didericis
fcbbc4484d
Replace bottle.tokens (with Kind enum and hardcoded per-kind
route/auth tables) with bottle.cred_proxy.routes — each route
declares its own path, upstream, auth_scheme, token_ref, and
optional role[]. The manifest is now the source of truth for the
proxy's runtime route table; adding an upstream is a manifest edit,
not a code change.
Agent-side rewrites move from per-kind dispatch to per-role tags
on routes:
anthropic-base-url -> set ANTHROPIC_BASE_URL=<proxy><path>
npm-registry -> write ~/.npmrc registry=
git-insteadof -> write ~/.gitconfig [url] insteadOf, keyed
off route.upstream (suppressed when
bottle.git brokers the same host)
tea-login -> add a ~/.config/tea/config.yml login
Roles are a list (string accepted as sugar). A gitea route
typically carries ["git-insteadof", "tea-login"]. Singleton roles
(anthropic-base-url, npm-registry) appear on at most one route.
token_env slots are assigned per distinct TokenRef in declaration
order — two routes sharing a token_ref (e.g. github API + git
endpoints) share a slot.
Drops: TOKEN_KINDS, _KIND_ROUTES, _KIND_AUTH_SCHEME, _TOKEN_DEFAULT_HOST,
cred_proxy_route_path_for_gitea, the kind field on CredProxyUpstream,
and the kind-based hardcoding in pipelock_token_hosts (now derives
from route.UpstreamHost).
Legacy bottle.tokens manifests now die with a hint pointing at
bottle.cred_proxy.routes + this PRD. Tests rewritten end-to-end.
Docs + example.json + the dev ~/claude-bottle.json updated to match.
201 lines
8.2 KiB
Python
201 lines
8.2 KiB
Python
"""Unit: CredProxy upstream lift + routes.json render + token resolution
|
|
(PRD 0010)."""
|
|
|
|
import json
|
|
import unittest
|
|
|
|
from claude_bottle.cred_proxy import (
|
|
cred_proxy_render_routes,
|
|
cred_proxy_resolve_token_values,
|
|
cred_proxy_token_env_map,
|
|
cred_proxy_upstreams_for_bottle,
|
|
)
|
|
from claude_bottle.log import Die
|
|
from claude_bottle.manifest import Manifest
|
|
|
|
|
|
def _bottle(routes):
|
|
return Manifest.from_json_obj({
|
|
"bottles": {"dev": {"cred_proxy": {"routes": routes}}},
|
|
"agents": {"demo": {"skills": [], "prompt": "", "bottle": "dev"}},
|
|
}).bottles["dev"]
|
|
|
|
|
|
class TestUpstreamLift(unittest.TestCase):
|
|
def test_single_route_yields_single_upstream(self):
|
|
b = _bottle([
|
|
{"path": "/anthropic/", "upstream": "https://api.anthropic.com",
|
|
"auth_scheme": "Bearer", "token_ref": "CLAUDE_BOTTLE_OAUTH_TOKEN",
|
|
"role": "anthropic-base-url"},
|
|
])
|
|
upstreams = cred_proxy_upstreams_for_bottle(b)
|
|
self.assertEqual(1, len(upstreams))
|
|
u = upstreams[0]
|
|
self.assertEqual("/anthropic/", u.path)
|
|
self.assertEqual("https://api.anthropic.com", u.upstream)
|
|
self.assertEqual("Bearer", u.auth_scheme)
|
|
self.assertEqual("CRED_PROXY_TOKEN_0", u.token_env)
|
|
self.assertEqual("CLAUDE_BOTTLE_OAUTH_TOKEN", u.token_ref)
|
|
self.assertEqual(("anthropic-base-url",), u.roles)
|
|
|
|
def test_shared_token_ref_collapses_to_one_slot(self):
