From f8de0e913b8257f7ab5439da7984f30207ba6740 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=B0=8F=E6=A9=98?= <xiaoju@shazhou.work>
Date: Wed, 27 May 2026 01:50:36 +0000
Subject: [PATCH] test(cli): add edge-case tests for maskApiKeys (#531)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- non-provider apiKey fields not masked (scope check)
- empty provider object handled
- null apiKey handled
- grep check for no legacy apiKeyEnv references

小橘 <xiaoju@shazhou.work>
---
 .../cli-workflow/src/__tests__/config.test.ts | 58 +++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/packages/cli-workflow/src/__tests__/config.test.ts b/packages/cli-workflow/src/__tests__/config.test.ts
index 2c08777..a564995 100644
--- a/packages/cli-workflow/src/__tests__/config.test.ts
+++ b/packages/cli-workflow/src/__tests__/config.test.ts
@@ -143,6 +143,44 @@ defaultModel: default
         const masked = maskApiKeys(config);
         expect(masked).toEqual(config);
       });
+
+      test("does not mask non-provider apiKey fields", () => {
+        const config = {
+          apiKey: "root-level-key",
+          providers: {
+            dashscope: { apiKey: "sk-secret" },
+          },
+          models: {
+            default: { provider: "dashscope" },
+          },
+        };
+        const masked = maskApiKeys(config);
+        // Root-level apiKey should NOT be masked
+        expect(masked.apiKey).toBe("root-level-key");
+        // Provider apiKey SHOULD be masked
+        const providers = masked.providers as Record<string, Record<string, unknown>>;
+        expect(providers.dashscope.apiKey).toBe("***MASKED***");
+      });
+
+      test("handles empty provider object", () => {
+        const config = {
+          providers: { dashscope: {} },
+        };
+        const masked = maskApiKeys(config);
+        expect(masked).toEqual({ providers: { dashscope: {} } });
+      });
+
+      test("handles provider with null apiKey", () => {
+        const config = {
+          providers: {
+            dashscope: { apiKey: null, baseUrl: "https://example.com" },
+          },
+        };
+        const masked = maskApiKeys(config);
+        const providers = masked.providers as Record<string, Record<string, unknown>>;
+        expect(providers.dashscope.apiKey).toBe("***MASKED***");
+        expect(providers.dashscope.baseUrl).toBe("https://example.com");
+      });
     });
   });
 
@@ -619,4 +657,24 @@ defaultModel: default
       }
     });
   });
+
+  describe("no legacy apiKeyEnv references", () => {
+    test("config.ts has no references to apiKeyEnv", () => {
+      const configSource = readFileSync(
+        join(__dirname, "..", "commands", "config.ts"),
+        "utf8",
+      );
+      expect(configSource).not.toContain("apiKeyEnv");
+    });
+
+    test("config.test.ts has no references to apiKeyEnv (except this test)", () => {
+      const testSource = readFileSync(__filename, "utf8");
+      // Remove this test block's own mentions before checking
+      const withoutThisTest = testSource.replace(
+        /describe\("no legacy apiKeyEnv references"[\s\S]*$/,
+        "",
+      );
+      expect(withoutThisTest).not.toContain("apiKeyEnv");
+    });
+  });
 });