74 lines
2.9 KiB
Python
74 lines
2.9 KiB
Python
"""Tests for the encrypted config cache (stirling.config.config_cache)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from stirling.config import config_cache
|
|
from stirling.contracts import ConfigPushRequest
|
|
|
|
|
|
def _sample() -> ConfigPushRequest:
|
|
return ConfigPushRequest.model_validate(
|
|
{
|
|
"models": {
|
|
"provider": "anthropic",
|
|
"smartModel": "claude-haiku-4-5",
|
|
"fastModel": "claude-haiku-4-5",
|
|
"smartMaxTokens": 8192,
|
|
"fastMaxTokens": 2048,
|
|
"apiKey": "secret-key-value",
|
|
"baseUrl": "",
|
|
},
|
|
"rag": {
|
|
"embeddingProvider": "voyageai",
|
|
"embeddingModel": "voyage-4",
|
|
"embeddingApiKey": "embed-secret",
|
|
"embeddingBaseUrl": "",
|
|
"topK": 20,
|
|
"maxSearches": 5,
|
|
},
|
|
"limits": {"maxPages": 200, "maxCharacters": 200000, "modelMaxConcurrency": 32},
|
|
}
|
|
)
|
|
|
|
|
|
def test_roundtrip_with_shared_secret(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
|
|
monkeypatch.setattr(config_cache, "_shared_secret", lambda: "the-shared-secret")
|
|
req = _sample()
|
|
config_cache.save_config(req, data_dir=tmp_path)
|
|
# HKDF-from-secret path: no keyfile is written.
|
|
assert not (tmp_path / "ai_config_cache.key").exists()
|
|
assert config_cache.load_config(data_dir=tmp_path) == req
|
|
# Secrets are encrypted at rest.
|
|
assert b"secret-key-value" not in (tmp_path / "ai_config_cache.enc").read_bytes()
|
|
|
|
|
|
def test_roundtrip_with_keyfile_when_no_secret(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
|
|
monkeypatch.setattr(config_cache, "_shared_secret", lambda: "")
|
|
req = _sample()
|
|
config_cache.save_config(req, data_dir=tmp_path)
|
|
# No shared secret: a random keyfile is generated and reused for decrypt.
|
|
assert (tmp_path / "ai_config_cache.key").exists()
|
|
assert config_cache.load_config(data_dir=tmp_path) == req
|
|
|
|
|
|
def test_load_missing_returns_none(tmp_path: Path) -> None:
|
|
assert config_cache.load_config(data_dir=tmp_path) is None
|
|
|
|
|
|
def test_load_corrupt_returns_none(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
|
|
monkeypatch.setattr(config_cache, "_shared_secret", lambda: "a-secret")
|
|
(tmp_path / "ai_config_cache.enc").write_bytes(b"not-a-valid-fernet-token")
|
|
assert config_cache.load_config(data_dir=tmp_path) is None
|
|
|
|
|
|
def test_wrong_key_returns_none(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
|
|
monkeypatch.setattr(config_cache, "_shared_secret", lambda: "secret-a")
|
|
config_cache.save_config(_sample(), data_dir=tmp_path)
|
|
# A different secret derives a different key -> decrypt fails, returns None.
|
|
monkeypatch.setattr(config_cache, "_shared_secret", lambda: "secret-b")
|
|
assert config_cache.load_config(data_dir=tmp_path) is None
|