feat: advance login workflow and integration gates

scripts/test-cli.sh

@@ -0,0 +1,107 @@
+#!/bin/sh
+# Exercise the non-interactive CLI contract without authenticating a user.
+#
+# This suite intentionally uses --preview. It validates TOML parsing, command
+# line validation, build metadata, and the preflight path without requiring a
+# PAM secret, a controlling VT, or a running display server.
+set -eu
+
+binary=${1:-target/debug/latchd}
+
+if [ ! -x "$binary" ]; then
+    echo "test-cli: binary is not executable: $binary" >&2
+    exit 2
+fi
+
+workdir=$(mktemp -d "${TMPDIR:-/tmp}/latchd-cli.XXXXXX")
+trap 'rm -rf "$workdir"' EXIT HUP INT TERM
+
+config="$workdir/config.toml"
+cat >"$config" <<'TOML'
+tty = 2
+main_log_path = "/tmp/latchd-test.log"
+client_log_path = "/tmp/latchd-test.client.log"
+pam_service = "latchd"
+system_shell = "/bin/sh"
+initial_path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+[x11]
+display = ":99"
+server_path = "/usr/bin/X"
+xauth_path = "/usr/bin/xauth"
+server_timeout_secs = 5
+server_log_path = "/tmp/latchd-test.xorg.log"
+sessions_path = "/nonexistent/latchd-test/xsessions"
+scripts_path = "/nonexistent/latchd-test/wms"
+
+[wayland]
+sessions_path = "/nonexistent/latchd-test/wayland-sessions"
+scripts_path = "/nonexistent/latchd-test/wayland"
+
+[environment_switcher]
+include_tty_shell = false
+max_display_length = 18
+
+[power_controls]
+entries = []
+
+[accounts]
+minimum_uid = 1000
+excluded_users = []
+enumerate = true
+faillock_path = "/usr/sbin/faillock"
+faillock_config = "/etc/security/faillock.conf"
+
+[visual]
+background_enabled = false
+animations = false
+notifications = false
+reduced_motion = true
+max_wallpaper_bytes = 1048576
+TOML
+
+assert_contains() {
+    needle=$1
+    haystack=$2
+    grep -F -- "$needle" "$haystack" >/dev/null || {
+        echo "test-cli: expected '$needle' in $haystack" >&2
+        cat "$haystack" >&2
+        exit 1
+    }
+}
+
+info="$workdir/build-info"
+"$binary" --build-info >"$info"
+assert_contains "version=" "$info"
+assert_contains "commit=" "$info"
+assert_contains "epoch=" "$info"
+
+version="$workdir/version"
+"$binary" --version >"$version"
+assert_contains "latchd" "$version"
+
+valid="$workdir/valid"
+"$binary" --preview --no-tui --no-log --config "$config" >"$valid"
+assert_contains "configuration valid" "$valid"
+
+shown="$workdir/show-config"
+"$binary" --preview --show-config --no-log --config "$config" >"$shown"
+assert_contains "tty = 2" "$shown"
+assert_contains "pam_service" "$shown"
+
+unknown="$workdir/unknown.toml"
+printf 'unknown = true\n' >"$unknown"
+if "$binary" --preview --no-tui --no-log --config "$unknown" >"$workdir/unknown.out" 2>&1; then
+    echo "test-cli: unknown configuration field was accepted" >&2
+    exit 1
+fi
+assert_contains "unknown" "$workdir/unknown.out"
+
+invalid_tty="$workdir/invalid-tty"
+if "$binary" --preview --no-tui --no-log --config "$config" --tty 0 >"$invalid_tty" 2>&1; then
+    echo "test-cli: --tty 0 was accepted" >&2
+    exit 1
+fi
+assert_contains "--tty must be greater than zero" "$invalid_tty"
+
+echo "test-cli: PASS (CLI metadata, config validation, preflight, and safe preview paths)"