75 lines
2.6 KiB
Python
75 lines
2.6 KiB
Python
from unittest.mock import patch
|
|
|
|
from rein_openweights.credentials import resolve_openrouter_api_key
|
|
|
|
|
|
def test_explicit_env_var_short_circuits(monkeypatch):
|
|
monkeypatch.setenv("OPENROUTER_API_KEY", "sk-explicit")
|
|
assert resolve_openrouter_api_key() == "sk-explicit"
|
|
|
|
|
|
def test_falls_back_to_bao_kv_when_no_approle(monkeypatch, tmp_path):
|
|
monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
|
|
monkeypatch.setenv("REIN_OPENWEIGHTS_APPROLE_DIR", str(tmp_path / "missing"))
|
|
|
|
with patch("rein_openweights.credentials._bao", return_value="sk-from-vault") as bao:
|
|
key = resolve_openrouter_api_key()
|
|
|
|
assert key == "sk-from-vault"
|
|
bao.assert_called_once()
|
|
assert bao.call_args.args[0] == "kv"
|
|
|
|
|
|
def test_approle_lane_exchanges_token_before_kv_read(monkeypatch, tmp_path):
|
|
monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
|
|
role_id = tmp_path / "role_id"
|
|
secret_id = tmp_path / "secret_id"
|
|
role_id.write_text("role-123")
|
|
secret_id.write_text("secret-456")
|
|
monkeypatch.setenv("REIN_OPENWEIGHTS_APPROLE_DIR", str(tmp_path))
|
|
|
|
calls = []
|
|
|
|
def fake_bao(*args, env=None):
|
|
calls.append(args)
|
|
if args[0] == "write":
|
|
return "vault-token"
|
|
return "sk-from-vault"
|
|
|
|
with patch("rein_openweights.credentials._bao", side_effect=fake_bao):
|
|
key = resolve_openrouter_api_key()
|
|
|
|
assert key == "sk-from-vault"
|
|
assert calls[0][0] == "write"
|
|
assert calls[1][0] == "kv"
|
|
|
|
|
|
def test_returns_none_when_bao_fails(monkeypatch, tmp_path):
|
|
monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
|
|
monkeypatch.setenv("REIN_OPENWEIGHTS_APPROLE_DIR", str(tmp_path / "missing"))
|
|
|
|
|
|
def test_uses_standard_approle_directory_by_default(monkeypatch, tmp_path):
|
|
monkeypatch.delenv("OPENROUTER_API_KEY", raising=False)
|
|
monkeypatch.delenv("REIN_OPENWEIGHTS_APPROLE_DIR", raising=False)
|
|
role_id = tmp_path / "role_id"
|
|
secret_id = tmp_path / "secret_id"
|
|
role_id.write_text("role-123")
|
|
secret_id.write_text("secret-456")
|
|
monkeypatch.setattr("rein_openweights.credentials._DEFAULT_APPROLE_DIR", tmp_path)
|
|
|
|
calls = []
|
|
|
|
def fake_bao(*args, env=None):
|
|
calls.append(args)
|
|
return "vault-token" if args[0] == "write" else "sk-from-vault"
|
|
|
|
with patch("rein_openweights.credentials._bao", side_effect=fake_bao):
|
|
assert resolve_openrouter_api_key() == "sk-from-vault"
|
|
|
|
assert [call[0] for call in calls] == ["write", "kv"]
|
|
|
|
from rein_openweights.credentials import CredentialError
|
|
|
|
with patch("rein_openweights.credentials._bao", side_effect=CredentialError("boom")):
|
|
assert resolve_openrouter_api_key() is None
|