Implement iPhone and Apple Watch preferences (#53)

crates/storage/tests/secret_store.rs

@@ -11,7 +11,7 @@ use std::{
 };
 
 use ironstorage::{
-    config::ConfigLoader,
+    config::{ConfigLoader, GitRemote},
     crypto::{CryptoError, KeyInfo, KeyStore, SecretProvider as _, SecretProviderError},
     git::{GitCredentialProvider as _, GitError},
     repository::{EncryptedEntry, SecretBytes},
@@ -325,6 +325,40 @@ fn bounded_cache_is_cleared_by_lock_and_never_aliases_git_accounts() -> TestResu
     Ok(())
 }
 
+#[test]
+fn git_account_status_and_removal_never_expose_the_token() -> TestResult {
+    let backend = MemoryBackend::default();
+    let store = SecretStore::new(
+        backend,
+        SecretCachePolicy::Disabled,
+        SecretProtectionPolicy::device_unlocked(),
+    );
+    let remote = GitRemote::https(
+        "origin",
+        "https://git.example.test/alice/store.git",
+        "personal-git",
+        "ironstorage-mobile",
+    )?;
+    store.unlock()?;
+    store.store_https_git_credential(
+        remote.server_id(),
+        remote.application_id(),
+        "alice",
+        SecretBytes::new(b"private-token".to_vec()),
+    )?;
+    assert_eq!(
+        store.https_git_credential_account(remote.server_id(), remote.application_id())?,
+        "alice"
+    );
+    store.delete_https_git_credential(remote.server_id(), remote.application_id())?;
+    assert!(matches!(
+        store.https_git_credential_account(remote.server_id(), remote.application_id()),
+        Err(SecretStoreError::Missing)
+    ));
+    assert!(!format!("{store:?}").contains("private-token"));
+    Ok(())
+}
+
 #[test]
 fn one_unlocked_provider_supplies_openpgp_and_https_git_secrets() -> TestResult {
     let fixture = FixtureSet::load()?;