extract generator policy to testable module and add Section 1 + Section 2 tests

@@ -0,0 +1,259 @@1+import { describe, it, expect, beforeEach } from 'vitest';2+import { vi } from 'vitest';3+4+import type { Message, MessageResponse } from '../shared/types';5+6+type StorageShape = Record<string, unknown>;7+type MessageListener = (8+  msg: unknown,9+  sender: chrome.runtime.MessageSender,10+  sendResponse: (response: MessageResponse) => void11+) => boolean;12+13+describe('notes message handlers', () => {14+  let storage: StorageShape;15+  let sessionStorage: StorageShape;16+  let listener: MessageListener;17+18+  beforeEach(async () => {19+    vi.resetModules();20+    vi.useRealTimers();21+    storage = { peach_settings: { breachMonitoring: false } };22+    sessionStorage = {};23+24+    vi.stubGlobal('fetch', vi.fn(async () => ({ ok: true, status: 200, text: async () => '' })));25+    vi.stubGlobal('__PEACH_E2E_PASSKEYS__', false);26+27+    const chromeMock = {28+      runtime: {29+        id: 'peach-extension',30+        onMessage: {31+          addListener: vi.fn((fn: MessageListener) => { listener = fn; }),32+        },33+        sendMessage: vi.fn(async () => ({ ok: true })),34+      },35+      tabs: {36+        query: vi.fn((_, cb?: (tabs: unknown[]) => void) => {37+          if (typeof cb === 'function') { cb([{ id: 1 }]); return; }38+          return Promise.resolve([{ id: 1 }]);39+        }),40+        sendMessage: vi.fn(async () => ({ ok: true })),41+      },42+      storage: {43+        local: {44+          get: vi.fn(async (key?: string | string[]) => {45+            if (!key) return storage;46+            if (typeof key === 'string') return { [key]: storage[key] };47+            return key.reduce<Record<string, unknown>>((acc, k) => { acc[k] = storage[k]; return acc; }, {});48+          }),49+          set: vi.fn(async (next: Record<string, unknown>) => { Object.assign(storage, next); }),50+          remove: vi.fn(async (keys: string | string[]) => {51+            const list = Array.isArray(keys) ? keys : [keys];52+            for (const key of list) delete storage[key];53+          }),54+        },55+        session: {56+          get: vi.fn(async (key?: string | string[]) => {57+            if (!key) return sessionStorage;58+            if (typeof key === 'string') return { [key]: sessionStorage[key] };59+            return key.reduce<Record<string, unknown>>((acc, k) => { acc[k] = sessionStorage[k]; return acc; }, {});60+          }),61+          set: vi.fn(async (next: Record<string, unknown>) => { Object.assign(sessionStorage, next); }),62+          remove: vi.fn(async (keys: string | string[]) => {63+            const list = Array.isArray(keys) ? keys : [keys];64+            for (const key of list) delete sessionStorage[key];65+          }),66+          clear: vi.fn(async () => { for (const k of Object.keys(sessionStorage)) delete sessionStorage[k]; }),67+        },68+      },69+      alarms: {70+        clear: vi.fn(), create: vi.fn(),71+        onAlarm: { addListener: vi.fn() },72+      },73+      idle: {74+        setDetectionInterval: vi.fn(),75+        onStateChanged: { addListener: vi.fn() },76+      },77+      scripting: { executeScript: vi.fn(async () => []) },78+    } as unknown as typeof chrome;79+80+    (globalThis as { chrome?: typeof chrome }).chrome = chromeMock;81+82+    const messages = await import('./messages');83+    messages.setupMessageHandler();84+    const vault = await import('./vault');85+    await vault.ensureSettingsLoaded();86+  });87+88+  async function dispatch(message: Message): Promise<MessageResponse> {89+    return new Promise<MessageResponse>((resolve) => {90+      const keepOpen = listener(message, { id: 'peach-extension' }, resolve);91+      expect(keepOpen).toBe(true);92+    });93+  }94+95+  async function setupVault(): Promise<void> {96+    const vault = await import('./vault');97+    await vault.createVault('test-pass-12345');98+  }99+100+  async function lockVault(): Promise<void> {101+    const vault = await import('./vault');102+    vault.lock();103+  }104+105+  describe('SAVE_NOTE handler', () => {106+    beforeEach(async () => { await setupVault(); });107+108+    it('creates a new note entry with type="note"', async () => {109+      const result = await dispatch({110+        type: 'SAVE_NOTE',111+        payload: { title: 'Test note', body: 'Hello world' },112+      });113+      expect(result.ok).toBe(true);114+      const note = (result as { data: Record<string, unknown> }).data;115+      expect(note.type).toBe('note');116+      expect(note.title).toBe('Test note');117+      expect(note.id).toBeTruthy();118+    });119+120+    it('assigns createdAt and modifiedAt timestamps', async () => {121+      const before = Date.now();122+      const result = await dispatch({123+        type: 'SAVE_NOTE',124+        payload: { title: 'Timestamps', body: '' },125+      });126+      const after = Date.now();127+      const note = (result as { data: Record<string, unknown> }).data;128+      expect(note.createdAt as number).toBeGreaterThanOrEqual(before);129+      expect(note.createdAt as number).toBeLessThanOrEqual(after);130+      expect(note.modifiedAt as number).toBeGreaterThanOrEqual(before);131+    });132+133+    it('updates existing note by id', async () => {134+      const created = await dispatch({135+        type: 'SAVE_NOTE',136+        payload: { title: 'Original', body: 'First' },137+      });138+      const createdNote = (created as { data: Record<string, unknown> }).data;139+      const updated = await dispatch({140+        type: 'SAVE_NOTE',141+        payload: { id: createdNote.id as string, title: 'Updated', body: 'Second' },142+      });143+      expect(updated.ok).toBe(true);144+      const updatedNote = (updated as { data: Record<string, unknown> }).data;145+      expect(updatedNote.id).toBe(createdNote.id);146+      expect(updatedNote.title).toBe('Updated');147+      expect(updatedNote.modifiedAt as number).toBeGreaterThanOrEqual(createdNote.modifiedAt as number);148+    });149+150+    it('does not change createdAt on update', async () => {151+      const created = await dispatch({152+        type: 'SAVE_NOTE',153+        payload: { title: 'Original', body: '' },154+      });155+      const createdNote = (created as { data: Record<string, unknown> }).data;156+      await new Promise(r => setTimeout(r, 10));157+      const updated = await dispatch({158+        type: 'SAVE_NOTE',159+        payload: { id: createdNote.id as string, title: 'Updated', body: '' },160+      });161+      const updatedNote = (updated as { data: Record<string, unknown> }).data;162+      expect(updatedNote.createdAt).toBe(createdNote.createdAt);163+    });164+165+    it('returns error when vault is locked', async () => {166+      await lockVault();167+      const result = await dispatch({168+        type: 'SAVE_NOTE',169+        payload: { title: 'Test', body: '' },170+      });171+      expect(result.ok).toBe(false);172+      expect((result as { error: string }).error).toMatch(/vault_locked/);173+    });174+175+    it('returns error when updating nonexistent id', async () => {176+      const result = await dispatch({177+        type: 'SAVE_NOTE',178+        payload: { id: 'nonexistent-id', title: 'Test', body: '' },179+      });180+      expect(result.ok).toBe(false);181+      expect((result as { error: string }).error).toMatch(/not_found/);182+    });183+  });184+185+  describe('DELETE_NOTE handler', () => {186+    it('soft-deletes a note and removes it from GET_NOTES results', async () => {187+      await setupVault();188+      const created = await dispatch({189+        type: 'SAVE_NOTE',190+        payload: { title: 'To delete', body: '' },191+      });192+      const note = (created as { data: Record<string, unknown> }).data;193+      const deleted = await dispatch({194+        type: 'DELETE_NOTE',195+        payload: { id: note.id as string },196+      });197+      expect(deleted.ok).toBe(true);198+      const notes = await dispatch({ type: 'GET_NOTES' });199+      const notesList = (notes as unknown as { data: Array<Record<string, unknown>> }).data;200+      expect(notesList.find((n) => n.id === note.id)).toBeUndefined();201+    });202+203+    it('returns error when vault is locked', async () => {204+      await setupVault();205+      await lockVault();206+      const result = await dispatch({207+        type: 'DELETE_NOTE',208+        payload: { id: 'some-id' },209+      });210+      expect(result.ok).toBe(false);211+    });212+  });213+214+  describe('notes in vault entries', () => {215+    it('note entries do not appear in autofill results', async () => {216+      await setupVault();217+      