Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

backend/tests/test_huggingface_provider.py

@@ -55,6 +55,19 @@ def test_search_uses_official_client_and_preserves_unknowns() -> None:
     assert calls["search"] == "model" and calls["full"] is True
 
 
+def test_provider_uses_only_explicit_credential_and_official_origin(monkeypatch) -> None:
+    from huggingface_hub import constants
+    from huggingface_hub.utils import build_hf_headers
+
+    monkeypatch.setenv("HF_TOKEN", "hf_ambient_test_only")
+    monkeypatch.setattr(constants, "ENDPOINT", "https://untrusted.invalid")
+    anonymous = OfficialHuggingFaceProvider()
+    assert anonymous.api.endpoint == "https://huggingface.co"
+    assert "authorization" not in build_hf_headers(token=anonymous.token)
+    explicit = OfficialHuggingFaceProvider(token="hf_explicit_test_only")  # noqa: S106
+    assert build_hf_headers(token=explicit.token)["authorization"] == "Bearer hf_explicit_test_only"
+
+
 def test_snapshot_resolves_sha_inventory_card_and_scanner_evidence() -> None:
     provider = OfficialHuggingFaceProvider()
     provider.api.model_info = lambda *args, **kwargs: SimpleNamespace(  # type: ignore[method-assign]