Make optional API key environments nonblocking

internal/usecase/prepared_execution_test.go

@@ -3,7 +3,6 @@ package usecase
 import (
 	"context"
 	"errors"
-	"os"
 	"reflect"
 	"testing"
 
@@ -241,49 +240,76 @@ func excessivelyDeepPreparedJSONValue() any {
 	return value
 }
 
-func TestRunnerRunPreparedRechecksEnvironmentCredentialBeforeAdmission(t *testing.T) {
+func TestRunnerRunPreparedCredentialAvailabilityBeforeAdmission(t *testing.T) {
 	const environmentName = "PROMPTKIT_PREPARED_EXECUTION_TEST_KEY"
-	t.Setenv(environmentName, "available-during-preparation")
-
-	profile := defaultExecutionProfile()
-	profile.APIKeyEnv = environmentName
-	validator := &recordingValidationPreparer{plan: &recordingPreparedValidation{}}
-	admitter := &fakeRunAdmitter{}
-	llmClient := &fakeLLM{resp: &domain.GenerateResponse{Content: "unexpected"}}
-	runner := NewRunner(
-		&fakePromptRepo{def: promptDef(domain.FormatText, domain.ValidationNone, 0)},
-		&fakeExecutionProfileRepo{profiles: map[string]*domain.ExecutionProfile{"exec": profile}},
-		nil,
-		defaultArtifactReader(),
-		defaultRenderer(),
-		llmClient,
-		validator,
-		admitter,
-	)
-	prepared, err := runner.PrepareExecution(context.Background(), domain.RunRequest{
-		PromptID:  "p",
-		ProfileID: "exec",
-		Inputs:    singleInputRef(),
-	})
-	if err != nil {
-		t.Fatalf("prepare execution: %v", err)
-	}
-	if err := os.Unsetenv(environmentName); err != nil {
-		t.Fatalf("unset credential environment: %v", err)
+	tests := []struct {
+		name           string
+		apiKeyRequired bool
+		profileEnv     bool
+		overrideEnv    bool
+		wantFailure    bool
+	}{
+		{name: "optional environment becomes unavailable", profileEnv: true},
+		{
+			name:           "required request environment becomes unavailable",
+			apiKeyRequired: true,
+			overrideEnv:    true,
+			wantFailure:    true,
+		},
 	}
 
-	result, err := runner.RunPrepared(context.Background(), prepared)
-	if result != nil {
-		t.Fatalf("credential failure returned partial result: %+v", result)
-	}
-	if !errors.Is(err, ErrInvalidRequest) || !errors.Is(err, ErrAPIKeyEnvMissing) {
-		t.Fatalf("credential error identities are missing: %v", err)
-	}
-	if len(admitter.backendIDs) != 0 || llmClient.calls != 0 {
-		t.Fatalf("credential failure reached admission or generation: admission=%v generation=%d", admitter.backendIDs, llmClient.calls)
-	}
-	if _, err := runner.RunPrepared(context.Background(), prepared); !errors.Is(err, ErrInvalidRequest) {
-		t.Fatalf("credential failure did not consume execution: %v", err)
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv(environmentName, "available-during-preparation")
+
+			profile := defaultExecutionProfile()
+			profile.APIKeyRequired = tc.apiKeyRequired
+			if tc.profileEnv {
+				profile.APIKeyEnv = environmentName
+			}
+			validator := &recordingValidationPreparer{plan: &recordingPreparedValidation{}}
+			admitter := &fakeRunAdmitter{}
+			llmClient := &fakeLLM{resp: &domain.GenerateResponse{Content: "ok"}}
+			runner := NewRunner(
+				&fakePromptRepo{def: promptDef(domain.FormatText, domain.ValidationNone, 0)},
+				&fakeExecutionProfileRepo{profiles: map[string]*domain.ExecutionProfile{"exec": profile}},
+				nil,
+				defaultArtifactReader(),
+				defaultRenderer(),
+				llmClient,
+				validator,
+				admitter,
+			)
+			request := domain.RunRequest{PromptID: "p", ProfileID: "exec", Inputs: singleInputRef()}
+			if tc.overrideEnv {
+				request.Execution = &domain.ExecutionTargetOverride{APIKeyEnv: environmentName}
+			}
+			prepared, err := runner.PrepareExecution(context.Background(), request)
+			if err != nil {
+				t.Fatalf("prepare execution: %v", err)
+			}
+			t.Setenv(environmentName, "")
+
+			result, err := runner.RunPrepared(context.Background(), prepared)
+			if tc.wantFailure {
+				if result != nil || !errors.Is(err, ErrInvalidRequest) || !errors.Is(err, ErrAPIKeyEnvMissing) {
+					t.Fatalf("required credential result = (%+v, %v)", result, err)
+				}
+				if len(admitter.backendIDs) != 0 || llmClient.calls != 0 {
+					t.Fatalf("required credential reached admission or generation: admission=%v generation=%d", admitter.backendIDs, llmClient.calls)
+				}
+			} else {
+				if result == nil || err != nil {
+					t.Fatalf("optional credential result = (%+v, %v), want success", result, err)
+				}
+				if len(admitter.backendIDs) != 1 || llmClient.calls != 1 {
+					t.Fatalf("optional credential admission=%v generation=%d, want one each", admitter.backendIDs, llmClient.calls)
+				}
+			}
+			if _, err := runner.RunPrepared(context.Background(), prepared); !errors.Is(err, ErrInvalidRequest) {
+				t.Fatalf("execution outcome did not consume handle: %v", err)
+			}
+		})
 	}
 }
 

