test(cloud-auth): cover authorization failures

2026-07-12 18:05:30 +08:00
parent 7d22b5234d
commit a05465458c
3 changed files with 69 additions and 1 deletions
@@ -147,3 +147,18 @@ def test_public_principal_cannot_act_as_host() -> None:
    assert principal is not None
    with pytest.raises(HostPrincipalRequiredError):
        principal.require_host("host-a")
+
+
+def test_authentication_failure_does_not_log_bearer_secret(caplog) -> None:
+    provider = ConfiguredBearerAuthProvider(
+        [BearerCredential(principal_id="integrator", token="valid-secret")]
+    )
+
+    assert (
+        provider.authenticate(
+            _Request(headers={"authorization": "Bearer invalid-secret"})
+        )
+        is None
+    )
+    assert "invalid-secret" not in caplog.text
+    assert "valid-secret" not in caplog.text