fix(config): validate protected cookie stores

[iMelki]

Summary

• Validate configuration through the same secure-file reader used by the application.
• Accept Windows DPAPI-protected manual-cookie stores without converting them to plaintext.
• Add focused coverage for a valid protected store and malformed-wrapper error redaction.

Validation

• git diff --check
• cargo fmt --all --check
• gitleaks protect --staged --redact
• Focused Rust test compilation is currently blocked locally before tests start: Cargo returns Windows os error 2 while copying the num-traits build script. The failed build cache and logs were preserved; no security product or source data was changed.
• The upstream PR check workflow is awaiting maintainer approval because this is a first-time fork contribution.

Privacy

This change does not include account cookies, credential values, personal paths, or local configuration data.

Summary by CodeRabbit

• Bug Fixes

  • Configuration validation now supports protected configuration files.
  • Invalid secure file wrappers are rejected safely without exposing protected contents.
  • Improved error reporting for secure file access failures.

• Tests

  • Added Windows coverage for validating DPAPI-protected manual cookie configurations without storing plaintext data.

[Finesssee]

Thanks for the PR, I will review it ASAP.

[Finesssee]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d4f43d34-c770-40a5-a394-2e92ac2a22e6

📥 Commits

Reviewing files that changed from the base of the PR and between bdf0773 and 90a451e.

📒 Files selected for processing (1)

• rust/src/cli/config.rs

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

Configuration JSON validation now reads through secure_file::read_string. Windows tests cover DPAPI-protected manual cookies and malformed secure wrappers without plaintext or encoded payload exposure.

Changes

Secure configuration validation

Layer / File(s)	Summary
Secure configuration reading and validation rust/src/cli/config.rs	read_json_config uses secure_file::read_string and maps read failures to ConfigFileError::Read. Windows tests validate DPAPI-protected cookies and reject malformed wrappers without exposing their payloads.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 90a45

This localized configuration-validation change has no actionable merge-blocking risk remaining based on the supplied evidence and is merge-ready after normal checks and review.

Suggested reviewers: finesssee

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: configuration validation now supports protected cookie stores.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}