mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-23 16:36:23 +00:00
8e089db689
Keep the env-presence row, but add a real Bitwarden probe so revoked or malformed tokens no longer look healthy in hermes secrets bitwarden status. Also document the new status behavior and lock it in with a dedicated regression test. Refs: NousResearch/hermes-agent#40275 Tested: ./scripts/run_tests.sh tests/hermes_cli/test_bitwarden_status.py tests/test_bitwarden_secrets.py Tested: .venv/bin/python -m ruff check hermes_cli/secrets_cli.py tests/hermes_cli/test_bitwarden_status.py
110 lines
3.4 KiB
Python
110 lines
3.4 KiB
Python
from __future__ import annotations
|
|
|
|
from argparse import Namespace
|
|
from pathlib import Path
|
|
|
|
|
|
def _bitwarden_config(*, enabled: bool = True, server_url: str = "") -> dict:
|
|
return {
|
|
"secrets": {
|
|
"bitwarden": {
|
|
"enabled": enabled,
|
|
"access_token_env": "BWS_ACCESS_TOKEN",
|
|
"project_id": "proj-123",
|
|
"server_url": server_url,
|
|
"cache_ttl_seconds": 300,
|
|
"override_existing": True,
|
|
"auto_install": True,
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
def test_status_surfaces_failed_token_validation(monkeypatch, capsys):
|
|
from hermes_cli import secrets_cli
|
|
|
|
seen = {}
|
|
|
|
monkeypatch.setattr(
|
|
secrets_cli,
|
|
"load_config",
|
|
lambda: _bitwarden_config(server_url="https://vault.bitwarden.eu"),
|
|
)
|
|
monkeypatch.setenv("BWS_ACCESS_TOKEN", "0.invalid-token")
|
|
monkeypatch.setattr(
|
|
secrets_cli.bw,
|
|
"find_bws",
|
|
lambda install_if_missing=False: Path("/tmp/bws"),
|
|
)
|
|
monkeypatch.setattr(secrets_cli, "_bws_version", lambda _binary: "bws v2.1.0")
|
|
|
|
def _fake_list_projects(binary, token, console, *, server_url=""):
|
|
seen["binary"] = binary
|
|
seen["token"] = token
|
|
seen["server_url"] = server_url
|
|
console.print(" bws project list failed: Doesn't contain a decryption key")
|
|
console.print(
|
|
" This usually means the access token is wrong or revoked. "
|
|
"Double-check it in the Bitwarden web app."
|
|
)
|
|
return None
|
|
|
|
monkeypatch.setattr(secrets_cli, "_list_projects", _fake_list_projects)
|
|
|
|
assert secrets_cli.cmd_status(Namespace()) == 0
|
|
|
|
out = capsys.readouterr().out
|
|
assert "Token in env" in out
|
|
assert "Token validation" in out
|
|
assert "failed" in out
|
|
assert "Doesn't contain a decryption key" in out
|
|
assert "wrong or revoked" in out
|
|
assert seen == {
|
|
"binary": Path("/tmp/bws"),
|
|
"token": "0.invalid-token",
|
|
"server_url": "https://vault.bitwarden.eu",
|
|
}
|
|
|
|
|
|
def test_status_warns_when_token_does_not_look_like_bsm_token(monkeypatch, capsys):
|
|
from hermes_cli import secrets_cli
|
|
|
|
monkeypatch.setattr(secrets_cli, "load_config", lambda: _bitwarden_config())
|
|
monkeypatch.setenv("BWS_ACCESS_TOKEN", "not-a-bitwarden-token")
|
|
monkeypatch.setattr(
|
|
secrets_cli.bw,
|
|
"find_bws",
|
|
lambda install_if_missing=False: Path("/tmp/bws"),
|
|
)
|
|
monkeypatch.setattr(secrets_cli, "_bws_version", lambda _binary: "bws v2.1.0")
|
|
monkeypatch.setattr(
|
|
secrets_cli,
|
|
"_list_projects",
|
|
lambda binary, token, console, *, server_url="": [],
|
|
)
|
|
|
|
assert secrets_cli.cmd_status(Namespace()) == 0
|
|
|
|
out = capsys.readouterr().out
|
|
assert "Token validation" in out
|
|
assert "passed" in out
|
|
assert "doesn't start with '0.'" in out
|
|
|
|
|
|
def test_status_marks_validation_as_not_checked_without_bws_binary(monkeypatch, capsys):
|
|
from hermes_cli import secrets_cli
|
|
|
|
monkeypatch.setattr(secrets_cli, "load_config", lambda: _bitwarden_config())
|
|
monkeypatch.setenv("BWS_ACCESS_TOKEN", "0.token-present")
|
|
monkeypatch.setattr(
|
|
secrets_cli.bw,
|
|
"find_bws",
|
|
lambda install_if_missing=False: None,
|
|
)
|
|
|
|
assert secrets_cli.cmd_status(Namespace()) == 0
|
|
|
|
out = capsys.readouterr().out
|
|
assert "Token validation" in out
|
|
assert "not checked" in out
|
|
assert "bws not installed" in out
|