@pippit-dev/cli 1.0.38 → 1.0.40

package/internal/canvas/media_identity.go

@@ -0,0 +1,300 @@
+package canvas
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+)
+
+var canvasMediaAssetTypes = map[string]int{"image": 1, "video": 2, "audio": 3}
+
+func mediaIdentityError(nodeID, field, reason string) error {
+	return fmt.Errorf("INVALID_MEDIA_IDENTITY asset %q at %s: %s", nodeID, field, reason)
+}
+
+func identityField(values map[string]json.RawMessage, name string) (json.RawMessage, error) {
+	var result json.RawMessage
+	for key, value := range values {
+		if !strings.EqualFold(key, name) {
+			continue
+		}
+		if result != nil {
+			return nil, fmt.Errorf("duplicate %s fields are ambiguous", name)
+		}
+		result = value
+	}
+	return result, nil
+}
+
+func identityString(values map[string]json.RawMessage, name string) (string, error) {
+	raw, err := identityField(values, name)
+	if err != nil {
+		return "", err
+	}
+	if raw == nil || string(raw) == "null" {
+		return "", nil
+	}
+	var value string
+	if err := json.Unmarshal(raw, &value); err != nil {
+		return "", fmt.Errorf("%s must be a JSON string", name)
+	}
+	return strings.TrimSpace(value), nil
+}
+
+func mediaSection(raw json.RawMessage, kind string) (map[string]json.RawMessage, error) {
+	var asset map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &asset); err != nil {
+		return nil, err
+	}
+	// Native AgentAsset type, not preview sections: videos may also contain Image.
+	expectedType := canvasMediaAssetTypes[kind]
+	if typeRaw, ok := rawField(asset, "AssetType", "asset_type"); ok {
+		var actual int
+		if err := json.Unmarshal(typeRaw, &actual); err != nil || actual != expectedType {
+			return nil, fmt.Errorf("expected %s material", kind)
+		}
+	}
+	sectionRaw, ok := rawField(asset, strings.ToUpper(kind[:1])+kind[1:], kind)
+	if !ok {
+		return nil, fmt.Errorf("expected %s material", kind)
+	}
+	var section map[string]json.RawMessage
+	if err := json.Unmarshal(sectionRaw, &section); err != nil || section == nil {
+		return nil, fmt.Errorf("invalid %s material section", kind)
+	}
+	return section, nil
+}
+
+func cloudMediaID(raw json.RawMessage, kind string) (string, error) {
+	section, err := mediaSection(raw, kind)
+	if err != nil {
+		return "", err
+	}
+	id, err := optionalStringField(section, "asset_id", "assetId", "AssetID")
+	if err != nil {
+		return "", err
+	}
+	if id == "" {
+		return "", fmt.Errorf("media ID is not ready; query the material again")
+	}
+	pippitID, err := assetIDFromRaw(raw)
+	if err != nil {
+		return "", err
+	}
+	if id == pippitID {
+		return "", fmt.Errorf("cloud media ID cannot be the Pippit material ID")
+	}
+	return id, nil
+}
+
+func touchesMediaIdentity(path string) bool {
+	switch strings.ToLower(path) {
+	case "", "/type", "/content", "/content/assetid", "/content/pippitassetid":
+		return true
+	}
+	return false
+}
+
+func decodeNodeAsset(raw json.RawMessage) (map[string]json.RawMessage, error) {
+	var record map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &record); err != nil {
+		return nil, err
+	}
+	textRaw, ok := rawField(record, "TextInfo", "Text", "textInfo", "text")
+	if !ok {
+		return nil, fmt.Errorf("node asset has no inline text content")
+	}
+	var text map[string]json.RawMessage
+	if err := json.Unmarshal(textRaw, &text); err != nil {
+		return nil, err
+	}
+	content, ok := rawField(text, "Content", "content")
+	if !ok {
+		return nil, fmt.Errorf("node asset has no inline text content")
+	}
+	var value string
+	if json.Unmarshal(content, &value) == nil {
+		content = json.RawMessage(value)
+	}
+	var node map[string]json.RawMessage
+	if err := json.Unmarshal(content, &node); err != nil || node == nil {
+		return nil, fmt.Errorf("invalid node content")
+	}
+	return node, nil
+}
+
+// Only identity paths and their parents are projected. Other fields stay in the
+// original request, so validation never reconstructs or rewrites persisted data.
+func projectIdentityPatch(node map[string]json.RawMessage, patch PatchEntry) (map[string]json.RawMessage, error) {
+	if patch.Path == "" {
+		if patch.Op == "remove" {
+			return nil, nil
+		}
+		var value map[string]json.RawMessage
+		if err := json.Unmarshal(patch.Value, &value); err != nil {
+			return nil, err
+		}
+		return value, nil
+	}
+	if node == nil {
+		return nil, fmt.Errorf("cannot validate a patch without its node base")
+	}
+	parts := strings.Split(strings.TrimPrefix(patch.Path, "/"), "/")
+	key := parts[0]
+	if len(parts) == 1 {
+		if patch.Op == "remove" {
+			delete(node, key)
+		} else {
+			node[key] = patch.Value
+		}
+		return node, nil
