create-workframe 0.1.11 → 0.1.13

package/workframe-api/snapshot_feed.py

@@ -0,0 +1,49 @@
+"""WF-032 extract: aggregate Hermes/workspace snapshot for /api/snapshot."""
+
+from __future__ import annotations
+
+from typing import Any
+
+import crew_registry
+import health_monitor
+from kanban_cron import cron_data, kanban_data
+
+
+def _srv():
+    import server as srv
+
+    return srv
+
+
+def build_snapshot() -> dict[str, Any]:
+    profiles = _srv()._list_profiles()
+    primary = _srv()._primary_profile()
+    gateway = _srv().gateway_data(primary) if primary else _srv().gateway_data("")
+    crew = crew_registry.crew_data(profiles, primary, gateway)
+    activity = _srv().activity_data(profiles, crew)
+    health = health_monitor.health_data(primary)
+    sessions = _srv().sessions_data(primary) if primary else _srv().sessions_data("")
+    kanban = kanban_data()
+    cron = cron_data(primary) if primary else cron_data("")
+    return {
+        "ok": True,
+        "generated_at": _srv()._utc_now(),
+        "version": _srv().VERSION,
+        "project_name": _srv().PROJECT_NAME,
+        "native_profile": primary,
+        "native_agent_name": _srv()._native_display_name(),
+        "native_model": _srv()._profile_model(primary) if primary else "",
+        "profiles": profiles,
+        "crew": crew,
+        "gateway": gateway,
+        "sessions": sessions,
+        "activity": activity["entries"],
+        "agents": activity["agents"],
+        "activity_by_day": activity["activity_by_day"],
+        "stats": activity["stats"],
+        "kanban": kanban,
+        "cron": cron,
+        "crons": cron,
+        "vps": health,
+        "health": health,
+    }

package/workframe-api/stack_config.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 import json
 import os
+import time
 from pathlib import Path
 from typing import Any
 
@@ -45,6 +46,11 @@ def _read_raw() -> dict[str, Any]:
         return {}
 
 
+def read_stack_raw() -> dict[str, Any]:
+    """Stack file dict (install wizard reads wizard_step)."""
+    return _read_raw()
+
+
 def _write_raw(data: dict[str, Any]) -> None:
     DATA_DIR.mkdir(parents=True, exist_ok=True)
     tmp = CONFIG_PATH.with_suffix(".tmp")
@@ -123,6 +129,7 @@ def get_stack_config() -> dict[str, Any]:
             "port": int(smtp.get("port") or 587),
             "user": str(smtp.get("user") or "").strip(),
             "from": str(smtp.get("from") or smtp.get("from_address") or "").strip(),
+            "admin_email": str(smtp.get("admin_email") or "").strip(),
             "secure": str(smtp.get("secure") or "starttls").strip(),
             "has_password": bool(str(smtp.get("password") or "").strip()),
         },
@@ -156,6 +163,10 @@ def patch_stack_config(body: dict[str, Any]) -> dict[str, Any]:
         raw["app_base_url"] = str(body.get("app_base_url") or "").strip().rstrip("/")
     if body.get("install_complete") is True:
         raw["install_complete"] = True
+    if "wizard_step" in body:
+        step = str(body.get("wizard_step") or "").strip()
+        if step:
+            raw["wizard_step"] = step
     if "smtp" in body and isinstance(body["smtp"], dict):
         smtp = dict(raw.get("smtp") if isinstance(raw.get("smtp"), dict) else {})
         creds_changed = False
@@ -348,6 +359,26 @@ def smtp_setup_complete() -> bool:
     return bool(str(stack.get("admin_email") or "").strip()) and smtp_has_password() and smtp_configured()
 
