refactor: use test_secrets_store() helper in orchestrator api test

Co-authored-by: henrypark133 <[email protected]>

src/config/sandbox.rs

@@ -408,10 +408,10 @@ mod tests {
     fn parse_oauth_token_valid() {
         let json = format!(
             r#"{{"claudeAiOauth": {{"accessToken": "{}"}}}}"#,
-            TEST_ANTHROPIC_OAUTH_BASIC
+            TEST_ANTHROPIC_OAUTH_FAKE
         );
         let token = parse_oauth_access_token(&json);
-        assert_eq!(token, Some(TEST_ANTHROPIC_OAUTH_BASIC.to_string()));
+        assert_eq!(token, Some(TEST_ANTHROPIC_OAUTH_FAKE.to_string()));
     }
 
     #[test]
@@ -446,11 +446,11 @@ mod tests {
                 "expiresAt": 1700000000
             }}
         }}"#,
-            TEST_ANTHROPIC_OAUTH_NESTED
+            TEST_ANTHROPIC_OAUTH_REAL
         );
         assert_eq!(
             parse_oauth_access_token(&json),
-            Some(TEST_ANTHROPIC_OAUTH_NESTED.to_string())
+            Some(TEST_ANTHROPIC_OAUTH_REAL.to_string())
         );
     }
 

src/orchestrator/api.rs

@@ -458,6 +458,7 @@ mod tests {
     use crate::orchestrator::auth::TokenStore;
     use crate::orchestrator::job_manager::{ContainerJobConfig, ContainerJobManager};
     use crate::testing::StubLlm;
+    use crate::testing::credentials::test_secrets_store;
 
     use super::*;
 
@@ -661,7 +662,6 @@ mod tests {
 
     #[tokio::test]
     async fn credentials_returns_secrets_when_store_configured() {
-        use crate::testing::credentials::test_secrets_store;
         use secrecy::SecretString;
         let secrets_store = Arc::new(test_secrets_store());
 

src/testing/credentials.rs

@@ -12,7 +12,7 @@ use crate::secrets::{InMemorySecretsStore, SecretsCrypto};
 
 // ── Encryption keys ──────────────────────────────────────────────────────
 
-/// 32-character key string for `SecretsCrypto::new()` in tests.
+/// 32-byte hex key for `SecretsCrypto::new()` in tests.
 pub const TEST_CRYPTO_KEY: &str = "0123456789abcdef0123456789abcdef";
 
 /// 32+ char key for web gateway `SecretsCrypto` in tests.
@@ -38,13 +38,13 @@ pub const TEST_OPENAI_API_KEY_ISSUE_129: &str = "sk-test-key-for-issue-129";
 pub const TEST_ANTHROPIC_OAUTH_TOKEN: &str = "sk-ant-oat01-test-token";
 
 /// Anthropic API key for priority tests.
-pub const TEST_ANTHROPIC_API_KEY: &str = "sk-ant-priority-key";
+pub const TEST_ANTHROPIC_API_KEY: &str = "sk-ant-real-key";
 
 /// Anthropic OAuth token for sandbox config parse tests.
-pub const TEST_ANTHROPIC_OAUTH_BASIC: &str = "sk-ant-oat01-basic";
+pub const TEST_ANTHROPIC_OAUTH_FAKE: &str = "sk-ant-oat01-fake";
 
 /// Anthropic OAuth token in nested JSON parse test.
-pub const TEST_ANTHROPIC_OAUTH_NESTED: &str = "sk-ant-oat01-primary-token";
+pub const TEST_ANTHROPIC_OAUTH_REAL: &str = "sk-ant-oat01-real-token";
 
 // ── Google OAuth ─────────────────────────────────────────────────────────
 
@@ -89,7 +89,7 @@ pub const TEST_AUTH_SECRET_TOKEN: &str = "secret-token";
 // ── Stripe ──────────────────────────────────────────────────────────────
 
 /// Stripe-style test key.
-pub const TEST_STRIPE_KEY: &str = "sk_test_fake123";
+pub const TEST_STRIPE_KEY: &str = "sk-live";
 
 // ── Redaction test values ───────────────────────────────────────────────
 

src/tools/builtin/http.rs

@@ -609,7 +609,7 @@ impl Tool for HttpTool {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::testing::credentials::{TEST_OPENAI_API_KEY, test_secrets_store};
+    use crate::testing::credentials::{TEST_CRYPTO_KEY, TEST_OPENAI_API_KEY};
 
     #[test]
     fn test_http_tool_schema_headers_is_array() {
@@ -869,7 +869,12 @@ mod tests {
         let tool = HttpTool::new().with_credentials(
             registry,
             // secrets_store is not used in requires_approval, just needs to be present
-            Arc::new(test_secrets_store()),
+            Arc::new(crate::secrets::InMemorySecretsStore::new(Arc::new(
+                crate::secrets::SecretsCrypto::new(secrecy::SecretString::from(
+                    TEST_CRYPTO_KEY.to_string(),
+                ))
+                .unwrap(),
+            ))),
         );
 
         let params = serde_json::json!({
@@ -886,7 +891,15 @@ mod tests {
         let registry = Arc::new(SharedCredentialRegistry::new());
         // Empty registry - no credential mappings
 
-        let tool = HttpTool::new().with_credentials(registry, Arc::new(test_secrets_store()));
+        let tool = HttpTool::new().with_credentials(
+            registry,
+            Arc::new(crate::secrets::InMemorySecretsStore::new(Arc::new(
+                crate::secrets::SecretsCrypto::new(secrecy::SecretString::from(
+                    TEST_CRYPTO_KEY.to_string(),
+                ))
+                .unwrap(),
+            ))),
+        );
 
         let params = serde_json::json!({
             "method": "GET",
@@ -945,7 +958,15 @@ mod tests {
         let registry = Arc::new(SharedCredentialRegistry::new());
         registry.add_mappings(vec![CredentialMapping::bearer("test_key", "api.test.com")]);
 
-        let tool = HttpTool::new().with_credentials(registry, Arc::new(test_secrets_store()));
+        let tool = HttpTool::new().with_credentials(
+            registry,
+            Arc::new(crate::secrets::InMemorySecretsStore::new(Arc::new(
+                crate::secrets::SecretsCrypto::new(secrecy::SecretString::from(
+                    TEST_CRYPTO_KEY.to_string(),
+                ))
+                .unwrap(),
+            ))),
+        );
 
         // These calls should not panic in multi-thread runtime
         let params_no_auth = serde_json::json!({

tests/config_round_trip.rs

@@ -12,9 +12,8 @@ use tempfile::tempdir;
 
 use ironclaw::bootstrap::{save_bootstrap_env_to, upsert_bootstrap_var_to};
 
-/// Fake OpenAI API key for test use only. Mirrors the internal
-/// `TEST_OPENAI_API_KEY_LONG` constant from the main crate, which is not
-/// directly available to integration tests due to `#[cfg(test)]`.
+/// Fake OpenAI API key for test use only. Mirrors `TEST_OPENAI_API_KEY_LONG`
+/// from `crate::testing::credentials` (unavailable in integration tests).
 const TEST_OPENAI_API_KEY_LONG: &str = "sk-test-key-1234567890";
 
 /// Parse a .env file into a HashMap using dotenvy.