Merge pull request #989 from kaitranntt/kai/fix/984-tokens-api-key-regenerate-secret

fix: apply api-key updates during token regeneration

tests/unit/commands/tokens-command-auth-rotation.test.ts

@@ -0,0 +1,85 @@
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { getCliproxyConfigPath } from '../../../src/cliproxy';
+import { handleTokensCommand } from '../../../src/commands/tokens-command';
+import { getConfigYamlPath, loadUnifiedConfig } from '../../../src/config/unified-config-loader';
+
+describe('tokens command auth rotation', () => {
+  let tempHome = '';
+  let logLines: string[] = [];
+  let errorLines: string[] = [];
+  let originalCcsHome: string | undefined;
+  let originalNoColor: string | undefined;
+  let originalConsoleLog: typeof console.log;
+  let originalConsoleError: typeof console.error;
+
+  beforeEach(() => {
+    tempHome = fs.mkdtempSync(path.join(os.tmpdir(), 'ccs-tokens-rotation-'));
+    logLines = [];
+    errorLines = [];
+    originalCcsHome = process.env.CCS_HOME;
+    originalNoColor = process.env.NO_COLOR;
+    originalConsoleLog = console.log;
+    originalConsoleError = console.error;
+
+    process.env.CCS_HOME = tempHome;
+    process.env.NO_COLOR = '1';
+    console.log = (...args: unknown[]) => {
+      logLines.push(args.map(String).join(' '));
+    };
+    console.error = (...args: unknown[]) => {
+      errorLines.push(args.map(String).join(' '));
+    };
+  });
+
+  afterEach(() => {
+    if (originalCcsHome !== undefined) process.env.CCS_HOME = originalCcsHome;
+    else delete process.env.CCS_HOME;
+
+    if (originalNoColor !== undefined) process.env.NO_COLOR = originalNoColor;
+    else delete process.env.NO_COLOR;
+
+    console.log = originalConsoleLog;
+    console.error = originalConsoleError;
+    fs.rmSync(tempHome, { recursive: true, force: true });
+  });
+
+  it('applies api-key and regenerated secret in a single invocation', async () => {
+    const exitCode = await handleTokensCommand([
+      '--api-key',
+      'ccs-custom-key-123',
+      '--regenerate-secret',
+    ]);
+
+    expect(exitCode).toBe(0);
+    expect(errorLines).toHaveLength(0);
+    expect(logLines.some((line) => line.includes('New management secret generated'))).toBe(true);
+    expect(logLines.some((line) => line.includes('Global API key updated'))).toBe(true);
+    expect(logLines.filter((line) => line.includes('CLIProxy config regenerated'))).toHaveLength(1);
+
+    const config = loadUnifiedConfig();
+    const managementSecret = config?.cliproxy.auth?.management_secret;
+    expect(config?.cliproxy.auth?.api_key).toBe('ccs-custom-key-123');
+    expect(typeof managementSecret).toBe('string');
+    expect((managementSecret ?? '').length).toBeGreaterThan(20);
+
+    const cliproxyConfig = fs.readFileSync(getCliproxyConfigPath(), 'utf8');
+    expect(cliproxyConfig).toContain('"ccs-custom-key-123"');
+  });
+
+  it('rejects conflicting manual and generated secret flags', async () => {
+    const exitCode = await handleTokensCommand([
+      '--secret',
+      'manual-secret',
+      '--regenerate-secret',
+    ]);
+
+    expect(exitCode).toBe(1);
+    expect(
+      errorLines.some((line) => line.includes('Cannot combine --secret with --regenerate-secret'))
+    ).toBe(true);
+    expect(fs.existsSync(getConfigYamlPath())).toBe(false);
+  });
+});