fix(backend): inject provider credentials from file

2026-07-12 07:53:22 +02:00
parent ee92ef45ab
commit e40a9d9a56
13 changed files with 280 additions and 15 deletions
@@ -46,3 +46,12 @@ test("loadConfig accepts an authenticated upstream trust boundary", () => {
    AUTH_MODE: "upstream",
  }).authMode).toBe("upstream");
 });
+
+test("loadConfig accepts only an absolute generic model key file", () => {
+  expect(loadConfig({ THT_MODEL_API_KEY_FILE: "/run/secrets/model_api_key" }).modelApiKeyFile)
+    .toBe("/run/secrets/model_api_key");
+  expect(() => loadConfig({ THT_MODEL_API_KEY_FILE: "relative/key" }))
+    .toThrow(/model credential configuration is invalid/);
+  expect(() => loadConfig({ THT_MODEL_API_KEY_FILE: " /run/secrets/key" }))
+    .toThrow(/model credential configuration is invalid/);
+});