Skip to content

Commit 148ec32

Browse files
lin-hongkuanlin-hongkuan
authored
fix: require env resolution for web provider refs (#96400)
* fix: require env resolution for web provider refs * chore: retrigger PR checks --------- Co-authored-by: lin-hongkuan <[email protected]>
1 parent 4f9a371 commit 148ec32

2 files changed

Lines changed: 43 additions & 2 deletions

File tree

‎packages/web-content-core/src/provider-runtime-shared.test.ts‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,43 @@ describe("hasWebProviderEntryCredential", () => {
8080
).toBe(true);
8181
});
8282

83+
it("does not treat env secret refs as literal credentials when env resolution misses", () => {
84+
expect(
85+
hasWebProviderEntryCredential({
86+
provider,
87+
config: {},
88+
toolConfig: undefined,
89+
resolveRawValue: () => "${CUSTOM_API_KEY}",
90+
resolveEnvValue: () => undefined,
91+
}),
92+
).toBe(false);
93+
});
94+
95+
it("does not treat fallback env secret refs as literal credentials", () => {
96+
expect(
97+
hasWebProviderEntryCredential({
98+
provider,
99+
config: {},
100+
toolConfig: undefined,
101+
resolveRawValue: () => undefined,
102+
resolveFallbackRawValue: () => "$CUSTOM_API_KEY",
103+
resolveEnvValue: () => undefined,
104+
}),
105+
).toBe(false);
106+
});
107+
108+
it("keeps non-reference config strings as literal credentials", () => {
109+
expect(
110+
hasWebProviderEntryCredential({
111+
provider,
112+
config: {},
113+
toolConfig: undefined,
114+
resolveRawValue: () => "literal-secret",
115+
resolveEnvValue: () => undefined,
116+
}),
117+
).toBe(true);
118+
});
119+
83120
it("falls back to provider auth before env probing", () => {
84121
expect(
85122
hasWebProviderEntryCredential({

‎packages/web-content-core/src/provider-runtime-shared.ts‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,9 @@ export function hasWebProviderEntryCredential<
190190
if (configuredRef && configuredRef.source !== "env") {
191191
return true;
192192
}
193-
const fromConfig = normalizeSecretInput(normalizeSecretInputString(rawValue));
193+
const fromConfig = configuredRef
194+
? ""
195+
: normalizeSecretInput(normalizeSecretInputString(rawValue));
194196
if (fromConfig) {
195197
return true;
196198
}
@@ -217,7 +219,9 @@ export function hasWebProviderEntryCredential<
217219
if (fallbackRef && fallbackRef.source !== "env") {
218220
return true;
219221
}
220-
const fallbackConfig = normalizeSecretInput(normalizeSecretInputString(fallbackRawValue));
222+
const fallbackConfig = fallbackRef
223+
? ""
224+
: normalizeSecretInput(normalizeSecretInputString(fallbackRawValue));
221225
if (fallbackConfig) {
222226
return true;
223227
}

0 commit comments

Comments
 (0)