Auth profiles: resolve keyRef/tokenRef outside gateway

src/agents/auth-profiles/oauth.test.ts

@@ -168,3 +168,72 @@ describe("resolveApiKeyForProfile token expiry handling", () => {
     });
   });
 });
+
+describe("resolveApiKeyForProfile secret refs", () => {
+  it("resolves api_key keyRef from env", async () => {
+    const profileId = "openai:default";
+    const previous = process.env.OPENAI_API_KEY;
+    process.env.OPENAI_API_KEY = "sk-openai-ref";
+    try {
+      const result = await resolveApiKeyForProfile({
+        cfg: cfgFor(profileId, "openai", "api_key"),
+        store: {
+          version: 1,
+          profiles: {
+            [profileId]: {
+              type: "api_key",
+              provider: "openai",
+              keyRef: { source: "env", id: "OPENAI_API_KEY" },
+            },
+          },
+        },
+        profileId,
+      });
+      expect(result).toEqual({
+        apiKey: "sk-openai-ref",
+        provider: "openai",
+        email: undefined,
+      });
+    } finally {
+      if (previous === undefined) {
+        delete process.env.OPENAI_API_KEY;
+      } else {
+        process.env.OPENAI_API_KEY = previous;
+      }
+    }
+  });
+
+  it("resolves token tokenRef from env", async () => {
+    const profileId = "github-copilot:default";
+    const previous = process.env.GITHUB_TOKEN;
+    process.env.GITHUB_TOKEN = "gh-ref-token";
+    try {
+      const result = await resolveApiKeyForProfile({
+        cfg: cfgFor(profileId, "github-copilot", "token"),
+        store: {
+          version: 1,
+          profiles: {
+            [profileId]: {
+              type: "token",
+              provider: "github-copilot",
+              token: "",
+              tokenRef: { source: "env", id: "GITHUB_TOKEN" },
+            },
+          },
+        },
+        profileId,
+      });
+      expect(result).toEqual({
+        apiKey: "gh-ref-token",
+        provider: "github-copilot",
+        email: undefined,
+      });
+    } finally {
+      if (previous === undefined) {
+        delete process.env.GITHUB_TOKEN;
+      } else {
+        process.env.GITHUB_TOKEN = previous;
+      }
+    }
+  });
+});