66 lines
2.1 KiB
Go
66 lines
2.1 KiB
Go
package config
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
|
|
"gopkg.in/yaml.v3"
|
|
)
|
|
|
|
func TestScriptoriumCredentialsComposeAndSerializeSafely(t *testing.T) {
|
|
t.Setenv("OPENROUTER_API_KEY", "synthetic-first-secret")
|
|
t.Setenv("CUSTOM_PROVIDER_KEY", "synthetic-second-secret")
|
|
dir := t.TempDir()
|
|
root := writePipelineFixture(t, dir, "pipeline.yml", "whisperx:\n transcribe_url: https://example.test/transcribe\nscriptorium:\n credentials: [OPENROUTER_API_KEY]\n")
|
|
base, err := LoadPipeline(root)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, marshal := range []func() ([]byte, error){
|
|
func() ([]byte, error) { return yaml.Marshal(base) },
|
|
func() ([]byte, error) { return MarshalEffectivePipeline(base) },
|
|
} {
|
|
data, err := marshal()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !strings.Contains(string(data), "OPENROUTER_API_KEY") || strings.Contains(string(data), "synthetic-first-secret") {
|
|
t.Fatal("unsafe or missing credential projection")
|
|
}
|
|
}
|
|
t.Setenv("OPENROUTER_API_KEY", "rotated-secret")
|
|
rotated, err := LoadPipeline(root)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if EffectivePipelineDigest(base) != EffectivePipelineDigest(rotated) {
|
|
t.Fatal("rotation changed effective digest")
|
|
}
|
|
for _, tc := range []struct{ name, value, want string }{
|
|
{"replace", "[CUSTOM_PROVIDER_KEY]", "CUSTOM_PROVIDER_KEY"},
|
|
{"clear", "[]", ""}, {"null", "null", ""},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
writePipelineFixture(t, dir, "overlays/"+tc.name+".yml", "scriptorium:\n credentials: "+tc.value+"\n")
|
|
loaded, err := LoadPipelineWithOptions(root, PipelineLoadOptions{Overlay: &tc.name})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
creds := loaded.Scriptorium.Credentials
|
|
if tc.want == "" {
|
|
if len(creds) != 0 {
|
|
t.Fatal("credentials not cleared")
|
|
}
|
|
return
|
|
}
|
|
if len(creds) != 1 || creds[0].EnvName() != tc.want || creds[0].Value() != "synthetic-second-secret" {
|
|
t.Fatal("overlay did not replace resolved credentials")
|
|
}
|
|
})
|
|
}
|
|
t.Setenv("OPENROUTER_API_KEY", "")
|
|
if _, err := LoadPipeline(root); err == nil {
|
|
t.Fatal("empty selected credential accepted")
|
|
}
|
|
}
|