Refine VPN installer and menu-bar app integration

2026-06-24 23:15:38 +03:00
parent 2acf5dd50b
commit fdb15ae462
6 changed files with 1126 additions and 228 deletions
--- a/tests/smoke.sh
+++ b/tests/smoke.sh
@@ -15,13 +15,18 @@ output="$(cd "$ROOT" && sh install.sh --dry-run --non-interactive --minimal)"

 printf '%s\n' "$output" | grep -q 'Detected state:'
 printf '%s\n' "$output" | grep -q 'Interactive prompts: off'
-printf '%s\n' "$output" | grep -q 'Modules: credential_source=keychain bitwarden=0 touchid=0 sudoers=1 shell=1 app=1 autostart=1'
+printf '%s\n' "$output" | grep -q 'Modules: auth_profile=manual credential_source=none bitwarden=0 touchid=0 sudoers=1 shell=1 app=1 autostart=1'
 printf '%s\n' "$output" | grep -q 'Проверяю Homebrew-зависимости'
 printf '%s\n' "$output" | grep -q 'Swift build может занять минуту'
 printf '%s\n' "$output" | grep -q 'sudo install -d -m 755 -o root -g wheel /usr/local/sbin'
 printf '%s\n' "$output" | grep -q 'swift build -c release --package-path'
 printf '%s\n' "$output" | grep -q 'launchctl load'
 printf '%s\n' "$output" | grep -q 'restart LemanaVPN.app if running'
+printf '%s\n' "$output" | grep -q '+ cp .*/bin/vpn-lemanapro.sh '
+if printf '%s\n' "$output" | grep -q 'curl -fsSL .*raw/branch/main'; then
+  echo "checkout install dry-run should use local files, not remote main" >&2
+  exit 1
+fi

 esc="$(printf '\033')"
 if printf '%s\n' "$output" | grep -q "$esc"; then
@@ -33,34 +38,130 @@ if command -v expect >/dev/null 2>&1; then
  interactive_output="$(
    ROOT="$ROOT" expect <<'EXPECT'
 set timeout 30
-spawn sh $env(ROOT)/install.sh --dry-run --interactive --without-app --no-shell --no-sudoers
-expect "Как хранить VPN credentials?"
-expect "Выбор"
-send "2\r"
-expect eof
+    spawn sh $env(ROOT)/install.sh --dry-run --interactive --without-app --no-shell --no-sudoers
+    expect "Как подключаться по умолчанию?"
+    expect "Выбор"
+    send "\r"
+    expect "Сохранить логин и пароль"
+    send "y\r"
+    expect eof
 EXPECT
  )"

-  printf '%s\n' "$interactive_output" | grep -q 'Как хранить VPN credentials?'
-  printf '%s\n' "$interactive_output" | grep -q '1) Bitwarden'
-  printf '%s\n' "$interactive_output" | grep -q '2) macOS Keychain: ввести LDAP password и TOTP seed сейчас'
-  printf '%s\n' "$interactive_output" | grep -q '3) macOS Keychain: настрою вручную позже'
-  printf '%s\n' "$interactive_output" | grep -q 'Modules: credential_source=keychain bitwarden=0 touchid=0 sudoers=0 shell=0 app=0 autostart=0'
-  printf '%s\n' "$interactive_output" | grep -q "vpn-lemanapro.sh --configure-keychain"
+  printf '%s\n' "$interactive_output" | grep -q 'По умолчанию ничего не сохраняется'
+  printf '%s\n' "$interactive_output" | grep -q 'Как подключаться по умолчанию?'
+  printf '%s\n' "$interactive_output" | grep -q '1) Вводить всё вручную'
+  printf '%s\n' "$interactive_output" | grep -q '2) Запомнить логин и пароль'
+  printf '%s\n' "$interactive_output" | grep -q '3) Настроить автоматический вход'
+  printf '%s\n' "$interactive_output" | grep -q 'Сохранить логин и пароль в macOS Keychain для подстановки при входе?'
+  printf '%s\n' "$interactive_output" | grep -q 'Выбран режим: сохранить логин и пароль, одноразовый код вводить вручную'
+  printf '%s\n' "$interactive_output" | grep -q '+ .*/vpn-lemanapro.sh --configure-login'
+  if printf '%s\n' "$interactive_output" | grep -Eq 'credential_source|auth_profile|TOTP seed'; then
+    echo "basic interactive wizard should not expose technical credential wording" >&2
+    exit 1
+  fi
 fi

