feat(cred_proxy): add DockerCredProxy concrete lifecycle (PRD 0010)

Mirrors DockerGitGate: build the image, docker create on the internal network with --network-alias cred-proxy, docker cp the routes.json into /run/cred-proxy/, attach the egress network, docker start. stop() is idempotent. Token values flow host env -> subprocess env -> sidecar env via docker create -e NAME (no =VALUE on argv). The resolver fails early with a clear pointer at the missing host env var name if any TokenRef is unset. Helpers (cred_proxy_container_name, cred_proxy_url) are agent-side stable: the URL uses the network alias, not the slugged container name, so the provisioner can write a fixed http://cred-proxy:9099/ URL regardless of which bottle is running.
2026-05-13 16:07:52 -04:00
parent 3436d8a68a
commit 61e334c1b8
2 changed files with 291 additions and 0 deletions
@@ -0,0 +1,82 @@
+"""Unit: DockerCredProxy helpers + early-exit guards (PRD 0010).
+
+The full docker lifecycle is exercised by integration tests; here we
+cover the pure helpers and the validation checks `.start` runs
+before touching docker."""
+
+import unittest
+from pathlib import Path
+
+from claude_bottle.backend.docker.cred_proxy import (
+    CRED_PROXY_HOSTNAME,
+    CRED_PROXY_PORT,
+    DockerCredProxy,
+    cred_proxy_container_name,
+    cred_proxy_url,
+)
+from claude_bottle.cred_proxy import CredProxyPlan, CredProxyUpstream
+from claude_bottle.log import Die
+
+
+def _empty_plan(**overrides):
+    base = {
+        "slug": "demo",
+        "routes_path": Path("/nonexistent"),
+        "upstreams": (),
+        "token_env_map": {},
+        "internal_network": "",
+        "egress_network": "",
+    }
+    base.update(overrides)
+    return CredProxyPlan(**base)
+
+
+class TestNameAndUrl(unittest.TestCase):
+    def test_container_name_carries_slug(self):
+        self.assertEqual("claude-bottle-cred-proxy-demo",
+                         cred_proxy_container_name("demo"))
+
+    def test_url_uses_alias_not_container_name(self):
+        # The URL agents dial is stable across bottles — the slug
+        # never appears in it. That's the whole point of attaching
+        # --network-alias cred-proxy on the internal network.
+        self.assertEqual(f"http://{CRED_PROXY_HOSTNAME}:{CRED_PROXY_PORT}",
+                         cred_proxy_url())
+
+
+class TestStartGuards(unittest.TestCase):
+    def setUp(self):
+        self.proxy = DockerCredProxy()
+
+    def test_empty_upstreams_dies(self):
+        with self.assertRaises(Die):
+            self.proxy.start(_empty_plan())
+
+    def test_missing_internal_network_dies(self):
+        upstream = CredProxyUpstream(
+            kind="anthropic", path="/anthropic/",
+            upstream="https://api.anthropic.com",
+            auth_scheme="Bearer", token_env="CRED_PROXY_TOKEN_0",
+            token_ref="T",
+        )
+        with self.assertRaises(Die):
+            self.proxy.start(_empty_plan(upstreams=(upstream,)))
+
+    def test_missing_routes_file_dies(self):
+        upstream = CredProxyUpstream(
+            kind="anthropic", path="/anthropic/",
+            upstream="https://api.anthropic.com",
+            auth_scheme="Bearer", token_env="CRED_PROXY_TOKEN_0",
+            token_ref="T",
+        )
+        with self.assertRaises(Die):
+            self.proxy.start(_empty_plan(
+                upstreams=(upstream,),
+                internal_network="net-x",
+                egress_network="egress-x",
+                routes_path=Path("/tmp/cred-proxy-test-does-not-exist.json"),
+            ))
+
+
+if __name__ == "__main__":
+    unittest.main()