@@ -36,7 +36,7 @@ type MockManifestRegistry = {
3636};
37373838const pluginRegistryMocks = vi.hoisted(() => {
39-const loadManifestRegistry = vi.fn<() => MockManifestRegistry>(() => ({
39+const loadManifestRegistry = vi.fn<(...args: unknown[]) => MockManifestRegistry>(() => ({
4040plugins: [],
4141diagnostics: [],
4242}));
@@ -153,6 +153,81 @@ describe("provider env vars dynamic manifest metadata", () => {
153153source: "external cloud credentials",
154154},
155155]);
156+expect(
157+pluginRegistryMocks.loadPluginManifestRegistryForPluginRegistry.mock.calls.at(-1)?.[0],
158+).toMatchObject({ includeDisabled: false });
159+});
160+161+it("excludes untrusted workspace plugin auth evidence by default", async () => {
162+pluginRegistryMocks.loadPluginManifestRegistryForPluginRegistry.mockReturnValue({
163+plugins: [
164+{
165+id: "workspace-cloud",
166+origin: "workspace",
167+setup: {
168+providers: [
169+{
170+id: "workspace-cloud",
171+authEvidence: [
172+{
173+type: "local-file-with-env",
174+fileEnvVar: "WORKSPACE_CLOUD_CREDENTIALS",
175+credentialMarker: "workspace-cloud-local-credentials",
176+},
177+],
178+},
179+],
180+},
181+},
182+],
183+diagnostics: [],
184+});
185+186+expect(
187+resolveProviderAuthEvidence({ config: { plugins: {} } })["workspace-cloud"],
188+).toBeUndefined();
189+});
190+191+it("keeps explicitly trusted workspace plugin auth evidence", async () => {
192+pluginRegistryMocks.loadPluginManifestRegistryForPluginRegistry.mockReturnValue({
193+plugins: [
194+{
195+id: "workspace-cloud",
196+origin: "workspace",
197+setup: {
198+providers: [
199+{
200+id: "workspace-cloud",
201+authEvidence: [
202+{
203+type: "local-file-with-env",
204+fileEnvVar: "WORKSPACE_CLOUD_CREDENTIALS",
205+credentialMarker: "workspace-cloud-local-credentials",
206+},
207+],
208+},
209+],
210+},
211+},
212+],
213+diagnostics: [],
214+});
215+216+expect(
217+resolveProviderAuthEvidence({
218+config: {
219+plugins: {
220+allow: ["workspace-cloud"],
221+},
222+},
223+})["workspace-cloud"],
224+).toEqual([
225+{
226+type: "local-file-with-env",
227+fileEnvVar: "WORKSPACE_CLOUD_CREDENTIALS",
228+credentialMarker: "workspace-cloud-local-credentials",
229+},
230+]);
156231});
157232158233it("appends setup provider env vars after explicit provider auth env vars", async () => {
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。