1 files changed, 74 insertions, 0 deletions
diff --git a/packages/meshbay-node/tests/test_packaging_default_env.py b/packages/meshbay-node/tests/test_packaging_default_env.py
new file mode 100644
index 0000000..60bbb78
--- /dev/null
+++ b/packages/meshbay-node/tests/test_packaging_default_env.py
@@ -0,0 +1,74 @@
+"""
+What the Linux packages ship of QE/default.env.
+
+The file is unversioned and lives beside other QE notes; the packages are
+public. build-node.sh once copied it whole after checking only its first 30
+bytes, so any line added to it later would have gone out in every deb and rpm.
+Only the validated token line may ship.
+
+These run the build step itself (the lines from `DEFAULT_ENV=` to its echo)
+under bash against a scratch repo, rather than reading its text.
+"""
+
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[3]
+BUILD_NODE = ROOT / "packaging" / "build" / "build-node.sh"
+
+pytestmark = [
+    pytest.mark.skipif(not BUILD_NODE.exists(), reason="packaging not present"),
+    pytest.mark.skipif(shutil.which("bash") is None, reason="no bash"),
+]
+
+TOKEN = "MESHBAY_TMDB_DEFAULT_TOKEN=eyJhbGciOi.eyJzdWIi-x_y"
+
+
+def _step() -> str:
+    lines = BUILD_NODE.read_text(encoding="utf-8").splitlines()
+    start = next(i for i, l in enumerate(lines) if l.startswith("DEFAULT_ENV="))
+    end = next(i for i in range(start, len(lines)) if "default.env:" in lines[i] and lines[i].lstrip().startswith("echo"))
+    return "\n".join(lines[start : end + 1]) + "\n"
+
+
+def _build(tmp_path: Path, content: bytes | None) -> Path | None:
+    (tmp_path / "QE").mkdir()
+    share = tmp_path / "root" / "opt" / "meshbay-node" / "share"
+    share.mkdir(parents=True)
+    if content is not None:
+        (tmp_path / "QE" / "default.env").write_bytes(content)
+    script = tmp_path / "step.sh"
+    script.write_text(_step(), encoding="utf-8")
+    run = subprocess.run(
+        ["bash", str(script)],
+        env={"REPO": str(tmp_path), "ROOT": str(tmp_path / "root"), "PATH": "/usr/bin:/bin"},
+        capture_output=True,
+    )
+    out = share / "default.env"
+    return out if run.returncode == 0 else None
+
+
+def test_only_the_token_line_ships(tmp_path):
+    out = _build(tmp_path, (TOKEN + "\r\nANOTHER_SECRET=hunter2\n# a note\n").encode())
+    assert out is not None
+    assert out.read_bytes() == (TOKEN + "\n").encode()
+    assert out.stat().st_mode & 0o777 == 0o644
+
+
+@pytest.mark.parametrize(
+    "content",
+    [
+        None,
+        b"",
+        b"\xef\xbb\xbf" + TOKEN.encode() + b"\n",
+        b"# token below\n" + TOKEN.encode() + b"\n",
+        b"MESHBAY_TMDB_DEFAULT_TOKEN=eyJ\n",
+        b"MESHBAY_TMDB_DEFAULT_TOKEN=eyJa b\n",
+    ],
+    ids=["missing", "empty", "bom", "not-first", "no-token", "space"],
+)
+def test_no_valid_token_line_no_build(tmp_path, content):
+    assert _build(tmp_path, content) is None