hermes-agent/tests/hermes_cli/test_provider_precedence.py

"""Regression tests for #29285 — provider precedence in resolve_provider("auto").

Explicit user intent (config.yaml model.provider, env-var API keys) must win
over a stale logged-in OAuth `active_provider` in auth.json. Before the fix,
`active_provider` sat above the env/config checks and silently overrode an
explicit choice — e.g. a user OAuth-logged-into Anthropic but with
OPENAI_API_KEY exported (or model.provider set) got routed to Anthropic.
"""
import pytest

from hermes_cli.auth import resolve_provider, AuthError


def _login(monkeypatch, provider_id):
    """Simulate a logged-in OAuth active_provider in auth.json."""
    monkeypatch.setattr("hermes_cli.auth._load_auth_store",
                        lambda: {"active_provider": provider_id})
    monkeypatch.setattr("hermes_cli.auth.get_auth_status",
                        lambda p: {"logged_in": p == provider_id})


def _config(monkeypatch, model_cfg):
    monkeypatch.setattr("hermes_cli.config.load_config", lambda: {"model": model_cfg})


def _no_aws(monkeypatch):
    # Neutralize any ambient AWS creds so Bedrock auto-detect can't interfere.
    monkeypatch.setattr("agent.bedrock_adapter.has_aws_credentials", lambda: False)


def _clear_provider_env(monkeypatch):
    for var in ("OPENAI_API_KEY", "OPENROUTER_API_KEY", "GLM_API_KEY", "ZAI_API_KEY",
                "KIMI_API_KEY", "MINIMAX_API_KEY", "HERMES_INFERENCE_PROVIDER"):
        monkeypatch.delenv(var, raising=False)


class TestProviderPrecedence:
    def test_config_provider_beats_stale_oauth(self, monkeypatch):
        """config.yaml model.provider wins over a logged-in OAuth active_provider."""
        _clear_provider_env(monkeypatch)
        _no_aws(monkeypatch)
        _login(monkeypatch, "anthropic")           # stale OAuth login
        _config(monkeypatch, {"provider": "zai", "default": "glm-4.6"})
        assert resolve_provider("auto") == "zai"

    def test_env_key_beats_stale_oauth(self, monkeypatch):
        """An exported provider API key wins over a logged-in OAuth active_provider."""
        _clear_provider_env(monkeypatch)
        _no_aws(monkeypatch)
        _login(monkeypatch, "anthropic")
        _config(monkeypatch, {"default": "some-model"})  # dict, NO provider key
        monkeypatch.setenv("OPENAI_API_KEY", "sk-test-key")
        assert resolve_provider("auto") == "openai-api"


    def test_oauth_used_as_last_resort(self, monkeypatch):
        """With NO config provider and NO env keys, the logged-in OAuth provider
        is still used (it's the last-resort fallback, not removed)."""
        _clear_provider_env(monkeypatch)
        _no_aws(monkeypatch)
        _login(monkeypatch, "anthropic")
        _config(monkeypatch, {})  # empty model config, no provider
        assert resolve_provider("auto") == "anthropic"




    def test_openrouter_pool_beats_stale_oauth(self, monkeypatch):
        """An OpenRouter credential-pool entry (no env var) wins over a logged-in
        OAuth provider — the pool rung sits above OAuth (#42130 + #29285)."""
        _clear_provider_env(monkeypatch)
        _no_aws(monkeypatch)
        _login(monkeypatch, "anthropic")
        _config(monkeypatch, {})

        class _Pool:
            def has_credentials(self):
                return True

        monkeypatch.setattr("agent.credential_pool.load_pool", lambda name: _Pool())
        assert resolve_provider("auto") == "openrouter"


def _logged_out(monkeypatch):
    monkeypatch.setattr("hermes_cli.auth._load_auth_store", lambda: {})
    monkeypatch.setattr("hermes_cli.auth.get_auth_status", lambda p: {"logged_in": False})


def _free_tier(monkeypatch, *, on=True, identity=False):
    """Free tier switch + whether a free-tier identity already exists. The resolver is a READ: any
    call into the creator from inside it is a bug, so the stub fails loudly."""
    monkeypatch.setattr("hermes_cli.anon_auth.guest_enabled", lambda: on)
    monkeypatch.setattr("hermes_cli.anon_auth.has_guest", lambda: identity)
    monkeypatch.setattr("hermes_cli.anon_auth.ensure_portal_identity",
                        lambda **kw: (_ for _ in ()).throw(AssertionError("resolve_provider must not mint")))


class TestFreeTierBeatsImplicitHostCredentials:
    """NS-829: a leftover ~/.aws profile must not pre-empt the free tier on a fresh install.

    The ladder: explicit intent still wins, an EXISTING free-tier identity sits above the implicit
    Bedrock chain, the free tier off (or its identity absent) restores Bedrock. The resolver never
    creates the identity; the boot bootstrap does, before any turn asks."""

    @pytest.mark.parametrize("free_tier_on, identity, env_key, login, expected", [
        (True, True, None, None, "nous"),                 # existing identity beats the AWS chain
        (True, False, None, None, "bedrock"),             # no identity yet: Bedrock, nothing minted
        (False, True, None, None, "bedrock"),             # free tier off: Bedrock as before
        (True, True, "OPENAI_API_KEY", None, "openai-api"),  # env key still wins
        (True, True, None, "anthropic", "anthropic"),        # a sign-in still wins
    ])
    def test_free_tier_sits_above_the_bedrock_chain(self, monkeypatch, free_tier_on, identity,
                                                     env_key, login, expected):
        _clear_provider_env(monkeypatch)
        _config(monkeypatch, "")
        if login:
            _login(monkeypatch, login)
        else:
            _logged_out(monkeypatch)
        if env_key:
            monkeypatch.setenv(env_key, "sk-test-key")
        monkeypatch.setattr("agent.bedrock_adapter.has_aws_credentials", lambda: True)
        _free_tier(monkeypatch, on=free_tier_on, identity=identity)
        assert resolve_provider("auto") == expected

    def test_skip_free_tier_answers_what_else_would_carry_inference(self, monkeypatch):
        """The bootstrap's question: with the free tier hidden, an existing identity is not an
        answer and the ladder falls through to the next real rung."""
        _clear_provider_env(monkeypatch)
        _config(monkeypatch, "")
        _logged_out(monkeypatch)
        monkeypatch.setattr("agent.bedrock_adapter.has_aws_credentials", lambda: False)
        _free_tier(monkeypatch, on=True, identity=True)
        assert resolve_provider("auto") == "nous"
        with pytest.raises(AuthError):
            resolve_provider("auto", skip_free_tier=True)