feat(cloud-sdk): authenticate client requests

tests/test_cloud_client.py

@@ -3,12 +3,14 @@
 from __future__ import annotations
 
 import pytest
+import httpx
 
+from cloud.auth import BearerCredential, ConfiguredBearerAuthProvider
 from cloud.config import CloudConfig
 from cloud.plugins import PluginRegistry
 from cloud.pool import DevicePool
 from cloud.sdk.api import create_cloud_router
-from cloud.sdk.client import CloudClient
+from cloud.sdk.client import CloudAuthorizationError, CloudClient
 from cloud.scheduler import TaskScheduler
 from cloud.store import CloudStore
 from core.models import Device
@@ -30,7 +32,7 @@ def _config() -> CloudConfig:
     )
 
 
-def _client_and_pool(tmp_path):
+def _client_and_pool(tmp_path, *, auth_provider=None, token: str | None = None):
     store = CloudStore(tmp_path / "cloud.sqlite3")
     pool = DevicePool(store, _config())
     scheduler = TaskScheduler(pool, store, _config())
@@ -41,10 +43,15 @@ def _client_and_pool(tmp_path):
             pool=pool,
             scheduler=scheduler,
             plugin_registry=plugin_registry,
+            auth_provider=auth_provider,
         )
     )
     test_client = TestClient(app)
-    cloud_client = CloudClient("http://testserver", http_client=test_client)
+    cloud_client = CloudClient(
+        "http://testserver",
+        http_client=test_client,
+        token=token,
+    )
     return cloud_client, pool
 
 
@@ -111,8 +118,107 @@ def test_client_submit_with_constraints(tmp_path) -> None:
 
 
 def test_client_unknown_task_raises(tmp_path) -> None:
-    import httpx
-
     client, _ = _client_and_pool(tmp_path)
     with pytest.raises(httpx.HTTPStatusError):
         client.get_task_status("does-not-exist")
+
+
+def test_client_applies_bearer_token_to_every_public_method(tmp_path) -> None:
+    token = "sdk-secret"
+    provider = ConfiguredBearerAuthProvider(
+        [
+            BearerCredential(
+                principal_id="sdk",
+                token=token,
+                scopes=frozenset(
+                    {
+                        "tasks:submit",
+                        "tasks:read",
+                        "pool:read",
+                        "plugins:read",
+                        "plugins:admin",
+                    }
+                ),
+            )
+        ]
+    )
+    client, _ = _client_and_pool(
+        tmp_path,
+        auth_provider=provider,
+        token=token,
+    )
+
+    task_id = client.submit_task(goal="authenticated")["task_id"]
+    assert client.get_task_status(task_id)["status"] == "queued"
+    assert client.list_devices() == []
+    assert client.list_hosts() == []
+    assert client.list_plugins() == []
+    assert client.register_plugin(
+        name="authenticated-plugin",
+        version="1.0.0",
+        entry_point_kind="tool",
+        target="cloud.store:CloudStore",
+    )["name"] == "authenticated-plugin"
+
+
+def test_client_raises_typed_authorization_error_without_exposing_token(
+    tmp_path,
+) -> None:
+    provider = ConfiguredBearerAuthProvider(
+        [BearerCredential(principal_id="sdk", token="valid-token")]
+    )
+    client, _ = _client_and_pool(
+        tmp_path,
+        auth_provider=provider,
+        token="invalid-secret-token",
+    )
+
+    with pytest.raises(CloudAuthorizationError) as error:
+        client.list_devices()
+
+    assert error.value.status_code == 401
+    assert "invalid-secret-token" not in str(error.value)
+
+
+def test_client_supports_injected_httpx_auth(tmp_path) -> None:
+    class StaticAuth(httpx.Auth):
+        def auth_flow(self, request):
+            request.headers["Authorization"] = "Bearer injected-token"
+            yield request
+
+    provider = ConfiguredBearerAuthProvider(
+        [
+            BearerCredential(
+                principal_id="sdk",
+                token="injected-token",
+                scopes=frozenset({"pool:read"}),
+            )
+        ]
+    )
+    store = CloudStore(tmp_path / "auth.sqlite3")
+    pool = DevicePool(store, _config())
+    app = FastAPI()
+    app.include_router(
+        create_cloud_router(
+            pool=pool,
+            scheduler=TaskScheduler(pool, store, _config()),
+            plugin_registry=PluginRegistry(store),
+            auth_provider=provider,
+        )
+    )
+    client = CloudClient(
+        "http://testserver",
+        http_client=TestClient(app),
+        auth=StaticAuth(),
+    )
+
+    assert client.list_devices() == []
+
+
+def test_client_rejects_token_and_auth_together() -> None:
+    with pytest.raises(ValueError, match="mutually exclusive"):
+        CloudClient(
+            "https://cloud.example",
+            token="secret",
+            auth=httpx.BasicAuth("user", "password"),
+        )