Setting up Open CMIS TCK

src/open_cmis_tck/profile.py

@@ -118,12 +118,25 @@ def validate_cmis_profile_config(
     repository_id = None
     if isinstance(opencmis_policy, dict):
         repository_id = opencmis_policy.get("repository_id")
-        if repository_id is not None and not isinstance(repository_id, str):
+    if repository_id is not None and not isinstance(repository_id, str):
+        diagnostics.append(
+            _diagnostic(
+                "error",
+                "runtime_policy.opencmis_tck.repository_id",
+                "repository_id must be a string when configured.",
+            )
+        )
+
+    credentials_ref = target_profile.get("credentials_ref")
+    auth_mode = "anonymous"
+    if isinstance(credentials_ref, str) and credentials_ref:
+        auth_mode = _auth_mode(credentials_ref)
+        if auth_mode == "unknown":
             diagnostics.append(
                 _diagnostic(
-                    "error",
-                    "runtime_policy.opencmis_tck.repository_id",
-                    "repository_id must be a string when configured.",
+                    "warning",
+                    "credentials_ref",
+                    "Use null, env:USER_VAR,PASSWORD_VAR, or file:/path/to/credentials.json.",
                 )
             )
 
@@ -134,7 +147,8 @@ def validate_cmis_profile_config(
         "cmis_config": {
             "browser_binding_url": browser_endpoints[0]["url"] if browser_endpoints else None,
             "repository_id": repository_id,
-            "auth_mode": "anonymous" if target_profile.get("credentials_ref") is None else "credentials_ref",
+            "auth_mode": auth_mode,
+            "credentials_ref": credentials_ref,
             "declared_capabilities": sorted(declared),
             "known_gap_refs": sorted(known_gap_refs),
             "timeout_seconds": timeout,
@@ -144,3 +158,11 @@ def validate_cmis_profile_config(
 
 def _diagnostic(severity: str, field: str, message: str) -> dict[str, str]:
     return {"severity": severity, "field": field, "message": message}
+
+
+def _auth_mode(credentials_ref: str) -> str:
+    if credentials_ref.startswith("env:"):
+        return "env"
+    if credentials_ref.startswith("file:"):
+        return "file"
+    return "unknown"