 status_json="$(bash "$ROOT/bin/vpn-lemanapro.sh" --status --json)"
 printf '%s\n' "$status_json" | grep -q '"modules":'
 printf '%s\n' "$status_json" | grep -q '"app":'
+printf '%s\n' "$status_json" | grep -q '"app_menu":{"install_label":"Режим: полностью вручную","configured_mode":"manual","available_modes":\["configured"\],"setup_hint":null}'

 keychain_status_json="$(LEMANA_VPN_CREDENTIAL_SOURCE=keychain bash "$ROOT/bin/vpn-lemanapro.sh" --status --json)"
-printf '%s\n' "$keychain_status_json" | grep -q '"credentials":{"source":"keychain","keychain_ready":false}'
+printf '%s\n' "$keychain_status_json" | grep -q '"credentials":{"source":"keychain","auth_profile":"manual","login_ready":false,"keychain_ready":false}'
 printf '%s\n' "$keychain_status_json" | grep -q '"bitwarden":{"enabled":false'
 printf '%s\n' "$keychain_status_json" | grep -q '"touchid":{"enabled":false'

 bitwarden_status_json="$(LEMANA_VPN_CREDENTIAL_SOURCE=bitwarden bash "$ROOT/bin/vpn-lemanapro.sh" --status --json)"
-printf '%s\n' "$bitwarden_status_json" | grep -q '"credentials":{"source":"bitwarden","keychain_ready":false}'
+printf '%s\n' "$bitwarden_status_json" | grep -q '"credentials":{"source":"bitwarden","auth_profile":"manual","login_ready":false,"keychain_ready":false}'
 printf '%s\n' "$bitwarden_status_json" | grep -q '"bitwarden":{"enabled":true'
+
+status_password_bin="$TMP_DIR/status-password-bin"
+mkdir -p "$status_password_bin"
+cat > "$status_password_bin/security" <<'SH'
+#!/bin/sh
+if [ "${1:-}" = "find-generic-password" ]; then
+  account=""
+  while [ "$#" -gt 0 ]; do
+    if [ "$1" = "-a" ]; then
+      shift
+      account="${1:-}"
+      break
+    fi
+    shift
+  done
+  case "$account" in
+    ""|totp/*) exit 1 ;;
+    *) exit 0 ;;
+  esac
+fi
+exit 1
+SH
+chmod +x "$status_password_bin/security"
+
+status_full_bin="$TMP_DIR/status-full-bin"
+mkdir -p "$status_full_bin"
+cat > "$status_full_bin/security" <<'SH'
+#!/bin/sh
+if [ "${1:-}" = "find-generic-password" ]; then
+  account=""
+  while [ "$#" -gt 0 ]; do
+    if [ "$1" = "-a" ]; then
+      shift
+      account="${1:-}"
+      break
+    fi
+    shift
+  done
+  [ -n "$account" ]
+  exit $?
+fi
+exit 1
+SH
+chmod +x "$status_full_bin/security"
+
+saved_login_missing_status="$(
+  LEMANA_VPN_USERNAME="lemana-status-login-missing" \
+  LEMANA_VPN_AUTH_PROFILE=saved-login \
+  LEMANA_VPN_CREDENTIAL_SOURCE=keychain \
+    bash "$ROOT/bin/vpn-lemanapro.sh" --status --json
+)"
+printf '%s\n' "$saved_login_missing_status" | grep -q '"app_menu":{"install_label":"Режим: логин и пароль не настроены","configured_mode":"saved-login","available_modes":\["manual-full"\],"setup_hint":"Настройте в Terminal: vpn --configure-login"}'
+
+saved_login_ready_status="$(
+  PATH="$status_password_bin:$PATH" \
