fix: Malysis analyzer should fallback to Community Mode when API Credentials are Incorrect (#325)

analyzer/malysis_factory_test.go

@@ -0,0 +1,49 @@
+package analyzer
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/safedep/dry/cloud"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewMalysisAnalyzer_CommunityWhenCredentialsUnavailable(t *testing.T) {
+	resolver := func() (*cloud.Credentials, func() error, error) {
+		return nil, func() error { return nil }, errors.New("no credentials")
+	}
+
+	an, err := newMalysisAnalyzer(MalysisQueryAnalyzerConfig{}, resolver)
+	require.NoError(t, err)
+
+	community, ok := an.(*malysisQueryAnalyzer)
+	require.True(t, ok, "must be the plain community analyzer, got %T", an)
+	assert.False(t, community.honorExclusions)
+}
+
+func TestNewMalysisAnalyzer_FallbackWrappedWhenCredentialsAvailable(t *testing.T) {
+	creds, err := cloud.NewAPIKeyCredential("test-key", "test-tenant")
+	require.NoError(t, err)
+
+	resolverClosed := false
+	resolver := func() (*cloud.Credentials, func() error, error) {
+		return creds, func() error { resolverClosed = true; return nil }, nil
+	}
+
+	an, err := newMalysisAnalyzer(MalysisQueryAnalyzerConfig{}, resolver)
+	require.NoError(t, err)
+
+	fb, ok := an.(*malysisFallbackAnalyzer)
+	require.True(t, ok, "credentialed analyzer must carry a community fallback, got %T", an)
+
+	primary, ok := fb.primary.(*malysisQueryAnalyzer)
+	require.True(t, ok)
+	assert.True(t, primary.honorExclusions, "primary must be the authenticated analyzer")
+
+	fallback, ok := fb.fallback.(*malysisQueryAnalyzer)
+	require.True(t, ok)
+	assert.False(t, fallback.honorExclusions, "fallback must be the community analyzer")
+
+	assert.True(t, resolverClosed, "credential resolver must be closed after analyzer creation")
+}