brokerd: consult config, secrets, loopback URL

Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>

crates/brokerd/tests/config_consult.rs

@@ -0,0 +1,84 @@
+//! `[consult]` in `brokerd.toml`. Do not edit.
+
+#[path = "support/tmp.rs"]
+mod tmp;
+
+use brokerd::config::{Config, ConfigError};
+use brokerd::consult::{DEFAULT_TEMPERATURE_MILLI, DEFAULT_TIMEOUT_MS};
+use tmp::TempDir;
+
+fn load(text: &str) -> Result<Config, ConfigError> {
+    let dir = TempDir::new("cfg-consult");
+    let path = dir.write("brokerd.toml", text);
+    Config::load(&path)
+}
+
+const TABLE: &str = r#"
+[consult]
+url = "http://127.0.0.1:9/v1/chat/completions"
+model = "test-model"
+secret = "consult"
+"#;
+
+#[test]
+fn no_consult_table_means_none() {
+    let c = load("").unwrap();
+    assert!(c.consult.is_none());
+    assert!(c.secrets.is_empty());
+}
+
+#[test]
+fn a_consult_table_loads_defaults() {
+    let c = load(TABLE).unwrap();
+    let consult = c.consult.expect("consult");
+    assert_eq!(consult.url, "http://127.0.0.1:9/v1/chat/completions");
+    assert_eq!(consult.model, "test-model");
+    assert_eq!(consult.secret, "consult");
+    assert_eq!(consult.temperature_milli, DEFAULT_TEMPERATURE_MILLI);
+    assert_eq!(consult.timeout_ms, DEFAULT_TIMEOUT_MS);
+    assert!((consult.temperature() - 0.6).abs() < 1e-9);
+}
+
+#[test]
+fn temperature_above_zero_point_six_is_invalid() {
+    let text = format!("{TABLE}temperature = 0.7\n");
+    match load(&text) {
+        Err(ConfigError::Parse(_, err)) => {
+            let msg = err.to_string();
+            assert!(msg.contains("0.6"), "{msg}");
+        }
+        other => panic!("{other:?}"),
+    }
+}
+
+#[test]
+fn a_non_loopback_url_is_invalid() {
+    let text = r#"
+[consult]
+url = "https://example.com/v1/chat/completions"
+model = "x"
+secret = "consult"
+"#;
+    match load(text) {
+        Err(ConfigError::Invalid(_, why)) => {
+            assert!(
+                why.contains("http://127.0.0.1") || why.contains("localhost"),
+                "{why}"
+            );
+        }
+        other => panic!("{other:?}"),
+    }
+}
+
+#[test]
+fn unknown_consult_keys_are_errors() {
+    let text = format!("{TABLE}vendor = \"x\"\n");
+    assert!(matches!(load(&text), Err(ConfigError::Parse(_, _))));
+}
+
+#[test]
+fn a_secret_spec_loads_under_secrets() {
+    let text = format!("{TABLE}\n[secrets.consult]\nenv = \"CONSULT_TOKEN\"\n");
+    let c = load(&text).unwrap();
+    assert!(c.secrets.contains_key("consult"));
+}

crates/brokerd/tests/consult_secret.rs

@@ -0,0 +1,82 @@
+//! `[consult]` without a readable secret: `brokerd` does not start. Do not edit.
+
+#[path = "support/tmp.rs"]
+mod tmp;
+
+use std::ffi::OsString;
+
+use brokerd::config::Config;
+use brokerd::consult::{self, SECRET_POINTER};
+use tmp::TempDir;
+
+#[test]
+fn a_missing_secrets_entry_is_consult_secret_unreadable() {
+    let dir = TempDir::new("consult-secret-missing");
+    let path = dir.write(
+        "brokerd.toml",
+        r#"
+[consult]
+url = "http://127.0.0.1:9/v1/chat/completions"
+model = "test-model"
+secret = "consult"
+"#,
+    );
+    let cfg = Config::load(&path).unwrap();
+    let err = consult::load_secret(&cfg, &|_| None).unwrap_err();
+    let text = err.to_string();
+    assert!(text.contains(SECRET_POINTER), "{text}");
+    assert!(text.contains("consult"), "{text}");
+}
+
+#[test]
+fn an_unreadable_env_secret_names_both_pointers() {
+    let dir = TempDir::new("consult-secret-env");
+    let path = dir.write(
+        "brokerd.toml",
+        r#"
+[consult]
+url = "http://127.0.0.1:9/v1/chat/completions"
+model = "test-model"
+secret = "consult"
+
+[secrets.consult]
+env = "CONSULT_TOKEN_FOR_THIS_TEST_UNSET"
+"#,
+    );
+    let cfg = Config::load(&path).unwrap();
+    let err = consult::load_secret(&cfg, &|_| None).unwrap_err();
+    let text = err.to_string();
+    assert!(text.contains(SECRET_POINTER), "{text}");
+    assert!(
+        text.contains("docs/runbook.md#secret-unavailable"),
+        "{text}"
+    );
+}
+
+#[test]
+fn a_present_env_secret_loads() {
+    let dir = TempDir::new("consult-secret-ok");
+    let path = dir.write(
+        "brokerd.toml",
+        r#"
+[consult]
+url = "http://127.0.0.1:9/v1/chat/completions"
+model = "test-model"
+secret = "consult"
+
+[secrets.consult]
+env = "CONSULT_TOKEN_FOR_THIS_TEST_SET"
+"#,
+    );
+    let cfg = Config::load(&path).unwrap();
+    let loaded = consult::load_secret(&cfg, &|k| {
+        if k == "CONSULT_TOKEN_FOR_THIS_TEST_SET" {
+            Some(OsString::from("bearer-value"))
+        } else {
+            None
+        }
+    })
+    .unwrap()
+    .expect("loaded");
+    assert_eq!(loaded.secret.expose(), "bearer-value");
+}

crates/brokerd/tests/support/rig.rs

@@ -43,6 +43,8 @@ impl Rig {
             runner: None,
             gateway: None,
             memory: Default::default(),
+            consult: None,
+            secrets: Default::default(),
         };
         Rig {
             dir,