Add S3 backend and storage verification

tests/unit/test_config_storage.py

@@ -0,0 +1,39 @@
+"""Storage configuration parsing tests."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from artifactstore.config import parse_backend_routes, resolve_secret_ref
+
+
+def test_parse_backend_routes_supports_wildcards() -> None:
+    routes = parse_backend_routes("guide-board:release-evidence=s3,*:*=local")
+    assert len(routes) == 2
+    assert routes[0].matches(producer="guide-board", retention_class="release-evidence")
+    assert not routes[0].matches(producer="guide-board", retention_class="raw-evidence")
+    assert routes[1].matches(producer="anything", retention_class="raw-evidence")
+    assert routes[0].backend_id == "s3"
+
+
+def test_parse_backend_routes_rejects_invalid_entry() -> None:
+    with pytest.raises(ValueError):
+        parse_backend_routes("guide-board=s3")
+
+
+def test_resolve_secret_ref_from_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("ARTIFACTSTORE_TEST_SECRET", "secret")
+    assert resolve_secret_ref("env:ARTIFACTSTORE_TEST_SECRET") == "secret"
+
+
+def test_resolve_secret_ref_from_file(tmp_path: Path) -> None:
+    secret_file = tmp_path / "secret"
+    secret_file.write_text("secret\n", encoding="utf-8")
+    assert resolve_secret_ref(f"file:{secret_file}") == "secret"
+
+
+def test_resolve_secret_ref_rejects_literal() -> None:
+    with pytest.raises(ValueError):
+        resolve_secret_ref("literal-secret")