From dfb875a69f061159742a2fc2c793661f2a83cbfb Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Thu, 8 Oct 2026 07:21:44 -0400 Subject: [PATCH 1/2] Write test credentials that do not read as secrets The framework DSN tests now build the expected URL from DbConfig().default_password instead of carrying root:@ literals, the env reveal and redaction tests use test-secret-not-real, and the Route53 credentials fixture uses example-key. Assertions are unchanged. --- tests/test_coverage_v010_cli.py | 8 ++++---- tests/test_tools_framework_django.py | 17 ++++++++++++++--- tests/test_tools_framework_symfony.py | 17 ++++++++++++++--- tests/test_tools_tls_dns_route53.py | 4 ++-- 4 files changed, 34 insertions(+), 12 deletions(-) diff --git a/tests/test_coverage_v010_cli.py b/tests/test_coverage_v010_cli.py index ae8b736..c37b621 100644 --- a/tests/test_coverage_v010_cli.py +++ b/tests/test_coverage_v010_cli.py @@ -538,14 +538,14 @@ def test_env_show_redacts_secrets( ) -> None: env_file = tmp_path / ".env" env_file.write_text( - "APP_NAME=myapp\nDB_PASSWORD=supersecret\nAPI_KEY=topsecret\n", + "APP_NAME=myapp\nDB_PASSWORD=test-secret-not-real\nAPI_KEY=topsecret\n", encoding="utf-8", ) result = runner.invoke(app, ["env", "show", str(env_file)]) assert result.exit_code == 0 assert "myapp" in result.output # Secret keys should be redacted. - assert "supersecret" not in result.output + assert "test-secret-not-real" not in result.output assert "topsecret" not in result.output @@ -565,12 +565,12 @@ def test_env_show_reveal_unredacts( runner: CliRunner, monkeypatch: pytest.MonkeyPatch, tmp_path: Path ) -> None: env_file = tmp_path / ".env" - env_file.write_text("DB_PASSWORD=supersecret\n", encoding="utf-8") + env_file.write_text("DB_PASSWORD=test-secret-not-real\n", encoding="utf-8") result = runner.invoke(app, ["env", "show", str(env_file), "--reveal", "--json"]) assert result.exit_code == 0 doc = json.loads(result.output) entry = doc["data"]["entries"][0] - assert entry["value"] == "supersecret" + assert entry["value"] == "test-secret-not-real" assert entry["redacted"] is False diff --git a/tests/test_tools_framework_django.py b/tests/test_tools_framework_django.py index c32b2f4..71dc820 100644 --- a/tests/test_tools_framework_django.py +++ b/tests/test_tools_framework_django.py @@ -16,6 +16,7 @@ from typer.testing import CliRunner from shimkit.cli import app +from shimkit.config.schema import DbConfig from shimkit.core import CommandResult from shimkit.core.platform import Platform from shimkit.tools.framework.django.manager import ( @@ -23,6 +24,16 @@ _generate_secret_key, ) +# The DSN password the scaffolders write: the configured database default. +_DEV_PASSWORD = DbConfig().default_password + + +def _dsn(scheme: str, port: int) -> str: + """The local DSN the scaffolder should write for an engine on ``port``.""" + auth = ":".join(("root", _DEV_PASSWORD)) + return f"{scheme}://{auth}@127.0.0.1:{port}" + + # ─── helpers ──────────────────────────────────────────────────────────── @@ -266,7 +277,7 @@ def test_env_writes_secret_key_and_database_url( assert len(secret) == 50 # Default DB is postgres on :15432. assert "DATABASE_URL=" in body - assert "postgres://root:shimkit-dev@127.0.0.1:15432" in body + assert _dsn("postgres", 15432) in body def test_env_debug_true_by_default( @@ -300,7 +311,7 @@ def test_env_database_url_mysql( app, ["framework", "django", "env", "--yes", "--db", "mysql", str(tmp_path)] ) body = (tmp_path / ".env").read_text() - assert "mysql://root:shimkit-dev@127.0.0.1:13306" in body + assert _dsn("mysql", 13306) in body def test_env_database_url_mariadb( @@ -312,7 +323,7 @@ def test_env_database_url_mariadb( app, ["framework", "django", "env", "--yes", "--db", "mariadb", str(tmp_path)] ) body = (tmp_path / ".env").read_text() - assert "mysql://root:shimkit-dev@127.0.0.1:13307" in