seb/hermes-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(dashboard): direct unit coverage for internal WS credential + docstring fix

Browse Source 
Follow-up to Ben's PR #37892. Adds a TestInternalCredential block to
test_dashboard_auth_ws_tickets.py exercising the mint-once stability,
multi-use, unminted-rejection, empty-value, wrong-value, reset-and-remint,
and ticket-store-independence branches directly (previously only covered
indirectly via _ws_auth_ok, which left the unminted and empty-value
branches unexercised).

Also corrects the consume_internal_credential docstring: the returned
identity dict is discarded by the current _ws_auth_ok caller (which only
needs the boolean outcome), so the prior 'carry it into its session log'
wording over-promised.
This commit is contained in:
kshitijk4poor
2026-06-02 23:43:27 -07:00
committed by kshitij
parent fd1ec8033d
commit e114b31eda
2 changed files with 75 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hermes_cli/dashboard_auth/ws_tickets.py
+5 -3
View File
@@ -131,9 +131,11 @@ def consume_internal_credential(value: str) -> Dict[str, Any]:
Unlike :func:`consume_ticket` this is **not** single-use — the value is
not removed on success, so a server-spawned child can present it on every
(re)connect. Returns the fixed server-internal identity ``info`` dict so
the WS handler can carry it into its session log, mirroring the shape
``consume_ticket`` returns.
(re)connect. Returns the fixed server-internal identity ``info`` dict
(``{user_id, provider}``), mirroring the ``info`` shape ``consume_ticket``
returns, so a caller that wants to record the connecting identity can; the
current ``_ws_auth_ok`` caller validates for the boolean outcome only and
discards the dict.
A constant-time compare against the (lazily-minted) credential avoids
leaking length / prefix information on mismatch. If no internal