wehub-resource-sync
b4fbd6fe9f
Deploy Site / deploy-vercel (push) Has been skipped
Deploy Site / deploy-docs (push) Has been skipped
Build Skills Index / build-index (push) Has been skipped
CI / Deny unrelated histories (push) Has been skipped
CI / Detect affected areas (push) Successful in 27m35s
CI / OSV scan (push) Failing after 4s
CI / Build&Test Docker image (push) Successful in 9s
CI / Supply-chain scan (push) Has been skipped
CI / Lint Docker scripts (push) Failing after 5m13s
CI / Check contributors (push) Failing after 12m8s
CI / Docs Site (push) Failing after 12m8s
CI / TypeScript (push) Failing after 12m8s
CI / Python lints (push) Failing after 12m9s
CI / Python tests (push) Failing after 12m9s
CI / Check uv.lock (push) Failing after 23m22s
CI / CI timing report (push) Has been cancelled
Build Skills Index / trigger-deploy (push) Has been cancelled
CI / All required checks pass (push) Has been cancelled
64 lines
2.2 KiB
Python
64 lines
2.2 KiB
Python
"""Credential pools must never cross provider or custom-endpoint boundaries."""
|
|
|
|
from types import SimpleNamespace
|
|
from unittest.mock import patch
|
|
|
|
from agent.credential_pool import credential_pool_matches_provider
|
|
from hermes_cli import runtime_provider as rp
|
|
|
|
|
|
def test_provider_match_requires_exact_non_custom_identity():
|
|
assert credential_pool_matches_provider("deepseek", "deepseek")
|
|
assert not credential_pool_matches_provider("openai-codex", "deepseek")
|
|
assert not credential_pool_matches_provider("", "deepseek")
|
|
|
|
|
|
def test_custom_pool_match_is_scoped_by_endpoint():
|
|
with patch(
|
|
"agent.credential_pool.get_custom_provider_pool_key",
|
|
return_value="custom:lab",
|
|
):
|
|
assert credential_pool_matches_provider(
|
|
"custom:lab", "custom", base_url="https://lab.example/v1"
|
|
)
|
|
assert not credential_pool_matches_provider(
|
|
"custom:other", "custom", base_url="https://lab.example/v1"
|
|
)
|
|
|
|
|
|
def test_runtime_ignores_pool_loaded_for_different_provider(monkeypatch):
|
|
entry = SimpleNamespace(
|
|
provider="openai-codex",
|
|
access_token="wrong-token",
|
|
runtime_api_key="wrong-token",
|
|
runtime_base_url="https://chatgpt.com/backend-api/codex",
|
|
base_url="https://chatgpt.com/backend-api/codex",
|
|
)
|
|
pool = SimpleNamespace(
|
|
provider="openai-codex",
|
|
has_credentials=lambda: True,
|
|
select=lambda: entry,
|
|
)
|
|
monkeypatch.setattr(rp, "load_pool", lambda _provider: pool)
|
|
monkeypatch.setattr(rp, "resolve_provider", lambda *_a, **_kw: "deepseek")
|
|
monkeypatch.setattr(
|
|
rp,
|
|
"_get_model_config",
|
|
lambda: {"provider": "deepseek", "default": "deepseek-chat"},
|
|
)
|
|
monkeypatch.setattr(
|
|
rp,
|
|
"resolve_api_key_provider_credentials",
|
|
lambda _provider: {
|
|
"provider": "deepseek",
|
|
"api_key": "deepseek-key",
|
|
"base_url": "https://api.deepseek.com/v1",
|
|
"source": "env",
|
|
},
|
|
)
|
|
|
|
resolved = rp.resolve_runtime_provider(requested="deepseek")
|
|
|
|
assert resolved["provider"] == "deepseek"
|
|
assert resolved["api_key"] == "deepseek-key"
|
|
assert resolved["base_url"] == "https://api.deepseek.com/v1" |