+  LEMANA_VPN_USERNAME="lemana-status-login-ready" \
+  LEMANA_VPN_AUTH_PROFILE=saved-login \
+  LEMANA_VPN_CREDENTIAL_SOURCE=keychain \
+    bash "$ROOT/bin/vpn-lemanapro.sh" --status --json
+)"
+printf '%s\n' "$saved_login_ready_status" | grep -q '"app_menu":{"install_label":"Режим: логин и пароль сохранены","configured_mode":"saved-login","available_modes":\["configured","manual-full"\],"setup_hint":null}'
+
+saved_totp_missing_status="$(
+  LEMANA_VPN_USERNAME="lemana-status-totp-missing" \
+  LEMANA_VPN_AUTH_PROFILE=saved-totp \
+  LEMANA_VPN_CREDENTIAL_SOURCE=keychain \
+    bash "$ROOT/bin/vpn-lemanapro.sh" --status --json
+)"
+printf '%s\n' "$saved_totp_missing_status" | grep -q '"app_menu":{"install_label":"Режим: сохранённые данные не настроены","configured_mode":"saved-totp","available_modes":\["manual-full"\],"setup_hint":"Настройте в Terminal: vpn --configure-keychain"}'
+
+saved_totp_ready_status="$(
+  PATH="$status_full_bin:$PATH" \
+  LEMANA_VPN_USERNAME="lemana-status-totp-ready" \
+  LEMANA_VPN_AUTH_PROFILE=saved-totp \
+  LEMANA_VPN_CREDENTIAL_SOURCE=keychain \
+    bash "$ROOT/bin/vpn-lemanapro.sh" --status --json
+)"
+printf '%s\n' "$saved_totp_ready_status" | grep -q '"app_menu":{"install_label":"Режим: сохранённые данные без автоотправки","configured_mode":"saved-totp","available_modes":\["configured","saved-login","manual-full","auto"\],"setup_hint":null}'
+
+auto_ready_status="$(
+  PATH="$status_full_bin:$PATH" \
+  LEMANA_VPN_USERNAME="lemana-status-auto-ready" \
+  LEMANA_VPN_AUTH_PROFILE=auto \
+  LEMANA_VPN_CREDENTIAL_SOURCE=keychain \
+    bash "$ROOT/bin/vpn-lemanapro.sh" --status --json
+)"
+printf '%s\n' "$auto_ready_status" | grep -q '"app_menu":{"install_label":"Режим: автоматический вход","configured_mode":"auto","available_modes":\["configured","saved-totp","saved-login","manual-full"\],"setup_hint":null}'
 personal_ldap='601''03293'
 if grep -R "$personal_ldap" "$ROOT/bin" "$ROOT/install.sh" "$ROOT/uninstall.sh" "$ROOT/README.md" "$ROOT/templates" "$ROOT/app" "$ROOT/.agents" >/dev/null; then
  echo "personal LDAP username must not be hardcoded in runtime, installer, app, docs, or agent guidance" >&2
@@ -75,13 +176,32 @@ grep -q -- '--manual-full' "$ROOT/bin/vpn-lemanapro.sh"
 grep -q -- '--manual-sso' "$ROOT/bin/vpn-lemanapro.sh"
 grep -q 'LEMANA_VPN_AUTOFILL_DISABLE' "$ROOT/bin/vpn-lemanapro.sh"
 grep -q 'LEMANA_VPN_AUTOFILL_CLICK' "$ROOT/bin/vpn-lemanapro.sh"
+grep -q 'LEMANA_VPN_AUTOFILL_TOTP' "$ROOT/bin/vpn-lemanapro.sh"
 grep -q 'vpn-auto' "$ROOT/install.sh"
 grep -q 'vpn-manual' "$ROOT/install.sh"
 grep -q 'vpn-manual-full' "$ROOT/install.sh"
-grep -q 'connect(mode: .auto)' "$ROOT/app/Sources/LemanaVPN/LemanaVPNApp.swift"
-grep -q 'connect(mode: .manual)' "$ROOT/app/Sources/LemanaVPN/LemanaVPNApp.swift"