await dispatch({218+        type: 'SAVE_NOTE',219+        payload: { title: 'github.com', body: 'Some secret notes' },220+      });221+      const result = await dispatch({222+        type: 'AUTOFILL_QUERY',223+        payload: { domain: 'github.com' },224+      });225+      const data = (result as { data: Array<Record<string, unknown>> }).data;226+      const hasNote = data?.some((e) => e.type === 'note');227+      expect(hasNote).toBeFalsy();228+    });229+230+    it('note entries appear in vault search', async () => {231+      await setupVault();232+      await dispatch({233+        type: 'SAVE_NOTE',234+        payload: { title: 'SSH passphrase', body: 'my server key' },235+      });236+      const result = await dispatch({237+        type: 'SEARCH_VAULT',238+        payload: { query: 'SSH' },239+      });240+      const entries = (result as unknown as { data: Array<Record<string, unknown>> }).data;241+      const found = entries?.some((e) => e.type === 'note' && e.title === 'SSH passphrase');242+      expect(found).toBe(true);243+    });244+245+    it('note body is searched', async () => {246+      await setupVault();247+      await dispatch({248+        type: 'SAVE_NOTE',249+        payload: { title: 'Random title', body: 'backup codes ABCD1234' },250+      });251+      const result = await dispatch({252+        type: 'SEARCH_VAULT',253+        payload: { query: 'ABCD1234' },254+      });255+      const entries = (result as unknown as { data: Array<unknown> }).data;256+      expect(entries?.length).toBeGreaterThan(0);257+    });258+  });259+});

@@ -0,0 +1,277 @@1+import { describe, it, expect, beforeEach } from 'vitest';2+import { vi } from 'vitest';3+4+import type { Message, MessageResponse } from '../shared/types';5+import { WORD_LIST } from '../shared/recovery-word-list';6+7+type StorageShape = Record<string, unknown>;8+type MessageListener = (9+  msg: unknown,10+  sender: chrome.runtime.MessageSender,11+  sendResponse: (response: MessageResponse) => void12+) => boolean;13+14+describe('recovery words handlers', () => {15+  let storage: StorageShape;16+  let sessionStorage: StorageShape;17+  let listener: MessageListener;18+19+  beforeEach(async () => {20+    vi.resetModules();21+    vi.useRealTimers();22+    storage = { peach_settings: { breachMonitoring: false } };23+    sessionStorage = {};24+25+    vi.stubGlobal('fetch', vi.fn(async () => ({ ok: true, status: 200, text: async () => '' })));26+    vi.stubGlobal('__PEACH_E2E_PASSKEYS__', false);27+28+    const chromeMock = {29+      runtime: {30+        id: 'peach-extension',31+        onMessage: { addListener: vi.fn((fn: MessageListener) => { listener = fn; }) },32+        sendMessage: vi.fn(async () => ({ ok: true })),33+      },34+      tabs: {35+        query: vi.fn((_, cb?: (tabs: unknown[]) => void) => {36+          if (typeof cb === 'function') { cb([{ id: 1 }]); return; }37+          return Promise.resolve([{ id: 1 }]);38+        }),39+        sendMessage: vi.fn(async () => ({ ok: true })),40+      },41+      storage: {42+        local: {43+          get: vi.fn(async (key?: string | string[]) => {44+            if (!key) return storage;45+            if (typeof key === 'string') return { [key]: storage[key] };46+            return key.reduce<Record<string, unknown>>((acc, k) => { acc[k] = storage[k]; return acc; }, {});47+          }),48+          set: vi.fn(async (next: Record<string, unknown>) => { Object.assign(storage, next); }),49+          remove: vi.fn(async (keys: string | string[]) => {50+            const list = Array.isArray(keys) ? keys : [keys];51+            for (const key of list) delete storage[key];52+          }),53+        },54+        session: {55+          get: vi.fn(async (key?: string | string[]) => {56+            if (!key) return sessionStorage;57+            if (typeof key === 'string') return { [key]: sessionStorage[key] };58+            return key.reduce<Record<string, unknown>>((acc, k) => { acc[k] = sessionStorage[k]; return acc; }, {});59+          }),60+          set: vi.fn(async (next: Record<string, unknown>) => { Object.assign(sessionStorage, next); }),61+          remove: vi.fn(async (keys: string | string[]) => {62+            const list = Array.isArray(keys) ? keys : [keys];63+            for (const key of list) delete sessionStorage[key];64+          }),65+          