757 lines
25 KiB
Rust
757 lines
25 KiB
Rust
//! Authentication Manager
|
|
//!
|
|
//! Provides unified authentication management for LLM providers with support for:
|
|
//! - API key authentication
|
|
//! - OAuth device code flow
|
|
//! - Automatic token refresh
|
|
//! - Credential persistence
|
|
//!
|
|
//! # Usage
|
|
//!
|
|
//! ```rust,ignore
|
|
//! use auth_manager::AuthManager;
|
|
//! use llm_core::ProviderType;
|
|
//!
|
|
//! let mut manager = AuthManager::new()?;
|
|
//!
|
|
//! // Login with OAuth device flow
|
|
//! manager.login(ProviderType::Anthropic).await?;
|
|
//!
|
|
//! // Get auth for making API calls
|
|
//! let auth = manager.get_auth(ProviderType::Anthropic)?;
|
|
//!
|
|
//! // Check status
|
|
//! for status in manager.status() {
|
|
//! println!("{}: authenticated={}", status.provider, status.authenticated);
|
|
//! }
|
|
//! ```
|
|
|
|
mod login;
|
|
mod refresh;
|
|
|
|
pub use login::LoginFlow;
|
|
pub use refresh::{RefreshConfig, TokenRefresher};
|
|
|
|
use credentials::{CredentialError, CredentialManager, HelperManager};
|
|
use llm_core::{AuthMethod, ProviderStatus, ProviderType, StoredCredentials};
|
|
use std::collections::HashMap;
|
|
use std::sync::{Arc, RwLock};
|
|
use std::time::{SystemTime, UNIX_EPOCH};
|
|
use thiserror::Error;
|
|
|
|
// ============================================================================
|
|
// Error Types
|
|
// ============================================================================
|
|
|
|
/// Errors that can occur during authentication operations
|
|
#[derive(Error, Debug)]
|
|
pub enum AuthError {
|
|
#[error("Credential error: {0}")]
|
|
Credential(#[from] CredentialError),
|
|
|
|
#[error("OAuth error: {0}")]
|
|
OAuth(String),
|
|
|
|
#[error("Provider error: {0}")]
|
|
Provider(#[from] llm_core::LlmError),
|
|
|
|
#[error("Provider not supported for OAuth: {0}")]
|
|
NotSupported(String),
|
|
|
|
#[error("Not authenticated for provider: {0}")]
|
|
NotAuthenticated(String),
|
|
|
|
#[error("Token expired and no refresh token available")]
|
|
TokenExpired,
|
|
|
|
#[error("Login cancelled by user")]
|
|
Cancelled,
|
|
}
|
|
|
|
pub type Result<T> = std::result::Result<T, AuthError>;
|
|
|
|
// ============================================================================
|
|
// Authentication Manager
|
|
// ============================================================================
|
|
|
|
/// Manages authentication for all LLM providers
|
|
pub struct AuthManager {
|
|
/// Credential storage
|
|
credentials: CredentialManager,
|
|
|
|
/// Cached auth methods per provider (for performance)
|
|
cache: RwLock<HashMap<ProviderType, AuthMethod>>,
|
|
|
|
/// Environment variable overrides (checked first)
|
|
env_overrides: HashMap<ProviderType, String>,
|
|
|
|
/// API key helpers (1Password, pass, etc.)
|
|
helpers: RwLock<HelperManager>,
|
|
}
|
|
|
|
impl AuthManager {
|
|
/// Create a new authentication manager
|
|
pub fn new() -> Result<Self> {
|
|
let credentials = CredentialManager::new()?;
|
|
let env_overrides = Self::load_env_overrides();
|
|
|
|
Ok(Self {
|
|
credentials,
|
|
cache: RwLock::new(HashMap::new()),
|
|
env_overrides,
|
|
helpers: RwLock::new(HelperManager::new()),
|
|
})
|
|
}
|
|
|
|
/// Register an API key helper for a provider
|
|
///
|
|
/// Helpers are checked after environment variables but before stored credentials.
|
|
/// This allows using password managers like 1Password, Bitwarden, or pass.
