fix: mount referentiel ia token as docker secret

server/referentialIa.test.ts

@@ -1,9 +1,13 @@
 import { describe, expect, it } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import {
   invokeReferentialIa,
   testReferentialIaConnection,
   type ReferentielIaConnection,
 } from "./referentialIa";
+import { readSecretFile } from "./_core/env";
 
 const connection: ReferentielIaConnection = {
   baseUrl: "https://referentiel-ia.recette.santinova-soft.org",
@@ -18,6 +22,18 @@ function jsonResponse(body: unknown, status = 200) {
 }
 
 describe("Référentiel IA", () => {
+  it("lit un jeton serveur depuis un fichier monté sans le journaliser", () => {
+    const directory = mkdtempSync(join(tmpdir(), "referentiel-ia-"));
+    const secretFile = join(directory, "token");
+    try {
+      writeFileSync(secretFile, "  server-only-token\n", { mode: 0o600 });
+      expect(readSecretFile(secretFile)).toBe("server-only-token");
+      expect(readSecretFile(join(directory, "absent"))).toBe("");
+    } finally {
+      rmSync(directory, { recursive: true, force: true });
+    }
+  });
+
   it("transmet une requête OpenAI-compatible à la passerelle sélectionnée", async () => {
     let receivedUrl = "";
     let receivedInit: RequestInit | undefined;