fix(keychain): gate credential-store startup access

src/utils/keychainStartup.test.ts

@@ -0,0 +1,95 @@
+import { describe, expect, it } from 'vitest';
+import { getKeychainStartupDecision } from './keychainStartup';
+
+describe('getKeychainStartupDecision', () => {
+  it('defers persistent hydration and shows the explanation after an update', () => {
+    expect(getKeychainStartupDecision({
+      portable: false,
+      appVersion: '1.0.5',
+      approvedVersion: '1.0.4',
+      accessGranted: true,
+      promptDismissed: false
+    })).toEqual({
+      deferKeychainHydration: true,
+      showKeychainPrompt: true
+    });
+  });
+
+  it('hydrates automatically after the current version was explicitly approved', () => {
+    expect(getKeychainStartupDecision({
+      portable: false,
+      appVersion: '1.0.5',
+      approvedVersion: '1.0.5',
+      accessGranted: true,
+      promptDismissed: false
+    })).toEqual({
+      deferKeychainHydration: false,
+      showKeychainPrompt: false
+    });
+  });
+
+  it('shows the explanation on first run without touching the credential store', () => {
+    expect(getKeychainStartupDecision({
+      portable: false,
+      appVersion: '1.0.5',
+      approvedVersion: '',
+      accessGranted: false,
+      promptDismissed: false
+    })).toEqual({
+      deferKeychainHydration: true,
+      showKeychainPrompt: true
+    });
+  });
+
+  it('keeps a deliberately deferred session quiet on later launches', () => {
+    expect(getKeychainStartupDecision({
+      portable: false,
+      appVersion: '1.0.5',
+      approvedVersion: '1.0.5',
+      accessGranted: false,
+      promptDismissed: true
+    })).toEqual({
+      deferKeychainHydration: true,
+      showKeychainPrompt: false
+    });
+  });
+
+  it('reoffers the explanation after a later update even if the previous one was deferred', () => {
+    expect(getKeychainStartupDecision({
+      portable: false,
+      appVersion: '1.0.6',
+      approvedVersion: '1.0.5',
+      accessGranted: false,
+      promptDismissed: true
+    })).toEqual({
+      deferKeychainHydration: true,
+      showKeychainPrompt: true
+    });
+  });
+
+  it('does not repeat a deferred prompt when the version API is unavailable', () => {
+    expect(getKeychainStartupDecision({
+      portable: false,
+      appVersion: '',
+      approvedVersion: '',
+      accessGranted: false,
+      promptDismissed: true
+    })).toEqual({
+      deferKeychainHydration: true,
+      showKeychainPrompt: false
+    });
+  });
+
+  it('never gates portable pairing on credential-store access', () => {
+    expect(getKeychainStartupDecision({
+      portable: true,
+      appVersion: '1.0.5',
+      approvedVersion: '',
+      accessGranted: false,
+      promptDismissed: false
+    })).toEqual({
+      deferKeychainHydration: false,
+      showKeychainPrompt: false
+    });
+  });
+});