|
|
///
|
|
/// # Example
|
|
///
|
|
/// ```rust,ignore
|
|
/// use credentials::one_password_helper;
|
|
///
|
|
/// let manager = AuthManager::new()?;
|
|
/// manager.register_helper(
|
|
/// ProviderType::Anthropic,
|
|
/// Box::new(one_password_helper("Private", "Anthropic", "api_key"))
|
|
/// );
|
|
/// ```
|
|
pub fn register_helper(
|
|
&self,
|
|
provider: ProviderType,
|
|
helper: Box<dyn credentials::ApiKeyHelper>,
|
|
) -> Result<()> {
|
|
let mut helpers = self.helpers.write().map_err(|_| {
|
|
AuthError::OAuth("Failed to acquire helpers write lock".to_string())
|
|
})?;
|
|
helpers.register(provider.as_str(), helper);
|
|
Ok(())
|
|
}
|
|
|
|
/// Register a command-based API key helper
|
|
///
|
|
/// Convenience method for registering a shell command that outputs the API key.
|
|
///
|
|
/// # Example
|
|
///
|
|
/// ```rust,ignore
|
|
/// manager.register_command_helper(
|
|
/// ProviderType::Anthropic,
|
|
/// "op read 'op://Private/Anthropic/api_key'"
|
|
/// )?;
|
|
/// ```
|
|
pub fn register_command_helper(
|
|
&self,
|
|
provider: ProviderType,
|
|
command: impl Into<String>,
|
|
) -> Result<()> {
|
|
let mut helpers = self.helpers.write().map_err(|_| {
|
|
AuthError::OAuth("Failed to acquire helpers write lock".to_string())
|
|
})?;
|
|
helpers.register_command(provider.as_str(), command);
|
|
Ok(())
|
|
}
|
|
|
|
/// Load API key overrides from environment variables
|
|
fn load_env_overrides() -> HashMap<ProviderType, String> {
|
|
let mut overrides = HashMap::new();
|
|
|
|
// Check standard environment variables
|
|
if let Ok(key) = std::env::var("ANTHROPIC_API_KEY") {
|
|
overrides.insert(ProviderType::Anthropic, key);
|
|
}
|
|
if let Ok(key) = std::env::var("OPENAI_API_KEY") {
|
|
overrides.insert(ProviderType::OpenAI, key);
|
|
}
|
|
if let Ok(key) = std::env::var("OLLAMA_API_KEY") {
|
|
overrides.insert(ProviderType::Ollama, key);
|
|
}
|
|
|
|
// Also check OWLEN_ prefixed variants
|
|
if let Ok(key) = std::env::var("OWLEN_ANTHROPIC_API_KEY") {
|
|
overrides.insert(ProviderType::Anthropic, key);
|
|
}
|
|
if let Ok(key) = std::env::var("OWLEN_OPENAI_API_KEY") {
|
|
overrides.insert(ProviderType::OpenAI, key);
|
|
}
|
|
if let Ok(key) = std::env::var("OWLEN_API_KEY") {
|
|
// Generic API key - use for Ollama if set
|
|
if !overrides.contains_key(&ProviderType::Ollama) {
|
|
overrides.insert(ProviderType::Ollama, key);
|
|
}
|
|
}
|
|
|
|
overrides
|
|
}
|
|
|
|
/// Get authentication for a provider
|
|
///
|
|
/// Priority order:
|
|
/// 1. Environment variables (ANTHROPIC_API_KEY, etc.)
|
|
/// 2. API key helpers (1Password, pass, Bitwarden, etc.)
|
|
/// 3. In-memory cache
|
|
/// 4. Stored credentials
|
|
/// 5. None (for providers that don't require auth)
|
|
pub fn get_auth(&self, provider: ProviderType) -> Result<AuthMethod> {
|
|
// 1. Check environment variable override first
|
|
if let Some(key) = self.env_overrides.get(&provider) {
|
|
return Ok(AuthMethod::ApiKey(key.clone()));
|
|
}
|
|
|
|
// 2. Check API key helpers (1Password, pass, etc.)