+	}
+	var content map[string]json.RawMessage
+	if err := json.Unmarshal(node[key], &content); err != nil || content == nil {
+		return nil, fmt.Errorf("cannot validate a media identity without its content base")
+	}
+	if patch.Op == "remove" {
+		delete(content, parts[1])
+	} else {
+		content[parts[1]] = patch.Value
+	}
+	value, err := json.Marshal(content)
+	if err != nil {
+		return nil, err
+	}
+	node[key] = value
+	return node, nil
+}
+
+func readNodeIdentity(node map[string]json.RawMessage) (kind, pippitID, mediaID string, err error) {
+	if node == nil {
+		return
+	}
+	kind, err = identityString(node, "type")
+	if err != nil {
+		return
+	}
+	switch kind {
+	case "biz/image", "biz/video", "biz/audio":
+		kind = strings.TrimPrefix(kind, "biz/")
+	default:
+		kind = ""
+		return
+	}
+	contentRaw, fieldErr := identityField(node, "content")
+	if fieldErr != nil {
+		err = fieldErr
+		return
+	}
+	var content map[string]json.RawMessage
+	if err = json.Unmarshal(contentRaw, &content); err != nil {
+		return
+	}
+	pippitID, err = identityString(content, "pippitAssetId")
+	if err != nil {
+		return
+	}
+	mediaID, err = identityString(content, "assetId")
+	return
+}
+
+func validateApplyMediaIdentities(ctx context.Context, request ApplyRequest, runner *common.Runner) error {
+	patches := request.Transactions[0].Patches
+	affected := make(map[string]bool)
+	var ordered []string
+	var toQuery []string
+	for _, patch := range patches {
+		if touchesMediaIdentity(patch.Path) && !affected[patch.AssetID] {
+			affected[patch.AssetID] = true
+			ordered = append(ordered, patch.AssetID)
+			if patch.Path != "" {
+				toQuery = append(toQuery, patch.AssetID)
+			}
+		}
+	}
+	nodes := make(map[string]map[string]json.RawMessage)
+	type identity struct{ nodeID, kind, pippitID, mediaID string }
+	previous := make(map[string]identity)
+	if len(toQuery) > 0 {
+		result, err := queryAssets(ctx, toQuery, true, runner)
+		if err != nil {
+			return fmt.Errorf("canvas media identity preflight failed: %w", err)
+		}
+		for _, raw := range result.Assets {
+			id, _ := assetIDFromRaw(raw)
+			node, err := decodeNodeAsset(raw)
+			if err != nil {
+				return mediaIdentityError(id, "/content", err.Error())
+			}
+			nodes[id] = node
+			kind, pippitID, mediaID, readErr := readNodeIdentity(node)
+			if readErr == nil {
+				previous[id] = identity{id, kind, pippitID, mediaID}
+			}
+		}
+	}
+	for _, patch := range patches {
+		if !affected[patch.AssetID] || !touchesMediaIdentity(patch.Path) {
+			continue
+		}
+		node, err := projectIdentityPatch(nodes[patch.AssetID], patch)
+		if err != nil {
+			return mediaIdentityError(patch.AssetID, patch.Path, err.Error())
+		}
+		nodes[patch.AssetID] = node
+	}
+	var identities []identity
+	var materialIDs []string
+	seen := make(map[string]bool)
+	for _, nodeID := range ordered {
+		kind, pippitID, mediaID, err := readNodeIdentity(nodes[nodeID])
+		if err != nil {
+			return mediaIdentityError(nodeID, "/content", err.Error())
+		}
+		if kind == "" || (pippitID == "" && mediaID == "") {
+			continue
+		}
+		if old, ok := previous[nodeID]; ok && old.kind == kind && old.pippitID == pippitID && old.mediaID == mediaID {
+			continue
+		}
+		if mediaID == nodeID || (mediaID != "" && mediaID == pippitID) {
+			return mediaIdentityError(nodeID, "/content/assetId", "expected cloud media ID, received Pippit material or Canvas node ID")
+		}
+		if pippitID == "" {
+			return mediaIdentityError(nodeID, "/content/pippitAssetId", "Pippit material ID is required to verify the media")
+		}
+		if mediaID == "" {
+			return mediaIdentityError(nodeID, "/content/assetId", "use a semantic media command to resolve pippitAssetId")
+		}
+		identities = append(identities, identity{nodeID, kind, pippitID, mediaID})
+		if !seen[pippitID] {
+			materialIDs = append(materialIDs, pippitID)
+			seen[pippitID] = true
+		}
+	}
+	if len(materialIDs) == 0 {
+		return nil
+	}
+	materials, err := queryAssets(ctx, materialIDs, true, runner)
+	if err != nil {
+		return fmt.Errorf("canvas media identity preflight failed: %w", err)
+	}
+	byID := make(map[string]json.RawMessage)
+	for _, raw := range materials.Assets {
+		id, _ := assetIDFromRaw(raw)
+		byID[id] = raw
+	}
+	for _, item := range identities {
+		expected, err := cloudMediaID(byID[item.pippitID], item.kind)
+		if err != nil {
+			return mediaIdentityError(item.nodeID, "/content/assetId", err.Error())
+		}
+		if expected != item.mediaID {
+			return mediaIdentityError(item.nodeID, "/content/assetId", "media ID does not belong to the Pippit material")
+		}
+	}
+	return nil
+}

