encrypt or decrypt purposes, a non-GCM block mode, enabled padding, or the wrong key size would all pass. Capture the spec and assert the required keystore configuration. [security]
Severity Level: Critical 🚨
- ❌ Keystore encryption policy regressions can pass tests.
- ⚠️ Token decryption compatibility may break later.
- ⚠️ Access-token protection parameters lack regression coverage.Steps of Reproduction ✅
1. The missing-key branch is exercised when `getOrCreateKey()` finds no alias at
`core-network/src/main/java/com/sayanthrock/rockreleasehub/core/network/auth/AccessTokenStore.kt:75-83`.
2. Production constructs the security-sensitive `KeyGenParameterSpec` at
`AccessTokenStore.kt:87-94`, requiring AES purposes, GCM mode, no encryption padding, and
a 256-bit key.
3. The test captures none of the argument passed to `mockKeyGenerator.init`; `verify { ...
init(any<AlgorithmParameterSpec>()) }` at `KeystoreAccessTokenStoreTest.kt:161` accepts
every parameter specification.
4. Mutate the production builder at lines 89-93 to remove decrypt purpose, use a different
block mode, enable padding, or change key size; the test still passes because it verifies
only that some `AlgorithmParameterSpec` was supplied.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** core-network/src/test/java/com/sayanthrock/rockreleasehub/core/network/auth/KeystoreAccessTokenStoreTest.kt
**Line:** 161:161
**Comment:**
*Security: The test only verifies that `init` receives some `AlgorithmParameterSpec`; it does not inspect the generated `KeyGenParameterSpec`. Consequently, incorrect security parameters such as a non-AES algorithm, missing encrypt or decrypt purposes, a non-GCM block mode, enabled padding, or the wrong key size would all pass. Capture the spec and assert the required keystore configuration.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix1 participant
User description
🎯 What: The
saveAccessTokenfunction inKeystoreAccessTokenStorewas untested, leaving a critical part of the authentication storage process (including encryption logic and Keystore interaction) without coverage.📊 Coverage: The new tests now cover:
IllegalArgumentExceptionis thrown on a blank token input.✨ Result: Enhanced reliability and confidence in the access token management layer by properly mocking and verifying previously untestable encryption sequences using MockK and Robolectric.
PR created automatically by Jules for task 11297996339464739625 started by @SayanthRock
CodeAnt-AI Description
Add coverage for access-token saving and validation
What Changed
Impact
✅ Reliable encrypted token storage✅ Covered encryption-key recovery✅ Clear validation for blank tokens💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.