 
+def install_admin_verified() -> bool:
+    """Install admin completed OTP during the install window."""
+    stack = _stack_smtp_raw()
+    return bool(stack.get("admin_verified_at"))
+
+
+def mark_install_admin_verified(email: str) -> None:
+    """Persist verified install admin — survives reload; closes anonymous install mutations."""
+    normalized = str(email or "").strip().lower()
+    if not normalized or "@" not in normalized:
+        return
+    raw = _read_raw()
+    smtp = dict(raw.get("smtp") if isinstance(raw.get("smtp"), dict) else {})
+    smtp["admin_email"] = normalized
+    smtp["admin_verified_at"] = int(time.time())
+    raw["smtp"] = smtp
+    raw["wizard_step"] = "workframe"
+    _write_raw(raw)
+
+
 def mark_smtp_tested() -> None:
     raw = _read_raw()
     smtp = dict(raw.get("smtp") if isinstance(raw.get("smtp"), dict) else {})
@@ -398,11 +429,12 @@ def public_stack_payload() -> dict[str, Any]:
             "port": smtp.get("port") or 587,
             "user": smtp.get("user") or "",
             "from": smtp.get("from") or "",
-            "admin_email": smtp.get("admin_email") or "",
+            "admin_email": str(_stack_smtp_raw().get("admin_email") or "").strip(),
             "secure": smtp.get("secure") or "starttls",
             "configured": smtp_configured(),
             "tested": smtp_tested(),
             "setup_complete": smtp_setup_complete(),
+            "admin_verified": install_admin_verified(),
             "has_password": smtp_has_password(),
         },
         "google_oauth": {

