coulomb/rein-openweights
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: support governed Glas execution

Browse source
This commit is contained in:
tegwick 2026-08-21 00:21:53 +02:00
parent 34e179ea5d
commit a9071245b2
6 changed files with 122 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

27
tests/test_credentials.py
View file

@ -8,9 +8,9 @@ def test_explicit_env_var_short_circuits(monkeypatch):
assert resolve_openrouter_api_key() == "sk-explicit"
def test_falls_back_to_bao_kv_when_no_approle(monkeypatch):
def test_falls_back_to_bao_kv_when_no_approle(monkeypatch, tmp_path):
monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
monkeypatch.delenv("REIN_OPENWEIGHTS_APPROLE_DIR", raising=False)
monkeypatch.setenv("REIN_OPENWEIGHTS_APPROLE_DIR", str(tmp_path / "missing"))
with patch("rein_openweights.credentials._bao", return_value="sk-from-vault") as bao:
key = resolve_openrouter_api_key()
@ -44,9 +44,30 @@ def test_approle_lane_exchanges_token_before_kv_read(monkeypatch, tmp_path):
assert calls[1][0] == "kv"
def test_returns_none_when_bao_fails(monkeypatch):
def test_returns_none_when_bao_fails(monkeypatch, tmp_path):
monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
monkeypatch.setenv("REIN_OPENWEIGHTS_APPROLE_DIR", str(tmp_path / "missing"))
def test_uses_standard_approle_directory_by_default(monkeypatch, tmp_path):
monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
monkeypatch.delenv("REIN_OPENWEIGHTS_APPROLE_DIR", raising=False)
role_id = tmp_path / "role_id"
secret_id = tmp_path / "secret_id"
role_id.write_text("role-123")
secret_id.write_text("secret-456")
monkeypatch.setattr("rein_openweights.credentials._DEFAULT_APPROLE_DIR", tmp_path)
calls = []
def fake_bao(*args, env=None):
calls.append(args)
return "vault-token" if args[0] == "write" else "sk-from-vault"
with patch("rein_openweights.credentials._bao", side_effect=fake_bao):
assert resolve_openrouter_api_key() == "sk-from-vault"
assert [call[0] for call in calls] == ["write", "kv"]
from rein_openweights.credentials import CredentialError