-grep -q 'connect(mode: .manualFull)' "$ROOT/app/Sources/LemanaVPN/LemanaVPNApp.swift"
-grep -q 'Подключить полностью вручную' "$ROOT/app/Sources/LemanaVPN/LemanaVPNApp.swift"
+grep -q 'ForEach(vpnManager.availableLaunchModes)' "$ROOT/app/Sources/LemanaVPN/LemanaVPNApp.swift"
+grep -q 'vpnManager.installModeLabel' "$ROOT/app/Sources/LemanaVPN/LemanaVPNApp.swift"
+grep -q 'vpnManager.installSetupHint' "$ROOT/app/Sources/LemanaVPN/LemanaVPNApp.swift"
+grep -q 'Button("Изменить логин и пароль")' "$ROOT/app/Sources/LemanaVPN/LemanaVPNApp.swift"
+grep -q 'vpnManager.configureLogin()' "$ROOT/app/Sources/LemanaVPN/LemanaVPNApp.swift"
+if grep -Fq 'connect(mode: .auto)' "$ROOT/app/Sources/LemanaVPN/LemanaVPNApp.swift"; then
+  echo "disconnected app menu should not hardcode the auto button" >&2
+  exit 1
+fi
+if grep -Fq 'Button("Подставить только логин и пароль")' "$ROOT/app/Sources/LemanaVPN/LemanaVPNApp.swift"; then
+  echo "disconnected app menu should not hardcode saved-login button visibility" >&2
+  exit 1
+fi
+grep -q 'app_menu' "$ROOT/app/Sources/LemanaVPN/VPNManager.swift"
+grep -q 'available_modes' "$ROOT/app/Sources/LemanaVPN/VPNManager.swift"
+grep -q 'menuTitle' "$ROOT/app/Sources/LemanaVPN/VPNManager.swift"
+grep -q 'Подключить полностью вручную' "$ROOT/app/Sources/LemanaVPN/VPNManager.swift"
+grep -q 'case "auth_profile":' "$ROOT/app/Sources/LemanaVPN/VPNManager.swift"
+grep -q 'case "manual_sso", "auto_sso":' "$ROOT/app/Sources/LemanaVPN/VPNManager.swift"
+grep -q 'case "username_required", "username_saved":' "$ROOT/app/Sources/LemanaVPN/VPNManager.swift"
+grep -q 'func configureLogin()' "$ROOT/app/Sources/LemanaVPN/VPNManager.swift"
+grep -q -- '--configure-login' "$ROOT/app/Sources/LemanaVPN/VPNManager.swift"
 grep -q 'enum VPNLaunchMode' "$ROOT/app/Sources/LemanaVPN/VPNManager.swift"
 grep -q 'struct Credentials: Decodable' "$ROOT/app/Sources/LemanaVPN/VPNManager.swift"
 grep -q 'credential_source' "$ROOT/app/Sources/LemanaVPN/VPNManager.swift"
@@ -178,6 +298,8 @@ grep -q 'script.setWorldId(QWebEngineScript.ScriptWorldId.ApplicationWorld)' "$f
 grep -q 'new Event("input", {{bubbles: true}})' "$fake_webengine"
 grep -q 'LEMANA_VPN_AUTOFILL_CLICK' "$fake_webengine"
 grep -q 'os.environ.get("LEMANA_VPN_AUTOFILL_CLICK", "1") != "0"' "$fake_webengine"
+grep -q 'LEMANA_VPN_AUTOFILL_TOTP' "$fake_webengine"
+grep -q 'rule.fill == "totp"' "$fake_webengine"
 if grep -q 'ScriptWorldId.MainWorld' "$fake_webengine"; then
  echo "patched auto-fill should keep the original ApplicationWorld behavior" >&2
  exit 1
@@ -230,6 +352,7 @@ set +e
 manual_output="$(
  HOME="$HOME" \
  LEMANA_VPN_USERNAME="$missing_user" \
+  LEMANA_VPN_AUTH_PROFILE=saved-login \
  LEMANA_VPN_CREDENTIAL_SOURCE=keychain \
  bash "$ROOT/bin/vpn-lemanapro.sh" --json 2>&1
 )"
@@ -238,9 +361,9 @@ set -e