package/internal/canvas/media_identity_test.go

@@ -0,0 +1,160 @@
+package canvas
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+)
+
+const testPippitID = "10155947700492"
+const testMediaID = "7693046454219440665"
+const testNodeID = "10901596019212"
+
+func imageNode(mediaID string) json.RawMessage {
+	return json.RawMessage(fmt.Sprintf(`{"type":"biz/image","pippitAssetId":"%s","content":{"pippitAssetId":"%s","assetId":"%s","caption":"keep"}}`, testNodeID, testPippitID, mediaID))
+}
+
+func applyIdentityFixture(patches []PatchEntry, mediaRaw string) (ApplyOptions, *common.Runner, *int) {
+	writes := 0
+	client := &fakeClient{send: func(_ context.Context, path string, body, out any) error {
+		switch path {
+		case QueryPath:
+			request := body.(queryRequest)
+			var assets []json.RawMessage
+			for _, id := range request.PippitAssetIDs {
+				if id == testNodeID {
+					content, _ := json.Marshal(string(imageNode(testMediaID)))
+					assets = append(assets, json.RawMessage(fmt.Sprintf(`{"PippitAssetID":"%s","TextInfo":{"content":%s},"version":5}`, id, content)))
+				} else if id == testPippitID {
+					assets = append(assets, json.RawMessage(mediaRaw))
+				}
+			}
+			payload, _ := json.Marshal(map[string]any{"ret": "0", "data": map[string]any{"Assets": assets}})
+			return decodeInto(out, string(payload))
+		case ApplyPath:
+			writes++
+			return decodeInto(out, fmt.Sprintf(`{"ret":"0","data":{"results":[{"transaction_id":"tx","status":"ack","asset_versions":{"%s":6}}]}}`, testNodeID))
+		default:
+			return fmt.Errorf("unexpected request %s", path)
+		}
+	}}
+	return ApplyOptions{Request: ApplyRequest{
+		BatchID: "batch", ClientID: "client", Transactions: []PatchTransaction{{TransactionID: "tx", Patches: patches}},
+	}}, runnerWithClient(client), &writes
+}
+
+func imageMaterial() string {
+	return fmt.Sprintf(`{"PippitAssetID":"%s","AssetType":1,"SourceID":"workspace-source-id","Image":{"asset_id":"%s"}}`, testPippitID, testMediaID)
+}
+
+func TestApplyMediaIdentityRejectsBadIDsBeforeWrite(t *testing.T) {
+	for _, wrong := range []string{testPippitID, testNodeID, "workspace-source-id", "7693046454219440666"} {
+		t.Run(wrong, func(t *testing.T) {
+			opts, runner, writes := applyIdentityFixture([]PatchEntry{{AssetID: testNodeID, Op: "add", Path: "", Value: imageNode(wrong)}}, imageMaterial())
+			_, err := Apply(context.Background(), opts, runner)
+			if err == nil || !strings.Contains(err.Error(), "INVALID_MEDIA_IDENTITY") {
+				t.Fatalf("error = %v", err)
+			}
+			if *writes != 0 {
+				t.Fatalf("invalid data was written %d times", *writes)
+			}
+		})
+	}
+}
+
+func TestApplyMediaIdentityChecksFinalTransactionAndAllowsValidPair(t *testing.T) {
+	patches := []PatchEntry{
+		{AssetID: testNodeID, Op: "add", Path: "", Value: imageNode(testPippitID)},
+		{AssetID: testNodeID, Op: "replace", Path: "/content/assetId", Value: json.RawMessage(`"` + testMediaID + `"`)},
+	}
+	opts, runner, writes := applyIdentityFixture(patches, imageMaterial())
+	if _, err := Apply(context.Background(), opts, runner); err != nil {
+		t.Fatal(err)
+	}
+	if *writes != 1 {
+		t.Fatalf("writes = %d", *writes)
+	}
+}
+
+func TestApplyMediaIdentityRejectsPartialPatchBypass(t *testing.T) {
+	opts, runner, writes := applyIdentityFixture([]PatchEntry{{AssetID: testNodeID, Op: "replace", Path: "/content/assetId", Value: json.RawMessage(`"` + testPippitID + `"`)}}, imageMaterial())
