Import AITURK IDE 1.0.0-beta.1 from Hermes 63279301; preserve MIT license

tests/agent/test_credential_pool_provider_boundary.py

@@ -0,0 +1,235 @@
+"""Credential pools must never cross provider or custom-endpoint boundaries."""
+
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from agent.credential_pool import (
+    credential_pool_matches_provider,
+    resolve_runtime_pool_key,
+)
+from hermes_cli import runtime_provider as rp
+
+
+def test_provider_match_requires_exact_non_custom_identity():
+    assert credential_pool_matches_provider("deepseek", "deepseek")
+    assert not credential_pool_matches_provider("openai-codex", "deepseek")
+    assert not credential_pool_matches_provider("", "deepseek")
+
+
+def test_custom_pool_match_is_scoped_by_endpoint():
+    with patch(
+        "agent.credential_pool.get_custom_provider_pool_key",
+        return_value="custom:lab",
+    ):
+        assert credential_pool_matches_provider(
+            "custom:lab", "custom", base_url="https://lab.example/v1"
+        )
+        assert not credential_pool_matches_provider(
+            "custom:other", "custom", base_url="https://lab.example/v1"
+        )
+
+
+def test_named_custom_pool_match_requires_configured_identity_and_endpoint():
+    configured = [
+        (
+            "gemini-display",
+            {
+                "name": "Gemini Display",
+                "provider_key": "gemini-no-filter",
+                "base_url": "https://generativelanguage.googleapis.com/v1beta/",
+            },
+        )
+    ]
+    with patch("agent.credential_pool._iter_custom_providers", return_value=configured):
+        assert credential_pool_matches_provider(
+            "custom:gemini-display",
+            "gemini-no-filter",
+            base_url="https://generativelanguage.googleapis.com/v1beta",
+        )
+        assert credential_pool_matches_provider(
+            "custom:gemini-display",
+            "custom:gemini-no-filter",
+            base_url="https://generativelanguage.googleapis.com/v1beta",
+        )
+        assert not credential_pool_matches_provider(
+            "custom:gemini-display",
+            "gemini-no-filter",
+            base_url="https://fallback.example/v1",
+        )
+        assert not credential_pool_matches_provider(
+            "custom:gemini-display",
+            "custom:gemini-no-filter",
+            base_url="https://fallback.example/v1",
+        )
+        assert not credential_pool_matches_provider(
+            "custom:gemini-display",
+            "other-provider",
+            base_url="https://generativelanguage.googleapis.com/v1beta",
+        )
+
+
+def test_runtime_pool_key_resolves_all_custom_runtime_identities():
+    endpoint = "https://generativelanguage.googleapis.com/v1beta"
+    configured = [
+        (
+            "sibling-display",
+            {
+                "name": "Sibling Display",
+                "provider_key": "sibling-provider",
+                "base_url": endpoint,
+            },
+        ),
+        (
+            "gemini-display",
+            {
+                "name": "Gemini Display",
+                "provider_key": "gemini-no-filter",
+                "base_url": endpoint,
+            },
+        )
+    ]
+    with patch("agent.credential_pool._iter_custom_providers", return_value=configured):
+        assert resolve_runtime_pool_key("custom", endpoint) == "sibling-provider"
+        assert (
+            resolve_runtime_pool_key("gemini-no-filter", endpoint)
+            == "gemini-no-filter"
+        )
+        assert (
+            resolve_runtime_pool_key("custom:gemini-no-filter", endpoint)
+            == "gemini-no-filter"
+        )
+        assert (
+            resolve_runtime_pool_key(
+                "gemini-no-filter",
+                "https://fallback.example/v1",
+            )
+            == "gemini-no-filter"
+        )
+
+
+def test_runtime_pool_key_resolves_modern_provider_in_mixed_config():
+    endpoint = "https://generativelanguage.googleapis.com/v1beta"
+    config = {
+        "custom_providers": [
+            {
