eric/narratio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 27 Wiki Activity

Forward Notarius credentials securely

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-16 14:27:06 +00:00
parent 9d68cfcf2f
commit dcaa2ad9c6
6 changed files with 206 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
internal/stage/extract.go
View File

@@ -147,7 +147,7 @@ func (extractStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (re
return nil, fmt.Errorf("extract: build configuration fingerprint: %w", err)
}
request := notarius.RunRequest{
Binary: resolvedBinary, ConfigPath: configPath, PipelineID: notariusConfig.PipelineID,
Binary: resolvedBinary, LLMAPIKey: notariusConfig.LLMAPIKey, ConfigPath: configPath, PipelineID: notariusConfig.PipelineID,
InputPath: inputPath, OutputRoot: outputRoot, WorkingDirectory: workingDirectory,
ReceiptPath: receiptPath, LogPath: logPath, Timeout: timeout, References: referenceBindings,
}

28
internal/stage/extract_test.go
View File

@@ -51,7 +51,25 @@ func TestExtractStageDisabledReturnsExplicitSkip(t *testing.T) {
}
func TestExtractStageResolvesManifestInputAndBuildsExactRequest(t *testing.T) {
const credentialName = "NARRATIO_EXTRACT_NOTARIUS_KEY"
const credentialCanary = "extract-notarius-credential-canary"
t.Setenv(credentialName, credentialCanary)
credentialPipelinePath := filepath.Join(t.TempDir(), "pipeline.yml")
if err := os.WriteFile(credentialPipelinePath, []byte(`whisperx:
transcribe_url: https://transcription.example.test/transcribe
notarius:
enabled: false
llm_api_key: NARRATIO_EXTRACT_NOTARIUS_KEY
`), 0o644); err != nil {
t.Fatal(err)
}
loadedPipeline, err := config.LoadPipeline(credentialPipelinePath)
if err != nil {
t.Fatalf("LoadPipeline() error = %v", err)
}
env, m, fake := setupExtractEnv(t)
env.Config.Pipeline.Notarius.LLMAPIKey = loadedPipeline.Notarius.LLMAPIKey
result, err := (extractStage{}).Run(context.Background(), env, m)
if err != nil {
t.Fatalf("Run() error = %v", err)
@@ -78,9 +96,19 @@ func TestExtractStageResolvesManifestInputAndBuildsExactRequest(t *testing.T) {
if len(req.References) != 0 {
t.Fatalf("references = %#v, want none", req.References)
}
if req.LLMAPIKey != loadedPipeline.Notarius.LLMAPIKey || req.LLMAPIKey.EnvName() != credentialName || !req.LLMAPIKey.IsResolved() {
t.Fatal("request did not retain the loaded Notarius credential reference")
}
if result.Metadata["reference_count"] != 0 || len(result.Metadata["references"].([]map[string]any)) != 0 {
t.Fatalf("reference metadata = count %#v references %#v", result.Metadata["reference_count"], result.Metadata["references"])
}
metadata, err := json.Marshal(result.Metadata)
if err != nil {
t.Fatal(err)
}
if strings.Contains(string(metadata), credentialCanary) || strings.Contains(string(metadata), credentialName) {
t.Fatal("result metadata contains the Notarius credential")
}
if len(result.Outputs) != 2 {
t.Fatalf("outputs = %#v, want lane and index", result.Outputs)
}