From 90021b5a4822df3c61d6cb400aebb4d4167e4ff9 Mon Sep 17 00:00:00 2001
From: sascha <sascha@sascha-lutz.de>
Date: Fri, 14 Aug 2026 10:34:29 +0200
Subject: [PATCH] =?UTF-8?q?Hetzner-DNS-Vaultalias=20sicher=20aufl=C3=B6sen?=
 =?UTF-8?q?:=20tests/test=5Fapp.py?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tests/test_app.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tests/test_app.py b/tests/test_app.py
index a3ea996..cf541dd 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -277,6 +277,13 @@ def test_dns_rrset_dry_run_returns_only_selected_records(monkeypatch):
     assert body["deleted"] == []
 
 
+def test_hetzner_dns_token_accepts_single_sanitized_vault_alias(monkeypatch):
+    monkeypatch.setattr(app, "_vault_cache", {"hetzner-dns-api": "secret-value", "other": "ignored"})
+    monkeypatch.setattr(app, "_read", lambda _name: None)
+    monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not sync vault")))
+    assert app._get_hetzner_dns_token() == "secret-value"
+
+
 def test_invalid_log_target_is_rejected_before_ssh():
     with TestClient(app.app) as client:
         response = client.get(