Repository navigation
Expand file tree
/
Copy pathtest_secrets.py
More file actions
74 lines (51 loc) · 2.83 KB
/
Copy pathtest_secrets.py
File metadata and controls
74 lines (51 loc) · 2.83 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
"""Secrets endpoints tests — real CRUD; values never readable via the API
(matches real Databricks: dbutils.secrets.get() only, not direct API calls)."""
from uuid import uuid4
import pytest
from databricks.sdk import WorkspaceClient
@pytest.mark.crud
def test_secrets_create_scope_and_list(workspace_client: WorkspaceClient):
"""Test: create_scope creates a real scope, visible via list_scopes."""
scope = f"scope_{uuid4().hex[:8]}"
workspace_client.secrets.create_scope(scope=scope)
scopes = [s.name for s in workspace_client.secrets.list_scopes()]
assert scope in scopes
print(f"✓ Secret scope created for real: {scope}")
@pytest.mark.crud
def test_secrets_put_and_list_secrets(workspace_client: WorkspaceClient):
"""Test: put_secret stores a real secret, visible via list_secrets (metadata only)."""
scope = f"scope_{uuid4().hex[:8]}"
workspace_client.secrets.create_scope(scope=scope)
workspace_client.secrets.put_secret(scope=scope, key="api-key", string_value="s3cr3t-value")
secrets = [s.key for s in workspace_client.secrets.list_secrets(scope=scope)]
assert "api-key" in secrets
print(f"✓ Secret stored for real in scope: {scope}")
@pytest.mark.crud
def test_secrets_delete_secret_and_scope(workspace_client: WorkspaceClient):
"""Test: delete_secret and delete_scope really remove them."""
scope = f"scope_{uuid4().hex[:8]}"
workspace_client.secrets.create_scope(scope=scope)
workspace_client.secrets.put_secret(scope=scope, key="k", string_value="v")
workspace_client.secrets.delete_secret(scope=scope, key="k")
assert "k" not in [s.key for s in workspace_client.secrets.list_secrets(scope=scope)]
workspace_client.secrets.delete_scope(scope=scope)
assert scope not in [s.name for s in workspace_client.secrets.list_scopes()]
print("✓ Secret and scope deletion works for real")
@pytest.mark.error
def test_secrets_get_secret_always_rejected(workspace_client: WorkspaceClient):
"""Test: get_secret (direct API call) is always rejected, matching real
Databricks — secrets are only readable via dbutils inside a running job."""
scope = f"scope_{uuid4().hex[:8]}"
workspace_client.secrets.create_scope(scope=scope)
workspace_client.secrets.put_secret(scope=scope, key="k", string_value="v")
with pytest.raises(Exception):
workspace_client.secrets.get_secret(scope=scope, key="k")
print("✓ Direct get_secret call correctly rejected")
@pytest.mark.error
def test_secrets_create_scope_duplicate_fails(workspace_client: WorkspaceClient):
"""Test: Creating a duplicate scope raises an error."""
scope = f"scope_{uuid4().hex[:8]}"
workspace_client.secrets.create_scope(scope=scope)
with pytest.raises(Exception):
workspace_client.secrets.create_scope(scope=scope)
print("✓ Duplicate scope creation raises error")