package/workframe-api/supervisor_client.py

@@ -0,0 +1,154 @@
+"""WF-032 extract: workframe-supervisor HTTP client and gateway exec proxies."""
+
+from __future__ import annotations
+
+import json
+import os
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any
+
+
+def _srv():
+    import server as srv
+
+    return srv
+
+
+def _supervisor_ready() -> bool:
+    return bool(_srv().SUPERVISOR_URL) and bool(_srv().SUPERVISOR_TOKEN)
+
+
+def _supervisor_request(
+    method: str,
+    path: str,
+    body: dict[str, Any] | None = None,
+    timeout: float = 30.0,
+) -> tuple[int, Any]:
+    """Proxy a JSON request to workframe-supervisor."""
+    if not _srv().SUPERVISOR_URL:
+        return 503, {"ok": False, "error": "WORKFRAME_SUPERVISOR_URL not configured"}
+    if not _srv().SUPERVISOR_TOKEN:
+        return 503, {"ok": False, "error": "WORKFRAME_SUPERVISOR_TOKEN not configured"}
+    url = f"{_srv().SUPERVISOR_URL}{path}"
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": f"Bearer {_srv().SUPERVISOR_TOKEN}",
+    }
+    if body is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
+            raw = resp.read().decode("utf-8", errors="replace")
+            return int(resp.status), json.loads(raw) if raw else {}
+    except urllib.error.HTTPError as exc:
+        raw = exc.read().decode("utf-8", errors="replace")
+        try:
+            return int(exc.code), json.loads(raw) if raw else {}
+        except json.JSONDecodeError:
+            return int(exc.code), {"ok": False, "error": raw}
+    except (urllib.error.URLError, TimeoutError) as exc:
+        return 503, {
+            "ok": False,
+            "error": "supervisor_unavailable",
+            "hint": "On the server: cd infra/compose/workframe && docker compose up -d",
+            "detail": str(exc),
+        }
+
+
+def _maybe_sync_compose_public_url(public_url: str, *, restart: bool | None = None) -> dict[str, Any] | None:
+    """Write APP_BASE_URL into host compose .env; optionally recreate API/gateway (not supervisor)."""
+    url = str(public_url or "").strip()
+    if not url:
+        return None
+    lowered = url.lower()
+    if "127.0.0.1" in lowered or "localhost" in lowered:
+        return None
+    if not _supervisor_ready():
+        return None
+    if not str(os.environ.get("WORKFRAME_HOST_COMPOSE_DIR") or "").strip():
+        return None
+    if restart is None:
+        restart = not _srv()._install_window_open()
+    status, data = _supervisor_request(
+        "POST",
+        "/v1/host.set_compose_public_url",
+        {"url": url, "restart": restart},
+        timeout=180.0,
+    )
+    if status >= 400:
+        return data if isinstance(data, dict) else {"ok": False, "error": "compose_sync_failed"}
+    return data if isinstance(data, dict) else {"ok": True}
+
+
+def _supervisor_gateway_exec(profile: str, args: list[str]) -> tuple[int, str]:
+    if not _supervisor_ready():
+        raise RuntimeError(
+            "Docker socket access is disabled in SECURE_MODE; "
+            "configure WORKFRAME_SUPERVISOR_URL and WORKFRAME_SUPERVISOR_TOKEN"
+        )
+    status, data = _supervisor_request(
+        "POST",
+        "/v1/gateway.exec",
+        {"profile": profile, "args": args},
+        timeout=120.0,
+    )
+    if status >= 300:
+        err = data.get("error") if isinstance(data, dict) else str(data)
+        raise ValueError(err or f"supervisor gateway.exec failed ({status})")
+    if not isinstance(data, dict):
+        raise ValueError("supervisor gateway.exec returned invalid payload")
+    exit_code = data.get("exit_code")
+    try:
+        code = int(exit_code if exit_code is not None else 1)
+    except (TypeError, ValueError):
+        code = 1
+    return code, str(data.get("output") or "")
+
+
+def _supervisor_container_exec(cmd: list[str], *, detach: bool = False) -> tuple[int, str]:
+    if not _supervisor_ready():
+        raise RuntimeError(
+            "Docker socket access is disabled in SECURE_MODE; "
+            "configure WORKFRAME_SUPERVISOR_URL and WORKFRAME_SUPERVISOR_TOKEN"
+        )
+    status, data = _supervisor_request(
+        "POST",
+        "/v1/gateway.container_exec",
+        {"args": [str(part) for part in cmd], "detach": detach},
+        timeout=30.0 if detach else 120.0,
+    )
+    if status >= 300:
+        err = data.get("error") if isinstance(data, dict) else str(data)
+        raise ValueError(err or f"supervisor gateway.container_exec failed ({status})")
+    if not isinstance(data, dict):
+        raise ValueError("supervisor gateway.container_exec returned invalid payload")
+    if detach:
+        return 0, str(data.get("output") or "")
+    exit_code = data.get("exit_code")
+    try:
+        code = int(exit_code if exit_code is not None else 1)
+    except (TypeError, ValueError):
+        code = 1
+    return code, str(data.get("output") or "")
+
+
+def _supervisor_profile_lifecycle(profile: str, action: str) -> dict[str, Any]:
+    if not _supervisor_ready():
+        raise RuntimeError(
+            "Docker socket access is disabled in SECURE_MODE; "
+            "configure WORKFRAME_SUPERVISOR_URL and WORKFRAME_SUPERVISOR_TOKEN"
+        )
+    if action == "status":
+        q = urllib.parse.quote(profile, safe="")
+        status, data = _supervisor_request("GET", f"/v1/profile.status?profile={q}", timeout=15.0)
+    else:
+        status, data = _supervisor_request("POST", f"/v1/profile.{action}", {"profile": profile}, timeout=60.0)
+    if status >= 300:
+        err = data.get("error") if isinstance(data, dict) else str(data)
+        raise ValueError(err or f"supervisor {action} failed ({status})")
+    if not isinstance(data, dict):
+        raise ValueError(f"supervisor {action} returned invalid payload")
+    return data

package/workframe-api/test_api_meta_build_stamp.py

@@ -0,0 +1,34 @@
+"""ponytail self-check: /api/meta exposes package + UI build stamp (WF-012).
+
+Run: python services/workframe-api/test_api_meta_build_stamp.py
+"""
+import json
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import api_meta  # noqa: E402
+
+with tempfile.TemporaryDirectory() as tmp:
+    ui_public = Path(tmp) / "workframe-ui" / "public"
+    ui_public.mkdir(parents=True)
+    stamp = {
+        "package_version": "9.9.9",
+        "bundled_at": "2026-07-08T12:00:00.000Z",
+        "git_ref": "abc1234",
+    }
+    (ui_public / "workframe-build.json").write_text(json.dumps(stamp), encoding="utf-8")
+    os.environ["WORKFRAME_PROJECT_ROOT"] = tmp
+    os.environ["WORKFRAME_API_VERSION"] = "9.9.9"
+    try:
+        ui = api_meta._ui_build_stamp()
+        assert ui["package_version"] == "9.9.9", ui
+        assert ui["git_ref"] == "abc1234", ui
+    finally:
+        os.environ.pop("WORKFRAME_PROJECT_ROOT", None)
+        os.environ.pop("WORKFRAME_API_VERSION", None)
+
+print("api meta build stamp self-check ok")

