fix: audit round 2 - DPAPI secrets, pinned hop probe, gost exe hash, admin guard, PID-scoped browser tracking, emergency disengage button, build sidecar

tests/test_secrets_store.py

@@ -0,0 +1,48 @@
+"""Round-trip tests for the DPAPI-backed secrets store.
+
+These are skipped automatically on non-Windows so the test suite stays cross-
+platform.  On Windows, DPAPI is part of the OS — no extra deps required.
+"""
+from __future__ import annotations
+
+import sys
+import unittest
+
+from proxy_chain_manager import secrets_store
+
+
+@unittest.skipUnless(sys.platform == "win32", "DPAPI only on Windows")
+class TestSecretsStore(unittest.TestCase):
+    def test_empty_passthrough(self) -> None:
+        self.assertEqual(secrets_store.encrypt(""), "")
+        self.assertEqual(secrets_store.decrypt(""), "")
+
+    def test_legacy_plaintext_passthrough(self) -> None:
+        # Anything without the DPAPI: prefix decrypts to itself so migration
+        # from plaintext files is automatic on first read.
+        self.assertEqual(secrets_store.decrypt("legacy_pw"), "legacy_pw")
+
+    def test_round_trip_ascii(self) -> None:
+        secret = "hunter2!"
+        token = secrets_store.encrypt(secret)
+        self.assertTrue(token.startswith("DPAPI:v1:"))
+        self.assertEqual(secrets_store.decrypt(token), secret)
+
+    def test_round_trip_unicode(self) -> None:
+        secret = "пароль · 🔐 · café"
+        token = secrets_store.encrypt(secret)
+        self.assertEqual(secrets_store.decrypt(token), secret)
+
+    def test_double_encrypt_idempotent(self) -> None:
+        token = secrets_store.encrypt("once")
+        again = secrets_store.encrypt(token)
+        self.assertEqual(token, again)
+
+    def test_is_encrypted_helper(self) -> None:
+        self.assertFalse(secrets_store.is_encrypted(""))
+        self.assertFalse(secrets_store.is_encrypted("plaintext"))
+        self.assertTrue(secrets_store.is_encrypted(secrets_store.encrypt("x")))
+
+
+if __name__ == "__main__":
+    unittest.main()