char-slop/berry

multipurpose self-modifiable agentic harness

git clone https://git.t4t.associates/char-slop/berry

Charlotte Somcut a bunch of code volumecb11725

main
branchesmainall refs →
3.2 KiB67 linesraw
1import { assert, assertEquals, assertRejects, assertThrows } from "@std/assert";
2import { writeFile } from "node:fs/promises";
3import { dirname, join } from "node:path";
4import { piAuthStore, resolveConfigValue } from "./auth.ts";
5import { tempDir } from "@berry/util";
6
7async function store(run: (path: string) => Promise<void>) {
8  await using temporary = await tempDir({ prefix: "berry-auth-" });
9  const dir = temporary.path;
10  await run(join(dir, "auth.json"));
11}
12
13Deno.test("reads see what another process wrote, and what this one modified", () =>
14  store(async (path) => {
15    const auth = piAuthStore(path);
16    assertEquals(await auth.list(), []);
17    // pi, writing the file itself
18    await writeFile(path, JSON.stringify({ a: { type: "api_key", key: "from pi" } }, null, 2));
19    assertEquals(await auth.read("a"), { type: "api_key", key: "from pi" });
20
21    await auth.modify("b", () => Promise.resolve({ type: "api_key", key: "from berry" }));
22    assertEquals(await auth.list(), [{ providerId: "a", type: "api_key" }, {
23      providerId: "b",
24      type: "api_key",
25    }]);
26    await auth.delete("a");
27    assertEquals(await auth.read("a"), undefined);
28    assertEquals(await piAuthStore(path).read("b"), { type: "api_key", key: "from berry" });
29  }));
30
31Deno.test("command-based API keys fail without executing their command", () =>
32  store(async (path) => {
33    const marker = join(dirname(path), "command-ran");
34    const command = `!touch ${JSON.stringify(marker)}`;
35    await writeFile(path, JSON.stringify({ a: { type: "api_key", key: command } }));
36    const auth = piAuthStore(path);
37    const error = await assertRejects(
38      () => auth.read("a"),
39      Error,
40      "Command-based API keys are disabled",
41    );
42    assert(!error.message.includes(command));
43    await assertRejects(() => Deno.stat(marker), Deno.errors.NotFound);
44    await auth.modify("a", () => Promise.resolve({ type: "api_key", key: "literal" }));
45    assertEquals(await auth.read("a"), { type: "api_key", key: "literal" });
46  }));
47
48Deno.test("config values reject command syntax and keep literal and environment forms", () => {
49  for (const config of ["!", "!echo secret", "!false"]) {
50    assertThrows(() => resolveConfigValue(config), Error, "Command-based API keys are disabled");
51  }
52  assertEquals(resolveConfigValue("literal"), "literal");
53  assertEquals(resolveConfigValue("$TOKEN", { TOKEN: "secret" }), "secret");
54  assertEquals(resolveConfigValue("prefix-${TOKEN}", { TOKEN: "secret" }), "prefix-secret");
55  assertEquals(resolveConfigValue("$$literal"), "$literal");
56  assertEquals(resolveConfigValue("$!literal"), "!literal");
57  assertEquals(resolveConfigValue("$TOKEN", { TOKEN: "!literal" }), "!literal");
58  const missing = `BERRY_AUTH_TEST_${crypto.randomUUID().replaceAll("-", "_")}`;
59  assertEquals(resolveConfigValue(`$${missing}`), undefined);
60});
61
62Deno.test("the auth store still resolves API keys from configured environment values", () =>
63  store(async (path) => {
64    const credential = { type: "api_key" as const, key: "${TOKEN}", env: { TOKEN: "secret" } };
65    await writeFile(path, JSON.stringify({ a: credential }));
66    assertEquals(await piAuthStore(path).read("a"), { ...credential, key: "secret" });
67  }));