chore: import upstream snapshot with attribution

tests/cli/test_auth_command.py

@@ -0,0 +1,165 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import keyring
+from click.testing import CliRunner
+
+from config.llm_credentials import resolve_llm_api_key
+from surfaces.cli.__main__ import cli
+from surfaces.cli.llm_auth.service import AuthSetupResult
+from tests.shared.keyring_backend import MemoryKeyring
+
+
+def _patch_auth_env(monkeypatch, tmp_path: Path) -> Path:
+    env_path = tmp_path / ".env"
+    monkeypatch.delenv("OPENSRE_DISABLE_KEYRING", raising=False)
+    monkeypatch.delenv("DEEPSEEK_API_KEY", raising=False)
+    monkeypatch.setenv("OPENSRE_LLM_AUTH_METADATA_PATH", str(tmp_path / "llm-auth.json"))
+    monkeypatch.setattr("surfaces.cli.wizard.env_sync.PROJECT_ENV_PATH", env_path)
+    monkeypatch.setattr(
+        "surfaces.cli.wizard.store.get_store_path", lambda: tmp_path / "opensre.json"
+    )
+    return env_path
+
+
+def test_auth_login_deepseek_stores_keyring_not_env(monkeypatch, tmp_path: Path) -> None:
+    env_path = _patch_auth_env(monkeypatch, tmp_path)
+
+    previous_backend = keyring.get_keyring()
+    keyring.set_keyring(MemoryKeyring())
+    try:
+        result = CliRunner().invoke(
+            cli,
+            [
+                "auth",
+                "login",
+                "deepseek",
+                "--api-key",
+                "deepseek-secret",
+                "--no-validate",
+                "--no-open-browser",
+            ],
+        )
+
+        assert result.exit_code == 0, result.output
+        assert "Authenticated: DeepSeek API key" in result.output
+        assert resolve_llm_api_key("DEEPSEEK_API_KEY") == "deepseek-secret"
+        env_content = env_path.read_text(encoding="utf-8")
+        assert "LLM_PROVIDER=deepseek\n" in env_content
+        assert "DEEPSEEK_API_KEY=" not in env_content
+    finally:
+        keyring.set_keyring(previous_backend)
+
+
+def test_auth_status_provider_reports_metadata_without_keychain_verify(
+    monkeypatch, tmp_path: Path
+) -> None:
+    _patch_auth_env(monkeypatch, tmp_path)
+    previous_backend = keyring.get_keyring()
+    keyring.set_keyring(MemoryKeyring())
+    try:
+        CliRunner().invoke(
+            cli,
+            [
+                "auth",
+                "login",
+                "deepseek",
+                "--api-key",
+                "deepseek-secret",
+                "--no-validate",
+                "--no-open-browser",
+            ],
+        )
+
+        result = CliRunner().invoke(cli, ["auth", "status", "deepseek"])
+
+        assert result.exit_code == 0, result.output
+        assert "deepseek" in result.output
+        assert "ok" in result.output
+        assert "metadata" in result.output
+    finally:
+        keyring.set_keyring(previous_backend)
+
+
+def test_auth_verify_provider_reports_keyring_source(monkeypatch, tmp_path: Path) -> None:
+    _patch_auth_env(monkeypatch, tmp_path)
+    previous_backend = keyring.get_keyring()
+    keyring.set_keyring(MemoryKeyring())
+    try:
+        CliRunner().invoke(
+            cli,
+            [
+                "auth",
+                "login",
+                "deepseek",
+                "--api-key",
+                "deepseek-secret",
+                "--no-validate",
+                "--no-open-browser",
+            ],
+        )
+
+        result = CliRunner().invoke(cli, ["auth", "verify", "deepseek"])
+
+        assert result.exit_code == 0, result.output
+        assert "Provider : deepseek" in result.output
+        assert "Status   : ok" in result.output
+        assert "Source   : keyring" in result.output
+        assert "secure local storage" in result.output
+    finally:
+        keyring.set_keyring(previous_backend)
+
+
+def test_auth_login_chatgpt_delegates_to_subscription_provider(monkeypatch, tmp_path: Path) -> None:
+    _patch_auth_env(monkeypatch, tmp_path)
+    calls: list[tuple[str, bool]] = []
+
+    def _fake_configure(**kwargs):
+        calls.append((kwargs["profile"].name, kwargs["launch_login"]))
+        return AuthSetupResult(
+            provider="codex",
+            model="",
+            source="vendor-cli",
+            detail="Logged in.",
+            env_path=tmp_path / ".env",
+        )
+
+    monkeypatch.setattr(
+        "surfaces.cli.commands.auth.configure_cli_subscription_provider", _fake_configure
+    )
+
+    result = CliRunner().invoke(
+        cli,
+        ["auth", "login", "chatgpt", "--no-launch-login", "--no-open-browser"],
+    )
+
+    assert result.exit_code == 0, result.output
+    assert calls == [("chatgpt", False)]
+    assert "Provider     : codex" in result.output
+
+
+def test_auth_logout_deepseek_removes_keyring_secret(monkeypatch, tmp_path: Path) -> None:
+    _patch_auth_env(monkeypatch, tmp_path)
+    previous_backend = keyring.get_keyring()
+    keyring.set_keyring(MemoryKeyring())
+    try:
+        CliRunner().invoke(
+            cli,
+            [
+                "auth",
+                "login",
+                "deepseek",
+                "--api-key",
+                "deepseek-secret",
+                "--no-validate",
+                "--no-open-browser",
+            ],
+        )
+
+        result = CliRunner().invoke(cli, ["auth", "logout", "deepseek"])
+
+        assert result.exit_code == 0, result.output
+        assert resolve_llm_api_key("DEEPSEEK_API_KEY") == ""
+    finally:
+        keyring.set_keyring(previous_backend)