hermes_overlay/tests/test_runtime_audit_private_space.py

import asyncio
import importlib.util
from pathlib import Path

import httpx


SCRIPT = Path(__file__).parents[2] / "scripts" / "verify_futures_runtime.py"
SPEC = importlib.util.spec_from_file_location("verify_futures_runtime", SCRIPT)
assert SPEC and SPEC.loader
AUDIT = importlib.util.module_from_spec(SPEC)
SPEC.loader.exec_module(AUDIT)


def test_private_space_uses_bearer_header_and_dashboard_cookie_login(monkeypatch):
    monkeypatch.setenv("HF_TOKEN", "hf_example_private_space_token")
    monkeypatch.setenv("HERMES_ADMIN_PASSWORD", "dashboard-password")
    monkeypatch.setenv("HERMES_DASHBOARD_BASIC_AUTH_USERNAME", "admin")
    monkeypatch.delenv("HERMES_DASHBOARD_COOKIE", raising=False)

    auth, headers, needs_login = AUDIT._client_auth()

    assert auth is None
    assert headers["Authorization"] == "Bearer hf_example_private_space_token"
    assert needs_login is True

    async def exercise_login():
        async def handler(request: httpx.Request) -> httpx.Response:
            assert request.headers["Authorization"] == "Bearer hf_example_private_space_token"
            assert request.url.path == "/auth/password-login"
            assert b"dashboard-password" in request.content
            return httpx.Response(
                200,
                headers={"set-cookie": "hermes_session=opaque; Path=/; HttpOnly"},
                json={"ok": True},
            )

        async with httpx.AsyncClient(
            base_url="https://private-space.example",
            headers=headers,
            transport=httpx.MockTransport(handler),
        ) as client:
            result = await AUDIT._establish_dashboard_session(client, needs_login)
            assert result == {
                "attempted": True,
                "statusCode": 200,
                "cookieEstablished": True,
            }

    asyncio.run(exercise_login())


def test_public_space_keeps_existing_basic_auth(monkeypatch):
    monkeypatch.delenv("HF_TOKEN", raising=False)
    monkeypatch.setenv("HERMES_ADMIN_PASSWORD", "dashboard-password")
    monkeypatch.setenv("HERMES_DASHBOARD_BASIC_AUTH_USERNAME", "admin")
    monkeypatch.delenv("HERMES_DASHBOARD_COOKIE", raising=False)

    auth, headers, needs_login = AUDIT._client_auth()

    assert isinstance(auth, httpx.BasicAuth)
    assert "Authorization" not in headers
    assert needs_login is False