Hermes-agent

tests/acp_adapter/test_detect_provider_entra.py

@@ -0,0 +1,87 @@
+"""Regression tests for ACP adapter detection under Azure Foundry Entra ID.
+
+The ACP adapter's ``detect_provider`` previously gated on
+``isinstance(api_key, str)`` and returned ``None`` for any runtime that
+returned a callable ``api_key`` — i.e. Azure Foundry with
+``auth_mode=entra_id``. Downstream, ACP would default to
+``"openrouter"`` and reject the legitimate provider in its auth handshake.
+This test pins the callable-aware fix so it never regresses.
+"""
+
+from __future__ import annotations
+
+from unittest.mock import patch
+
+
+class TestDetectProviderEntra:
+    def test_callable_api_key_is_a_valid_credential(self):
+        """A runtime returning a callable ``api_key`` (Entra bearer token
+        provider) must be detected as a configured provider, not
+        ``None``."""
+        from acp_adapter import auth as _acp_auth
+
+        def _fake_runtime(**_kwargs):
+            return {
+                "provider": "azure-foundry",
+                "api_mode": "chat_completions",
+                "auth_mode": "entra_id",
+                "base_url": "https://r.openai.azure.com/openai/v1",
+                "api_key": lambda: "jwt-fresh",
+            }
+
+        with patch(
+            "hermes_cli.runtime_provider.resolve_runtime_provider",
+            side_effect=_fake_runtime,
+        ):
+            assert _acp_auth.detect_provider() == "azure-foundry"
+            assert _acp_auth.has_provider() is True
+
+    def test_string_api_key_still_works(self):
+        from acp_adapter import auth as _acp_auth
+
+        def _fake_runtime(**_kwargs):
+            return {
+                "provider": "openrouter",
+                "api_key": "sk-or-static-key",
+            }
+
+        with patch(
+            "hermes_cli.runtime_provider.resolve_runtime_provider",
+            side_effect=_fake_runtime,
+        ):
+            assert _acp_auth.detect_provider() == "openrouter"
+
+    def test_empty_string_api_key_returns_none(self):
+        from acp_adapter import auth as _acp_auth
+
+        def _fake_runtime(**_kwargs):
+            return {"provider": "openrouter", "api_key": ""}
+
+        with patch(
+            "hermes_cli.runtime_provider.resolve_runtime_provider",
+            side_effect=_fake_runtime,
+        ):
+            assert _acp_auth.detect_provider() is None
+
+    def test_missing_provider_returns_none(self):
+        """A callable api_key without a provider is still ``None`` —
+        we don't synthesize a provider name from the credential shape."""
+        from acp_adapter import auth as _acp_auth
+
+        def _fake_runtime(**_kwargs):
+            return {"api_key": lambda: "jwt-fresh", "provider": ""}
+
+        with patch(
+            "hermes_cli.runtime_provider.resolve_runtime_provider",
+            side_effect=_fake_runtime,
+        ):
+            assert _acp_auth.detect_provider() is None
+
+    def test_resolver_exception_returns_none(self):
+        from acp_adapter import auth as _acp_auth
+
+        with patch(
+            "hermes_cli.runtime_provider.resolve_runtime_provider",
+            side_effect=RuntimeError("simulated"),
+        ):
+            assert _acp_auth.detect_provider() is None