Make optional API key environments nonblocking

internal/usecase/prepared_execution_test.go

@@ -3,7 +3,6 @@ package usecase
 import (
 	"context"
 	"errors"
-	"os"
 	"reflect"
 	"testing"
 
@@ -241,49 +240,76 @@ func excessivelyDeepPreparedJSONValue() any {
 	return value
 }
 
-func TestRunnerRunPreparedRechecksEnvironmentCredentialBeforeAdmission(t *testing.T) {
+func TestRunnerRunPreparedCredentialAvailabilityBeforeAdmission(t *testing.T) {
 	const environmentName = "PROMPTKIT_PREPARED_EXECUTION_TEST_KEY"
-	t.Setenv(environmentName, "available-during-preparation")
-
-	profile := defaultExecutionProfile()
-	profile.APIKeyEnv = environmentName
-	validator := &recordingValidationPreparer{plan: &recordingPreparedValidation{}}
-	admitter := &fakeRunAdmitter{}
-	llmClient := &fakeLLM{resp: &domain.GenerateResponse{Content: "unexpected"}}
-	runner := NewRunner(
-		&fakePromptRepo{def: promptDef(domain.FormatText, domain.ValidationNone, 0)},
-		&fakeExecutionProfileRepo{profiles: map[string]*domain.ExecutionProfile{"exec": profile}},
-		nil,
-		defaultArtifactReader(),
-		defaultRenderer(),
-		llmClient,
-		validator,
-		admitter,
-	)
-	prepared, err := runner.PrepareExecution(context.Background(), domain.RunRequest{
-		PromptID:  "p",
-		ProfileID: "exec",
-		Inputs:    singleInputRef(),
-	})
-	if err != nil {
-		t.Fatalf("prepare execution: %v", err)
-	}
-	if err := os.Unsetenv(environmentName); err != nil {
-		t.Fatalf("unset credential environment: %v", err)
+	tests := []struct {
+		name           string
+		apiKeyRequired bool
+		profileEnv     bool
+		overrideEnv    bool
+		wantFailure    bool
+	}{
+		{name: "optional environment becomes unavailable", profileEnv: true},
+		{
+			name:           "required request environment becomes unavailable",
+			apiKeyRequired: true,
+			overrideEnv:    true,
+			wantFailure:    true,
+		},
 	}
 
-	result, err := runner.RunPrepared(context.Background(), prepared)
-	if result != nil {
-		t.Fatalf("credential failure returned partial result: %+v", result)
-	}
-	if !errors.Is(err, ErrInvalidRequest) || !errors.Is(err, ErrAPIKeyEnvMissing) {
-		t.Fatalf("credential error identities are missing: %v", err)
-	}
-	if len(admitter.backendIDs) != 0 || llmClient.calls != 0 {
-		t.Fatalf("credential failure reached admission or generation: admission=%v generation=%d", admitter.backendIDs, llmClient.calls)
-	}
-	if _, err := runner.RunPrepared(context.Background(), prepared); !errors.Is(err, ErrInvalidRequest) {
-		t.Fatalf("credential failure did not consume execution: %v", err)
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv(environmentName, "available-during-preparation")
+
+			profile := defaultExecutionProfile()
+			profile.APIKeyRequired = tc.apiKeyRequired
+			if tc.profileEnv {
+				profile.APIKeyEnv = environmentName
+			}
+			validator := &recordingValidationPreparer{plan: &recordingPreparedValidation{}}
+			admitter := &fakeRunAdmitter{}
+			llmClient := &fakeLLM{resp: &domain.GenerateResponse{Content: "ok"}}
+			runner := NewRunner(
+				&fakePromptRepo{def: promptDef(domain.FormatText, domain.ValidationNone, 0)},
+				&fakeExecutionProfileRepo{profiles: map[string]*domain.ExecutionProfile{"exec": profile}},
+				nil,
+				defaultArtifactReader(),
+				defaultRenderer(),
+				llmClient,
+				validator,
+				admitter,
+			)
+			request := domain.RunRequest{PromptID: "p", ProfileID: "exec", Inputs: singleInputRef()}
+			if tc.overrideEnv {
+				request.Execution = &domain.ExecutionTargetOverride{APIKeyEnv: environmentName}
+			}
+			prepared, err := runner.PrepareExecution(context.Background(), request)
+			if err != nil {
+				t.Fatalf("prepare execution: %v", err)
+			}
+			t.Setenv(environmentName, "")
+
+			result, err := runner.RunPrepared(context.Background(), prepared)
+			if tc.wantFailure {
+				if result != nil || !errors.Is(err, ErrInvalidRequest) || !errors.Is(err, ErrAPIKeyEnvMissing) {
+					t.Fatalf("required credential result = (%+v, %v)", result, err)
+				}
+				if len(admitter.backendIDs) != 0 || llmClient.calls != 0 {
+					t.Fatalf("required credential reached admission or generation: admission=%v generation=%d", admitter.backendIDs, llmClient.calls)
+				}
+			} else {
+				if result == nil || err != nil {
+					t.Fatalf("optional credential result = (%+v, %v), want success", result, err)
+				}
+				if len(admitter.backendIDs) != 1 || llmClient.calls != 1 {
+					t.Fatalf("optional credential admission=%v generation=%d, want one each", admitter.backendIDs, llmClient.calls)
+				}
+			}
+			if _, err := runner.RunPrepared(context.Background(), prepared); !errors.Is(err, ErrInvalidRequest) {
+				t.Fatalf("execution outcome did not consume handle: %v", err)
+			}
+		})
 	}
 }