feat(cloud): remove static credentials and add host console

tests/test_cloud_control_config.py

@@ -2,11 +2,7 @@ from __future__ import annotations
 
 import pytest
 
-from cloud.auth import (
-    ConfiguredBearerAuthProvider,
-    NullAuthProvider,
-    create_auth_provider,
-)
+from cloud.auth import NullAuthProvider, RejectingAuthProvider, create_auth_provider
 from cloud.control_config import (
     CloudConfigurationError,
     CloudControlConfig,
@@ -18,7 +14,7 @@ def test_load_control_config_uses_safe_local_defaults() -> None:
     assert load_control_config({}) == CloudControlConfig()
 
 
-def test_load_control_config_parses_deployment_values() -> None:
+def test_production_configuration_needs_no_static_credential_json() -> None:
     config = load_control_config(
         {
             "CLOUD_ENVIRONMENT": "production",
@@ -27,14 +23,6 @@ def test_load_control_config_parses_deployment_values() -> None:
             "CLOUD_LEASE_REAPER_INTERVAL_SECONDS": "7",
             "CLOUD_LEASE_DURATION_SECONDS": "90",
             "CLOUD_MAX_TASK_ATTEMPTS": "5",
-            "CLOUD_PUBLIC_CREDENTIALS_JSON": (
-                '[{"principal_id":"sdk","token":"sdk-secret",'
-                '"scopes":["tasks:submit","tasks:read"]}]'
-            ),
-            "CLOUD_HOST_CREDENTIALS_JSON": (
-                '[{"principal_id":"agent-a","token":"host-secret",'
-                '"host_id":"host-a","scopes":["host:agent"]}]'
-            ),
         }
     )
 
@@ -42,23 +30,6 @@ def test_load_control_config_parses_deployment_values() -> None:
     assert config.database_url.startswith("postgresql+psycopg://")
     assert config.scheduler_interval_seconds == 2.5
     assert config.max_task_attempts == 5
-    assert len(config.credentials) == 2
-    assert config.credentials[1].host_id == "host-a"
-    assert "sdk-secret" not in repr(config)
-
-
-def test_load_control_config_parses_enrollment_credentials() -> None:
-    config = load_control_config(
-        {
-            "CLOUD_ENROLLMENT_TOKENS_JSON": (
-                '[{"principal_id":"installer-a","token":"one-time-enrollment-secret"}]'
-            )
-        }
-    )
-
-    assert len(config.enrollment_credentials) == 1
-    assert config.enrollment_credentials[0].principal_id == "installer-a"
-    assert "one-time-enrollment-secret" not in repr(config)
 
 
 @pytest.mark.parametrize(
@@ -85,19 +56,6 @@ def test_load_control_config_rejects_unsafe_production_anonymous_mode() -> None:
                 "CLOUD_ENVIRONMENT": "production",
                 "CLOUD_DATABASE_URL": "postgresql://db/cloud",
                 "CLOUD_ALLOW_INSECURE_ANONYMOUS": "true",
-                "CLOUD_PUBLIC_CREDENTIALS_JSON": (
-                    '[{"principal_id":"sdk","token":"secret","scopes":[]}]'
-                ),
-            }
-        )
-
-
-def test_load_control_config_rejects_missing_production_credentials() -> None:
-    with pytest.raises(CloudConfigurationError, match="credential"):
-        load_control_config(
-            {
-                "CLOUD_ENVIRONMENT": "production",
-                "CLOUD_DATABASE_URL": "postgresql://db/cloud",
             }
         )
 
@@ -139,43 +97,29 @@ def test_production_requires_secure_user_session_cookie() -> None:
             {
                 "CLOUD_ENVIRONMENT": "production",
                 "CLOUD_DATABASE_URL": "postgresql://db/cloud",
-                "CLOUD_PUBLIC_CREDENTIALS_JSON": (
-                    '[{"principal_id":"sdk","token":"secret","scopes":[]}]'
-                ),
                 "CLOUD_SESSION_COOKIE_SECURE": "false",
             }
         )
 
 
-@pytest.mark.parametrize(
-    "name,value",
-    [
-        ("CLOUD_PUBLIC_CREDENTIALS_JSON", "not-json"),
-        ("CLOUD_PUBLIC_CREDENTIALS_JSON", "{}"),
-        (
-            "CLOUD_HOST_CREDENTIALS_JSON",
-            '[{"principal_id":"agent","token":"secret","scopes":[]}]',
-        ),
-        (
-            "CLOUD_ENROLLMENT_TOKENS_JSON",
-            '[{"principal_id":"installer","token":123}]',
-        ),
-    ],
-)
-def test_load_control_config_rejects_invalid_credentials(
-    name: str,
-    value: str,
-) -> None:
-    with pytest.raises(CloudConfigurationError, match="credential") as error:
-        load_control_config({name: value})
-    assert "secret" not in str(error.value)
+def test_removed_static_credential_variables_are_ignored() -> None:
+    config = load_control_config(
+        {
+            "CLOUD_PUBLIC_CREDENTIALS_JSON": "not-json",
+            "CLOUD_HOST_CREDENTIALS_JSON": "not-json",
+            "CLOUD_ENROLLMENT_TOKENS_JSON": "not-json",
+            "CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED": "not-a-bool",
+        }
+    )
+
+    assert config == CloudControlConfig()
 
 
 def test_auth_provider_requires_explicit_anonymous_override() -> None:
-    secure_provider = create_auth_provider([], allow_insecure_anonymous=False)
-    insecure_provider = create_auth_provider([], allow_insecure_anonymous=True)
+    secure_provider = create_auth_provider(allow_insecure_anonymous=False)
+    insecure_provider = create_auth_provider(allow_insecure_anonymous=True)
 
-    assert isinstance(secure_provider, ConfiguredBearerAuthProvider)
+    assert isinstance(secure_provider, RejectingAuthProvider)
     request = type("Request", (), {"headers": {}})()
     assert secure_provider.authenticate(request) is None
     assert isinstance(insecure_provider, NullAuthProvider)