+                "name": "Legacy Provider",
+                "base_url": "https://legacy.example/v1",
+            }
+        ],
+        "providers": {
+            "gemini-no-filter": {
+                "name": "Gemini Display",
+                "api": endpoint,
+            }
+        },
+    }
+
+    with patch("agent.credential_pool._load_config_safe", return_value=config):
+        assert (
+            resolve_runtime_pool_key("gemini-no-filter", endpoint)
+            == "gemini-no-filter"
+        )
+        assert (
+            resolve_runtime_pool_key("custom:gemini-no-filter", endpoint)
+            == "gemini-no-filter"
+        )
+        assert (
+            resolve_runtime_pool_key(
+                "custom:gemini-no-filter",
+                "https://fallback.example/v1",
+            )
+            == "custom:gemini-no-filter"
+        )
+
+
+def test_keyed_provider_pool_matches_runtime_aliases():
+    configured = [
+        (
+            "b.ai",
+            {
+                "name": "B.AI",
+                "provider_key": "b-ai",
+                "base_url": "https://api.b.ai/v1",
+            },
+        )
+    ]
+    with patch("agent.credential_pool._iter_custom_providers", return_value=configured):
+        assert credential_pool_matches_provider(
+            "b-ai", "b-ai", base_url="https://api.b.ai/v1"
+        )
+        assert credential_pool_matches_provider(
+            "b-ai", "custom", base_url="https://api.b.ai/v1"
+        )
+        assert credential_pool_matches_provider(
+            "b-ai", "custom:b.ai", base_url="https://api.b.ai/v1"
+        )
+        assert not credential_pool_matches_provider(
+            "b-ai", "custom", base_url="https://other.example/v1"
+        )
+        assert not credential_pool_matches_provider(
+            "b-ai", "deepseek", base_url="https://api.b.ai/v1"
+        )
+
+
+def test_runtime_pool_key_prefers_durable_provider_slug():
+    endpoint = "https://api.b.ai/v1"
+    configured = [
+        (
+            "b.ai",
+            {
+                "name": "B.AI",
+                "provider_key": "b-ai",
+                "base_url": endpoint,
+            },
+        )
+    ]
+    with patch("agent.credential_pool._iter_custom_providers", return_value=configured):
+        assert resolve_runtime_pool_key("b-ai", endpoint) == "b-ai"
+        assert resolve_runtime_pool_key("custom", endpoint) == "b-ai"
+        assert resolve_runtime_pool_key("custom:b.ai", endpoint) == "b-ai"
+
+
+def test_runtime_pool_key_preserves_non_custom_identity():
+    with patch("agent.credential_pool._iter_custom_providers", return_value=[]):
+        assert (
+            resolve_runtime_pool_key("openai-codex", "https://chatgpt.com/backend-api")
+            == "openai-codex"
+        )
+
+
+def test_runtime_ignores_pool_loaded_for_different_provider(monkeypatch):
+    entry = SimpleNamespace(
+        provider="openai-codex",
+        access_token="wrong-token",
+        runtime_api_key="wrong-token",
+        runtime_base_url="https://chatgpt.com/backend-api/codex",
+        base_url="https://chatgpt.com/backend-api/codex",
+    )
+    pool = SimpleNamespace(
+        provider="openai-codex",
+        has_credentials=lambda: True,
+        select=lambda: entry,
+    )
+    monkeypatch.setattr(rp, "load_pool", lambda _provider: pool)
+    monkeypatch.setattr(rp, "resolve_provider", lambda *_a, **_kw: "deepseek")
+    monkeypatch.setattr(
+        rp,
+        "_get_model_config",
+        lambda: {"provider": "deepseek", "default": "deepseek-chat"},
+    )
+    monkeypatch.setattr(
+        rp,
+        "resolve_api_key_provider_credentials",
+        lambda _provider: {
+            "provider": "deepseek",
+            "api_key": "deepseek-key",
+            "base_url": "https://api.deepseek.com/v1",
+            "source": "env",
+        },
+    )
+
+    resolved = rp.resolve_runtime_provider(requested="deepseek")
+
+    assert resolved["provider"] == "deepseek"
+    assert resolved["api_key"] == "deepseek-key"
+    assert resolved["base_url"] == "https://api.deepseek.com/v1"