package/workframe-api/test_cell_authority.py

@@ -0,0 +1,79 @@
+"""WF-007 CellAuthorityGate self-check."""
+
+from __future__ import annotations
+
+import json
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from cell_authority import (  # noqa: E402
+    evaluate_adopt,
+    evaluate_connect,
+    evaluate_create,
+    evaluate_open,
+    evaluate_update,
+    load_cell_from_manifest,
+)
+
+
+def test_create_deny_nonempty() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        root = Path(tmp)
+        (root / "existing.txt").write_text("x", encoding="utf-8")
+        decision = evaluate_create(root)
+        assert decision.decision == "deny"
+        assert decision.reason == "target_not_empty"
+
+
+def test_create_allow_empty() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        root = Path(tmp) / "newcell"
+        decision = evaluate_create(root, package_version="0.1.0")
+        assert decision.decision == "allow"
+        assert decision.mutation_plan
+
+
+def test_open_readonly() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        root = Path(tmp)
+        (root / "Files").mkdir()
+        manifest = {
+            "install_id": "cell-1",
+            "package_name": "create-workframe",
+            "package_version": "0.1.0",
+            "layout": {"workspace": "Files", "runtime": "Agents"},
+        }
+        (root / "workframe-manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+        cell = load_cell_from_manifest(root)
+        assert cell is not None
+        decision = evaluate_open(root)
+        assert decision.decision == "allow_readonly"
+
+
+def test_update_needs_ack() -> None:
+    with tempfile.TemporaryDirectory() as tmp:
+        root = Path(tmp)
+        (root / "Files").mkdir()
+        (root / "workframe-manifest.json").write_text(
+            json.dumps({"layout": {"workspace": "Files"}}),
+            encoding="utf-8",
+        )
+        decision = evaluate_update(root, user_ack=False)
+        assert decision.decision == "needs_user_action"
+
+
+def test_adopt_denied() -> None:
+    assert evaluate_adopt(runtime_kind="cursor").reason == "adapter_not_proven"
+    assert evaluate_connect(remote_attested=False).decision == "deny"
+
+
+if __name__ == "__main__":
+    test_create_deny_nonempty()
+    test_create_allow_empty()
+    test_open_readonly()
+    test_update_needs_ack()
+    test_adopt_denied()
+    print("test_cell_authority: ok")

package/workframe-api/test_chat_bind.py

@@ -0,0 +1,48 @@
+"""WF-032 chat_bind self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import chat_bind  # noqa: E402
+
+
+def test_extract_title() -> None:
+    assert chat_bind._extract_title("# Hello World\nbody", "fallback") == "Hello World"
+    assert chat_bind._extract_title("no heading", "fallback") == "fallback"
+    assert chat_bind._extract_title("  # Indented\n", "x") == "Indented"
+
+
+def test_enrich_room_chat_payload_sets_user() -> None:
+    out = chat_bind._enrich_room_chat_payload({"text": "hi"}, "user-1")
+    assert out["user_id"] == "user-1"
+    assert out["text"] == "hi"
+
+
+def test_room_chat_bind_delegates_room_id() -> None:
+    """room_chat_bind injects room_id then calls profile_chat_bind."""
+    calls: list[tuple] = []
+
+    orig = chat_bind.profile_chat_bind
+    chat_bind.profile_chat_bind = lambda profile, payload, user_id="": (
+        calls.append((profile, payload, user_id)) or {"ok": True, "session_id": "s1"}
+    )
+    try:
+        chat_bind.room_chat_bind("room-abc", {"source_id": "ui"}, "u1")
+    finally:
+        chat_bind.profile_chat_bind = orig
+
+    assert len(calls) == 1
+    assert calls[0][0] == ""
+    assert calls[0][1]["room_id"] == "room-abc"
+    assert calls[0][2] == "u1"
+
+
+if __name__ == "__main__":
+    test_extract_title()
+    test_enrich_room_chat_payload_sets_user()
+    test_room_chat_bind_delegates_room_id()
+    print("test_chat_bind: ok")

