You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
72 lines
2.2 KiB
72 lines
2.2 KiB
import pytest |
|
|
|
from voice_transcriptor.services.credentials import CredentialError, CredentialService |
|
|
|
|
|
class FakeKeyring: |
|
def __init__(self) -> None: |
|
self.value: str | None = None |
|
self.calls: list[tuple[str, str, str | None]] = [] |
|
|
|
def get_password(self, service: str, account: str) -> str | None: |
|
self.calls.append(("get", service, account)) |
|
return self.value |
|
|
|
def set_password(self, service: str, account: str, value: str) -> None: |
|
self.calls.append(("set", service, account, value)) |
|
self.value = value |
|
|
|
|
|
def test_get_api_key_uses_stable_keyring_service_and_account() -> None: |
|
backend = FakeKeyring() |
|
backend.value = "secret" |
|
|
|
assert CredentialService(backend).get_api_key() == "secret" |
|
assert backend.calls == [("get", "voice-transcriptor", "openai-api-key")] |
|
|
|
|
|
def test_has_api_key_reflects_keyring_value() -> None: |
|
backend = FakeKeyring() |
|
service = CredentialService(backend) |
|
|
|
assert service.has_api_key() is False |
|
backend.value = "secret" |
|
assert service.has_api_key() is True |
|
|
|
|
|
def test_set_api_key_rejects_blank_values() -> None: |
|
backend = FakeKeyring() |
|
|
|
with pytest.raises(CredentialError, match="API key"): |
|
CredentialService(backend).set_api_key(" \t") |
|
|
|
assert backend.calls == [] |
|
|
|
|
|
def test_set_api_key_persists_nonblank_value() -> None: |
|
backend = FakeKeyring() |
|
|
|
CredentialService(backend).set_api_key("secret") |
|
|
|
assert backend.calls == [("set", "voice-transcriptor", "openai-api-key", "secret")] |
|
|
|
|
|
@pytest.mark.parametrize("method", ["get_password", "set_password"]) |
|
def test_backend_failures_are_sanitized(method: str) -> None: |
|
class FailingKeyring: |
|
def get_password(self, service: str, account: str) -> str | None: |
|
raise RuntimeError("backend leaked secret") |
|
|
|
def set_password(self, service: str, account: str, value: str) -> None: |
|
raise RuntimeError("backend leaked secret") |
|
|
|
service = CredentialService(FailingKeyring()) |
|
|
|
with pytest.raises(CredentialError) as caught: |
|
if method == "get_password": |
|
service.get_api_key() |
|
else: |
|
service.set_api_key("secret") |
|
|
|
assert "secret" not in str(caught.value).lower() |
|
assert caught.value.__cause__ is None
|
|
|