derive a missing client digest from the secret that exists

A client with a secret in the store or in a leftover file but no digest gets the digest of that secret instead of stopping the unit. The password reaches authelia's prompt through a pty, not argv. A lost mint race takes the winner's secret. Also name the mint, not the publisher, in the remaining rust docs.

nix/script-tests/oidc-client-secrets.nix

@@ -55,12 +55,33 @@ let
     esac
   '';
 
-  # Prints what `authelia crypto hash generate pbkdf2 --random` prints, or
-  # nothing when `FAKE_AUTHELIA_EMPTY` is set. Every call is logged.
+  # With `--random`, prints what `authelia crypto hash generate pbkdf2 --random`
+  # prints. Without it, answers the password prompt from stdin the way the CLI
+  # does on a terminal: echo, then the digest of what was typed. Prints nothing
+  # when `FAKE_AUTHELIA_EMPTY` is set, and fails without a digest when
+  # `FAKE_AUTHELIA_NODIGEST` is set. Every call is logged.
   fakeAuthelia = pkgs.writeShellScriptBin "authelia" ''
     echo "$*" >> "$FAKE_AUTHELIA_LOG"
     [ -z "''${FAKE_AUTHELIA_EMPTY-}" ] || exit 0
-    printf 'Random Password: minted-secret\n\nDigest: $pbkdf2-sha512$fake\n'
+    case " $* " in
+      *" --random "*)
+        printf 'Random Password: minted-secret\n\nDigest: $pbkdf2-sha512$fake\n'
+        ;;
+      *)
+        [ -z "''${FAKE_AUTHELIA_NODIGEST-}" ] || exit 1
+        IFS= read -r typed
+        printf 'Enter Password: %s\r\nDigest: digest-of-%s\r\n' "$typed" "$typed"
+        ;;
+    esac
+  '';
+
+  # Runs the command it is given, as util-linux's `script -qec <cmd> /dev/null`
+  # does, without needing a pty in the build sandbox. The real pty is checked
+  # against the real authelia by hand.
+  fakeScript = pkgs.writeShellScriptBin "script" ''
+    echo "script $1 $3" >> "$FAKE_AUTHELIA_LOG"
+    [ "$1" = -qec ] || exit 99
+    exec ${pkgs.bash}/bin/bash -c "$2"
   '';
 in
 pkgs.runCommand "hyperhive-script-test-oidc-client-secrets"
@@ -75,6 +96,7 @@ pkgs.runCommand "hyperhive-script-test-oidc-client-secrets"
       paths = [
         fakeBao
         fakeAuthelia
+        fakeScript
       ];
     };
     nativeBuildInputs = [