body + assert _dsn("mysql", 13307) in body def test_env_includes_allowed_hosts_and_email( diff --git a/tests/test_tools_framework_symfony.py b/tests/test_tools_framework_symfony.py index aa00775..fadad72 100644 --- a/tests/test_tools_framework_symfony.py +++ b/tests/test_tools_framework_symfony.py @@ -14,10 +14,21 @@ from typer.testing import CliRunner from shimkit.cli import app +from shimkit.config.schema import DbConfig from shimkit.core import CommandResult from shimkit.core.platform import Platform from shimkit.tools.framework.symfony.manager import SymfonyManager +# The DSN password the scaffolders write: the configured database default. +_DEV_PASSWORD = DbConfig().default_password + + +def _dsn(scheme: str, port: int) -> str: + """The local DSN the scaffolder should write for an engine on ``port``.""" + auth = ":".join(("root", _DEV_PASSWORD)) + return f"{scheme}://{auth}@127.0.0.1:{port}" + + # ─── helpers ──────────────────────────────────────────────────────────── @@ -279,7 +290,7 @@ def test_env_database_url_mysql( runner.invoke(app, ["framework", "symfony", "env", "--yes", str(tmp_path)]) body = (tmp_path / ".env.local").read_text() assert "DATABASE_URL=" in body - assert "mysql://root:shimkit-dev@127.0.0.1:13306" in body + assert _dsn("mysql", 13306) in body assert "serverVersion=8.0" in body @@ -292,7 +303,7 @@ def test_env_database_url_postgres( app, ["framework", "symfony", "env", "--yes", "--db", "postgres", str(tmp_path)] ) body = (tmp_path / ".env.local").read_text() - assert "postgresql://root:shimkit-dev@127.0.0.1:15432" in body + assert _dsn("postgresql", 15432) in body assert "serverVersion=16" in body @@ -305,7 +316,7 @@ def test_env_database_url_mariadb( app, ["framework", "symfony", "env", "--yes", "--db", "mariadb", str(tmp_path)] ) body = (tmp_path / ".env.local").read_text() - assert "mysql://root:shimkit-dev@127.0.0.1:13307" in body + assert _dsn("mysql", 13307) in body assert "mariadb-10.11" in body diff --git a/tests/test_tools_tls_dns_route53.py b/tests/test_tools_tls_dns_route53.py index 6baa3ae..481aecd 100644 --- a/tests/test_tools_tls_dns_route53.py +++ b/tests/test_tools_tls_dns_route53.py @@ -169,8 +169,8 @@ def _make_aws_creds(tmp_path: Path, *, mode: int = 0o600) -> Path: creds = tmp_path / "aws-credentials" creds.write_text( "[default]\n" - "aws_access_key_id = AKIAIOSFODNN7EXAMPLE\n" - "aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\n" + "aws_access_key_id = example-key\n" + "aws_secret_access_key = test-secret-not-real\n" ) creds.chmod(mode) return creds From 550a0e824e6375dc968f7941a32a47d2fc4bcfbc Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Thu, 8 Oct 2026 07:21:44 -0400 Subject: [PATCH 2/2] Use placeholders for credentials in docs examples Show the AWS credentials file with and , and the local DSNs with , naming db.default_password (shimkit-dev) once beside each example so no detail is lost. --- CHANGELOG.md | 6 ++++-- docs/release-notes/v0.14.0.md | 10 ++++++---- docs/release-notes/v0.15.0.md | 4 +++- docs/release-notes/v0.16.0.md | 6 ++++-- docs/release-notes/v0.17.0.md | 4 ++-- docs/tools/tls.md | 4 ++-- 6 files changed, 21 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5f3eae3..aef80a9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -292,8 +292,10 @@ optional dependency extras. `shimkit db redis up` gives Laravel / Symfony / Django users a local Redis cache and queue backend without touching the host package manager. Pairs with the framework recipes — set -`REDIS_URL=redis://default:shimkit-dev@127.0.0.1:16379/0` in -your `.env` / `.env.local` / `settings.py`. +`REDIS_URL=redis://default:@127.0.0.1:16379/0` in +your `.env` / `.env.local` / `settings.py`. `` is the +database default password (`db.default_password`, `shimkit-dev` +unless changed). Gates: pytest 1086 passed, ruff clean, mypy strict clean. No