feat(cloud-auth): require production credentials

tests/test_cloud_control_config.py

@@ -2,6 +2,11 @@ from __future__ import annotations
 
 import pytest
 
+from cloud.auth import (
+    ConfiguredBearerAuthProvider,
+    NullAuthProvider,
+    create_auth_provider,
+)
 from cloud.control_config import (
     CloudConfigurationError,
     CloudControlConfig,
@@ -22,6 +27,14 @@ def test_load_control_config_parses_deployment_values() -> None:
             "CLOUD_LEASE_REAPER_INTERVAL_SECONDS": "7",
             "CLOUD_LEASE_DURATION_SECONDS": "90",
             "CLOUD_MAX_TASK_ATTEMPTS": "5",
+            "CLOUD_PUBLIC_CREDENTIALS_JSON": (
+                '[{"principal_id":"sdk","token":"sdk-secret",'
+                '"scopes":["tasks:submit","tasks:read"]}]'
+            ),
+            "CLOUD_HOST_CREDENTIALS_JSON": (
+                '[{"principal_id":"agent-a","token":"host-secret",'
+                '"host_id":"host-a","scopes":["host:agent"]}]'
+            ),
         }
     )
 
@@ -29,6 +42,9 @@ def test_load_control_config_parses_deployment_values() -> None:
     assert config.database_url.startswith("postgresql+psycopg://")
     assert config.scheduler_interval_seconds == 2.5
     assert config.max_task_attempts == 5
+    assert len(config.credentials) == 2
+    assert config.credentials[1].host_id == "host-a"
+    assert "sdk-secret" not in repr(config)
 
 
 @pytest.mark.parametrize(
@@ -55,10 +71,53 @@ def test_load_control_config_rejects_unsafe_production_anonymous_mode() -> None:
                 "CLOUD_ENVIRONMENT": "production",
                 "CLOUD_DATABASE_URL": "postgresql://db/cloud",
                 "CLOUD_ALLOW_INSECURE_ANONYMOUS": "true",
+                "CLOUD_PUBLIC_CREDENTIALS_JSON": (
+                    '[{"principal_id":"sdk","token":"secret","scopes":[]}]'
+                ),
             }
         )
 
 
+def test_load_control_config_rejects_missing_production_credentials() -> None:
+    with pytest.raises(CloudConfigurationError, match="credential"):
+        load_control_config(
+            {
+                "CLOUD_ENVIRONMENT": "production",
+                "CLOUD_DATABASE_URL": "postgresql://db/cloud",
+            }
+        )
+
+
+@pytest.mark.parametrize(
+    "name,value",
+    [
+        ("CLOUD_PUBLIC_CREDENTIALS_JSON", "not-json"),
+        ("CLOUD_PUBLIC_CREDENTIALS_JSON", "{}"),
+        (
+            "CLOUD_HOST_CREDENTIALS_JSON",
+            '[{"principal_id":"agent","token":"secret","scopes":[]}]',
+        ),
+    ],
+)
+def test_load_control_config_rejects_invalid_credentials(
+    name: str,
+    value: str,
+) -> None:
+    with pytest.raises(CloudConfigurationError, match="credentials") as error:
+        load_control_config({name: value})
+    assert "secret" not in str(error.value)
+
+
+def test_auth_provider_requires_explicit_anonymous_override() -> None:
+    secure_provider = create_auth_provider([], allow_insecure_anonymous=False)
+    insecure_provider = create_auth_provider([], allow_insecure_anonymous=True)
+
+    assert isinstance(secure_provider, ConfiguredBearerAuthProvider)
+    request = type("Request", (), {"headers": {}})()
+    assert secure_provider.authenticate(request) is None
+    assert isinstance(insecure_provider, NullAuthProvider)
+
+
 @pytest.mark.parametrize(
     "name,value",
     [