package/workframe-api/test_credential_lease_matrix.py

@@ -0,0 +1,171 @@
+"""WF-028 lease validation test matrix — expired, revoked, mismatch, proxy token.
+
+Run: python services/workframe-api/test_credential_lease_matrix.py
+"""
+
+from __future__ import annotations
+
+import os
+import sqlite3
+import sys
+import tempfile
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import broker_audit
+import credential_broker
+import internal_proxy_auth
+import turn_credentials
+from internal_proxy_auth import PROFILE_HEADER, PROXY_TOKEN_ENV, reset_proxy_token_for_tests
+
+_TD = tempfile.mkdtemp(prefix="wf-lease-matrix-")
+os.environ["WORKFRAME_API_DATA_DIR"] = _TD
+turn_credentials.WORKFRAME_DB = Path(_TD) / "workframe.db"
+turn_credentials._SCHEMA_READY.clear()
+broker_audit.WORKFRAME_DB = Path(_TD) / "workframe.db"
+broker_audit._SCHEMA_READY.clear()
+
+
+def _resolve_secret(_user: str, _ws: str, _provider: str, _binding: str) -> tuple[str, str]:
+    return "OPENROUTER_API_KEY", "sk-test-secret"
+
+
+def _issue(**kwargs: str) -> str:
+    return turn_credentials.issue_lease(
+        kwargs.get("run_id", "run-test"),
+        kwargs.get("user", "user-a"),
+        kwargs.get("workspace", "ws-1"),
+        kwargs.get("provider", "openrouter"),
+        kwargs.get("profile", "u-user-a-dev"),
+        kwargs.get("binding", "bind-1"),
+    )
+
+
+def _headers(token: str, profile: str = "u-user-a-dev") -> dict[str, str]:
+    return {
+        "Authorization": f"Bearer {token}",
+        PROFILE_HEADER: profile,
+    }
+
+
+def test_active_lease_ok() -> None:
+    tok = _issue(run_id="run-ok")
+    auth = credential_broker.authorize_broker_lease(
+        "openrouter",
+        _headers(tok),
+        resolve_secret=_resolve_secret,
+    )
+    assert auth.ok and auth.secret == "sk-test-secret"
+
+
+def test_revoked_lease() -> None:
+    tok = _issue(run_id="run-revoked")
+    turn_credentials.revoke_lease("run-revoked")
+    reason, _ = turn_credentials.inspect_lease(tok)
+    assert reason == "revoked"
+    auth = credential_broker.authorize_broker_lease(
+        "openrouter",
+        _headers(tok),
+        resolve_secret=_resolve_secret,
+    )
+    assert not auth.ok and auth.deny_reason == "revoked" and auth.status == 401
+
+
+def test_expired_lease() -> None:
+    tok = _issue(run_id="run-expired")
+    past = (datetime.now(timezone.utc) - timedelta(seconds=60)).isoformat()
+    conn = sqlite3.connect(str(turn_credentials.WORKFRAME_DB))
+    conn.execute(
+        "UPDATE turn_credential_leases SET expires_at = ? WHERE run_id = ?",
+        (past, "run-expired"),
+    )
+    conn.commit()
+    conn.close()
+    reason, _ = turn_credentials.inspect_lease(tok)
+    assert reason == "expired"
+    auth = credential_broker.authorize_broker_lease(
+        "openrouter",
+        _headers(tok),
+        resolve_secret=_resolve_secret,
+    )
+    assert not auth.ok and auth.deny_reason == "expired"
+
+
+def test_provider_mismatch() -> None:
+    tok = _issue(run_id="run-prov", provider="openrouter")
+    auth = credential_broker.authorize_broker_lease(
+        "anthropic",
+        _headers(tok),
+        resolve_secret=_resolve_secret,
+    )
+    assert not auth.ok and auth.deny_reason == "provider_mismatch" and auth.status == 403
+
+
+def test_profile_mismatch() -> None:
+    tok = _issue(run_id="run-prof", profile="u-user-a-dev")
+    auth = credential_broker.authorize_broker_lease(
+        "openrouter",
+        _headers(tok, profile="u-other-dev"),
+        resolve_secret=_resolve_secret,
+    )
+    assert not auth.ok and auth.deny_reason == "profile_mismatch" and auth.status == 403
+
+
+def test_missing_profile_header() -> None:
+    tok = _issue(run_id="run-noprof", profile="u-user-a-dev")
+    auth = credential_broker.authorize_broker_lease(
+        "openrouter",
+        {"Authorization": f"Bearer {tok}"},
+        resolve_secret=_resolve_secret,
+    )
+    assert not auth.ok and auth.deny_reason == "profile_header_required"
+
+
+def test_missing_proxy_token() -> None:
+    reset_proxy_token_for_tests()
+    os.environ[PROXY_TOKEN_ENV] = "matrix-proxy-token"
+
+    class _Handler:
+        client_address = ("172.19.0.2", 1234)
+        headers: dict[str, str] = {}
+
+    ok, err = internal_proxy_auth.authorize_internal_proxy(_Handler())  # type: ignore[arg-type]
+    assert not ok and err == "proxy token required"
+
+    _Handler.headers = {internal_proxy_auth.PROXY_TOKEN_HEADER: "matrix-proxy-token"}
+    ok, err = internal_proxy_auth.authorize_internal_proxy(_Handler())  # type: ignore[arg-type]
+    assert ok and not err
+
+
+def test_broker_audit_on_deny() -> None:
+    broker_audit._SCHEMA_READY.clear()
+    tok = _issue(run_id="run-audit")
+    turn_credentials.revoke_lease("run-audit")
+    credential_broker.authorize_broker_lease(
+        "openrouter",
+        _headers(tok),
+        resolve_secret=_resolve_secret,
+        broker_kind="llm",
+        upstream_host="openrouter.ai",
+    )
+    events = broker_audit.list_broker_events(limit=20)
+    denied = [e for e in events if e.get("deny_reason") == "revoked" and e.get("run_id") == "run-audit"]
+    assert denied
+
+
+def main() -> None:
+    test_active_lease_ok()
+    test_revoked_lease()
+    test_expired_lease()
+    test_provider_mismatch()
+    test_profile_mismatch()
+    test_missing_profile_header()
+    test_missing_proxy_token()
+    test_broker_audit_on_deny()
+    print("credential lease matrix ok")
+
+
+if __name__ == "__main__":
+    main()

