brokerd: consult config, secrets, loopback URL

Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>
2026-10-03 22:13:57 -07:00
parent 45eb16a30a
commit 00d9ea9967
9 changed files with 415 additions and 1 deletions
@@ -0,0 +1,82 @@
+//! `[consult]` without a readable secret: `brokerd` does not start. Do not edit.
+
+#[path = "support/tmp.rs"]
+mod tmp;
+
+use std::ffi::OsString;
+
+use brokerd::config::Config;
+use brokerd::consult::{self, SECRET_POINTER};
+use tmp::TempDir;
+
+#[test]
+fn a_missing_secrets_entry_is_consult_secret_unreadable() {
+    let dir = TempDir::new("consult-secret-missing");
+    let path = dir.write(
+        "brokerd.toml",
+        r#"
+[consult]
+url = "http://127.0.0.1:9/v1/chat/completions"
+model = "test-model"
+secret = "consult"
+"#,
+    );
+    let cfg = Config::load(&path).unwrap();
+    let err = consult::load_secret(&cfg, &|_| None).unwrap_err();
+    let text = err.to_string();
+    assert!(text.contains(SECRET_POINTER), "{text}");
+    assert!(text.contains("consult"), "{text}");
+}
+
+#[test]
+fn an_unreadable_env_secret_names_both_pointers() {
+    let dir = TempDir::new("consult-secret-env");
+    let path = dir.write(
+        "brokerd.toml",
+        r#"
+[consult]
+url = "http://127.0.0.1:9/v1/chat/completions"
+model = "test-model"
+secret = "consult"
+
+[secrets.consult]
+env = "CONSULT_TOKEN_FOR_THIS_TEST_UNSET"
+"#,
+    );
+    let cfg = Config::load(&path).unwrap();
+    let err = consult::load_secret(&cfg, &|_| None).unwrap_err();
+    let text = err.to_string();
+    assert!(text.contains(SECRET_POINTER), "{text}");
+    assert!(
+        text.contains("docs/runbook.md#secret-unavailable"),
+        "{text}"
+    );
+}
+
+#[test]
+fn a_present_env_secret_loads() {
+    let dir = TempDir::new("consult-secret-ok");
+    let path = dir.write(
+        "brokerd.toml",
+        r#"
+[consult]
+url = "http://127.0.0.1:9/v1/chat/completions"
+model = "test-model"
+secret = "consult"
+
+[secrets.consult]
+env = "CONSULT_TOKEN_FOR_THIS_TEST_SET"
+"#,
+    );
+    let cfg = Config::load(&path).unwrap();
+    let loaded = consult::load_secret(&cfg, &|k| {
+        if k == "CONSULT_TOKEN_FOR_THIS_TEST_SET" {
+            Some(OsString::from("bearer-value"))
+        } else {
+            None
+        }
+    })
+    .unwrap()
+    .expect("loaded");
+    assert_eq!(loaded.secret.expose(), "bearer-value");
+}