fix(git-tools): unify PR edit identity proof (#1080)

packages/mosaic/framework/tools/git/test-pr-edit.sh

@@ -28,16 +28,24 @@ YAML
 cat > "$BIN_DIR/tea" <<'SH'
 #!/usr/bin/env bash
 set -euo pipefail
-[[ "$*" == "api --login usc-coder3 /user" ]] && { printf '{"login":"coder3"}\n'; exit 0; }
-[[ "$*" == "api --login same-host-other /user" ]] && { printf '{"login":"other"}\n'; exit 0; }
-[[ "$*" == "api --login mosaic-coder3 /user" ]] && { printf '{"login":"coder3"}\n'; exit 0; }
+# Deliberately misleading duplicate-name response: the wrapper must never use
+# tea for identity validation because its name lookup is not host-bound.
+[[ "$*" == "api --login duplicate /user" ]] && { printf '{"login":"coder3"}\n'; exit 0; }
 exit 1
 SH
 cat > "$BIN_DIR/curl" <<'SH'
 #!/usr/bin/env bash
 set -euo pipefail
 printf 'curl' >> "$MOSAIC_TEST_LOG"; printf ' <%s>' "$@" >> "$MOSAIC_TEST_LOG"; printf '\n' >> "$MOSAIC_TEST_LOG"
-[[ " $* " == *" -X PATCH "* ]] && printf '{"number":42,"draft":false}\n' || printf '{"name":"repo"}\n'
+if [[ "${*: -1}" == */user ]]; then
+    printf '{"login":"%s"}\n' "${MOSAIC_STUB_AUTH_USER:-coder3}"
+elif [[ "${*: -1}" == */repos/* && " $* " != *" -X PATCH "* ]]; then
+    [[ "${MOSAIC_STUB_SIGNAL:-}" == "TERM" ]] && { kill -TERM "$PPID"; sleep 1; }
+    [[ "${MOSAIC_STUB_SIGNAL:-}" == "INT" ]] && { kill -INT "$PPID"; sleep 1; }
+    printf '{"name":"repo"}\n'
+else
+    printf '{"number":42,"draft":false}\n'
+fi
 SH
 cat > "$BIN_DIR/gh" <<'SH'
 #!/usr/bin/env bash
@@ -62,12 +70,13 @@ MOSAIC_GIT_IDENTITY=coder3 run_wrapper -n 42 --login mosaic-coder3 -r mosaicstac
 python3 - "$LOG_FILE" <<'PY'
 import json, pathlib, sys
 lines = pathlib.Path(sys.argv[1]).read_text().splitlines()
-assert len(lines) == 2, lines
-assert "https://git.mosaicstack.dev/api/v1/repos/mosaicstack/stack" in lines[0], lines
-assert "https://git.mosaicstack.dev/api/v1/repos/mosaicstack/stack/pulls/42" in lines[1], lines
-assert "--config" in lines[0] and "--config" in lines[1], lines
+assert len(lines) == 3, lines
+assert "https://git.mosaicstack.dev/api/v1/user" in lines[0], lines
+assert "https://git.mosaicstack.dev/api/v1/repos/mosaicstack/stack" in lines[1], lines
+assert "https://git.mosaicstack.dev/api/v1/repos/mosaicstack/stack/pulls/42" in lines[2], lines
+assert all("--config" in line for line in lines), lines
 assert "Authorization:" not in "\n".join(lines), lines
-payload = lines[1].split(" <-d> <", 1)[1].split("> <https://", 1)[0]
+payload = lines[2].split(" <-d> <", 1)[1].split("> <https://", 1)[0]
 assert json.loads(payload) == {"title":"New title","body":"Body with `literal` bytes","base":"develop","draft":True}
 PY
 assert_no_secret
@@ -82,7 +91,8 @@ grep -q '"draft": false' "$LOG_FILE"; assert_no_secret
 if run_wrapper -n 42 --login usc-coder3 --draft >/dev/null 2>&1; then echo "Unset identity wrote" >&2; exit 1; fi
 [[ ! -s "$LOG_FILE" ]] || { echo "Unset identity reached curl" >&2; exit 1; }
 