+	if _, err := Apply(context.Background(), opts, runner); err == nil {
+		t.Fatal("expected identity error")
+	}
+	if *writes != 0 {
+		t.Fatal("partial invalid patch was written")
+	}
+}
+
+func TestApplyMediaIdentityRejectsNumbersWrongTypeMissingOrUnreadyMaterial(t *testing.T) {
+	for name, raw := range map[string]string{
+		"numeric":    fmt.Sprintf(`{"PippitAssetID":"%s","AssetType":1,"Image":{"asset_id":7693046454219440665}}`, testPippitID),
+		"wrong-type": fmt.Sprintf(`{"PippitAssetID":"%s","AssetType":2,"Image":{"asset_id":"%s"},"Video":{"asset_id":"video-id"}}`, testPippitID, testMediaID),
+		"unready":    fmt.Sprintf(`{"PippitAssetID":"%s","AssetType":1,"Image":{}}`, testPippitID),
+		"missing":    "null",
+	} {
+		t.Run(name, func(t *testing.T) {
+			opts, runner, writes := applyIdentityFixture([]PatchEntry{{AssetID: testNodeID, Op: "add", Path: "", Value: imageNode(testMediaID)}}, raw)
+			if _, err := Apply(context.Background(), opts, runner); err == nil {
+				t.Fatal("expected identity preflight error")
+			}
+			if *writes != 0 {
+				t.Fatal("invalid material was written")
+			}
+		})
+	}
+}
+
+func TestMediaUploadLocatorDistinguishesSourceAndTypedMedia(t *testing.T) {
+	for _, kind := range []string{"image", "video", "audio"} {
+		nativeType := map[string]int{"image": 1, "video": 2, "audio": 3}[kind]
+		raw := json.RawMessage(fmt.Sprintf(`{"PippitAssetID":"%s","AssetType":%d,"asset_id":"wrong-root-id","SourceID":"workspace-source-id","%s":{"asset_id":"%s"}}`, testPippitID, nativeType, strings.ToUpper(kind[:1])+kind[1:], testMediaID))
+		locator := locatorFromAsset(raw, testPippitID)
+		if locator.PippitAssetID != testPippitID || locator.MediaAssetID != testMediaID || locator.SourceID != "workspace-source-id" {
+			t.Fatalf("locator = %#v", locator)
+		}
+	}
+}
+
+func TestUploadExposesDistinctIdentifiersAndKeepsUnreadyMediaProcessing(t *testing.T) {
+	for _, ready := range []bool{true, false} {
+		t.Run(fmt.Sprint(ready), func(t *testing.T) {
+			file := filepath.Join(t.TempDir(), "reference.png")
+			if err := os.WriteFile(file, []byte("image"), 0600); err != nil {
+				t.Fatal(err)
+			}
+			raw := imageMaterial()
+			if !ready {
+				raw = fmt.Sprintf(`{"PippitAssetID":"%s","AssetType":1,"Image":{}}`, testPippitID)
+			}
+			client := &fakeClient{
+				multipart: func(_ context.Context, _ string, _ map[string]string, _ common.MultipartFile, out any) error {
+					return decodeInto(out, fmt.Sprintf(`{"ret":"0","data":{"asset_id":"workspace-source-id","pippit_asset_id":"%s"}}`, testPippitID))
+				},
+				send: func(_ context.Context, _ string, _ any, out any) error {
+					return decodeInto(out, `{"ret":"0","data":{"Assets":[`+raw+`]}}`)
+				},
+			}
+			result, err := Upload(context.Background(), UploadOptions{Path: file}, runnerWithClient(client))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if result.PippitAssetID != testPippitID || result.SourceID != "workspace-source-id" || result.AssetID != result.SourceID {
+				t.Fatalf("result = %#v", result)
+			}
+			if ready {
+				if result.MediaAssetID != testMediaID || result.Locator.MediaAssetID != testMediaID || result.State != StateReady {
+					t.Fatalf("ready result = %#v", result)
+				}
+			} else if result.MediaAssetID != "" || result.State != StateProcessing || result.Warning == "" {
+				t.Fatalf("processing result = %#v", result)
+			}
+		})
+	}
+}