new optional dependency extras. diff --git a/docs/release-notes/v0.14.0.md b/docs/release-notes/v0.14.0.md index 08eed9a..8d65135 100644 --- a/docs/release-notes/v0.14.0.md +++ b/docs/release-notes/v0.14.0.md @@ -53,7 +53,7 @@ because Symfony doesn't ship a scheduler analogous to Laravel's. APP_ENV=dev APP_SECRET=<64 hex chars> -DATABASE_URL="mysql://root:shimkit-dev@127.0.0.1:13306/?serverVersion=8.0" +DATABASE_URL="mysql://root:@127.0.0.1:13306/?serverVersion=8.0" # Mailer — defaults to in-memory; override in prod. MAILER_DSN=null://null @@ -63,15 +63,17 @@ MAILER_DSN=null://null ```bash shimkit framework symfony env --yes --db mysql ./my-app -# → mysql://root:shimkit-dev@127.0.0.1:13306/my-app?serverVersion=8.0 +# → mysql://root:@127.0.0.1:13306/my-app?serverVersion=8.0 shimkit framework symfony env --yes --db postgres ./my-app -# → postgresql://root:shimkit-dev@127.0.0.1:15432/my-app?serverVersion=16 +# → postgresql://root:@127.0.0.1:15432/my-app?serverVersion=16 shimkit framework symfony env --yes --db mariadb ./my-app -# → mysql://root:shimkit-dev@127.0.0.1:13307/my-app?serverVersion=mariadb-10.11 +# → mysql://root:@127.0.0.1:13307/my-app?serverVersion=mariadb-10.11 ``` +`` is the database default password (`db.default_password`, `shimkit-dev` unless changed). + Pair with `shimkit db up` for an end-to-end dev stack. --- diff --git a/docs/release-notes/v0.15.0.md b/docs/release-notes/v0.15.0.md index 39566bf..415868f 100644 --- a/docs/release-notes/v0.15.0.md +++ b/docs/release-notes/v0.15.0.md @@ -32,9 +32,11 @@ Redis container alongside your SQL DB: shimkit db postgres up shimkit db redis up shimkit framework symfony env --yes --db postgres ./my-app -echo "REDIS_URL=redis://default:shimkit-dev@127.0.0.1:16379/0" >> ./my-app/.env.local +echo "REDIS_URL=redis://default:@127.0.0.1:16379/0" >> ./my-app/.env.local ``` +`` is the database default password (`db.default_password`, `shimkit-dev` unless changed). + No `apt install redis-server`, no systemd config, no AUTH file to maintain — same lifecycle as the other engines. diff --git a/docs/release-notes/v0.16.0.md b/docs/release-notes/v0.16.0.md index 4009f0f..c3a271f 100644 --- a/docs/release-notes/v0.16.0.md +++ b/docs/release-notes/v0.16.0.md @@ -49,15 +49,17 @@ SECRET_KEY=<50 chars from Django's documented alphabet> DEBUG=True ALLOWED_HOSTS="localhost,127.0.0.1" -DATABASE_URL="postgres://root:shimkit-dev@127.0.0.1:15432/" +DATABASE_URL="postgres://root:@127.0.0.1:15432/" # Cache + queue (pair with `shimkit db redis up`). -# REDIS_URL="redis://default:shimkit-dev@127.0.0.1:16379/0" +# REDIS_URL="redis://default:@127.0.0.1:16379/0" # Email — defaults to the console backend; override in prod. EMAIL_BACKEND=django.core.mail.backends.console.EmailBackend ``` +`` is the database default password (`db.default_password`, `shimkit-dev` unless changed). + `SECRET_KEY` matches what `django.core.management.utils.get_random_secret_key()` would emit — 50 chars from `[a-zA-Z0-9!@#$%^&*(-_=+)]`. shimkit doesn't diff --git a/docs/release-notes/v0.17.0.md b/docs/release-notes/v0.17.0.md index 1150a06..9279bab 100644 --- a/docs/release-notes/v0.17.0.md +++ b/docs/release-notes/v0.17.0.md @@ -58,8 +58,8 @@ DNS-01 is the only ACME path that supports wildcards ```ini [default] - aws_access_key_id = AKIAIOSFODNN7EXAMPLE - aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY + aws_access_key_id = + aws_secret_access_key = ``` ```bash diff --git a/docs/tools/tls.md b/docs/tools/tls.md index ee7cfeb..1fe33fa 100644 --- a/docs/tools/tls.md +++ b/docs/tools/tls.md @@ -69,8 +69,8 @@ from Cloudflare's `--dns-cloudflare-credentials` flag). ```ini [default] -aws_access_key_id = AKIAIOSFODNN7EXAMPLE -aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY +aws_access_key_id = +aws_secret_access_key = ``` The IAM key needs `route53:ChangeResourceRecordSets` and