|
|
# Two github routes share GH_PAT — they share token_env.
|
|
b = _bottle([
|
|
{"path": "/gh-api/", "upstream": "https://api.github.com",
|
|
"auth_scheme": "Bearer", "token_ref": "GH_PAT"},
|
|
{"path": "/gh-git/", "upstream": "https://github.com",
|
|
"auth_scheme": "Bearer", "token_ref": "GH_PAT",
|
|
"role": "git-insteadof"},
|
|
])
|
|
upstreams = cred_proxy_upstreams_for_bottle(b)
|
|
self.assertEqual(2, len(upstreams))
|
|
self.assertEqual({"CRED_PROXY_TOKEN_0"},
|
|
{u.token_env for u in upstreams})
|
|
|
|
def test_distinct_token_refs_get_distinct_slots(self):
|
|
b = _bottle([
|
|
{"path": "/a/", "upstream": "https://a.example",
|
|
"auth_scheme": "Bearer", "token_ref": "T1"},
|
|
{"path": "/b/", "upstream": "https://b.example",
|
|
"auth_scheme": "Bearer", "token_ref": "T2"},
|
|
{"path": "/c/", "upstream": "https://c.example",
|
|
"auth_scheme": "Bearer", "token_ref": "T1"},
|
|
])
|
|
upstreams = cred_proxy_upstreams_for_bottle(b)
|
|
# T1 -> slot 0, T2 -> slot 1, T1 reuses slot 0.
|
|
self.assertEqual("CRED_PROXY_TOKEN_0", upstreams[0].token_env)
|
|
self.assertEqual("CRED_PROXY_TOKEN_1", upstreams[1].token_env)
|
|
self.assertEqual("CRED_PROXY_TOKEN_0", upstreams[2].token_env)
|
|
|
|
def test_upstream_trailing_slash_stripped(self):
|
|
b = _bottle([
|
|
{"path": "/x/", "upstream": "https://gitea.dideric.is/",
|
|
"auth_scheme": "token", "token_ref": "T"},
|
|
])
|
|
self.assertEqual("https://gitea.dideric.is",
|
|
cred_proxy_upstreams_for_bottle(b)[0].upstream)
|
|
|
|
def test_roles_list_passes_through(self):
|
|
b = _bottle([
|
|
{"path": "/gitea/x/", "upstream": "https://gitea.example.com",
|
|
"auth_scheme": "token", "token_ref": "T",
|
|
"role": ["git-insteadof", "tea-login"]},
|
|
])
|
|
self.assertEqual(("git-insteadof", "tea-login"),
|
|
cred_proxy_upstreams_for_bottle(b)[0].roles)
|
|
|
|
def test_empty_routes_yields_empty_upstreams(self):
|
|
b = _bottle([])
|
|
self.assertEqual((), cred_proxy_upstreams_for_bottle(b))
|
|
|
|
|
|
class TestTokenEnvMap(unittest.TestCase):
|
|
def test_distinct_envs_yield_full_map(self):
|
|
b = _bottle([
|
|
{"path": "/a/", "upstream": "https://a.example",
|
|
"auth_scheme": "Bearer", "token_ref": "A"},
|
|
{"path": "/b/", "upstream": "https://b.example",
|
|
"auth_scheme": "Bearer", "token_ref": "B"},
|
|
])
|
|
m = cred_proxy_token_env_map(cred_proxy_upstreams_for_bottle(b))
|
|
self.assertEqual({"CRED_PROXY_TOKEN_0": "A",
|
|
"CRED_PROXY_TOKEN_1": "B"}, m)
|
|
|
|
def test_shared_token_ref_yields_one_env(self):
|
|
b = _bottle([
|
|
{"path": "/gh-api/", "upstream": "https://api.github.com",
|
|
"auth_scheme": "Bearer", "token_ref": "GH"},
|
|
{"path": "/gh-git/", "upstream": "https://github.com",
|
|
"auth_scheme": "Bearer", "token_ref": "GH"},
|
|
])
|
|
m = cred_proxy_token_env_map(cred_proxy_upstreams_for_bottle(b))
|
|
self.assertEqual({"CRED_PROXY_TOKEN_0": "GH"}, m)
|
|
|
|
|
|
class TestRoutesRender(unittest.TestCase):
|
|
def test_renders_json_with_expected_shape(self):
|
|
b = _bottle([
|
|
{"path": "/anthropic/", "upstream": "https://api.anthropic.com",
|
|
"auth_scheme": "Bearer", "token_ref": "CLAUDE_BOTTLE_OAUTH_TOKEN"},
|
|
{"path": "/gitea/x/", "upstream": "https://gitea.dideric.is",
|
|
"auth_scheme": "token", "token_ref": "GITEA_TOKEN"},
|
|
])
|
|
rendered = cred_proxy_render_routes(cred_proxy_upstreams_for_bottle(b))
|
|
payload = json.loads(rendered)
|
|
self.assertEqual(["routes"], list(payload.keys()))
|
|
self.assertEqual(2, len(payload["routes"]))
|
|
first = payload["routes"][0]
|
|
self.assertEqual({"path", "upstream", "auth_scheme", "token_env"},
|
|
set(first.keys()))
|
|
|
|
def test_routes_carry_no_token_values_or_host_env_names(self):