|
|
{
|
|
let helpers = self.helpers.read().map_err(|_| {
|
|
AuthError::OAuth("Failed to acquire helpers read lock".to_string())
|
|
})?;
|
|
|
|
if let Some(result) = helpers.get_key(provider.as_str()) {
|
|
match result {
|
|
Ok(key) => return Ok(AuthMethod::ApiKey(key)),
|
|
Err(e) => {
|
|
// Log helper error but continue to other sources
|
|
tracing::warn!(
|
|
provider = provider.as_str(),
|
|
error = %e,
|
|
"API key helper failed, trying other sources"
|
|
);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// 3. Check cache
|
|
{
|
|
let cache = self.cache.read().map_err(|_| {
|
|
AuthError::OAuth("Failed to acquire cache read lock".to_string())
|
|
})?;
|
|
|
|
if let Some(auth) = cache.get(&provider) {
|
|
// Check if OAuth token needs refresh
|
|
if !auth.needs_refresh() {
|
|
return Ok(auth.clone());
|
|
}
|
|
}
|
|
}
|
|
|
|
// 4. Load from stored credentials
|
|
let provider_name = provider.as_str();
|
|
if let Some(creds) = self.credentials.retrieve(provider_name)? {
|
|
let auth = Self::credentials_to_auth(&creds);
|
|
|
|
// Cache it
|
|
let mut cache = self.cache.write().map_err(|_| {
|
|
AuthError::OAuth("Failed to acquire cache write lock".to_string())
|
|
})?;
|
|
cache.insert(provider, auth.clone());
|
|
|
|
return Ok(auth);
|
|
}
|
|
|
|
// 5. No credentials found
|
|
// For Ollama, return None (local doesn't need auth)
|
|
if provider == ProviderType::Ollama {
|
|
return Ok(AuthMethod::None);
|
|
}
|
|
|
|
Err(AuthError::NotAuthenticated(provider_name.to_string()))
|
|
}
|
|
|
|
/// Convert stored credentials to AuthMethod
|
|
fn credentials_to_auth(creds: &StoredCredentials) -> AuthMethod {
|
|
if creds.refresh_token.is_some() || creds.expires_at.is_some() {
|
|
// This is OAuth
|
|
AuthMethod::OAuth {
|
|
access_token: creds.access_token.clone(),
|
|
refresh_token: creds.refresh_token.clone(),
|
|
expires_at: creds.expires_at,
|
|
}
|
|
} else {
|
|
// This is an API key
|
|
AuthMethod::ApiKey(creds.access_token.clone())
|
|
}
|
|
}
|
|
|
|
/// Store an API key for a provider
|
|
pub fn store_api_key(&self, provider: ProviderType, api_key: &str) -> Result<()> {
|
|
let creds = StoredCredentials {
|
|
provider: provider.as_str().to_string(),
|
|
access_token: api_key.to_string(),
|
|
refresh_token: None,
|
|
expires_at: None,
|
|
};
|
|
|
|
self.credentials.store(provider.as_str(), creds)?;
|
|
|
|
// Update cache
|
|
let mut cache = self.cache.write().map_err(|_| {
|
|
AuthError::OAuth("Failed to acquire cache write lock".to_string())
|
|
})?;
|
|
cache.insert(provider, AuthMethod::ApiKey(api_key.to_string()));
|
|
|
|
Ok(())
|
|
}
|
|
|
|
/// Store OAuth credentials for a provider
|
|
pub fn store_oauth(
|
|
&self,
|
|
provider: ProviderType,
|
|
access_token: &str,
|
|
refresh_token: Option<&str>,
|
|
expires_in: Option<u64>,
|
|
) -> Result<()> {
|
|
let expires_at = expires_in.map(|secs| {
|
|
SystemTime::now()
|
|
.duration_since(UNIX_EPOCH)
|
|
.map(|d| d.as_secs() + secs)
|
|
.unwrap_or(0)
|
|
});
|
|
|
|
let creds = StoredCredentials {
|
|
provider: provider.as_str().to_string(),
|
|
access_token: access_token.to_string(),
