test(crypto+db+cli): add master key, crypto, credentials_repo, and CLI tests

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_master_key.py

@@ -0,0 +1,60 @@
+# -*- coding: utf-8 -*-
+import os
+import sys
+import tempfile
+
+import pytest
+from cryptography.fernet import Fernet
+
+_scripts = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "scripts")
+if _scripts not in sys.path:
+    sys.path.insert(0, _scripts)
+
+from service.master_key import (  # noqa: E402
+    ENV_MASTER_KEY,
+    MasterKeyMissingError,
+    load_master_key,
+    write_master_key_file,
+)
+
+
+@pytest.fixture()
+def iso_mk(monkeypatch):
+    tmp = tempfile.mkdtemp(prefix="mk_test_")
+    data_root = os.path.join(tmp, "claw-data")
+    os.makedirs(data_root, exist_ok=True)
+    monkeypatch.setenv("JIANGCHANG_DATA_ROOT", data_root)
+    monkeypatch.setenv("JIANGCHANG_USER_ID", "mk_uid")
+    monkeypatch.delenv(ENV_MASTER_KEY, raising=False)
+    yield tmp
+
+
+def test_env_priority_over_file(iso_mk, monkeypatch):
+    key_env = Fernet.generate_key()
+    key_file = Fernet.generate_key()
+    monkeypatch.setenv(ENV_MASTER_KEY, key_env.decode("ascii"))
+    write_master_key_file(key_file, allow_overwrite=True)
+    assert load_master_key() == key_env
+
+
+def test_file_fallback(iso_mk):
+    key_file = Fernet.generate_key()
+    write_master_key_file(key_file, allow_overwrite=True)
+    assert load_master_key() == key_file
+
+
+def test_missing_raises(iso_mk):
+    with pytest.raises(MasterKeyMissingError) as ei:
+        load_master_key()
+    assert ei.value.code == "ERR_MASTER_KEY_MISSING"
+
+
+def test_invalid_env_falls_back_to_file(iso_mk, monkeypatch):
+    monkeypatch.setenv(ENV_MASTER_KEY, "not-a-real-key")
+    with pytest.raises(MasterKeyMissingError):
+        load_master_key()
+
+    key_file = Fernet.generate_key()
+    write_master_key_file(key_file, allow_overwrite=True)
+    monkeypatch.setenv(ENV_MASTER_KEY, "not-a-real-key")
+    assert load_master_key() == key_file