feat(server): add workbench API, DSH planner worker and RAG pipeline

server/tests/test_secret_store.py

@@ -0,0 +1,46 @@
+"""密钥安全存储单元测试。"""
+from unittest.mock import patch
+
+from app import secret_store
+from app.secret_store import mask_secret, resolve_secret, store_secret
+
+
+def test_mask_plaintext():
+    assert mask_secret("sk-abcdef123456") == "***3456"
+    assert mask_secret("abc") == "••••"
+    assert mask_secret("") == ""
+
+
+def test_mask_keychain_ref():
+    assert mask_secret("keychain:yawen-workbench.providers:provider-1") == "•••• 钥匙串保管"
+
+
+def test_store_without_keychain_returns_plaintext():
+    with patch.object(secret_store, "keychain_available", return_value=False):
+        result = store_secret("provider-1", "sk-secret")
+    assert result == "sk-secret"  # 降级：DB 存明文（旧行为）
+
+
+def test_store_with_keychain_writes_reference():
+    class FakeCompleted:
+        returncode = 0
+    with patch.object(secret_store, "keychain_available", return_value=True), \
+         patch.object(secret_store.subprocess, "run", return_value=FakeCompleted()) as run:
+        result = store_secret("provider-1", "sk-secret")
+    assert result == "keychain:yawen-workbench.providers:provider-1"
+    assert run.call_count == 2  # delete + add
+
+
+def test_resolve_keychain_reference():
+    class FakeCompleted:
+        returncode = 0
+        stdout = "sk-real-secret\n"
+    with patch.object(secret_store, "keychain_available", return_value=True), \
+         patch.object(secret_store.subprocess, "run", return_value=FakeCompleted()):
+        assert resolve_secret("keychain:yawen-workbench.providers:provider-1",
+                              "provider-1") == "sk-real-secret"
+
+
+def test_resolve_plaintext_passthrough():
+    assert resolve_secret("sk-plain", "provider-1") == "sk-plain"
+    assert resolve_secret("", "provider-1") == ""