feat(cloud): add edge host enrollment

tests/test_cloud_auth.py

@@ -6,10 +6,15 @@ import cloud.auth as auth_module
 import pytest
 from cloud.auth import (
     BearerCredential,
+    ChainedAuthProvider,
     ConfiguredBearerAuthProvider,
+    ConfiguredEnrollmentTokenProvider,
+    EnrollmentCredential,
     HostIdentityMismatchError,
     HostPrincipalRequiredError,
     NullAuthProvider,
+    RepositoryHostAuthProvider,
+    digest_token,
 )
 
 
@@ -162,3 +167,49 @@ def test_authentication_failure_does_not_log_bearer_secret(caplog) -> None:
     )
     assert "invalid-secret" not in caplog.text
     assert "valid-secret" not in caplog.text
+
+
+def test_enrollment_token_provider_returns_digest_without_exposing_secret() -> None:
+    credential = EnrollmentCredential(
+        principal_id="installer-a",
+        token="one-time-enrollment-secret",
+    )
+    provider = ConfiguredEnrollmentTokenProvider([credential])
+
+    principal = provider.authenticate(
+        _Request(headers={"authorization": "Bearer one-time-enrollment-secret"})
+    )
+
+    assert principal is not None
+    assert principal.id == "installer-a"
+    assert principal.token_digest == digest_token("one-time-enrollment-secret")
+    assert "one-time-enrollment-secret" not in repr(credential)
+    assert "one-time-enrollment-secret" not in repr(provider.__dict__)
+
+
+def test_repository_host_auth_and_chain_preserve_host_scope() -> None:
+    class Repository:
+        def authenticate_enrolled_host(self, credential_digest: str) -> str | None:
+            if credential_digest == digest_token("dynamic-host-secret"):
+                return "host-managed"
+            return None
+
+    configured = ConfiguredBearerAuthProvider(
+        [BearerCredential(principal_id="sdk", token="sdk-secret")]
+    )
+    provider = ChainedAuthProvider(
+        [configured, RepositoryHostAuthProvider(Repository())]  # type: ignore[arg-type]
+    )
+
+    public_principal = provider.authenticate(
+        _Request(headers={"authorization": "Bearer sdk-secret"})
+    )
+    host_principal = provider.authenticate(
+        _Request(headers={"authorization": "Bearer dynamic-host-secret"})
+    )
+
+    assert public_principal is not None
+    assert public_principal.id == "sdk"
+    assert host_principal is not None
+    assert host_principal.host_id == "host-managed"
+    assert host_principal.scopes == frozenset()