clear: vi.fn(async () => { for (const k of Object.keys(sessionStorage)) delete sessionStorage[k]; }),66+        },67+      },68+      alarms: {69+        clear: vi.fn(), create: vi.fn(),70+        onAlarm: { addListener: vi.fn() },71+      },72+      idle: {73+        setDetectionInterval: vi.fn(),74+        onStateChanged: { addListener: vi.fn() },75+      },76+      scripting: { executeScript: vi.fn(async () => []) },77+    } as unknown as typeof chrome;78+79+    (globalThis as { chrome?: typeof chrome }).chrome = chromeMock;80+81+    const messages = await import('./messages');82+    messages.setupMessageHandler();83+    const vault = await import('./vault');84+    await vault.ensureSettingsLoaded();85+  });86+87+  async function dispatch(message: Message): Promise<MessageResponse> {88+    return new Promise<MessageResponse>((resolve) => {89+      const keepOpen = listener(message, { id: 'peach-extension' }, resolve);90+      expect(keepOpen).toBe(true);91+    });92+  }93+94+  async function setupUnlockedVault(): Promise<void> {95+    const vault = await import('./vault');96+    await vault.createVault('test-pass-12345');97+  }98+99+  async function lockVault(): Promise<void> {100+    const vault = await import('./vault');101+    vault.lock();102+  }103+104+  async function mockNoPro(): Promise<void> {105+    const license = await import('./license');106+    vi.spyOn(license, 'isProUser').mockResolvedValue(false);107+  }108+109+  describe('GET_RECOVERY_WORDS handler', () => {110+    beforeEach(async () => { await setupUnlockedVault(); });111+112+    it('returns 12 words', async () => {113+      const result = await dispatch({ type: 'GET_RECOVERY_WORDS' });114+      expect(result.ok).toBe(true);115+      const words = (result as { data: string[] }).data;116+      expect(words).toHaveLength(12);117+    });118+119+    it('all words are from the BIP39 word list', async () => {120+      const result = await dispatch({ type: 'GET_RECOVERY_WORDS' });121+      const words = (result as { data: string[] }).data;122+      for (const word of words) {123+        expect(WORD_LIST).toContain(word);124+      }125+    });126+127+    it('returns same words on subsequent calls (deterministic)', async () => {128+      const r1 = await dispatch({ type: 'GET_RECOVERY_WORDS' });129+      const r2 = await dispatch({ type: 'GET_RECOVERY_WORDS' });130+      expect((r1 as { data: string[] }).data).toEqual((r2 as { data: string[] }).data);131+    });132+133+    it('returns error when vault is locked', async () => {134+      await lockVault();135+      const result = await dispatch({ type: 'GET_RECOVERY_WORDS' });136+      expect(result.ok).toBe(false);137+    });138+  });139+140+  describe('VALIDATE_RECOVERY_WORDS handler', () => {141+    beforeEach(async () => { await setupUnlockedVault(); });142+143+    it('returns no invalid words for correct list', async () => {144+      const r = await dispatch({ type: 'GET_RECOVERY_WORDS' });145+      const words = (r as { data: string[] }).data;146+      const result = await dispatch({147+        type: 'VALIDATE_RECOVERY_WORDS',148+        payload: { words },149+      });150+      const data = (result as { data: { invalid: Array<{ index: number; word: string }> } }).data;151+      expect(data.invalid).toEqual([]);152+    });153+154+    it('returns invalid words for unknown words', async () => {155+      const result = await dispatch({156+        type: 'VALIDATE_RECOVERY_WORDS',157+        payload: { words: ['notaword', 'alsonotaword'] },158+      });159+      const data = (result as { data: { invalid: Array<{ index: number; word: string }> } }).data;160+      const invalidWords = data.invalid.map((x) => x.word);161+      expect(invalidWords).toContain('notaword');162+      expect(invalidWords).toContain('alsonotaword');163+    });164+165+    it('is case-insensitive for validation', async () => {166+      const r = await dispatch({ type: 'GET_RECOVERY_WORDS' });167+      const words = (r as { data: string[] }).data;168+      const uppercased = words.map((w: string) => w.toUpperCase());169+      const result = await dispatch({170+        type: 'VALIDATE_RECOVERY_WORDS',171+        payload: { words: uppercased },172+      });173+      const data = (result as { data: { invalid: Array<{ index: number; word: string }> } }).data;174+      