test(crypto+db+cli): add master key, crypto, credentials_repo, and CLI tests

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_schema_migration_v21.py

@@ -0,0 +1,104 @@
+# -*- coding: utf-8 -*-
+import os
+import sqlite3
+import sys
+import tempfile
+
+import pytest
+
+_scripts = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "scripts")
+if _scripts not in sys.path:
+    sys.path.insert(0, _scripts)
+
+from util.constants import SKILL_SLUG  # noqa: E402
+
+
+def _db_path(root: str, uid: str) -> str:
+    return os.path.join(root, uid, SKILL_SLUG, "account-manager.db")
+
+
+def _prep_logging():
+    from util.logging_config import setup_skill_logging
+
+    setup_skill_logging(SKILL_SLUG, "openclaw.skill.account_manager_schema_v21")
+
+
+def _column_names(conn: sqlite3.Connection, table: str) -> list[str]:
+    cur = conn.cursor()
+    cur.execute(f"PRAGMA table_info({table})")
+    return [row[1] for row in cur.fetchall()]
+
+
+@pytest.fixture()
+def iso_v21(monkeypatch):
+    with tempfile.TemporaryDirectory(prefix="acc_mgr_v21_", ignore_cleanup_errors=True) as tmp:
+        data_root = os.path.join(tmp, "data-root")
+        os.makedirs(data_root)
+        uid = "v21_uid"
+        monkeypatch.setenv("JIANGCHANG_DATA_ROOT", data_root)
+        monkeypatch.setenv("JIANGCHANG_USER_ID", uid)
+        db_path = _db_path(data_root, uid)
+        os.makedirs(os.path.dirname(db_path), exist_ok=True)
+        _prep_logging()
+        yield {"tmp": tmp, "db_path": db_path}
+
+
+class TestSchemaV21:
+    def test_fresh_has_secret_ciphertext_and_meta(self, iso_v21):
+        from db.connection import get_conn, init_db
+
+        if os.path.isfile(iso_v21["db_path"]):
+            os.remove(iso_v21["db_path"])
+        init_db()
+        conn = get_conn()
+        try:
+            assert "secret_ciphertext" in _column_names(conn, "credentials")
+            cur = conn.cursor()
+            cur.execute(
+                "SELECT value FROM _schema_meta WHERE key = ?",
+                ("schema_version",),
+            )
+            assert cur.fetchone()[0] == "2.1"
+        finally:
+            conn.close()
+
+    def test_v2_to_v21_idempotent(self, iso_v21, capsys):
+        from db.connection import get_conn, init_db
+
+        db_path = iso_v21["db_path"]
+        if os.path.isfile(db_path):
+            os.remove(db_path)
+
+        init_db()
+        conn = get_conn()
+        try:
+            conn.execute("ALTER TABLE credentials DROP COLUMN secret_ciphertext")
+            conn.execute(
+                "UPDATE _schema_meta SET value = ? WHERE key = ?",
+                ("2", "schema_version"),
+            )
+            conn.commit()
+        finally:
+            conn.close()
+
+        capsys.readouterr()
+        init_db()
+        err = capsys.readouterr().err
+        assert "v2→v2.1" in err
+
+        conn = get_conn()
+        try:
+            assert "secret_ciphertext" in _column_names(conn, "credentials")
+            cur = conn.cursor()
+            cur.execute(
+                "SELECT value FROM _schema_meta WHERE key = ?",
+                ("schema_version",),
+            )
+            assert cur.fetchone()[0] == "2.1"
+        finally:
+            conn.close()
+
+        capsys.readouterr()
+        init_db()
+        err2 = capsys.readouterr().err
+        assert "v2→v2.1" not in err2