 [ "$manual_code" -ne 0 ]
 printf '%s\n' "$manual_output" | grep -q '"event":"keychain_required"'
-printf '%s\n' "$manual_output" | grep -q 'vpn --configure-keychain'
+printf '%s\n' "$manual_output" | grep -q 'vpn --configure-login'
 if printf '%s\n' "$manual_output" | grep -q 'Cleaning up VPN DNS'; then
-  echo "missing manual credentials should fail before VPN cleanup trap is installed" >&2
+  echo "missing saved login should fail before VPN cleanup trap is installed" >&2
  exit 1
 fi

@@ -249,10 +372,11 @@ mkdir -p "$missing_username_home"
 set +e
 missing_username_output="$(
  HOME="$missing_username_home" \
-  LEMANA_VPN_CONFIG_DIR="$missing_username_home/.config/lemana-vpn" \
-  OPENCONNECT_LITE_CONFIG_DIR="$missing_username_home/.config/openconnect-lite" \
-  LEMANA_VPN_CREDENTIAL_SOURCE=keychain \
-  bash "$ROOT/bin/vpn-lemanapro.sh" --json 2>&1
+	  LEMANA_VPN_CONFIG_DIR="$missing_username_home/.config/lemana-vpn" \
+	  OPENCONNECT_LITE_CONFIG_DIR="$missing_username_home/.config/openconnect-lite" \
+	  LEMANA_VPN_AUTH_PROFILE=saved-login \
+	  LEMANA_VPN_CREDENTIAL_SOURCE=keychain \
+	  bash "$ROOT/bin/vpn-lemanapro.sh" --json 2>&1
 )"
 missing_username_code=$?
 set -e
@@ -294,6 +418,25 @@ cat > "$fake_oc_bin" <<'SH'
  printf 'args=%s\n' "$*"
  printf 'autofill_disable=%s\n' "${LEMANA_VPN_AUTOFILL_DISABLE:-}"
  printf 'autofill_click=%s\n' "${LEMANA_VPN_AUTOFILL_CLICK:-}"
+  printf 'autofill_totp=%s\n' "${LEMANA_VPN_AUTOFILL_TOTP:-}"
+  config_home="${XDG_CONFIG_HOME:-$HOME/.config}"
+  config_file="$config_home/openconnect-lite/config.toml"
+  printf 'xdg_config_home=%s\n' "$config_home"
+  if [ -f "$config_file" ]; then
+    if grep -q '^\[credentials\]' "$config_file"; then
+      printf 'credentials_block=1\n'
+    else
+      printf 'credentials_block=0\n'
+    fi
+    if grep -q 'username = ""' "$config_file"; then
+      printf 'empty_username=1\n'
+    else
+      printf 'empty_username=0\n'
+    fi
+  else
+    printf 'credentials_block=missing\n'
+    printf 'empty_username=missing\n'
+  fi
 } > "$LEMANA_VPN_CAPTURE_LAUNCH"
 exit 0
 SH
@@ -307,9 +450,139 @@ exit 1
 SH
 chmod +x "$fake_missing_keychain_bin/security"