expect(data.invalid).toEqual([]);175+    });176+  });177+178+  describe('RECOVER_WITH_WORDS handler', () => {179+    it('recovery succeeds with correct words and new passphrase', async () => {180+      await setupUnlockedVault();181+      const r = await dispatch({ type: 'GET_RECOVERY_WORDS' });182+      const words = (r as { data: string[] }).data;183+      await lockVault();184+185+      const result = await dispatch({186+        type: 'RECOVER_WITH_WORDS',187+        payload: { words, newPassword: 'new-passphrase' },188+      });189+      expect(result.ok).toBe(true);190+      const unlocked = await dispatch({ type: 'IS_UNLOCKED' });191+      expect((unlocked as { data: boolean }).data).toBe(true);192+    });193+194+    it('fails with wrong recovery words', async () => {195+      await setupUnlockedVault();196+      await lockVault();197+      const fakeWords = Array(12).fill('abandon');198+      const result = await dispatch({199+        type: 'RECOVER_WITH_WORDS',200+        payload: { words: fakeWords, newPassword: 'new-pass' },201+      });202+      expect(result.ok).toBe(false);203+      expect((result as { error: string }).error).toMatch(/invalid/);204+    });205+206+    it('fails with partial word list (fewer than 12)', async () => {207+      await setupUnlockedVault();208+      const r = await dispatch({ type: 'GET_RECOVERY_WORDS' });209+      const words = (r as { data: string[] }).data;210+      await lockVault();211+      const partial = words.slice(0, 6);212+      const result = await dispatch({213+        type: 'RECOVER_WITH_WORDS',214+        payload: { words: partial, newPassword: 'new-pass' },215+      });216+      expect(result.ok).toBe(false);217+    });218+219+    it('new passphrase works after recovery', async () => {220+      await setupUnlockedVault();221+      const r = await dispatch({ type: 'GET_RECOVERY_WORDS' });222+      const words = (r as { data: string[] }).data;223+      await lockVault();224+      await dispatch({225+        type: 'RECOVER_WITH_WORDS',226+        payload: { words, newPassword: 'brand-new-password' },227+      });228+      await lockVault();229+      const unlock = await dispatch({230+        type: 'UNLOCK',231+        payload: { password: 'brand-new-password' },232+      });233+      expect(unlock.ok).toBe(true);234+    });235+236+    it('old passphrase does not work after recovery', async () => {237+      await setupUnlockedVault();238+      const r = await dispatch({ type: 'GET_RECOVERY_WORDS' });239+      const words = (r as { data: string[] }).data;240+      await lockVault();241+      await dispatch({242+        type: 'RECOVER_WITH_WORDS',243+        payload: { words, newPassword: 'brand-new-password' },244+      });245+      await lockVault();246+      const unlock = await dispatch({247+        type: 'UNLOCK',248+        payload: { password: 'test-pass-12345' },249+      });250+      expect(unlock.ok).toBe(false);251+    });252+253+    it('fresh recovery words are generated after password change', async () => {254+      await setupUnlockedVault();255+      const before = (await dispatch({ type: 'GET_RECOVERY_WORDS' }) as { data: string[] }).data;256+      await dispatch({257+        type: 'CHANGE_PASSWORD',258+        payload: { currentPassword: 'test-pass-12345', newPassword: 'new-pass-67890' },259+      });260+      const after = (await dispatch({ type: 'GET_RECOVERY_WORDS' }) as { data: string[] }).data;261+      expect(after).not.toEqual(before);262+    });263+264+    it('recovery is not Pro-gated', async () => {265+      await setupUnlockedVault();266+      await mockNoPro();267+      const r = await dispatch({ type: 'GET_RECOVERY_WORDS' });268+      const words = (r as { data: string[] }).data;269+      await lockVault();270+      const result = await dispatch({271+        type: 'RECOVER_WITH_WORDS',272+        payload: { words, newPassword: 'new-pass' },273+      });274+      expect((result as { error?: string }).error ?? '').not.toMatch(/pro_required/);275+    });276+  });277+});

