src/cli/capability-cli/local-account-secrets.test.ts

import { beforeEach, describe, expect, it, vi } from "vitest";
import type { OpenClawConfig } from "../../config/types.openclaw.js";

const mocks = vi.hoisted(() => ({
  resolveAgentDir: vi.fn((_cfg: OpenClawConfig, agentId: string) => `/tmp/agent-${agentId}`),
  getRuntimeConfigSourceSnapshot: vi.fn<() => OpenClawConfig | null>(() => null),
  getActiveSecretsRuntimeConfigSnapshot: vi.fn<
    typeof import("../../secrets/runtime-state.js").getActiveSecretsRuntimeConfigSnapshot
  >(() => null),
  prepareSecretsRuntimeSnapshot: vi.fn(async (_params: unknown) => ({ marker: "snapshot" })),
  activateSecretsRuntimeSnapshot: vi.fn(),
}));

vi.mock("../../agents/agent-scope.js", () => ({
  resolveAgentDir: mocks.resolveAgentDir,
}));

vi.mock("../../agents/auth-profiles/sqlite.js", () => ({
  assertAuthProfileStoreAgentOwner: vi.fn(),
}));

vi.mock("../../config/config.js", () => ({
  getRuntimeConfigSourceSnapshot: mocks.getRuntimeConfigSourceSnapshot,
}));

vi.mock("../../secrets/runtime-state.js", () => ({
  getActiveSecretsRuntimeConfigSnapshot: mocks.getActiveSecretsRuntimeConfigSnapshot,
}));

vi.mock("../../secrets/runtime.js", () => ({
  prepareSecretsRuntimeSnapshot: mocks.prepareSecretsRuntimeSnapshot,
  activateSecretsRuntimeSnapshot: mocks.activateSecretsRuntimeSnapshot,
}));

import { prepareLocalCapabilityAccountSecrets } from "./local-account-secrets.js";

describe("prepareLocalCapabilityAccountSecrets", () => {
  beforeEach(() => {
    vi.clearAllMocks();
    mocks.getRuntimeConfigSourceSnapshot.mockReturnValue(null);
    mocks.getActiveSecretsRuntimeConfigSnapshot.mockReturnValue(null);
  });

  it("prepares only the selected agent auth store and preserves the source config", async () => {
    const cfg: OpenClawConfig = { agents: { defaults: { workspace: "/tmp/workspace" } } };
    const sourceConfig: OpenClawConfig = { secrets: { providers: {} } };
    mocks.getRuntimeConfigSourceSnapshot.mockReturnValue(sourceConfig);

    await prepareLocalCapabilityAccountSecrets({ cfg, agentId: "ops" });

    expect(mocks.resolveAgentDir).toHaveBeenCalledWith(cfg, "ops");
    expect(mocks.prepareSecretsRuntimeSnapshot).toHaveBeenCalledWith({
      config: sourceConfig,
      assignmentConfig: cfg,
      agentDirs: ["/tmp/agent-ops"],
      includeConfigRefs: false,
      allowUnavailableSecretOwners: true,
    });
    expect(mocks.activateSecretsRuntimeSnapshot).toHaveBeenCalledWith({ marker: "snapshot" });
  });
});