|
|
refresh_token: refresh_token.map(|s| s.to_string()),
|
|
expires_at,
|
|
};
|
|
|
|
self.credentials.store(provider.as_str(), creds)?;
|
|
|
|
// Update cache
|
|
let auth = AuthMethod::OAuth {
|
|
access_token: access_token.to_string(),
|
|
refresh_token: refresh_token.map(|s| s.to_string()),
|
|
expires_at,
|
|
};
|
|
|
|
let mut cache = self.cache.write().map_err(|_| {
|
|
AuthError::OAuth("Failed to acquire cache write lock".to_string())
|
|
})?;
|
|
cache.insert(provider, auth);
|
|
|
|
Ok(())
|
|
}
|
|
|
|
/// Perform OAuth login for a provider
|
|
pub async fn login(&self, provider: ProviderType) -> Result<()> {
|
|
let flow = LoginFlow::new(provider)?;
|
|
let auth = flow.execute().await?;
|
|
|
|
// Store the credentials
|
|
match &auth {
|
|
AuthMethod::OAuth {
|
|
access_token,
|
|
refresh_token,
|
|
expires_at,
|
|
} => {
|
|
let expires_in = expires_at.map(|exp| {
|
|
let now = SystemTime::now()
|
|
.duration_since(UNIX_EPOCH)
|
|
.map(|d| d.as_secs())
|
|
.unwrap_or(0);
|
|
exp.saturating_sub(now)
|
|
});
|
|
|
|
self.store_oauth(
|
|
provider,
|
|
access_token,
|
|
refresh_token.as_deref(),
|
|
expires_in,
|
|
)?;
|
|
}
|
|
AuthMethod::ApiKey(key) => {
|
|
self.store_api_key(provider, key)?;
|
|
}
|
|
AuthMethod::None => {
|
|
// Nothing to store
|
|
}
|
|
}
|
|
|
|
Ok(())
|
|
}
|
|
|
|
/// Logout from a provider (delete stored credentials)
|
|
pub fn logout(&self, provider: ProviderType) -> Result<()> {
|
|
// Remove from credential store
|
|
self.credentials.delete(provider.as_str())?;
|
|
|
|
// Remove from cache
|
|
let mut cache = self.cache.write().map_err(|_| {
|
|
AuthError::OAuth("Failed to acquire cache write lock".to_string())
|
|
})?;
|
|
cache.remove(&provider);
|
|
|
|
Ok(())
|
|
}
|
|
|
|
/// Get authentication status for all providers
|
|
pub fn status(&self) -> Vec<ProviderStatus> {
|
|
let providers = [
|
|
ProviderType::Ollama,
|
|
ProviderType::Anthropic,
|
|
ProviderType::OpenAI,
|
|
];
|
|
|
|
// Check which providers have helpers configured
|
|
let helper_providers: Vec<String> = self.helpers.read()
|
|
.map(|h| h.providers().into_iter().map(|s| s.to_string()).collect())
|
|
.unwrap_or_default();
|
|
|
|
providers
|
|
.iter()
|
|
.map(|provider| {
|
|
let auth_result = self.get_auth(*provider);
|
|
let authenticated = matches!(
|
|
&auth_result,
|
|
Ok(AuthMethod::ApiKey(_)) | Ok(AuthMethod::OAuth { .. })
|
|
);
|
|
|
|
let has_helper = helper_providers.contains(&provider.as_str().to_string());
|
|
|
|
let (source, message) = if self.env_overrides.contains_key(provider) {
|
|
("env", Some("API key from environment variable".to_string()))
|
|
} else if has_helper && authenticated {
|
|
("helper", Some("API key from helper command".to_string()))
|
|
} else if authenticated {
|
|
("stored", None)
|
|
} else {
|
|
("none", auth_result.err().map(|e| e.to_string()))
|
|
};
|
|
|
|
ProviderStatus {
|
|
provider: provider.as_str().to_string(),
|
|
authenticated,
|
|
account: None, // Would need to call provider API to get this
|
|
model: provider.default_model().to_string(),
|
|
endpoint: match provider {
