[PATCH 3/3] auto-t: Test transient PSK agent secrets

Extend the PSK agent test helper to implement
RequestPassphraseWithOptions and add coverage for Store=false. The test
verifies that IWD can use the agent-provided passphrase without writing
PSK secrets back to the profile.
---
 .../testEncryptedProfiles/connection_test.py  | 27 +++++++++++++++++++
 autotests/util/iwd.py                         | 14 +++++++++-
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/autotests/testEncryptedProfiles/connection_test.py b/autotests/testEncryptedProfiles/connection_test.py
index eb7fd7c5..17c5ff11 100644
--- a/autotests/testEncryptedProfiles/connection_test.py
+++ b/autotests/testEncryptedProfiles/connection_test.py
@@ -21,6 +21,17 @@ class Test(unittest.TestCase):
 
         return True
 
+    def profile_has_psk_secret(self, profile):
+        with open('/tmp/iwd/' + profile) as f:
+            contents = f.read()
+
+        return any(secret in contents for secret in [
+            'Passphrase',
+            'PreSharedKey',
+            'SAE-PT-Group19',
+            'SAE-PT-Group20',
+        ])
+
     def validate(self, wd):
         devices = wd.list_devices(1)
         device = devices[0]
@@ -80,6 +91,22 @@ class Test(unittest.TestCase):
 
         wd.unregister_psk_agent(psk_agent)
 
+    # Tests that an agent can request one-time use of a passphrase.
+    def test_agent_transient_profile(self):
+        wd = IWD(True)
+
+        psk_agent = PSKAgent("secret123", store=False)
+        wd.register_psk_agent(psk_agent)
+
+        with self.assertRaises(FileNotFoundError):
+            self.profile_has_psk_secret('ssidCCMP.psk')
+
+        self.validate(wd)
+
+        self.assertFalse(self.profile_has_psk_secret('ssidCCMP.psk'))
+
+        wd.unregister_psk_agent(psk_agent)
+
     # Tests that an invalid profile gets re-written after an agent request
     def test_invalid_profile_rewritten(self):
         bad_config = '[Security]\nPassphrase=incorrect\n'
diff --git a/autotests/util/iwd.py b/autotests/util/iwd.py
index 37eb4943..54096b01 100755
--- a/autotests/util/iwd.py
+++ b/autotests/util/iwd.py
@@ -1153,7 +1153,7 @@ agent_count = 0
 
 class PSKAgent(dbus.service.Object):
 
-    def __init__(self, passphrases=[], users=[], namespace=ctx):
+    def __init__(self, passphrases=[], users=[], namespace=ctx, store=True):
         global agent_count
 
         if type(passphrases) != list:
@@ -1162,6 +1162,7 @@ class PSKAgent(dbus.service.Object):
         if type(users) != list:
             users = [users]
         self.users = users
+        self.store = store
         self._path = '/test/agent/%s' % agent_count
         self._bus = dbus.bus.BusConnection(address_or_type=namespace.dbus_address)
 
@@ -1193,6 +1194,17 @@ class PSKAgent(dbus.service.Object):
 
         return self.passphrases.pop(0)
 
+    @dbus.service.method(IWD_AGENT_INTERFACE, in_signature='o',
+                                                        out_signature='sa{sv}')
+    def RequestPassphraseWithOptions(self, path):
+        print('Requested PSK with options for ' + path)
+
+        if not self.passphrases:
+            raise CanceledEx("canceled")
+
+        return (self.passphrases.pop(0),
+                {'Store': dbus.Boolean(self.store, variant_level=1)})
+
     @dbus.service.method(IWD_AGENT_INTERFACE, in_signature='o',
                                                               out_signature='s')
     def RequestPrivateKeyPassphrase(self, path):
-- 
2.54.0