@@ -0,0 +1,177 @@1+import { describe, it, expect, beforeEach } from 'vitest';2+import { vi } from 'vitest';3+4+import type { Message, MessageResponse } from '../shared/types';5+6+type StorageShape = Record<string, unknown>;7+type MessageListener = (8+  msg: unknown,9+  sender: chrome.runtime.MessageSender,10+  sendResponse: (response: MessageResponse) => void11+) => boolean;12+13+describe('hasPaired flag', () => {14+  let storage: StorageShape;15+16+  function installChromeMock(s: StorageShape): void {17+    const chromeMock = {18+      storage: {19+        local: {20+          get: vi.fn(async (key?: string | string[]) => {21+            if (!key) return s;22+            if (typeof key === 'string') return { [key]: s[key] };23+            return key.reduce<Record<string, unknown>>((acc, k) => { acc[k] = s[k]; return acc; }, {});24+          }),25+          set: vi.fn(async (next: Record<string, unknown>) => { Object.assign(s, next); }),26+          remove: vi.fn(async (keys: string | string[]) => {27+            const list = Array.isArray(keys) ? keys : [keys];28+            for (const key of list) delete s[key];29+          }),30+        },31+      },32+    } as unknown as typeof chrome;33+    (globalThis as { chrome?: typeof chrome }).chrome = chromeMock;34+  }35+36+  beforeEach(async () => {37+    vi.resetModules();38+    storage = {};39+    installChromeMock(storage);40+  });41+42+  async function clearStorage(): Promise<void> {43+    for (const key of Object.keys(storage)) delete storage[key];44+  }45+46+  it('getHasPaired returns false when never paired', async () => {47+    await clearStorage();48+    const { getHasPaired } = await import('./sync-storage');49+    const result = await getHasPaired();50+    expect(result).toBe(false);51+  });52+53+  it('setHasPaired persists across calls', async () => {54+    const { setHasPaired, getHasPaired } = await import('./sync-storage');55+    await setHasPaired();56+    const result = await getHasPaired();57+    expect(result).toBe(true);58+  });59+60+  it('hasPaired remains true after multiple calls to setHasPaired', async () => {61+    const { setHasPaired, getHasPaired } = await import('./sync-storage');62+    await setHasPaired();63+    await setHasPaired(); // idempotent64+    const result = await getHasPaired();65+    expect(result).toBe(true);66+  });67+});68+69+describe('PAIRING_COMPLETED handler', () => {70+  let storage: StorageShape;71+  let sessionStorage: StorageShape;72+  let listener: MessageListener;73+74+  beforeEach(async () => {75+    vi.resetModules();76+    vi.useRealTimers();77+    storage = { peach_settings: { breachMonitoring: false } };78+    sessionStorage = {};79+80+    vi.stubGlobal('fetch', vi.fn(async () => ({ ok: true, status: 200, text: async () => '' })));81+    vi.stubGlobal('__PEACH_E2E_PASSKEYS__', false);82+83+    const chromeMock = {84+      runtime: {85+        id: 'peach-extension',86+        onMessage: { addListener: vi.fn((fn: MessageListener) => { listener = fn; }) },87+        sendMessage: vi.fn(async () => ({ ok: true })),88+      },89+      tabs: {90+        query: vi.fn((_, cb?: (tabs: unknown[]) => void) => {91+          if (typeof cb === 'function') { cb([{ id: 1 }]); return; }92+          return Promise.resolve([{ id: 1 }]);93+        }),94+        sendMessage: vi.fn(async () => ({ ok: true })),95+      },96+      storage: {97+        local: {98+          get: vi.fn(async (key?: string | string[]) => {99+            if (!key) return storage;100+            if (typeof key === 'string') return { [key]: storage[key] };101+            return key.reduce<Record<string, unknown>>((acc, k) => { acc[k] = storage[k]; return acc; }, {});102+          }),103+          set: vi.fn(async (next: Record<string, unknown>) => { Object.assign(storage, next); }),104+          remove: vi.fn(async (keys: string | string[]) => {105+            const list = Array.isArray(keys) ? keys : [keys];106+            for (const key of list) delete storage[key];107+          }),108+        },109+        session: {110+          get: vi.fn(async (key?: string | string[]) => {111+            if (!key) return sessionStorage;112+            if (typeof key === 'string') return { [key]: sessionStorage[key] };113+            return key.reduce<Record<string, unknown>>((acc, k) => { acc[k] = sessionStorage[k]; return acc; }, {});114+          }),115+          set: vi.fn(async (next: Record<string, unknown>) => { Object.assign(sessionStorage, next); }),116+          remove: vi.fn(async (keys: string | string[]) => {117+            const list = Array.isArray(keys) ? keys : [keys];118+            for (const key of list) delete sessionStorage[key];119+          }),120+          clear: vi.fn(async () => { for (const k of Object.keys(sessionStorage)) delete sessionStorage[k]; }),121+        },122+      },123+      alarms: {124+        clear: vi.fn(), create: vi.fn(),125+        onAlarm: { addListener: vi.fn() },126+      },127+      idle: {128+        setDetectionInterval: vi.fn(),129+        onStateChanged: { addListener: vi.fn() },130+      },131+      scripting: { executeScript: vi.fn(async () => []) },132+    } as unknown as typeof chrome;133+134+    (globalThis as { chrome?: typeof chrome }).chrome = chromeMock;135+136+    const messages = await import('./messages');137+    messages.setupMessageHandler();138+    const vault = await import('./vault');139+    await vault.ensureSettingsLoaded();140+  });141+142+  async function dispatch(message: Message): Promise<MessageResponse> {143+    return new Promise<MessageResponse>((resolve) => {144+      const keepOpen = listener(message, { id: 'peach-extension' }, resolve);145+      expect(keepOpen).toBe(true);146+    });147+  }148+149+  it('flag is set when PAIRING_COMPLETED fires', async () => {150+    await dispatch({151+      type: 'PAIRING_COMPLETED',152+      payload: {153+        deviceName: 'iPhone',154+        publicKeyHex: 'abc123',155+        deviceIp: '192.168.1.50',156+      },157+    });158+    const { getHasPaired } = await import('./sync-storage');159+    const paired = await getHasPaired();160+    expect(paired).toBe(true);161+  });162+163+  it('PAIRING_COMPLETED stores device with lastKnownIp and deviceName', async () => {164+    await dispatch({165+      type: 'PAIRING_COMPLETED',166+      payload: {167+        deviceName: 'iPhone',168+        publicKeyHex: 'abc123',169+        deviceIp: '192.168.1.50',170+      },171+    });172+    const { getPairedDevices } = await import('./sync-storage');173+    const devices = await getPairedDevices();174+    expect(devices[0].lastKnownIp).toBe('192.168.1.50');175+    expect(devices[0].displayName).toBe('iPhone');176+  });177+});

@@ -0,0 +1,169 @@1+import { describe, it, expect, beforeEach } from 'vitest';2+import { vi } from 'vitest';3+4+import type { Message, MessageResponse } from '../shared/types';5+6+type StorageShape = Record<string, unknown>;7+type MessageListener = (8+  msg: unknown,9+  sender: chrome.runtime.MessageSender,10+  sendResponse: (response: MessageResponse) => void11+) => boolean;12+13+describe('sync Pro gating', () => {14+  let storage: StorageShape;15+  let sessionStorage: StorageShape;16+  let listener: MessageListener;17+18+  beforeEach(async () => {19+    vi.resetModules();20+    vi.useRealTimers();21+    storage = { peach_settings: { breachMonitoring: false } };22+    sessionStorage = {};23+24+    vi.stubGlobal('fetch', vi.fn(async () => ({ ok: true, status: 200, text: async () => '' })));25+    vi.stubGlobal('__PEACH_E2E_PASSKEYS__', false);26+    // Default: desktop (no Capacitor)27+    (globalThis as Record<string, unknown>).Capacitor = undefined;28+29+    const chromeMock = {30+      runtime: {31+        id: 'peach-extension',32+        onMessage: { addListener: vi.fn((fn: MessageListener) => { listener = fn; }) },33+        sendMessage: vi.fn(async () => ({ ok: true })),34+      },35+      tabs: {36+        query: vi.fn((_, cb?: (tabs: unknown[]) => void) => {37+          if (typeof cb === 'function') { cb([{ id: 1 }]); return; }38+          return Promise.resolve([{ id: 1 }]);39+        }),40+        sendMessage: vi.fn(async () => ({ ok: true })),41+      },42+      storage: {43+        local: {44+          get: vi.fn(async (key?: string | string[]) => {45+            if (!key) return storage;46+            if (typeof key === 'string') return { [key]: storage[key] };47+            return key.reduce<Record<string, unknown>>((acc, k) => { acc[k] = storage[k]; return acc; }, {});48+          }),49+          set: vi.fn(async (next: Record<string, unknown>) => { Object.assign(storage, next); }),50+          remove: vi.fn(async (keys: string | string[]) => {51+            const list = Array.isArray(keys) ? keys : [keys];52+            for (const key of list) delete storage[key];53+          }),54+        },55+        session: {56+          get: vi.fn(async (key?: string | string[]) => {57+            if (!key) return sessionStorage;58+            if (typeof key === 'string') return { [key]: sessionStorage[key] };59+            return key.reduce<Record<string, unknown>>((acc, k) => { acc[k] = sessionStorage[k]; return acc; }, {});60+          }),61+          set: vi.fn(async (next: Record<string, unknown>) => { Object.assign(sessionStorage, next); }),62+          remove: vi.fn(async (keys: string | string[]) => {63+            const list = Array.isArray(keys) ? keys : [keys];64+            for (const key of list) delete sessionStorage[key];65+          }),66+          clear: vi.fn(async () => { for (const k of Object.keys(sessionStorage)) delete sessionStorage[k]; }),67+        },68+      },69+      alarms: {70+        clear: vi.fn(), create: vi.fn(),71+        onAlarm: { addListener: vi.fn() },72+      },73+      idle: {74+        setDetectionInterval: vi.fn(),75+        onStateChanged: { addListener: vi.fn() },76+      },77+      scripting: { executeScript: vi.fn(async () => []) },78+    } as unknown as typeof chrome;79+80+    (globalThis as { chrome?: typeof chrome }).chrome = chromeMock;81+82+    const messages = await import('./messages');83+    messages.setupMessageHandler();84+    const vault = await import('./vault');85+    await vault.ensureSettingsLoaded();86+  });87+88+  async function dispatch(message: Message): Promise<MessageResponse> {89+    return new Promise<MessageResponse>((resolve) => {90+      const keepOpen = listener(message, { id: 'peach-extension' }, resolve);91+      expect(keepOpen).toBe(true);92+    });93+  }94+95+  async function mockNoPro(): Promise<void> {96+    const license = await import('./license');97+    vi.spyOn(license, 'isProUser').mockResolvedValue(false);98+  }99+100+  async function mockPro(): Promise<void> {101+    const license = await import('./license');102+    vi.spyOn(license, 'isProUser').mockResolvedValue(true);103+  }104+105+  function mockDesktop(): void {106+    (globalThis as Record<string, unknown>).Capacitor = undefined;107+  }108+109+  function mockNative(): void {110+    (globalThis as Record<string, unknown>).Capacitor = { isNativePlatform: () => true };111+  }112+113+  describe('pairing initiation — free', () => {114+    it('START_PAIRING_SERVER succeeds without Pro', async () => {115+      await mockNoPro();116+      mockDesktop();117+      const result = await dispatch({ type: 'START_PAIRING_SERVER' });118+      expect((result as { error?: string }).error ?? '').not.toMatch(/pro_required/);119+    });120+121+    it('ACCEPT_PAIRING succeeds without Pro', async () => {122+      await mockNoPro();123+      const result = await dispatch({124+        type: 'ACCEPT_PAIRING',125+        payload: { token: 'test-token' },126+      });127+      expect((result as { error?: string }).error ?? '').not.toMatch(/pro_required/);128+    });129+130+    it('SCAN_PAIRING_QR does not return pro_required (returns android_only on desktop)', async () => {131+      await mockNoPro();132+      mockDesktop();133+      const result = await dispatch({134+        type: 'SCAN_PAIRING_QR',135+        payload: { token: '123456' },136+      });137+      expect((result as { error?: string }).error ?? '').not.toMatch(/pro_required/);138+    });139+  });140+141+  describe('ongoing sync — Pro required', () => {142+    it('TRIGGER_SYNC is Pro-gated on desktop', async () => {143+      await mockNoPro();144+      mockDesktop();145+      const result = await dispatch({ type: 'TRIGGER_SYNC' });146+      expect(result.ok).toBe(false);147+      expect((result as { error: string }).error).toMatch(/pro_required/);148+    });149+150+    it('TRIGGER_SYNC with Pro on desktop does not return pro_required', async () => {151+      await mockPro();152+      mockDesktop();153+      const vault = await import('./vault');154+      await vault.createVault('test-pass-12345');155+      const result = await dispatch({ type: 'TRIGGER_SYNC' });156+      expect((result as { error?: string }).error ?? '').not.toMatch(/pro_required/);157+    });158+159+    it('TRIGGER_SYNC with Pro on native succeeds', async () => {160+      await mockPro();161+      mockNative();162+      const vault = await import('./vault');163+      await vault.createVault('test-pass-12345');164+      const result = await dispatch({ type: 'TRIGGER_SYNC' });165+      expect(result.ok).toBe(true);166+      expect((result as { data: { mode: string } }).data?.mode).toBe('server');167+    });168+  });169+});