|
|
ProviderType::Ollama => "http://localhost:11434".to_string(),
|
|
ProviderType::Anthropic => "https://api.anthropic.com".to_string(),
|
|
ProviderType::OpenAI => "https://api.openai.com".to_string(),
|
|
},
|
|
reachable: true, // Would need to check connectivity
|
|
message: message.or_else(|| Some(format!("Source: {}", source))),
|
|
}
|
|
})
|
|
.collect()
|
|
}
|
|
|
|
/// Check if a helper is registered for a provider
|
|
pub fn has_helper(&self, provider: ProviderType) -> bool {
|
|
self.helpers.read()
|
|
.map(|h| h.has_helper(provider.as_str()))
|
|
.unwrap_or(false)
|
|
}
|
|
|
|
/// Check if a provider has stored credentials
|
|
pub fn is_authenticated(&self, provider: ProviderType) -> bool {
|
|
matches!(
|
|
self.get_auth(provider),
|
|
Ok(AuthMethod::ApiKey(_)) | Ok(AuthMethod::OAuth { .. })
|
|
)
|
|
}
|
|
|
|
/// Get the credential storage backend name
|
|
pub fn storage_name(&self) -> &'static str {
|
|
self.credentials.storage_name()
|
|
}
|
|
|
|
/// Clear all cached credentials (does not delete stored credentials)
|
|
pub fn clear_cache(&self) {
|
|
if let Ok(mut cache) = self.cache.write() {
|
|
cache.clear();
|
|
}
|
|
}
|
|
|
|
/// Start background token refresh with default configuration
|
|
///
|
|
/// Spawns a background task that periodically checks for expiring tokens
|
|
/// and refreshes them before they expire.
|
|
///
|
|
/// Returns a `TokenRefresher` handle that can be used to stop the refresh task.
|
|
pub fn start_background_refresh(self: Arc<Self>) -> TokenRefresher {
|
|
self.start_background_refresh_with_config(RefreshConfig::default())
|
|
}
|
|
|
|
/// Start background token refresh with custom configuration
|
|
pub fn start_background_refresh_with_config(
|
|
self: Arc<Self>,
|
|
config: RefreshConfig,
|
|
) -> TokenRefresher {
|
|
TokenRefresher::start(self, config)
|
|
}
|
|
|
|
// =========================================================================
|
|
// MCP Server OAuth Methods
|
|
// =========================================================================
|
|
|
|
/// Get the credential key for an MCP server
|
|
fn mcp_credential_key(server_name: &str) -> String {
|
|
format!("mcp:{}", server_name)
|
|
}
|
|
|
|
/// Store OAuth token for an MCP server
|
|
///
|
|
/// MCP tokens are stored with the key pattern `mcp:{server_name}`.
|
|
pub fn store_mcp_token(
|
|
&self,
|
|
server_name: &str,
|
|
access_token: &str,
|
|
refresh_token: Option<&str>,
|
|
expires_in: Option<u64>,
|
|
) -> Result<()> {
|
|
let key = Self::mcp_credential_key(server_name);
|
|
let expires_at = expires_in.map(|secs| {
|
|
SystemTime::now()
|
|
.duration_since(UNIX_EPOCH)
|
|
.map(|d| d.as_secs() + secs)
|
|
.unwrap_or(0)
|
|
});
|
|
|
|
let creds = StoredCredentials {
|
|
provider: key.clone(),
|
|
access_token: access_token.to_string(),
|
|
refresh_token: refresh_token.map(|s| s.to_string()),
|
|
expires_at,
|
|
};
|
|
|
|
self.credentials.store(&key, creds)?;
|
|
Ok(())
|
|
}
|
|
|
|
/// Get OAuth token for an MCP server
|
|
///
|
|
/// Returns the access token if available, or None if not authenticated.