package/workframe-api/test_credential_resolve.py

@@ -0,0 +1,51 @@
+"""WF-032 credential_resolve self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import credential_resolve  # noqa: E402
+
+
+def test_default_env_var() -> None:
+    assert credential_resolve._default_credential_env_var("openrouter", "api_key") == "OPENROUTER_API_KEY"
+    assert credential_resolve._default_credential_env_var("discord", "bot_token") == "DISCORD_BOT_TOKEN"
+
+
+def test_resolve_empty() -> None:
+    assert credential_resolve._resolve_credential("", "", "openrouter") is None
+    assert credential_resolve._resolve_credential("user-1", "", "") is None
+
+
+def test_binding_payload_shape() -> None:
+    class _Row(dict):
+        def __getitem__(self, key: str):
+            return dict(self).get(key)
+
+    row = _Row(
+        id="bind-1",
+        credential_ref="vault:abc",
+        provider="openrouter",
+        credential_type="api_key",
+        label="test",
+        user_id="u1",
+        workspace_id=None,
+        agent_profile_id=None,
+        created_by="u1",
+        created_at="1",
+        updated_at="1",
+        expires_at=None,
+    )
+    payload = credential_resolve._credential_binding_payload(row, "user")  # type: ignore[arg-type]
+    assert payload["scope"] == "user"
+    assert payload["credential_ref"] == "vault:abc"
+
+
+if __name__ == "__main__":
+    test_default_env_var()
+    test_resolve_empty()
+    test_binding_payload_shape()
+    print("test_credential_resolve: ok")