Share configured LLM secret extraction across diagnostics paths

internal/framework/llm/secrets.go

@@ -0,0 +1,17 @@
+package llm
+
+import "gitea.maximumdirect.net/eric/audita/internal/core/config"
+
+// ConfiguredSecrets returns all configured LLM API-key values that should be
+// redacted from diagnostics and surfaced error payloads.
+func ConfiguredSecrets(cfg *config.Config) []string {
+	if cfg == nil {
+		return nil
+	}
+	effectiveValidation := cfg.EffectiveValidationLLMConfig()
+	return []string{
+		cfg.PrimaryLLM.APIKey,
+		cfg.ValidationLLM.APIKey,
+		effectiveValidation.APIKey,
+	}
+}

internal/framework/llm/secrets_test.go

@@ -0,0 +1,38 @@
+package llm
+
+import (
+	"reflect"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/audita/internal/core/config"
+)
+
+func TestConfiguredSecretsNilConfig(t *testing.T) {
+	if got := ConfiguredSecrets(nil); got != nil {
+		t.Fatalf("expected nil secrets for nil config, got %v", got)
+	}
+}
+
+func TestConfiguredSecretsWithValidationOverride(t *testing.T) {
+	cfg := config.Default()
+	cfg.PrimaryLLM.APIKey = "primary-secret"
+	cfg.ValidationLLM.APIKey = "validation-secret"
+
+	got := ConfiguredSecrets(&cfg)
+	want := []string{"primary-secret", "validation-secret", "validation-secret"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("unexpected secrets: got=%v want=%v", got, want)
+	}
+}
+
+func TestConfiguredSecretsWithInheritedValidationKey(t *testing.T) {
+	cfg := config.Default()
+	cfg.PrimaryLLM.APIKey = "primary-secret"
+	cfg.ValidationLLM.APIKey = ""
+
+	got := ConfiguredSecrets(&cfg)
+	want := []string{"primary-secret", "", "primary-secret"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("unexpected inherited secrets: got=%v want=%v", got, want)
+	}
+}