From e241aedbcf10683bc7a7255c81a4b25e100b7c3f Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Mon, 11 May 2026 22:32:27 +0100
Subject: [PATCH] test: guard secrets channel collector calls

---
 ...runtime-config-collectors-channels.test.ts | 37 ++++++++++++++-----
 ...-external-channel-origin-discovery.test.ts | 21 +++++++++--
 2 files changed, 45 insertions(+), 13 deletions(-)

diff --git a/src/secrets/runtime-config-collectors-channels.test.ts b/src/secrets/runtime-config-collectors-channels.test.ts
index 57c909eb527..cd13f34bae4 100644
--- a/src/secrets/runtime-config-collectors-channels.test.ts
+++ b/src/secrets/runtime-config-collectors-channels.test.ts
@@ -13,6 +13,23 @@ vi.mock("./channel-contract-api.js", () => ({
   loadChannelSecretContractApi,
 }));
 
+function requireLoadChannelSecretContractApiCall(): {
+  channelId?: unknown;
+  config?: unknown;
+  env?: unknown;
+  loadablePluginOrigins?: unknown;
+} {
+  const [call] = loadChannelSecretContractApi.mock.calls;
+  if (!call) {
+    throw new Error("expected loadChannelSecretContractApi call");
+  }
+  const [params] = call;
+  if (typeof params !== "object" || params === null || Array.isArray(params)) {
+    throw new Error("expected loadChannelSecretContractApi params to be an object");
+  }
+  return params;
+}
+
 describe("runtime channel config collectors", () => {
   beforeEach(() => {
     getBootstrapChannelSecrets.mockReset();
@@ -43,11 +60,11 @@ describe("runtime channel config collectors", () => {
       context: {} as ResolverContext,
     });
 
-    const loadCall = loadChannelSecretContractApi.mock.calls[0]?.[0];
-    expect(loadCall?.channelId).toBe("imessage");
-    expect(loadCall?.config).toBe(config);
-    expect(loadCall?.env).toBeUndefined();
-    expect(loadCall?.loadablePluginOrigins).toBeUndefined();
+    const loadCall = requireLoadChannelSecretContractApiCall();
+    expect(loadCall.channelId).toBe("imessage");
+    expect(loadCall.config).toBe(config);
+    expect(loadCall.env).toBeUndefined();
+    expect(loadCall.loadablePluginOrigins).toBeUndefined();
     expect(collectRuntimeConfigAssignments).toHaveBeenCalledOnce();
     expect(getBootstrapChannelSecrets).not.toHaveBeenCalled();
   });
@@ -72,11 +89,11 @@ describe("runtime channel config collectors", () => {
       context: {} as ResolverContext,
     });
 
-    const loadCall = loadChannelSecretContractApi.mock.calls[0]?.[0];
-    expect(loadCall?.channelId).toBe("legacy");
-    expect(loadCall?.config).toBe(config);
-    expect(loadCall?.env).toBeUndefined();
-    expect(loadCall?.loadablePluginOrigins).toBeUndefined();
+    const loadCall = requireLoadChannelSecretContractApiCall();
+    expect(loadCall.channelId).toBe("legacy");
+    expect(loadCall.config).toBe(config);
+    expect(loadCall.env).toBeUndefined();
+    expect(loadCall.loadablePluginOrigins).toBeUndefined();
     expect(getBootstrapChannelSecrets).toHaveBeenCalledWith("legacy");
     expect(collectRuntimeConfigAssignments).toHaveBeenCalledOnce();
   });
diff --git a/src/secrets/runtime-external-channel-origin-discovery.test.ts b/src/secrets/runtime-external-channel-origin-discovery.test.ts
index aa00213e4fb..11addbb152c 100644
--- a/src/secrets/runtime-external-channel-origin-discovery.test.ts
+++ b/src/secrets/runtime-external-channel-origin-discovery.test.ts
@@ -28,6 +28,21 @@ function requireDiscordConfig(snapshot: Awaited<ReturnType<typeof prepareSecrets
   return config;
 }
 
+function requireLoadChannelSecretContractApiCall(): {
+  channelId?: unknown;
+  loadablePluginOrigins?: unknown;
+} {
+  const [call] = loadChannelSecretContractApiMock.mock.calls;
+  if (!call) {
+    throw new Error("expected loadChannelSecretContractApi call");
+  }
+  const [params] = call;
+  if (typeof params !== "object" || params === null || Array.isArray(params)) {
+    throw new Error("expected loadChannelSecretContractApi params to be an object");
+  }
+  return params;
+}
+
 describe("secrets runtime external channel origin discovery", () => {
   it("discovers loadable plugins for channel SecretRefs when plugins.entries is absent", async () => {
     loadPluginMetadataSnapshotMock.mockReturnValue({
@@ -78,8 +93,8 @@ describe("secrets runtime external channel origin discovery", () => {
 
     expect(requireDiscordConfig(snapshot).token).toBe("resolved-discord-token");
     expect(loadPluginMetadataSnapshotMock).toHaveBeenCalled();
-    const loadCall = loadChannelSecretContractApiMock.mock.calls[0]?.[0];
-    expect(loadCall?.channelId).toBe("discord");
-    expect(loadCall?.loadablePluginOrigins).toEqual(new Map([["discord", "global"]]));
+    const loadCall = requireLoadChannelSecretContractApiCall();
+    expect(loadCall.channelId).toBe("discord");
+    expect(loadCall.loadablePluginOrigins).toEqual(new Map([["discord", "global"]]));
   });
 });