package/internal/canvas/upload.go

@@ -38,6 +38,7 @@ type UploadOptions struct {
 // Canvas patches; callers should persist PippitAssetID instead.
 type AssetLocator struct {
 	PippitAssetID string `json:"pippit_asset_id"`
+	MediaAssetID  string `json:"media_asset_id,omitempty"`
 	SourceID      string `json:"source_id,omitempty"`
 	DownloadURL   string `json:"download_url,omitempty"`
 	InternalURL   string `json:"internal_url,omitempty"`
@@ -46,8 +47,11 @@ type AssetLocator struct {
 }
 
 type UploadResult struct {
-	State         string          `json:"state"`
+	State string `json:"state"`
+	// Deprecated compatibility field: upload workspace/source ID, never cloud media ID.
 	AssetID       string          `json:"asset_id,omitempty"`
+	SourceID      string          `json:"source_id,omitempty"`
+	MediaAssetID  string          `json:"media_asset_id,omitempty"`
 	PippitAssetID string          `json:"pippit_asset_id"`
 	Locator       AssetLocator    `json:"locator"`
 	Asset         json.RawMessage `json:"asset,omitempty"`
@@ -105,6 +109,7 @@ func Upload(ctx context.Context, opts UploadOptions, runner *common.Runner) (*Up
 	result := &UploadResult{
 		State:         StateProcessing,
 		AssetID:       assetID,
+		SourceID:      assetID,
 		PippitAssetID: pippitAssetID,
 		Locator:       AssetLocator{PippitAssetID: pippitAssetID},
 		LogID:         strings.TrimSpace(envelope.LogID),
@@ -121,8 +126,13 @@ func Upload(ctx context.Context, opts UploadOptions, runner *common.Runner) (*Up
 	}
 	result.State = StateReady
 	result.Locator = locatorFromAsset(asset, pippitAssetID)
+	result.MediaAssetID = result.Locator.MediaAssetID
 	result.Asset = asset
 	result.QueryLogID = queryLogID
+	if uploadedMediaKind(asset) != "" && result.MediaAssetID == "" {
+		result.State = StateProcessing
+		result.Warning = "material is queryable but its cloud media ID is not ready; use a semantic media command or query again, do not substitute asset_id/source_id"
+	}
 	return result, nil
 }
 
@@ -200,11 +210,30 @@ func uploadWaitError(err error, assetID string, timeout time.Duration) error {
 	return fmt.Errorf("wait for uploaded canvas asset %q canceled: %w", assetID, err)
 }
 