|
|
# routes.json lives mode-600 in the staging dir and gets
|
|
# docker cp'd into the sidecar — it must not leak secret values
|
|
# or the host-side TokenRef name.
|
|
b = _bottle([{"path": "/x/", "upstream": "https://x.example",
|
|
"auth_scheme": "Bearer", "token_ref": "GITHUB_TOKEN"}])
|
|
rendered = cred_proxy_render_routes(cred_proxy_upstreams_for_bottle(b))
|
|
self.assertNotIn("GITHUB_TOKEN", rendered)
|
|
|
|
def test_empty_upstreams_renders_empty_routes_array(self):
|
|
rendered = cred_proxy_render_routes(())
|
|
self.assertEqual({"routes": []}, json.loads(rendered))
|
|
|
|
|
|
class TestResolveTokenValues(unittest.TestCase):
|
|
def test_resolves_present_env(self):
|
|
out = cred_proxy_resolve_token_values(
|
|
{"CRED_PROXY_TOKEN_0": "FOO"},
|
|
{"FOO": "the-value"},
|
|
)
|
|
self.assertEqual({"CRED_PROXY_TOKEN_0": "the-value"}, out)
|
|
|
|
def test_unset_host_env_dies(self):
|
|
with self.assertRaises(Die):
|
|
cred_proxy_resolve_token_values(
|
|
{"CRED_PROXY_TOKEN_0": "MISSING"},
|
|
{},
|
|
)
|
|
|
|
def test_empty_host_env_dies(self):
|
|
with self.assertRaises(Die):
|
|
cred_proxy_resolve_token_values(
|
|
{"CRED_PROXY_TOKEN_0": "FOO"},
|
|
{"FOO": ""},
|
|
)
|
|
|
|
|
|
class TestCredProxyPrepare(unittest.TestCase):
|
|
def test_prepare_writes_routes_file_and_returns_plan(self):
|
|
import tempfile
|
|
from pathlib import Path
|
|
|
|
from claude_bottle.cred_proxy import CredProxy, CredProxyPlan
|
|
|
|
class StubCredProxy(CredProxy):
|
|
def start(self, plan): return ""
|
|
def stop(self, target): return None
|
|
|
|
b = _bottle([
|
|
{"path": "/gh-api/", "upstream": "https://api.github.com",
|
|
"auth_scheme": "Bearer", "token_ref": "GITHUB_TOKEN"},
|
|
{"path": "/gh-git/", "upstream": "https://github.com",
|
|
"auth_scheme": "Bearer", "token_ref": "GITHUB_TOKEN",
|
|
"role": "git-insteadof"},
|
|
])
|
|
with tempfile.TemporaryDirectory() as td:
|
|
stage = Path(td)
|
|
plan = StubCredProxy().prepare(b, "test-slug", stage)
|
|
self.assertIsInstance(plan, CredProxyPlan)
|
|
self.assertEqual("test-slug", plan.slug)
|
|
self.assertTrue(plan.routes_path.is_file())
|
|
self.assertEqual(0o600, plan.routes_path.stat().st_mode & 0o777)
|
|
payload = json.loads(plan.routes_path.read_text())
|
|
self.assertEqual(2, len(payload["routes"]))
|
|
self.assertEqual({"CRED_PROXY_TOKEN_0": "GITHUB_TOKEN"},
|
|
plan.token_env_map)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|