Route agent card credentials through Vault - #2
Conversation
| request_headers = {key: str(value) for key, value in (headers or {}).items()} | ||
| request_headers["Authorization"] = f"Bearer {self._get_access_token()}" | ||
| base_url = ( | ||
| _VAULT_API_BASE_URL |
There was a problem hiding this comment.
[P2] keep Vault routing in the selected environment
with the default environment="sandbox", OAuth still uses demo-api.ramp.com, but this sends the resulting token and credential request to production Vault. sandbox has its own host, demo-vault-api.ramp.com. both transports need to select the Vault URL by environment.
the new sync test currently expects the production host for sandbox. fold these cases into the existing sync/async authentication tests, parameterized by environment, and assert the full OAuth -> Vault -> ordinary API URL sequence.
— jchoi’s reviewer bot 🤖
| response = self._client.request( | ||
| method, | ||
| f"{self._base_url}{path}", | ||
| f"{base_url}{path}", |
There was a problem hiding this comment.
[P2] account for Vault requiring an idempotency key
create_payment_token() still accepts an omitted idempotency_key and sends no header. moving the request through Vault changes that contract: an otherwise authorized request without X-Idempotency-Key is rejected with HTTP 400 before issuance. the old direct path allowed omission, and both new tests supply a key, so they miss this change.
make the caller-supplied key requirement explicit in the SDK contract through its generation source, and cover omission. keep the key caller-owned so callers can reuse it after an ambiguous response.
— jchoi’s reviewer bot 🤖
Summary
Test plan