hermes-agent/tests/hermes_cli/test_fallback_config.py
Rage Lopez 998e35313a fix(auth): honor per-entry key_env when resolving fallback providers
A fallback chain entry can name its API key via key_env (or the
api_key_env alias) per the fallback-providers docs, but only the gateway
path resolved it — TUI/desktop, cron, and CLI setup fallbacks ignored it,
so a fallback provider whose key lives in a non-standard env var never
resolved on those surfaces.

Centralize the inline-api_key-then-key_env lookup in
hermes_cli/fallback_config.resolve_entry_api_key() and use it at all four
fallback resolution sites (tui_gateway, cron scheduler, gateway runner,
CLI setup mixin); the CLI mixin also gains the base_url passthrough the
other surfaces already had.

Salvaged from PR #43861 (surgical reapply — the original branch predates
the #65264 fallback restructuring).
2026-07-16 07:19:36 -07:00

40 lines
1.8 KiB
Python

"""Tests for hermes_cli/fallback_config.py — fallback entry API-key resolution."""
from hermes_cli.fallback_config import resolve_entry_api_key
class TestResolveEntryApiKey:
def test_inline_api_key_wins(self, monkeypatch):
monkeypatch.setenv("FB_KEY", "env-key")
entry = {"provider": "custom", "api_key": "inline-key", "key_env": "FB_KEY"}
assert resolve_entry_api_key(entry) == "inline-key"
def test_key_env_resolves_from_environment(self, monkeypatch):
monkeypatch.setenv("FB_KEY", "env-key")
assert resolve_entry_api_key({"key_env": "FB_KEY"}) == "env-key"
def test_api_key_env_alias(self, monkeypatch):
monkeypatch.setenv("FB_ALIAS_KEY", "alias-key")
assert resolve_entry_api_key({"api_key_env": "FB_ALIAS_KEY"}) == "alias-key"
def test_unset_env_var_returns_none(self, monkeypatch):
monkeypatch.delenv("FB_MISSING", raising=False)
# None (not "") lets resolve_runtime_provider fall through to the
# provider's standard credential resolution.
assert resolve_entry_api_key({"key_env": "FB_MISSING"}) is None
def test_empty_env_var_returns_none(self, monkeypatch):
monkeypatch.setenv("FB_EMPTY", " ")
assert resolve_entry_api_key({"key_env": "FB_EMPTY"}) is None
def test_no_key_fields_returns_none(self):
assert resolve_entry_api_key({"provider": "openrouter", "model": "glm"}) is None
def test_non_dict_returns_none(self):
assert resolve_entry_api_key(None) is None
assert resolve_entry_api_key("nope") is None # type: ignore[arg-type]
def test_whitespace_inline_key_falls_through_to_env(self, monkeypatch):
monkeypatch.setenv("FB_KEY", "env-key")
entry = {"api_key": " ", "key_env": "FB_KEY"}
assert resolve_entry_api_key(entry) == "env-key"