internal/usecase/runner.go

@@ -624,12 +624,12 @@ func validateAPIKey(apiKeyEnv string, apiKey string, apiKeyRequired bool) error
 	if strings.TrimSpace(apiKey) != "" {
 		return nil
 	}
+	if !apiKeyRequired {
+		return nil
+	}
 	envName := strings.TrimSpace(apiKeyEnv)
 	if envName == "" {
-		if apiKeyRequired {
-			return ErrAPIKeyRequired
-		}
-		return nil
+		return ErrAPIKeyRequired
 	}
 	if strings.TrimSpace(os.Getenv(envName)) == "" {
 		return fmt.Errorf("%w: api key environment variable %q is not set", ErrAPIKeyEnvMissing, envName)

internal/usecase/runner_test.go

@@ -1787,22 +1787,26 @@ func TestRunnerRunAPIKeyEnvResolvesFromEnvironment(t *testing.T) {
 	}
 }
 
-func TestRunnerRunAPIKeyEnvMissingEnvironmentValueFailsClearly(t *testing.T) {
+func TestRunnerRunOptionalAPIKeyEnvMissingEnvironmentValueReachesLLM(t *testing.T) {
+	const environmentName = "PROMPTKIT_MISSING_KEY"
+	t.Setenv(environmentName, "")
+
 	promptRepo := &fakePromptRepo{def: promptDef(domain.FormatText, domain.ValidationNone, 0)}
 	execRepo := &fakeExecutionProfileRepo{profiles: map[string]*domain.ExecutionProfile{
-		"exec": {ID: "exec", Endpoint: "http://profile/v1", Model: "profile-model", APIKeyEnv: "PROMPTKIT_MISSING_KEY"},
+		"exec": {ID: "exec", Endpoint: "http://profile/v1", Model: "profile-model", APIKeyEnv: environmentName},
 	}}
-	runner := NewRunner(promptRepo, execRepo, nil, defaultArtifactReader(), defaultRenderer(), &fakeLLM{resp: &domain.GenerateResponse{Content: "ok"}}, nil, nil)
+	llmClient := &fakeLLM{resp: &domain.GenerateResponse{Content: "ok"}}
+	runner := NewRunner(promptRepo, execRepo, nil, defaultArtifactReader(), defaultRenderer(), llmClient, nil, nil)
 
-	_, err := runner.Run(context.Background(), domain.RunRequest{PromptID: "p", ProfileID: "exec", Inputs: singleInputRef()})
-	if !errors.Is(err, ErrInvalidRequest) {
-		t.Fatalf("expected ErrInvalidRequest, got %v", err)
+	result, err := runner.Run(context.Background(), domain.RunRequest{PromptID: "p", ProfileID: "exec", Inputs: singleInputRef()})
+	if err != nil || result == nil {
+		t.Fatalf("optional credential run = (%+v, %v), want success", result, err)
 	}
-	if !errors.Is(err, ErrAPIKeyEnvMissing) {
-		t.Fatalf("expected ErrAPIKeyEnvMissing, got %v", err)
+	if llmClient.calls != 1 {
+		t.Fatalf("LLM calls = %d, want 1", llmClient.calls)
 	}
-	if !strings.Contains(err.Error(), "PROMPTKIT_MISSING_KEY") {
-		t.Fatalf("expected missing env name in error, got %v", err)
+	if llmClient.lastReq.Target.APIKeyEnv != environmentName {
+		t.Fatalf("LLM api_key_env = %q, want %q", llmClient.lastReq.Target.APIKeyEnv, environmentName)
 	}
 }