| 1 | package config |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "os" |
| 6 | "testing" |
| 7 | |
| 8 | "reasonix/internal/testenv" |
| 9 | ) |
| 10 | |
| 11 | func TestMain(m *testing.M) { |
| 12 | if os.Getenv("REASONIX_CONFIG_LOCK_HELPER") == "1" { |
| 13 | os.Exit(m.Run()) |
| 14 | } |
| 15 | // RunWithIsolatedUserState redirects every path-shaped location, but the OS |
| 16 | // keyring has no environment variable in front of it, so legacy migration |
| 17 | // would read the credentials of whoever is running the tests. Cases that |
| 18 | // exercise the lookup substitute their own. |
| 19 | legacyKeyringProbeLookup = func(context.Context, string) legacyKeyringOutcome { |
| 20 | return legacyKeyringOutcome{Status: legacyKeyringAbsent} |
| 21 | } |
| 22 | testenv.RunWithIsolatedUserState(m) |
| 23 | } |
| 24 | |
| 25 | // Guards the isolation above: a clean CI runner has an empty keyring and would |
| 26 | // stay green either way, so the substitution itself is what gets asserted. |
| 27 | func TestKeyringLookupStaysOutOfTheRealStore(t *testing.T) { |
| 28 | for _, key := range []string{"DEEPSEEK_API_KEY", "OPENAI_API_KEY", "ANTHROPIC_API_KEY"} { |
| 29 | o := legacyKeyringProbeLookup(context.Background(), key) |
| 30 | if o.Status != legacyKeyringAbsent || o.Value != "" { |
| 31 | t.Fatalf("%s resolved through the real keyring in tests: %+v", key, o) |
| 32 | } |
| 33 | } |
| 34 | } |
| 35 |