+default_manual_home="$TMP_DIR/default-manual-home"
+default_manual_capture="$TMP_DIR/default-manual-capture"
+mkdir -p "$default_manual_home"
+mkdir -p "$default_manual_home/.config/openconnect-lite"
+cat > "$default_manual_home/.config/openconnect-lite/config.toml" <<'TOML'
+on_disconnect = "true"
+
+[default_profile]
+address = "vpn.lemanapro.ru"
+user_group = ""
+name = "Default-K"
+
+[credentials]
+username = ""
+TOML
+default_manual_output="$(
+  HOME="$default_manual_home" \
+  PATH="$fake_missing_keychain_bin:$PATH" \
+  LEMANA_VPN_CONFIG_DIR="$default_manual_home/.config/lemana-vpn" \
+  OPENCONNECT_LITE_CONFIG_DIR="$default_manual_home/.config/openconnect-lite" \
+  LEMANA_VPN_OC_BIN="$fake_oc_bin" \
+  LEMANA_VPN_OC_PYTHON=python3 \
+  LEMANA_VPN_WEBENGINE_PROCESS="$fake_webengine" \
+  LEMANA_VPN_AUTHENTICATOR="$fake_authenticator" \
+  LEMANA_VPN_PATCH_BACKUP_DIR="$TMP_DIR/default-manual-patch-backups" \
+  LEMANA_VPN_DNS_CLEANUP="$TMP_DIR/no-dns-cleanup" \
+  LEMANA_VPN_CONNECT_LOG="$TMP_DIR/default-manual.log" \
+  LEMANA_VPN_CAPTURE_LAUNCH="$default_manual_capture" \
+  bash "$ROOT/bin/vpn-lemanapro.sh" --json
+)"
+
+printf '%s\n' "$default_manual_output" | grep -q '"event":"manual_sso","auth_profile":"manual","autofill":false,"submit":false'
+if printf '%s\n' "$default_manual_output" | grep -Eq '"event":"(username_required|keychain_required)"'; then
+  echo "default manual mode should open the browser without saved username or Keychain credentials" >&2
+  exit 1
+fi
+grep -q -- '--browser-display-mode shown' "$default_manual_capture"
+grep -q '^autofill_disable=1$' "$default_manual_capture"
+grep -q '^autofill_click=0$' "$default_manual_capture"
+grep -q '^autofill_totp=0$' "$default_manual_capture"
+grep -q '^credentials_block=0$' "$default_manual_capture"
+grep -q '^empty_username=0$' "$default_manual_capture"
+
+fake_login_keychain_bin="$TMP_DIR/fake-login-keychain-bin"
+mkdir -p "$fake_login_keychain_bin"
+cat > "$fake_login_keychain_bin/security" <<'SH'
+#!/bin/sh
+if [ "${1:-}" = "find-generic-password" ]; then
+  account=""
+  while [ "$#" -gt 0 ]; do
+    if [ "$1" = "-a" ]; then
+      shift
+      account="${1:-}"
+      break
+    fi
+    shift
+  done
+  case "$account" in
+    ""|totp/*) exit 1 ;;
+    *) exit 0 ;;
+  esac
+fi
+exit 1
+SH
+chmod +x "$fake_login_keychain_bin/security"
+
+saved_login_capture="$TMP_DIR/saved-login-capture"
+saved_login_output="$(
+  HOME="$HOME" \
+  PATH="$fake_login_keychain_bin:$PATH" \
+  LEMANA_VPN_USERNAME="lemana-saved-login-$$" \
+  LEMANA_VPN_AUTH_PROFILE=saved-login \
+  LEMANA_VPN_CREDENTIAL_SOURCE=keychain \
+  LEMANA_VPN_OC_BIN="$fake_oc_bin" \
+  LEMANA_VPN_OC_PYTHON=python3 \
