Use APPDATA for the default Windows token path

[LinuxJedi]

On Windows, wolfPKCS11_Store_Name() looked up the default token directory with getenv("%APPDIR%"). getenv() does not expand %VAR% syntax and APPDIR is not a standard Windows variable, so the lookup always returned NULL. Since 2.0, Windows has had no per-user default: token data went to WOLFPKCS11_DEFAULT_TOKEN_PATH, or token storage failed if that was not set.

• Read APPDATA instead, so the default is %APPDATA%\wolfPKCS11. There is no USERPROFILE fallback, mirroring the POSIX branch which only reads HOME. A single lookup keeps the token location deterministic rather than depending on which variables a given process inherited.
• token_path_test now expects only %APPDATA%\wolfPKCS11 (it previously also accepted a USERPROFILE fallback the library never had) and no longer unsets APPDIR.
• README now documents %APPDATA%\wolfPKCS11 and notes the behavior change.
• Windows CI now runs token_path_test. The existing job builds the Visual Studio solution, which enables wolfTPM, so its tests cannot run on runners without a TPM; nothing exercised this path, which is how the bug went unnoticed. A new cmake-token-path job in win-test.yml builds wolfSSL and wolfPKCS11 with CMake and MSVC as static libraries without wolfTPM and runs token_path_test via ctest. To build the test on Windows, testdata.h gains an unsetenv() shim next to its existing setenv() shim, and token_path_test.c includes io.h for _access().

Behavior change on Windows: %APPDATA%\wolfPKCS11 is checked before WOLFPKCS11_DEFAULT_TOKEN_PATH, so Windows builds that relied on the build-time default will now use the per-user directory. Deployments with existing tokens there need to set WOLFPKCS11_TOKEN_PATH to that directory or move the token files. This is called out in the README and should go in the next release notes.

Testing:

• Linux (debian:trixie container, wolfSSL master with the CI configure flags): ./configure && make && make -j1 check passes (55 pass, 4 skip, 0 fail), including token_path_test.
• macOS: pre-commit hook make test passes (55 pass, 4 skip, 0 fail).
• Windows, locally: built with the same CMake options as the new CI job using mingw-w64 (ucrt) and ran token_path_test.exe under Wine. All 9 checks pass and the token file is created in C:\users\<user>\AppData\Roaming\wolfPKCS11. As a negative control, restoring the old %APPDIR% lookup makes C_Initialize fail and the test exit 1, so the new job would have caught the original bug.
• Windows, MSVC: covered by the new cmake-token-path CI job on this PR.

[Copilot]

Copilot review overview

🟡 Changes recommended

The Windows-specific regression test is not runnable or executed in Windows CI.

Review effort: Balanced
Findings: 1

Open (1)

• Add Windows coverage for APPDATA token path fallback · New

What changed in this PR

Updates Windows token storage to use the standard per-user APPDATA directory.

Changes:

• Uses %APPDATA%\wolfPKCS11 as the Windows default.
• Updates path expectations and migration documentation.
• Removes obsolete APPDIR handling.

File	Description
src/​internal.c	Reads APPDATA for Windows storage.
tests/​token_path_test.c	Updates Windows path expectations.
README.md	Documents behavior and migration impact.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.