TestResolvedKeyExpandsEnvVar: `key: ${MY_KEY}` in config.yaml must expand the env var at read time while the raw reference round-trips on Save. This is the core of the "no plaintext secret on disk" path.
(t *testing.T)
| 660 | // the env var at read time while the raw reference round-trips on Save. This |
| 661 | // is the core of the "no plaintext secret on disk" path. |
| 662 | func TestResolvedKeyExpandsEnvVar(t *testing.T) { |
| 663 | p := &Profile{Key: "${TEST_CODEHAMR_KEY}"} |
| 664 | if err := os.Setenv("TEST_CODEHAMR_KEY", "sk-resolved-123"); err != nil { |
| 665 | t.Fatal(err) |
| 666 | } |
| 667 | defer os.Unsetenv("TEST_CODEHAMR_KEY") |
| 668 | |
| 669 | if got := p.ResolvedKey(); got != "sk-resolved-123" { |
| 670 | t.Fatalf("ResolvedKey() = %q, want sk-resolved-123", got) |
| 671 | } |
| 672 | // Raw Key must be untouched: Save writes this, not the expanded value. |
| 673 | if p.Key != "${TEST_CODEHAMR_KEY}" { |
| 674 | t.Fatalf("ResolvedKey() mutated raw Key to %q - must stay ${TEST_CODEHAMR_KEY} for Save", p.Key) |
| 675 | } |
| 676 | } |
| 677 | |
| 678 | // TestResolvedKeyPassesLiteralThrough: a plaintext key with no $-references |
| 679 | // must pass through unchanged so existing configs keep working. |
nothing calls this directly
no test coverage detected