Simplify chat secret CLI flow

tests/test_chat_secret_cli_flow.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""Smoke-test simplified chat secret CLI flow."""
+
+import importlib.util
+import pathlib
+import sys
+
+
+PROJECT_ID = "11111111-1111-1111-1111-111111111111"
+
+
+def load_module():
+    script_path = pathlib.Path(__file__).resolve().parents[1] / "resources" / "scripts" / "napseer_mcp_server.py"
+    sys.path.insert(0, str(script_path.parent))
+    spec = importlib.util.spec_from_file_location("napseer_mcp_server_chat_secret_test", script_path)
+    module = importlib.util.module_from_spec(spec)
+    assert spec and spec.loader
+    spec.loader.exec_module(module)
+    return module
+
+
+def run():
+    mod = load_module()
+    processed = []
+
+    mod.current_project_id = lambda: PROJECT_ID
+    mod.gateway_is_unlocked = lambda: True
+    mod.vault_exists = lambda: True
+    mod.gateway_vault_setup_requests = lambda args=None: {
+        "items": [{"id": "setup-1", "status": "pending", "project_id": PROJECT_ID}]
+    }
+    mod.gateway_process_vault_setup_requests = lambda args=None: processed.append(args) or {
+        "status": "processed",
+        "completed_count": 1,
+    }
+
+    def request_json(method, path, payload=None, **kwargs):
+        assert method == "GET"
+        assert path == f"/v1/projects/{PROJECT_ID}/vault/secrets?secret_kind=chat"
+        return {"items": []}
+
+    mod.request_json = request_json
+    setup = mod.chat_secret_setup({"project_id": PROJECT_ID})
+    assert processed and processed[-1]["complete_all"] is True
+    assert setup["chat_secret_configured"] is False
+
+    mod.gateway_vault_setup_requests = lambda args=None: {"items": []}
+    mod.request_json = lambda method, path, payload=None, **kwargs: {
+        "items": [{
+            "secret_kind": "chat",
+            "version": 3,
+            "status": "active",
+            "activation_status": "active",
+            "storage_provider": "hashicorp_vault_kv2",
+            "last_rotated_at": "2026-05-19T20:00:00Z",
+        }]
+    }
+    status = mod.chat_secret_status({"project_id": PROJECT_ID})
+    assert status["chat_secret_configured"] is True
+    assert status["active_chat_secret"]["version"] == 3
+
+    rotation = mod.chat_secret_rotate({"project_id": PROJECT_ID})
+    assert rotation["status"] == "operator_auth_required"
+    assert "worker token" in rotation["message"]
+
+    print("ok: chat secret CLI flow smoke passed")
+
+
+if __name__ == "__main__":
+    run()

tests/test_gateway_vault_setup_payload.py

@@ -139,7 +139,7 @@ def run():
     active_bundle = mod.wrapped_project_key_bundle_record(
         PROJECT_ID,
         ACCOUNT_ID,
-        "chat",
+        "memory",
         mod.generate_project_data_key_bundle(PROJECT_ID, ACCOUNT_ID, data_key_epoch=1),
         wrapping_epoch=1,
         bundle_version=1,
@@ -147,9 +147,9 @@ def run():
     )
 
     def request_json(method, path, payload=None, **kwargs):
-        assert (method, path) == ("GET", f"/v1/projects/{PROJECT_ID}/vault/secrets/chat/active")
+        assert (method, path) == ("GET", f"/v1/projects/{PROJECT_ID}/vault/secrets/memory/active")
         return {
-            "secret_kind": "chat",
+            "secret_kind": "memory",
             "version": 1,
             "wrapping_epoch": 1,
             "bundle_version": 1,
@@ -165,13 +165,20 @@ def run():
     ) or {
         "id": "secret-version-2",
         "version": 2,
-        "secret_kind": "chat",
+        "secret_kind": "memory",
     }
-    rotated = mod.gateway_rotate_project_vault_secret({"project_id": PROJECT_ID, "secret_kind": "chat"})
+    try:
+        mod.gateway_rotate_project_vault_secret({"project_id": PROJECT_ID, "secret_kind": "chat"})
+    except RuntimeError as exc:
+        assert "requires operator authorization" in str(exc)
+    else:
+        raise AssertionError("chat rotation must not run through the gateway worker path")
+
+    rotated = mod.gateway_rotate_project_vault_secret({"project_id": PROJECT_ID, "secret_kind": "memory"})
     assert rotated["version"] == 2
     assert not writes, "rotation must not persist project secret material locally"
     assert calls[0][0] == "POST"
-    assert calls[0][1] == f"/v1/projects/{PROJECT_ID}/vault/secrets/chat/rotate"
+    assert calls[0][1] == f"/v1/projects/{PROJECT_ID}/vault/secrets/memory/rotate"
     assert calls[0][5] == "encryption"
     assert set(calls[0][2]) == {
         "previous_wrapping_epoch",
@@ -186,7 +193,7 @@ def run():
     assert calls[0][2]["previous_data_key_epoch"] == 1
     assert calls[0][2]["previous_aad_hash"] == active_bundle["aad_hash"]
     assert calls[0][2]["previous_ciphertext_sha256"] == active_bundle["ciphertext_sha256"]
-    assert_wrapped_record(mod, calls[0][2]["wrapped_key_bundle"], "chat", data_key_epoch=2)
+    assert_wrapped_record(mod, calls[0][2]["wrapped_key_bundle"], "memory", data_key_epoch=2)
     assert "secret_b64" not in str(calls[0][2])
     assert mod.VAULT_SECRETS == local_before
 

tests/test_nap_install_gateway_routes.py

@@ -30,8 +30,14 @@ def run():
     assert mod.handle_gateway(["vault", "list"]) == 0
     assert calls[-1] == ("gateway", ["vault", "list"])
 
-    assert mod.handle_gateway(["vault", "rotate-secret", "--kind", "chat"]) == 0
-    assert calls[-1] == ("gateway", ["vault", "rotate-secret", "--kind", "chat"])
+    assert mod.handle_gateway(["vault", "rotate-secret", "--kind", "memory"]) == 0
+    assert calls[-1] == ("gateway", ["vault", "rotate-secret", "--kind", "memory"])
+
+    assert mod.handle_gateway(["process", "--all"]) == 0
+    assert calls[-1] == ("gateway", ["vault", "process", "--all"])
+
+    assert mod.main(["nap", "chat", "secret", "setup"]) == 0
+    assert calls[-1] == ("chat", ["secret", "setup"])
 
     try:
         mod.handle_gateway(["config"])