Testing: Verify credential environment precedence and isolation

[bcherrington]

Current gap

Environment tests cover several TimeLocker and Restic variables, XDG paths, master passwords, and password files, but the supported cross-source precedence contract is not proved consistently across repository operations.

Acceptance criteria

• Derive the supported precedence contract from Security: Reconcile the repository credential resolution contract #28 and document it once.
• Test per-repository storage, TIMELOCKER_PASSWORD, password-file configuration, and supported Restic fallback behavior.
• Verify an explicit TimeLocker source wins over a conflicting fallback source.
• Cover missing, empty, malformed, and non-interactive cases without exposing values.
• Isolate environment mutation in shared fixtures and prove cleanup between tests.
• Exercise representative backup, snapshot, restore, and repository commands.

[github-actions]

🔍 Triage Analysis

Issue Information:

• Issue Number: Testing: Verify credential environment precedence and isolation #56
• Repository: Auriora/TimeLocker
• Title: Testing: Add environment variable testing for TimeLocker preferences
• Author: @bcherrington
• Current Labels: enhancement, testing, cli, environment, configuration, area:testing, priority:medium, complexity:medium-high, auto-triaged

---

Priority Level: Medium 🟡

Rationale: This is a critical testing gap that affects user experience and system reliability, but it's not blocking core functionality. Environment variable handling is essential for proper TimeLocker behavior, especially for automated/scripted usage.

Issue Type: Task/Enhancement 📋

Rationale: This is a well-defined testing enhancement that adds comprehensive validation for existing functionality rather than fixing a bug or adding new features.

Complexity Estimate: Medium-High 🔧

Rationale:

• Requires comprehensive test design across multiple CLI commands
• Involves complex environment isolation and mocking strategies
• Needs integration with existing test infrastructure
• Must handle platform-specific XDG directory behaviors
• Estimated effort: 3-5 days for experienced developer

Suggested Labels Applied: ✅

• area:testing - Testing-related work
• priority:medium - Important but not urgent
• complexity:medium-high - Significant implementation effort
• auto-triaged - Processed by automated triage

Team/Component: 🎯

• Primary: Testing/QA team
• Secondary: CLI development team (for domain expertise)
• Component: CLI testing infrastructure, environment variable handling

Dependencies: 🔗

• Blocked by: Testing: Finish adoption of shared CLI test utilities #54 (Apply shared test utilities) - Must be completed first
• Blocked by: Testing: Replace ambiguous CLI exit-code assertions #55 (Specific exit code validation) - Required for proper error testing
• Builds on: Testing: Create comprehensive test suite for new CLI command structure #8 (CLI test suite implementation) - Foundation work
• Related to: User preferences documented in project memories

Reproducibility: N/A ✅

Rationale: This is a testing enhancement, not a bug report. The issue provides clear, actionable requirements.

Acceptance Criteria: Well-Defined ✅

Strengths:

• Comprehensive checklist with 9 specific criteria
• Clear technical requirements for each test category
• Specific environment variables and behaviors to test
• Integration requirements with existing test suite

Similar Issues: 🔍

• Related to other testing issues (Testing: Finish adoption of shared CLI test utilities #54, Testing: Replace ambiguous CLI exit-code assertions #55, Testing: Create comprehensive test suite for new CLI command structure #8) in the same testing improvement initiative
• Part of broader CLI testing enhancement effort
• No duplicate issues identified

---

📋 Recommendations

Next Steps:

1. Wait for dependencies - Ensure Testing: Finish adoption of shared CLI test utilities #54 and Testing: Replace ambiguous CLI exit-code assertions #55 are completed first
2. Assign to testing team - This requires testing expertise and CLI domain knowledge
3. Schedule for current sprint - Medium priority, well-defined scope
4. Review test strategy - Validate the proposed pytest fixture approach

Additional Information Needed: ❓

• None - Issue is comprehensively documented with clear implementation strategy

Potential Assignees: 👥

• Testing team members with CLI testing experience
• Developers familiar with pytest and environment variable handling
• Contributors who worked on issues Testing: Create comprehensive test suite for new CLI command structure #8, Testing: Finish adoption of shared CLI test utilities #54, or Testing: Replace ambiguous CLI exit-code assertions #55

Immediate Actions: ⚡

• ✅ Labels applied - Proper categorization complete
• ⏳ Monitor dependencies - Track completion of Testing: Finish adoption of shared CLI test utilities #54 and Testing: Replace ambiguous CLI exit-code assertions #55
• 📅 Sprint planning - Include in next testing sprint

---

💡 Technical Notes

Implementation Highlights:

• Excellent use of pytest fixtures for environment isolation
• Comprehensive coverage of TimeLocker-specific preferences
• Good integration strategy with existing test utilities
• Platform-independent approach with XDG directory testing

Risk Assessment: 🛡️

• Low risk - Pure testing enhancement, no production code changes
• High value - Prevents regressions in critical user-facing behavior
• Good ROI - Comprehensive test coverage for relatively focused effort

Quality Indicators: ⭐

• Well-structured issue with clear sections
• Comprehensive acceptance criteria
• Detailed implementation strategy
• Proper dependency management
• Security-conscious approach (password handling)

---

Triage Status: ✅ Complete
Recommended Action: Approve for development once dependencies are resolved
Estimated Timeline: 1-2 weeks (including dependency resolution)

[bcherrington]

Reconciled on 2026-07-18. Retained and narrowed to the current credential precedence contract; obsolete blanket assumptions were removed.