From e612cf96b7212f707385fec53724dd20298ebccd Mon Sep 17 00:00:00 2001 From: Bartok9 Date: Sat, 11 Jul 2026 13:15:05 -0400 Subject: [PATCH] test(gateway): prove API_SERVER_* reads honor profile secret scope Preserves intent of #52399 on main where _apply_env_overrides already uses _getenv_str/scoped secret reads; plates clear drift (2026-07-11). --- .../test_multiplex_credential_isolation.py | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/tests/gateway/test_multiplex_credential_isolation.py b/tests/gateway/test_multiplex_credential_isolation.py index 7659efc39840..0cd23fe4db31 100644 --- a/tests/gateway/test_multiplex_credential_isolation.py +++ b/tests/gateway/test_multiplex_credential_isolation.py @@ -156,3 +156,41 @@ def worker(): t.join() assert seen["home"] == str(prof_b) + + +class TestApiServerEnvIsScoped: + """_apply_env_overrides must read API_SERVER_* through the profile scope, + not the global os.environ, so a secondary profile is not falsely enabled + by the default profile's key loaded into os.environ (#52307).""" + + def test_secondary_profile_scope_without_key_does_not_enable(self, monkeypatch): + from gateway.config import _apply_env_overrides, GatewayConfig, Platform + + # Default profile's key is in the global process env (loaded at import). + monkeypatch.setenv("API_SERVER_KEY", "global-default-key") + ss.set_multiplex_active(True) + + # Secondary profile scope has NO api_server credential. + tok = ss.set_secret_scope({"OPENAI_API_KEY": "sk-secondary"}) + try: + config = GatewayConfig() + _apply_env_overrides(config) + api = config.platforms.get(Platform.API_SERVER) + assert api is None or api.enabled is False + finally: + ss.reset_secret_scope(tok) + + def test_profile_scope_with_key_enables(self, monkeypatch): + from gateway.config import _apply_env_overrides, GatewayConfig, Platform + + monkeypatch.delenv("API_SERVER_KEY", raising=False) + ss.set_multiplex_active(True) + tok = ss.set_secret_scope({"API_SERVER_KEY": "profile-scoped-key"}) + try: + config = GatewayConfig() + _apply_env_overrides(config) + api = config.platforms.get(Platform.API_SERVER) + assert api is not None and api.enabled is True + assert api.extra.get("key") == "profile-scoped-key" + finally: + ss.reset_secret_scope(tok)