|
|
pub fn get_mcp_token(&self, server_name: &str) -> Result<Option<String>> {
|
|
let key = Self::mcp_credential_key(server_name);
|
|
|
|
if let Some(creds) = self.credentials.retrieve(&key)? {
|
|
// Check if token is expired
|
|
if let Some(expires_at) = creds.expires_at {
|
|
let now = SystemTime::now()
|
|
.duration_since(UNIX_EPOCH)
|
|
.map(|d| d.as_secs())
|
|
.unwrap_or(0);
|
|
|
|
if expires_at <= now {
|
|
// Token expired
|
|
// TODO: Auto-refresh if refresh token is available
|
|
return Ok(None);
|
|
}
|
|
}
|
|
|
|
Ok(Some(creds.access_token))
|
|
} else {
|
|
Ok(None)
|
|
}
|
|
}
|
|
|
|
/// Check if an MCP server is authenticated
|
|
pub fn is_mcp_authenticated(&self, server_name: &str) -> bool {
|
|
self.get_mcp_token(server_name)
|
|
.ok()
|
|
.flatten()
|
|
.is_some()
|
|
}
|
|
|
|
/// Remove stored token for an MCP server
|
|
pub fn logout_mcp(&self, server_name: &str) -> Result<()> {
|
|
let key = Self::mcp_credential_key(server_name);
|
|
self.credentials.delete(&key)?;
|
|
Ok(())
|
|
}
|
|
|
|
/// List all authenticated MCP servers
|
|
pub fn list_mcp_servers(&self) -> Result<Vec<String>> {
|
|
let providers = self.credentials.list_providers()?;
|
|
Ok(providers
|
|
.into_iter()
|
|
.filter_map(|p| p.strip_prefix("mcp:").map(|s| s.to_string()))
|
|
.collect())
|
|
}
|
|
}
|
|
|
|
impl Default for AuthManager {
|
|
fn default() -> Self {
|
|
Self::new().expect("Failed to create auth manager")
|
|
}
|
|
}
|
|
|
|
// ============================================================================
|
|
// Tests
|
|
// ============================================================================
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
use credentials::HelperManager;
|
|
|
|
#[test]
|
|
fn test_env_override_loading() {
|
|
// Create a temp dir for config to avoid loading system credentials
|
|
let temp_dir = tempfile::tempdir().unwrap();
|
|
let temp_path = temp_dir.path().to_str().unwrap();
|
|
|
|
// Clear any env vars that might interfere and set XDG_CONFIG_HOME
|
|
// Also disable keyring to ensure we only use the temp config dir
|
|
// SAFETY: Single-threaded test context
|
|
unsafe {
|
|
std::env::set_var("XDG_CONFIG_HOME", temp_path);
|
|
std::env::set_var("OWLEN_KEYRING_DISABLE", "1");
|
|
std::env::remove_var("ANTHROPIC_API_KEY");
|
|
std::env::remove_var("OWLEN_ANTHROPIC_API_KEY");
|
|
}
|
|
|
|
// Set env var (unsafe in Rust 2024 due to potential thread safety issues)
|
|
// SAFETY: This is a single-threaded test, no concurrent access
|
|
unsafe {
|
|
std::env::set_var("ANTHROPIC_API_KEY", "test-key-123");
|
|
}
|
|
|
|
let manager = AuthManager::new().unwrap();
|
|
let auth = manager.get_auth(ProviderType::Anthropic).unwrap();
|
|
|
|
match auth {
|
|
AuthMethod::ApiKey(key) => assert_eq!(key, "test-key-123"),
|
|
_ => panic!("Expected API key auth"),
|
|
}
|
|
|
|
// Clean up
|
|
// SAFETY: Single-threaded test
|
|
unsafe {
|
|
std::env::remove_var("ANTHROPIC_API_KEY");
|
|
std::env::remove_var("XDG_CONFIG_HOME");
|
|
std::env::remove_var("OWLEN_KEYRING_DISABLE");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn test_ollama_no_auth_required() {
|
|
// Create a temp dir for config
|
|
let temp_dir = tempfile::tempdir().unwrap();
|
|
let temp_path = temp_dir.path().to_str().unwrap();
|
|
|
|
// Clear any env vars that might interfere and set XDG_CONFIG_HOME
|
|
// Also disable keyring
|
|
// SAFETY: Single-threaded test context
|
|
unsafe {
|
|
std::env::set_var("XDG_CONFIG_HOME", temp_path);
|
|
