93 lines
3.8 KiB
Go
93 lines
3.8 KiB
Go
package main
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestLifeboatProviderIsOptionalAndLocalAdapterBacked(t *testing.T) {
|
|
if _, enabled, err := newLifeboatProvider(""); err != nil || enabled {
|
|
t.Fatalf("empty lifeboat URL should disable provider: enabled=%v err=%v", enabled, err)
|
|
}
|
|
provider, enabled, err := newLifeboatProvider("http://lifeboat:8080/v1")
|
|
if err != nil || !enabled {
|
|
t.Fatalf("configured lifeboat should be enabled: enabled=%v err=%v", enabled, err)
|
|
}
|
|
if provider.ProviderInstanceID != "local-lifeboat" || provider.EndpointRef != "local-lifeboat-v1" || provider.Provider == nil {
|
|
t.Fatalf("unexpected lifeboat registration: %+v", provider)
|
|
}
|
|
}
|
|
|
|
func TestGPUProviderTimeoutUsesBoundedConfigurableDefault(t *testing.T) {
|
|
t.Setenv("LOCAL_GPU_PROVIDER_TIMEOUT", "")
|
|
if got := durationEnv("LOCAL_GPU_PROVIDER_TIMEOUT", 60*time.Second); got != 60*time.Second {
|
|
t.Fatalf("default GPU timeout=%s", got)
|
|
}
|
|
t.Setenv("LOCAL_GPU_PROVIDER_TIMEOUT", "31s")
|
|
if got := durationEnv("LOCAL_GPU_PROVIDER_TIMEOUT", 60*time.Second); got != 31*time.Second {
|
|
t.Fatalf("configured GPU timeout=%s", got)
|
|
}
|
|
t.Setenv("LOCAL_GPU_PROVIDER_TIMEOUT", "invalid")
|
|
if got := durationEnv("LOCAL_GPU_PROVIDER_TIMEOUT", 60*time.Second); got != 60*time.Second {
|
|
t.Fatalf("invalid GPU timeout=%s", got)
|
|
}
|
|
}
|
|
|
|
func TestLoadLocalCPUProviderAPIKeyUsesProtectedFileReference(t *testing.T) {
|
|
t.Setenv("LOCAL_CPU_PROVIDER_API_KEY", "")
|
|
_ = os.Unsetenv("LOCAL_CPU_PROVIDER_API_KEY")
|
|
root := t.TempDir()
|
|
path := filepath.Join(root, "local_cpu_provider_api_key")
|
|
if err := os.WriteFile(path, []byte("resolved-key\n"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Setenv("LOCAL_CPU_PROVIDER_API_KEY_FILE", path)
|
|
t.Setenv("LOCAL_CPU_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-cpu/provider-api-key/v1")
|
|
t.Setenv("SECRET_BACKEND_ROOT", root)
|
|
key, err := loadLocalCPUProviderAPIKey()
|
|
if err != nil || key != "resolved-key" {
|
|
t.Fatalf("unexpected key resolution result: err=%v", err)
|
|
}
|
|
}
|
|
|
|
func TestLoadLocalCPUProviderAPIKeyRejectsDirectEnvironmentSecret(t *testing.T) {
|
|
t.Setenv("LOCAL_CPU_PROVIDER_API_KEY", "must-not-be-used")
|
|
t.Setenv("LOCAL_CPU_PROVIDER_API_KEY_FILE", "")
|
|
if _, err := loadLocalCPUProviderAPIKey(); err == nil {
|
|
t.Fatal("expected direct environment secret to be rejected")
|
|
}
|
|
}
|
|
|
|
func TestLoadProviderAPIKeySupportsMediumCredentialRef(t *testing.T) {
|
|
t.Setenv("LOCAL_MEDIUM_PROVIDER_API_KEY", "")
|
|
_ = os.Unsetenv("LOCAL_MEDIUM_PROVIDER_API_KEY")
|
|
root := t.TempDir()
|
|
path := filepath.Join(root, "medium_provider_api_key")
|
|
if err := os.WriteFile(path, []byte("medium-key\n"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Setenv("LOCAL_MEDIUM_PROVIDER_API_KEY_FILE", path)
|
|
t.Setenv("LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-medium/provider-api-key/v1")
|
|
t.Setenv("SECRET_BACKEND_ROOT", root)
|
|
key, err := loadProviderAPIKey("LOCAL_MEDIUM_PROVIDER_API_KEY", "LOCAL_MEDIUM_PROVIDER_API_KEY_FILE", "LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-medium/provider-api-key/v1")
|
|
if err != nil || key != "medium-key" {
|
|
t.Fatalf("unexpected medium key resolution result: err=%v", err)
|
|
}
|
|
}
|
|
|
|
func TestLoadProviderAPIKeyRejectsMediumDirectEnvironmentSecret(t *testing.T) {
|
|
t.Setenv("LOCAL_MEDIUM_PROVIDER_API_KEY", "must-not-be-used")
|
|
t.Setenv("LOCAL_MEDIUM_PROVIDER_API_KEY_FILE", "")
|
|
if _, err := loadProviderAPIKey("LOCAL_MEDIUM_PROVIDER_API_KEY", "LOCAL_MEDIUM_PROVIDER_API_KEY_FILE", "LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-medium/provider-api-key/v1"); err == nil {
|
|
t.Fatal("expected direct medium environment secret to be rejected")
|
|
}
|
|
}
|
|
|
|
func TestReadProtectedRuntimeValueRejectsPathOutsideSecretRoot(t *testing.T) {
|
|
if _, err := readProtectedRuntimeValue("/tmp/not-a-domovoy-secret"); err == nil {
|
|
t.Fatal("expected protected path rejection")
|
|
}
|
|
}
|