chore: checkpoint 第一版

internal/config/config_test.go

@@ -260,3 +260,42 @@ func TestWorkerManagedContentSafetyConfiguration(t *testing.T) {
 		t.Fatalf("Validate() rejected complete non-production managed content safety config: %v", err)
 	}
 }
+
+func TestHardwareProvisioningLoadsProductSecretFromFile(t *testing.T) {
+	t.Setenv("APP_ENV", "test")
+	t.Setenv("VOLC_HARDWARE_PROVISIONING_ENABLED", "true")
+	t.Setenv("VOLC_HARDWARE_INSTANCE_ID", "instance-1")
+	t.Setenv("VOLC_HARDWARE_PRODUCT_KEY", "product-1")
+	t.Setenv("VOLC_HARDWARE_AGENT_BOT_ID", "bot-test")
+	t.Setenv("VOLC_HARDWARE_PRODUCT_SECRET", "")
+	secretPath := filepath.Join(t.TempDir(), "product-secret")
+	if err := os.WriteFile(secretPath, []byte("product-secret-at-least-16-bytes\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("VOLC_HARDWARE_PRODUCT_SECRET_FILE", secretPath)
+	t.Setenv("VOLC_HARDWARE_DEVICE_CREDENTIAL_MASTER_KEY", strings.Repeat("ab", 32))
+
+	cfg, err := Load("api")
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+	if cfg.VolcHardwareProductSecret != "product-secret-at-least-16-bytes" || !cfg.VolcHardwareProvisioningEnabled {
+		t.Fatalf("hardware provisioning secret/config was not loaded")
+	}
+}
+
+func TestHardwareProvisioningRejectsMissingProductSecret(t *testing.T) {
+	cfg, err := Load("api")
+	if err != nil {
+		t.Fatal(err)
+	}
+	cfg.VolcHardwareProvisioningEnabled = true
+	cfg.VolcHardwareInstanceID = "instance-1"
+	cfg.VolcHardwareProductKey = "product-1"
+	cfg.VolcHardwareAgentBotID = "bot-test"
+	cfg.VolcHardwareProductSecret = ""
+	cfg.VolcHardwareDeviceCredentialMasterKey = strings.Repeat("ab", 32)
+	if err = cfg.Validate(); err == nil || !strings.Contains(err.Error(), "hardware provisioning") {
+		t.Fatalf("Validate() error = %v, want missing product secret rejection", err)
+	}
+}