eric/narratio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 27 Wiki Activity

Migrate Notarius to credential lists

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-25 15:33:46 +00:00
parent 49948852d6
commit 7e0151ef93
21 changed files with 161 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
internal/config/notarius_test.go
View File

@@ -58,8 +58,10 @@ notarius:
func TestNotariusCredentialReferenceLoading(t *testing.T) {
const envName = "NARRATIO_TEST_NOTARIUS_KEY"
const secondName = "NARRATIO_TEST_NOTARIUS_SECOND_KEY"
const canary = "notarius-credential-canary"
t.Setenv(envName, canary)
t.Setenv(secondName, "second-canary")
tests := []struct {
name string
@@ -67,8 +69,9 @@ func TestNotariusCredentialReferenceLoading(t *testing.T) {
wantNil bool
}{
{name: "omitted", wantNil: true},
{name: "null", credential: " llm_api_key: null\n", wantNil: true},
{name: "custom reference", credential: " llm_api_key: " + envName + "\n"},
{name: "null", credential: " credentials: null\n", wantNil: true},
{name: "empty", credential: " credentials: []\n"},
{name: "custom references", credential: " credentials: [" + envName + ", " + secondName + "]\n"},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
@@ -81,15 +84,19 @@ func TestNotariusCredentialReferenceLoading(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if test.wantNil {
if cfg.Notarius.LLMAPIKey != nil {
t.Fatal("credential reference should be nil")
}
if test.wantNil && cfg.Notarius.Credentials != nil {
t.Fatal("credential list should be nil")
}
if test.name == "empty" && len(cfg.Notarius.Credentials) == 0 {
return
}
if cfg.Notarius.LLMAPIKey == nil || cfg.Notarius.LLMAPIKey.EnvName() != envName ||
!cfg.Notarius.LLMAPIKey.IsResolved() || cfg.Notarius.LLMAPIKey.Value() != canary {
t.Fatal("credential reference was not loaded and resolved")
if test.wantNil {
return
}
if len(cfg.Notarius.Credentials) != 2 ||
cfg.Notarius.Credentials[0].EnvName() != envName || cfg.Notarius.Credentials[0].Value() != canary ||
cfg.Notarius.Credentials[1].EnvName() != secondName || cfg.Notarius.Credentials[1].Value() != "second-canary" {
t.Fatal("credential references were not loaded and resolved")
}
})
}
@@ -110,7 +117,7 @@ func TestNotariusCredentialReferenceFailures(t *testing.T) {
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
path := filepath.Join(t.TempDir(), "pipeline.yml")
pipelineYAML := testPipelineBaseYAML + "\nnotarius:\n enabled: false\n llm_api_key: " + test.reference + "\n"
pipelineYAML := testPipelineBaseYAML + "\nnotarius:\n enabled: false\n credentials: [" + test.reference + "]\n"
if err := os.WriteFile(path, []byte(pipelineYAML), 0o644); err != nil {
t.Fatal(err)
}
@@ -122,6 +129,17 @@ func TestNotariusCredentialReferenceFailures(t *testing.T) {
}
}
func TestNotariusRejectsRetiredCredentialField(t *testing.T) {
path := filepath.Join(t.TempDir(), "pipeline.yml")
pipelineYAML := testPipelineBaseYAML + "\nnotarius:\n llm_api_key: NARRATIO_TEST_NOTARIUS_KEY\n"
if err := os.WriteFile(path, []byte(pipelineYAML), 0o644); err != nil {
t.Fatal(err)
}
if _, err := LoadPipeline(path); err == nil || !strings.Contains(err.Error(), "decode.unknown_field") {
t.Fatalf("LoadPipeline() error = %v, want unknown field", err)
}
}
func TestNotariusEnabledDefaultsAndPathResolution(t *testing.T) {
dir := t.TempDir()
pipelinePath := filepath.Join(dir, "deployment", "pipeline.yml")