feat(cloud): remove static credentials and add host console

tests/test_cloud_auth.py

@@ -7,15 +7,11 @@ import pytest
 from cloud.auth import (
     BearerCredential,
     ChainedAuthProvider,
-    ChainedEnrollmentAuthProvider,
     ConfiguredBearerAuthProvider,
-    ConfiguredEnrollmentTokenProvider,
-    EnrollmentCredential,
     HostIdentityMismatchError,
     HostPrincipalRequiredError,
     NullAuthProvider,
     RepositoryHostAuthProvider,
-    SelfServiceEnrollmentAuthProvider,
     digest_token,
 )
 
@@ -171,24 +167,6 @@ def test_authentication_failure_does_not_log_bearer_secret(caplog) -> None:
     assert "valid-secret" not in caplog.text
 
 
-def test_enrollment_token_provider_returns_digest_without_exposing_secret() -> None:
-    credential = EnrollmentCredential(
-        principal_id="installer-a",
-        token="one-time-enrollment-secret",
-    )
-    provider = ConfiguredEnrollmentTokenProvider([credential])
-
-    principal = provider.authenticate(
-        _Request(headers={"authorization": "Bearer one-time-enrollment-secret"})
-    )
-
-    assert principal is not None
-    assert principal.id == "installer-a"
-    assert principal.token_digest == digest_token("one-time-enrollment-secret")
-    assert "one-time-enrollment-secret" not in repr(credential)
-    assert "one-time-enrollment-secret" not in repr(provider.__dict__)
-
-
 def test_repository_host_auth_and_chain_preserve_host_scope() -> None:
     class Repository:
         def authenticate_enrolled_host(self, credential_digest: str) -> str | None:
@@ -215,67 +193,3 @@ def test_repository_host_auth_and_chain_preserve_host_scope() -> None:
     assert host_principal is not None
     assert host_principal.host_id == "host-managed"
     assert host_principal.scopes == frozenset()
-
-
-def test_self_service_enabled_with_no_token_enrolls_via_self_service() -> None:
-    provider = ChainedEnrollmentAuthProvider(
-        [ConfiguredEnrollmentTokenProvider(()), SelfServiceEnrollmentAuthProvider()]
-    )
-
-    principal = provider.authenticate(_Request(headers={}))
-
-    assert principal is not None
-    assert principal.id == "self-service"
-    assert principal.token_digest is None
-
-
-def test_self_service_disabled_with_no_token_is_unauthenticated() -> None:
-    provider = ChainedEnrollmentAuthProvider([ConfiguredEnrollmentTokenProvider(())])
-
-    assert provider.authenticate(_Request(headers={})) is None
-
-
-def test_self_service_enabled_with_valid_configured_token_uses_token_bound_path() -> (
-    None
-):
-    credential = EnrollmentCredential(
-        principal_id="installer-a",
-        token="one-time-enrollment-secret",
-    )
-    provider = ChainedEnrollmentAuthProvider(
-        [
-            ConfiguredEnrollmentTokenProvider([credential]),
-            SelfServiceEnrollmentAuthProvider(),
-        ]
-    )
-
-    principal = provider.authenticate(
-        _Request(headers={"authorization": "Bearer one-time-enrollment-secret"})
-    )
-
-    assert principal is not None
-    assert principal.id == "installer-a"
-    assert principal.token_digest == digest_token("one-time-enrollment-secret")
-
-
-def test_self_service_enabled_with_unknown_token_falls_through_to_self_service() -> (
-    None
-):
-    credential = EnrollmentCredential(
-        principal_id="installer-a",
-        token="one-time-enrollment-secret",
-    )
-    provider = ChainedEnrollmentAuthProvider(
-        [
-            ConfiguredEnrollmentTokenProvider([credential]),
-            SelfServiceEnrollmentAuthProvider(),
-        ]
-    )
-
-    principal = provider.authenticate(
-        _Request(headers={"authorization": "Bearer unknown-secret"})
-    )
-
-    assert principal is not None
-    assert principal.id == "self-service"
-    assert principal.token_digest is None