');$settings->Environment=$this->environment;$settings->MfaKeyFile=$this->file;return $settings; } } $old=getenv('HCR_MFA_KEY');$oldFile=getenv('HCR_MFA_KEY_FILE');putenv('HCR_MFA_KEY');putenv('HCR_MFA_KEY_FILE');$checks=0;$file=tempnam(sys_get_temp_dir(),'hcr-mfa-key-');$inside=__DIR__.'/.local/key-path-test-'.bin2hex(random_bytes(6)); function keyCheck(bool $ok,string $message):void{global $checks;if(!$ok)throw new RuntimeException($message);$checks++;echo "PASS: $message\n";} function keyDenied(callable $work,string $message):void{try{$work();}catch(RuntimeException $e){keyCheck(true,$message);return;}throw new LogicException($message.' was allowed');} try{ $service=new FileKeyMfa();$service->file=$file;file_put_contents($file,base64_encode(random_bytes(32))); keyCheck($service->sealSecret('test',1)!=='','Development loads a persistent key outside the application'); $service->file=$file.'.missing';putenv('HCR_MFA_KEY_FILE='.$file); keyCheck($service->sealSecret('test',1)!=='','Server key-file configuration overrides workstation settings'); $service->environment='Production';keyDenied(fn()=>$service->sealSecret('test',1),'Production cannot use the development key-file fallback'); putenv('HCR_MFA_KEY_FILE');$service->file=$file; putenv('HCR_MFA_KEY='.base64_encode(random_bytes(32)));keyCheck($service->sealSecret('test',1)!=='','Explicit production environment key remains supported'); putenv('HCR_MFA_KEY=invalid');$service->environment='Development';keyDenied(fn()=>$service->sealSecret('test',1),'Invalid explicit key is not silently replaced by a file');putenv('HCR_MFA_KEY'); if(!is_dir(dirname($inside)))mkdir(dirname($inside),0700,true);file_put_contents($inside,base64_encode(random_bytes(32)));$service->file=$inside; keyDenied(fn()=>$service->sealSecret('test',1),'Development key inside the application tree is rejected'); $service->file=$file;file_put_contents($file,str_repeat('A',129));keyDenied(fn()=>$service->sealSecret('test',1),'Oversized key file is rejected'); file_put_contents($file,'invalid');keyDenied(fn()=>$service->sealSecret('test',1),'Malformed file key is rejected'); $service->file=$file.'.missing';keyDenied(fn()=>$service->sealSecret('test',1),'Missing development key file is rejected'); echo "$checks MFA key configuration checks passed.\n"; }finally{ if(is_file($file))unlink($file);if(is_file($inside))unlink($inside); if($old===false)putenv('HCR_MFA_KEY');else putenv('HCR_MFA_KEY='.$old); if($oldFile===false)putenv('HCR_MFA_KEY_FILE');else putenv('HCR_MFA_KEY_FILE='.$oldFile); }