+  LEMANA_VPN_WEBENGINE_PROCESS="$fake_webengine" \
+  LEMANA_VPN_AUTHENTICATOR="$fake_authenticator" \
+  LEMANA_VPN_PATCH_BACKUP_DIR="$TMP_DIR/saved-login-patch-backups" \
+  LEMANA_VPN_DNS_CLEANUP="$TMP_DIR/no-dns-cleanup" \
+  LEMANA_VPN_CONNECT_LOG="$TMP_DIR/saved-login.log" \
+  LEMANA_VPN_CAPTURE_LAUNCH="$saved_login_capture" \
+  bash "$ROOT/bin/vpn-lemanapro.sh" --json
+)"
+
+printf '%s\n' "$saved_login_output" | grep -q '"event":"manual_sso","auth_profile":"saved-login","autofill":true,"totp":false,"submit":false'
+if printf '%s\n' "$saved_login_output" | grep -q '"event":"keychain_required"'; then
+  echo "saved-login should not require a TOTP seed" >&2
+  exit 1
+fi
+grep -q -- '--browser-display-mode shown' "$saved_login_capture"
+grep -q '^autofill_disable=0$' "$saved_login_capture"
+grep -q '^autofill_click=0$' "$saved_login_capture"
+grep -q '^autofill_totp=0$' "$saved_login_capture"
+
+saved_totp_capture="$TMP_DIR/saved-totp-capture"
+saved_totp_output="$(
+  HOME="$HOME" \
+  PATH="$fake_path_bin:$PATH" \
+  LEMANA_VPN_USERNAME="lemana-saved-totp-$$" \
+  LEMANA_VPN_AUTH_PROFILE=saved-totp \
+  LEMANA_VPN_CREDENTIAL_SOURCE=keychain \
+  LEMANA_VPN_OC_BIN="$fake_oc_bin" \
+  LEMANA_VPN_OC_PYTHON=python3 \
+  LEMANA_VPN_WEBENGINE_PROCESS="$fake_webengine" \
+  LEMANA_VPN_AUTHENTICATOR="$fake_authenticator" \
+  LEMANA_VPN_PATCH_BACKUP_DIR="$TMP_DIR/saved-totp-patch-backups" \
+  LEMANA_VPN_DNS_CLEANUP="$TMP_DIR/no-dns-cleanup" \
+  LEMANA_VPN_CONNECT_LOG="$TMP_DIR/saved-totp.log" \
+  LEMANA_VPN_CAPTURE_LAUNCH="$saved_totp_capture" \
+  bash "$ROOT/bin/vpn-lemanapro.sh" --json
+)"
+
+printf '%s\n' "$saved_totp_output" | grep -q '"event":"manual_sso","auth_profile":"saved-totp","autofill":true,"totp":true,"submit":false'
+grep -q -- '--browser-display-mode shown' "$saved_totp_capture"
+grep -q '^autofill_disable=0$' "$saved_totp_capture"
+grep -q '^autofill_click=0$' "$saved_totp_capture"
+grep -q '^autofill_totp=1$' "$saved_totp_capture"
+
 manual_full_no_credentials_home="$TMP_DIR/manual-full-no-credentials-home"
 manual_full_no_credentials_capture="$TMP_DIR/manual-full-no-credentials-capture"
 mkdir -p "$manual_full_no_credentials_home"
+mkdir -p "$manual_full_no_credentials_home/.config/openconnect-lite"
+cat > "$manual_full_no_credentials_home/.config/openconnect-lite/config.toml" <<'TOML'
+on_disconnect = "true"
+
+[default_profile]
+address = "vpn.lemanapro.ru"
+user_group = ""
+name = "Default-K"
+
+[credentials]
+username = ""
+TOML
 manual_full_no_credentials_output="$(
  HOME="$manual_full_no_credentials_home" \
  PATH="$fake_missing_keychain_bin:$PATH" \
@@ -327,7 +600,7 @@ manual_full_no_credentials_output="$(
  bash "$ROOT/bin/vpn-lemanapro.sh" --manual-full --json
 )"

