test(stack-encrypt): pin the wipe on drop and the Debug of a planned value

The mutants gate on #1595 found six surviving mutants: the two wipe
functions and the Drop of a marked query, the Zeroize and Debug of a
planned value, and the Debug of a field handle. Each is now pinned by a
unit test: a dropped query wipes its value once (both bounds of a
range), a value taken out of it is not wiped a second time, zeroizing a
planned value empties its frame, and Debug names the wrapper and the
field but shows no value.

Refs #1486.

Author: coderdan

packages/stack-encrypt/src/dynamic/planned.rs

@@ -676,3 +676,53 @@ impl<'p, R: TargetResolver + ?Sized> DynamicQuery<'p, R> {
             .term(keyset, self.value, &self.scopes, self.resolver)
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::dynamic::test_frame::{frame_of, Tree};
+    use vitaminc_protected::AsProtectedRef as _;
+
+    fn s(value: &str) -> Tree {
+        Tree::String(value.into())
+    }
+
+    fn the_plan() -> Plan {
+        let spec = Tree::Object(vec![
+            ("context".into(), Tree::Array(vec![s("users"), s("age")])),
+            ("outputs".into(), Tree::Array(vec![s("c")])),
+            ("type".into(), s("uint32")),
+        ]);
+        let value = Tree::Object(vec![("age".into(), spec)]);
+        record::plan(frame_of(&value).as_protected_ref().as_deref()).expect("parses")
+    }
+
+    fn a_row() -> ValueFrame {
+        let value = Tree::Object(vec![("age".into(), Tree::UInt32(34))]);
+        ValueFrame::from_bytes(frame_of(&value).as_protected_ref().as_deref()).expect("a frame")
+    }
+
+    /// Zeroizing a planned value wipes the value it holds: the frame is
+    /// replaced by the empty one, whose dropped buffer wipes the bytes.
+    #[test]
+    fn zeroizing_a_planned_value_empties_its_frame() {
+        let plan = the_plan();
+        let mut planned = Planned::new(&plan, a_row());
+        assert_ne!(planned.value, ValueFrame::empty());
+        planned.zeroize();
+        assert_eq!(planned.value, ValueFrame::empty());
+    }
+
+    /// `Debug` names the wrapper and the handle's field, and shows no value.
+    #[test]
+    fn debug_names_the_wrapper_and_the_field_but_no_value() {
+        let plan = the_plan();
+        let shown = format!("{:?}", Planned::new(&plan, a_row()));
+        assert!(shown.starts_with("Planned"), "{shown}");
+        assert!(!shown.contains("34"), "{shown}");
+        let handle = plan.field("age").expect("the field");
+        let shown = format!("{handle:?}");
+        assert!(shown.starts_with("FieldHandle"), "{shown}");
+        assert!(shown.contains("age"), "{shown}");
+    }
+}

packages/stack-encrypt/src/marker.rs

@@ -383,3 +383,65 @@ where
             .map(move |terms| T::Via::query(verifier, terms, token))
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    use std::sync::Arc;
+
+    /// A query value that counts how many times it was wiped.
+    struct Spy(Arc<AtomicUsize>);
+
+    impl Zeroize for Spy {
+        fn zeroize(&mut self) {
+            let _ = self.0.fetch_add(1, Ordering::SeqCst);
+        }
+    }
+
+    fn query<In>(value: In, wipe: fn(In)) -> MarkedQuery<(), (), In> {
+        MarkedQuery {
+            label: Label::parse("users/age").expect("a label"),
+            value: Some(value),
+            wipe,
+            scopes: DeclaredContext::default(),
+            marker: PhantomData,
+        }
+    }
+
+    /// A query dropped before it is derived wipes the value it copied.
+    #[test]
+    fn a_dropped_query_wipes_its_value() {
+        let wipes = Arc::new(AtomicUsize::new(0));
+        let query = query(Spy(Arc::clone(&wipes)), wipe_one::<Spy>);
+        assert_eq!(wipes.load(Ordering::SeqCst), 0, "held, not wiped");
+        drop(query);
+        assert_eq!(wipes.load(Ordering::SeqCst), 1, "wiped once on drop");
+    }
+
+    /// A range query wipes both of its bounds.
+    #[test]
+    fn a_dropped_range_query_wipes_both_bounds() {
+        let lo = Arc::new(AtomicUsize::new(0));
+        let hi = Arc::new(AtomicUsize::new(0));
+        let query = query(
+            (Spy(Arc::clone(&lo)), Spy(Arc::clone(&hi))),
+            wipe_pair::<Spy>,
+        );
+        drop(query);
+        assert_eq!(lo.load(Ordering::SeqCst), 1);
+        assert_eq!(hi.load(Ordering::SeqCst), 1);
+    }
+
+    /// A query whose value was taken, as deriving it does, wipes nothing
+    /// twice: the taken value is the derivation's to wipe.
+    #[test]
+    fn a_taken_value_is_not_wiped_by_the_drop() {
+        let wipes = Arc::new(AtomicUsize::new(0));
+        let mut query = query(Spy(Arc::clone(&wipes)), wipe_one::<Spy>);
+        let taken = query.value.take().expect("the value");
+        drop(query);
+        assert_eq!(wipes.load(Ordering::SeqCst), 0, "nothing left to wipe");
+        drop(taken);
+    }
+}