+func uploadedMediaKind(raw json.RawMessage) string {
+	var record map[string]json.RawMessage
+	_ = json.Unmarshal(raw, &record)
+	var nativeType int
+	_ = json.Unmarshal(record["AssetType"], &nativeType)
+	for kind, value := range canvasMediaAssetTypes {
+		if nativeType == value {
+			return kind
+		}
+	}
+	return ""
+}
+
 func locatorFromAsset(raw json.RawMessage, pippitAssetID string) AssetLocator {
 	var value any
 	_ = json.Unmarshal(raw, &value)
+	kind := uploadedMediaKind(raw)
+	mediaID := ""
+	if kind != "" {
+		mediaID, _ = cloudMediaID(raw, kind)
+	}
 	return AssetLocator{
 		PippitAssetID: pippitAssetID,
+		MediaAssetID:  mediaID,
 		SourceID:      findFirstString(value, "SourceID", "source_id", "sourceId"),
 		DownloadURL:   findFirstString(value, "DownloadUrl", "DownloadURL", "download_url", "downloadUrl"),
 		InternalURL:   findFirstString(value, "InternalUrl", "InternalURL", "internal_url", "internalUrl"),

package/internal/commandnames/names.go

@@ -0,0 +1,9 @@
+// Package commandnames defines top-level command names shared by registration and capability filtering.
+package commandnames
+
+const (
+	Login  = "login"
+	Logout = "logout"
+	Status = "status"
+	Update = "update"
+)

package/internal/common/adapter_test.go

@@ -0,0 +1,74 @@
+package common
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/adapter"
+)
+
+type decisionPolicy struct {
+	adapter.Default
+	decision           adapter.AuthDecision
+	err                error
+	prepared, stripped int
+}
+
+func (p *decisionPolicy) PrepareAPIRequest(context.Context, *http.Request) (adapter.AuthDecision, error) {
+	p.prepared++
+	return p.decision, p.err
+}
+func (p *decisionPolicy) StripSensitiveHeaders(req *http.Request) {
+	p.stripped++
+	req.Header.Del("X-Adapter-Auth")
+}
+
+// The common client handles authentication decisions and origin checks. Adapter errors must not trigger a fallback to local authentication.
+func TestAdapterAuthenticationBoundary(t *testing.T) {
+	failed := errors.New("adapter rejected")
+	for _, tc := range []struct {
+		name, target                     string
+		decision                         adapter.AuthDecision
+		policyErr                        error
+		wantAuth, wantPrepare, wantStrip bool
+		wantError                        bool
+	}{
+		{name: "default", target: "https://api.example.test/path", wantAuth: true, wantPrepare: true},
+		{name: "provided", target: "https://api.example.test/path", decision: adapter.AuthProvided, wantPrepare: true},
+		{name: "error", target: "https://api.example.test/path", policyErr: failed, wantPrepare: true, wantError: true},
+		{name: "invalid", target: "https://api.example.test/path", decision: adapter.AuthDecision(99), wantPrepare: true, wantError: true},
+		{name: "external", target: "https://files.example.test/file", wantStrip: true},
+		{name: "different port", target: "https://api.example.test:8443/file", wantStrip: true},
+		{name: "different scheme", target: "http://api.example.test/file", wantStrip: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			policy := &decisionPolicy{decision: tc.decision, err: tc.policyErr}
+			authCalls := 0
+			authorizer := NewAccessKeyContextProviderAuthorizer(func(context.Context) (string, error) { authCalls++; return "local-key", nil })
+			client := NewHTTPClientWithAdapter("https://api.example.test", time.Second, authorizer, policy).(*httpClient)
+			req, err := http.NewRequest(http.MethodGet, tc.target, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			err = client.prepareRequest(context.Background(), req, map[string]string{"Authorization": "Bearer caller", "X-Adapter-Auth": "caller"})
+			if (err != nil) != tc.wantError {
+				t.Fatalf("error=%v", err)
+			}
+			if tc.policyErr != nil && !errors.Is(err, failed) {
+				t.Fatalf("adapter error lost: %v", err)
+			}
+			if (authCalls == 1) != tc.wantAuth || (policy.prepared == 1) != tc.wantPrepare || (policy.stripped == 1) != tc.wantStrip {
+				t.Fatalf("auth=%d prepare=%d strip=%d", authCalls, policy.prepared, policy.stripped)
+			}
+			if !tc.wantAuth && req.Header.Get("Authorization") != "" {
+				t.Fatal("caller Authorization leaked")
+			}
+			if tc.wantStrip && req.Header.Get("X-Adapter-Auth") != "" {
+				t.Fatal("external request retained adapter credentials")
+			}
+		})
+	}
+}