std::env::set_var("OWLEN_KEYRING_DISABLE", "1");
|
|
std::env::remove_var("OLLAMA_API_KEY");
|
|
std::env::remove_var("OWLEN_API_KEY");
|
|
}
|
|
|
|
let manager = AuthManager::new().unwrap();
|
|
let auth = manager.get_auth(ProviderType::Ollama).unwrap();
|
|
|
|
assert!(matches!(auth, AuthMethod::None));
|
|
|
|
// Clean up
|
|
unsafe {
|
|
std::env::remove_var("XDG_CONFIG_HOME");
|
|
std::env::remove_var("OWLEN_KEYRING_DISABLE");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn test_status() {
|
|
let manager = AuthManager::new().unwrap();
|
|
let status = manager.status();
|
|
|
|
assert_eq!(status.len(), 3);
|
|
|
|
let provider_names: Vec<&str> = status.iter().map(|s| s.provider.as_str()).collect();
|
|
assert!(provider_names.contains(&"ollama"));
|
|
assert!(provider_names.contains(&"anthropic"));
|
|
assert!(provider_names.contains(&"openai"));
|
|
}
|
|
|
|
#[test]
|
|
fn test_helper_registration() {
|
|
// Clear any env vars that might interfere (from other tests)
|
|
// SAFETY: Single-threaded test context
|
|
unsafe {
|
|
std::env::remove_var("ANTHROPIC_API_KEY");
|
|
std::env::remove_var("OWLEN_ANTHROPIC_API_KEY");
|
|
}
|
|
|
|
// Create a fresh manager after clearing env vars
|
|
let manager = AuthManager::new().unwrap();
|
|
|
|
// No helper initially
|
|
assert!(!manager.has_helper(ProviderType::Anthropic));
|
|
|
|
// Register a command helper
|
|
manager
|
|
.register_command_helper(ProviderType::Anthropic, "echo 'helper-test-key'")
|
|
.unwrap();
|
|
|
|
// Now has helper
|
|
assert!(manager.has_helper(ProviderType::Anthropic));
|
|
|
|
// Should get auth from helper
|
|
let auth = manager.get_auth(ProviderType::Anthropic).unwrap();
|
|
match auth {
|
|
AuthMethod::ApiKey(key) => assert_eq!(key, "helper-test-key"),
|
|
_ => panic!("Expected API key from helper"),
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn test_helper_in_status() {
|
|
let manager = AuthManager::new().unwrap();
|
|
|
|
// Register a helper
|
|
manager
|
|
.register_command_helper(ProviderType::OpenAI, "echo 'status-test-key'")
|
|
.unwrap();
|
|
|
|
let status = manager.status();
|
|
let openai_status = status.iter().find(|s| s.provider == "openai").unwrap();
|
|
|
|
assert!(openai_status.authenticated);
|
|
assert!(openai_status
|
|
.message
|
|
.as_ref()
|
|
.map(|m| m.contains("helper"))
|
|
.unwrap_or(false));
|
|
}
|
|
|
|
#[test]
|
|
fn test_mcp_token_storage() {
|
|
// Use file-only credential manager to avoid keyring issues in test environment
|
|
let credentials = CredentialManager::file_only().unwrap();
|
|
let manager = AuthManager {
|
|
credentials,
|
|
cache: RwLock::new(HashMap::new()),
|
|
env_overrides: HashMap::new(),
|
|
helpers: RwLock::new(HelperManager::new()),
|
|
};
|
|
|
|
// Use a unique server name to avoid conflicts with other tests
|
|
let server_name = format!("test-mcp-{}", std::process::id());
|
|
|
|
// Initially not authenticated
|
|
assert!(!manager.is_mcp_authenticated(&server_name));
|
|
|
|
// Store a token
|
|
manager
|
|
.store_mcp_token(&server_name, "test-token-123", Some("refresh-456"), Some(3600))
|
|
.unwrap();
|
|
|
|
// Now authenticated
|
|
assert!(
|
|
manager.is_mcp_authenticated(&server_name),
|
|
"Expected to be authenticated after storing token"
|
|
);
|
|
|
|
// Get token
|
|
let token = manager.get_mcp_token(&server_name).unwrap();
|
|
assert_eq!(token, Some("test-token-123".to_string()));
|
|
|
|
// Cleanup
|
|
manager.logout_mcp(&server_name).unwrap();
|
|
assert!(!manager.is_mcp_authenticated(&server_name));
|
|
}
|
|
}
|