-# Explicit and ambient same-host wrong principals both refuse before preflight/write.
+# Explicit and ambient same-host wrong principals both refuse after identity
+# lookup but before repo preflight/PATCH. The /user read is expected curl #1.
 for mode in explicit ambient; do
     : > "$LOG_FILE"
     if [[ "$mode" == explicit ]]; then
@@ -90,11 +100,12 @@ for mode in explicit ambient; do
     else
         cmd=(); export GITEA_LOGIN=same-host-other
     fi
-    if MOSAIC_GIT_IDENTITY=coder3 run_wrapper -n 42 "${cmd[@]}" -r USC/uconnect -H git.uscllc.com --draft >/dev/null 2>&1; then
+    if MOSAIC_STUB_AUTH_USER=other MOSAIC_GIT_IDENTITY=coder3 run_wrapper -n 42 "${cmd[@]}" -r USC/uconnect -H git.uscllc.com --draft >/dev/null 2>&1; then
         echo "$mode wrong identity wrote" >&2; exit 1
     fi
     unset GITEA_LOGIN
-    [[ ! -s "$LOG_FILE" ]] || { echo "$mode wrong identity reached curl" >&2; exit 1; }
+    [[ "$(wc -l < "$LOG_FILE")" -eq 1 ]] || { echo "$mode wrong identity passed identity lookup" >&2; exit 1; }
+    ! grep -q '/repos/' "$LOG_FILE" || { echo "$mode wrong identity reached repo preflight/PATCH" >&2; exit 1; }
 done
 
 # Set identity with no explicit/ambient login refuses rather than selecting first host login.
@@ -104,6 +115,32 @@ if MOSAIC_GIT_IDENTITY=coder3 run_wrapper -n 42 -r USC/uconnect -H git.uscllc.co
 fi
 [[ ! -s "$LOG_FILE" ]] || { echo "Missing login reached curl" >&2; exit 1; }
 
+# Split-credential probe for the duplicate-name cross-host seam: tea's
+# name-only /user would report coder3, while the selected host-bound curl token
+# reports other. The wrapper must trust only the latter handle used by PATCH.
+: > "$LOG_FILE"
+if MOSAIC_STUB_AUTH_USER=other MOSAIC_GIT_IDENTITY=coder3 run_wrapper -n 42 --login mosaic-coder3 \
+    -r mosaicstack/stack -H git.mosaicstack.dev --draft >/dev/null 2>&1; then
+    echo "Duplicate-name split credential reached PATCH" >&2; exit 1
+fi
+[[ "$(wc -l < "$LOG_FILE")" -eq 1 ]] || { echo "Duplicate-name identity mismatch passed /user" >&2; cat "$LOG_FILE" >&2; exit 1; }
+! grep -q -- '-X> <PATCH' "$LOG_FILE" || { echo "Duplicate-name mismatch mutated" >&2; exit 1; }
+
+# TERM and INT during repo preflight clean up, do not mutate, and return the
+# signal status rather than swallowing termination into success.
+for sig in TERM INT; do
+    : > "$LOG_FILE"
+    set +e
+    MOSAIC_STUB_SIGNAL="$sig" MOSAIC_GIT_IDENTITY=coder3 run_wrapper -n 42 --login usc-coder3 \
+      -r USC/uconnect -H git.uscllc.com --draft >/dev/null 2>&1
+    rc=$?
+    set -e
+    [[ "$rc" -ne 0 ]] || { echo "$sig was swallowed into success" >&2; exit 1; }
+    [[ "$rc" -eq 143 || "$rc" -eq 130 ]] || { echo "$sig returned unexpected status $rc" >&2; exit 1; }
+    ! grep -q -- '-X> <PATCH' "$LOG_FILE" || { echo "$sig continued into PATCH" >&2; exit 1; }
+    assert_no_secret
+done
+
 # Cross-host credential fails before curl; explicit target preflight failure blocks PATCH.
 : > "$LOG_FILE"
 if MOSAIC_GIT_IDENTITY=coder3 run_wrapper -n 42 --login mosaic-coder3 -r USC/uconnect -H git.uscllc.com --draft >/dev/null 2>&1; then