-printf '%s\n' "$manual_full_no_credentials_output" | grep -q '"event":"manual_sso","autofill":false,"submit":false'
+printf '%s\n' "$manual_full_no_credentials_output" | grep -q '"event":"manual_sso","auth_profile":"manual","autofill":false,"submit":false'
 if printf '%s\n' "$manual_full_no_credentials_output" | grep -Eq '"event":"(username_required|keychain_required)"'; then
  echo "manual-full should not require saved username or Keychain credentials before opening the browser" >&2
  exit 1
@@ -335,6 +608,9 @@ fi
 grep -q -- '--browser-display-mode shown' "$manual_full_no_credentials_capture"
 grep -q '^autofill_disable=1$' "$manual_full_no_credentials_capture"
 grep -q '^autofill_click=0$' "$manual_full_no_credentials_capture"
+grep -q '^autofill_totp=0$' "$manual_full_no_credentials_capture"
+grep -q '^credentials_block=0$' "$manual_full_no_credentials_capture"
+grep -q '^empty_username=0$' "$manual_full_no_credentials_capture"

 if command -v expect >/dev/null 2>&1; then
  first_username_home="$TMP_DIR/first-username-home"
@@ -393,17 +669,18 @@ manual_full_output="$(
  bash "$ROOT/bin/vpn-lemanapro.sh" --manual-full --json
 )"

-printf '%s\n' "$manual_full_output" | grep -q '"event":"manual_sso","autofill":false,"submit":false'
+printf '%s\n' "$manual_full_output" | grep -q '"event":"manual_sso","auth_profile":"manual","autofill":false,"submit":false'
 grep -q -- '--browser-display-mode shown' "$manual_full_capture"
 grep -q '^autofill_disable=1$' "$manual_full_capture"
 grep -q '^autofill_click=0$' "$manual_full_capture"
+grep -q '^autofill_totp=0$' "$manual_full_capture"

 fake_oc_python="$TMP_DIR/fake-oc-python"
 captured_totp="$TMP_DIR/captured-totp"
 cat > "$fake_oc_python" <<'SH'
 #!/bin/sh
 cat >/dev/null
-printf '%s\n' "${_VPN_TOTP_SECRET:-}" > "$LEMANA_VPN_CAPTURE_TOTP"
+printf '%s' "${_VPN_TOTP_SECRET:-}" > "$LEMANA_VPN_CAPTURE_TOTP"
 SH
 chmod +x "$fake_oc_python"

@@ -420,6 +697,24 @@ configure_output="$(
 printf '%s\n' "$configure_output" | grep -q 'Credentials are ready in macOS Keychain'
 grep -q '^ABCD2345EFGH6723$' "$captured_totp"

+captured_login_totp="$TMP_DIR/captured-login-totp"
+configure_login_output="$(
+  printf 'ldap-password\n' |
+    HOME="$HOME" \
+    LEMANA_VPN_USERNAME="lemana-login-$$" \
+    LEMANA_VPN_AUTH_PROFILE=saved-login \
+    LEMANA_VPN_CREDENTIAL_SOURCE=keychain \
+    LEMANA_VPN_OC_PYTHON="$fake_oc_python" \
+    LEMANA_VPN_CAPTURE_TOTP="$captured_login_totp" \
+    bash "$ROOT/bin/vpn-lemanapro.sh" --configure-login
+)"
+
+printf '%s\n' "$configure_login_output" | grep -q 'Login and password are ready in macOS Keychain'
+if [ -s "$captured_login_totp" ]; then
+  echo "configure-login must not store a TOTP seed" >&2
+  exit 1
+fi
+
 fake_pwd="$TMP_DIR/fake-pwd"
 mkdir -p "$fake_pwd/bin"
 printf 'stale local cli\n' > "$fake_pwd/bin/vpn-lemanapro.sh"