From 103d02f98c100c70b2f6f94e8b3ead77a9e9c59a Mon Sep 17 00:00:00 2001
From: joshavant <830519+joshavant@users.noreply.github.com>
Date: Tue, 24 Feb 2026 11:59:33 -0600
Subject: [PATCH] Auth choice tests: expect env-backed key refs

---
 src/commands/auth-choice.test.ts | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/src/commands/auth-choice.test.ts b/src/commands/auth-choice.test.ts
index 5a96c31650f..b4a37aa7c14 100644
--- a/src/commands/auth-choice.test.ts
+++ b/src/commands/auth-choice.test.ts
@@ -46,6 +46,7 @@ vi.mock("./zai-endpoint-detect.js", () => ({
 
 type StoredAuthProfile = {
   key?: string;
+  keyRef?: { source: string; id: string };
   access?: string;
   refresh?: string;
   provider?: string;
@@ -697,7 +698,10 @@ describe("applyAuthChoice", () => {
           ),
         ).toBe(true);
       }
-      expect((await readAuthProfile(scenario.profileId))?.key).toBe(scenario.envValue);
+      expect((await readAuthProfile(scenario.profileId))?.keyRef).toEqual({
+        source: "env",
+        id: scenario.envKey,
+      });
     }
   });
 
@@ -906,7 +910,10 @@ describe("applyAuthChoice", () => {
 
     expect(await readAuthProfile("litellm:default")).toMatchObject({
       type: "api_key",
-      key: "sk-litellm-test",
+      keyRef: {
+        source: "env",
+        id: "LITELLM_API_KEY",
+      },
     });
   });
 
@@ -921,7 +928,8 @@ describe("applyAuthChoice", () => {
         cloudflareAiGatewayApiKey: string;
       };
       expectEnvPrompt: boolean;
-      expectedKey: string;
+      expectedKey?: string;
+      expectedKeyRef?: { source: string; id: string };
       expectedMetadata: { accountId: string; gatewayId: string };
     }> = [
       {
@@ -929,7 +937,10 @@ describe("applyAuthChoice", () => {
         textValues: ["cf-account-id", "cf-gateway-id"],
         confirmValue: true,
         expectEnvPrompt: true,
-        expectedKey: "cf-gateway-test-key",
+        expectedKeyRef: {
+          source: "env",
+          id: "CLOUDFLARE_AI_GATEWAY_API_KEY",
+        },
         expectedMetadata: {
           accountId: "cf-account-id",
           gatewayId: "cf-gateway-id",
@@ -993,7 +1004,11 @@ describe("applyAuthChoice", () => {
       );
 
       const profile = await readAuthProfile("cloudflare-ai-gateway:default");
-      expect(profile?.key).toBe(scenario.expectedKey);
+      if (scenario.expectedKeyRef) {
+        expect(profile?.keyRef).toEqual(scenario.expectedKeyRef);
+      } else {
+        expect(profile?.key).toBe(scenario.expectedKey);
+      }
       expect(profile?.metadata).toEqual(scenario.expectedMetadata);
     }
     delete process.env.CLOUDFLARE_AI_GATEWAY_API_KEY;