mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-21 16:18:55 +00:00
4a4a0c2fc7
Retain the provider-boundary core of #52799 while reusing the pool reload and handoff paths already landed in #53591 and #62417. Co-authored-by: Flownium <157689911+itsflownium@users.noreply.github.com>
64 lines
No EOL
2.2 KiB
Python
64 lines
No EOL
2.2 KiB
Python
"""Credential pools must never cross provider or custom-endpoint boundaries."""
|
|
|
|
from types import SimpleNamespace
|
|
from unittest.mock import patch
|
|
|
|
from agent.credential_pool import credential_pool_matches_provider
|
|
from hermes_cli import runtime_provider as rp
|
|
|
|
|
|
def test_provider_match_requires_exact_non_custom_identity():
|
|
assert credential_pool_matches_provider("deepseek", "deepseek")
|
|
assert not credential_pool_matches_provider("openai-codex", "deepseek")
|
|
assert not credential_pool_matches_provider("", "deepseek")
|
|
|
|
|
|
def test_custom_pool_match_is_scoped_by_endpoint():
|
|
with patch(
|
|
"agent.credential_pool.get_custom_provider_pool_key",
|
|
return_value="custom:lab",
|
|
):
|
|
assert credential_pool_matches_provider(
|
|
"custom:lab", "custom", base_url="https://lab.example/v1"
|
|
)
|
|
assert not credential_pool_matches_provider(
|
|
"custom:other", "custom", base_url="https://lab.example/v1"
|
|
)
|
|
|
|
|
|
def test_runtime_ignores_pool_loaded_for_different_provider(monkeypatch):
|
|
entry = SimpleNamespace(
|
|
provider="openai-codex",
|
|
access_token="wrong-token",
|
|
runtime_api_key="wrong-token",
|
|
runtime_base_url="https://chatgpt.com/backend-api/codex",
|
|
base_url="https://chatgpt.com/backend-api/codex",
|
|
)
|
|
pool = SimpleNamespace(
|
|
provider="openai-codex",
|
|
has_credentials=lambda: True,
|
|
select=lambda: entry,
|
|
)
|
|
monkeypatch.setattr(rp, "load_pool", lambda _provider: pool)
|
|
monkeypatch.setattr(rp, "resolve_provider", lambda *_a, **_kw: "deepseek")
|
|
monkeypatch.setattr(
|
|
rp,
|
|
"_get_model_config",
|
|
lambda: {"provider": "deepseek", "default": "deepseek-chat"},
|
|
)
|
|
monkeypatch.setattr(
|
|
rp,
|
|
"resolve_api_key_provider_credentials",
|
|
lambda _provider: {
|
|
"provider": "deepseek",
|
|
"api_key": "deepseek-key",
|
|
"base_url": "https://api.deepseek.com/v1",
|
|
"source": "env",
|
|
},
|
|
)
|
|
|
|
resolved = rp.resolve_runtime_provider(requested="deepseek")
|
|
|
|
assert resolved["provider"] == "deepseek"
|
|
assert resolved["api_key"] == "deepseek-key"
|
|
assert resolved["base_url"] == "https://api.deepseek.com/v1" |