rclone/docs/plans/001-protondrive-tier1-workspace/task-21g-brief.md

Task 21g: Golden fixtures from real Proton clients, re-keyed (owner chose option 2)

Part of plan Task 21 ("Capture golden fixtures from the account (nodes created by the web app and by Proton's official CLI) into testdata/golden/ with a -capture test flag, and add TestGoldenFixtures"), with the owner's decision of 2026-11-12:

Re-encrypt the captured files under keys generated only for the tests, keeping the real format but carrying no secret from the account.

Files (expected; adjust if the code says otherwise):

• Create: backend/protondrive/golden_internal_test.go (capture + test)
• Create: backend/protondrive/testdata/golden/ (fixtures, written only by the controller's live capture run; the implementer commits the code and, for its own testing, fixtures captured from the FAKE into a temp dir - never commit fake-captured fixtures as golden ones)
• Modify: docs/TODO.md, docs/DECISIONS.md (one entry: what is preserved and what is replaced)

What the capture does (go test ./backend/protondrive/ -run TestGoldenCapture -capture DIR -remote NAME:PATH):

1. Signs in through the normal backend code path (the remote's saved session), walks PATH (a folder made by another client), and for each folder and file node fetches what the client fetches: link/node JSON, node key and passphrase, name, hash key, xattrs, revision, block list and blocks (cap: 3 files, 16 MiB total per file; skip anything bigger).
2. In memory, re-keys everything onto freshly generated test keys (a test user key, test address key, and new node keys of the same algorithm and packet version as the originals):
   • Keep every SEIPD/AEAD data packet byte-for-byte (block contents, encrypted names, xattrs, hash keys): only re-wrap their session keys (PKESK packets) to the corresponding test key.
   • Signatures made by the account's address key must be re-made by the test address key (same signature version, hash and algorithm, same signed data). Record in the fixture which signatures were re-made.
   • Manifest signature re-made over the unchanged block hashes.
3. Sanitises: replace every ID (volume, share, link, revision, block, address, key) with stable placeholders, every email with golden@example.invalid, drop block URLs and tokens. Keep timestamps, sizes, flags, MIME types, block sizes and whether block sizes are recorded.
4. Writes to DIR: one JSON fixture per node set plus the test keys' ARMORED PRIVATE keys and their passphrase (these are test-only keys, so committing them is fine). Never writes the account's keys, passphrases, salted key pass, session tokens or any plaintext beyond what the test needs (file contents are random test data chosen by the controller).
5. Prints a summary listing each node, its original creator client (from the node's signature email domain is NOT enough - take it from a -capture-label flag), sizes, and which packets were re-wrapped or re-signed.

TestGoldenFixtures: loads every fixture in testdata/golden/ into the in-process fake (protontest) as if served by Proton, then reads every file through the real backend (Fs/Object, not internals) with ignore_signature_errors false: full read, a ranged read starting in a later block, listing, names decrypted, sizes and SHA1 match the fixture's expected values. Skips (not fails) when the directory has no fixtures.

Constraints:

• The implementer NEVER talks to Proton. Develop and test capture against the fake: seed the fake with files written in other shapes (e.g. SeedFileInBlocks, unrecorded block sizes), capture into a temp dir, then load with TestGoldenFixtures' loader and read back. A test must prove the round trip (capture from fake -> fixture -> load -> read identical bytes) and that the output contains none of the original account's key material, IDs or emails (search the written files for the fake account's email, IDs, armored key blocks and salted key pass).
• -capture without -remote must fail clearly; without -capture the capture test skips.
• No new dependencies. Comment style per AGENTS.md.
• Commit: protondrive: test against re-keyed files written by Proton's own clients.