refactor(core): handle empty auth config and tighten registry mocks

Author: Tranquility2

core/testcontainers/core/auth.py

@@ -31,7 +31,9 @@ def process_docker_auth_config_encoded(auth_config_dict: dict[str, dict[str, dic
 
     auths = auth_config_dict.get("auths")
     if not auths:
-        raise KeyError("No auths found in the docker auth config")
+        # An explicit but empty ``auths`` map means "no credentials configured".
+        # Treat it the same as a missing key so callers don't fail to start.
+        return auth_info
 
     for registry, auth in auths.items():
         auth_str = str(auth.get("auth"))

core/tests/registry_mocks.py

@@ -18,6 +18,7 @@
 from typing import Iterator, Optional
 from unittest.mock import MagicMock, patch
 
+import docker
 from docker.errors import ImageNotFound, NotFound
 
 from testcontainers.core.docker_client import DockerClient
@@ -29,6 +30,21 @@ def make_auth_config(registry: str, username: str, password: str) -> str:
     return json.dumps({"auths": {registry: {"auth": creds}}})
 
 
+def _build_mock_docker_client() -> MagicMock:
+    """Construct a Docker SDK mock constrained to the surface we actually use.
+
+    Using ``spec=docker.DockerClient`` keeps the mock honest: production code
+    that calls a non-existent SDK method will raise ``AttributeError`` rather
+    than silently returning a new ``MagicMock``.
+    """
+    mock_client = MagicMock(spec=docker.DockerClient)
+    # ``DockerClient.__init__`` writes session headers via ``client.api.headers``.
+    # ``api`` isn't on the public ``DockerClient`` spec, so attach it explicitly.
+    mock_client.api = MagicMock()
+    mock_client.api.headers = {}
+    return mock_client
+
+
 @contextmanager
 def mock_docker_registry(
     *,
@@ -51,7 +67,7 @@ def mock_docker_registry(
         :func:`make_auth_config`). When provided, it is applied for the duration
         of the context so ``DockerClient`` performs a registry login on init.
     """
-    mock_client = MagicMock()
+    mock_client = _build_mock_docker_client()
     if missing_image:
         mock_client.images.get.side_effect = ImageNotFound("missing")
         mock_client.images.pull.side_effect = NotFound("missing")

core/tests/test_auth.py

@@ -69,9 +69,8 @@ def test_parse_docker_auth_config_error():
 
 
 def test_parse_docker_auth_config_empty_auths():
-    auth_config_str = '{"auths": {}}'
-    with pytest.raises(ValueError):
-        parse_docker_auth_config(auth_config_str)
+    """An explicit but empty ``auths`` map means 'no credentials configured'."""
+    assert parse_docker_auth_config('{"auths": {}}') == []
 
 
 def test_parse_docker_auth_all():

core/tests/test_core_registry.py

@@ -55,11 +55,15 @@ def test_missing_on_private_registry_raises_not_found(image, tag, username, pass
     registry_url = "localhost:5000"
     auth_config = make_auth_config(registry_url, username, password)
 
-    with mock_docker_registry(missing_image=True, auth_config=auth_config):
+    with mock_docker_registry(missing_image=True, auth_config=auth_config) as mock_client:
         client = DockerClient()
         with pytest.raises(NotFound):
             client.create(f"{registry_url}/{image}:{tag}")
 
+    full_image = f"{registry_url}/{image}:{tag}"
+    mock_client.images.get.assert_called_once_with(full_image)
+    mock_client.images.pull.assert_called_once_with(full_image)
+
 
 @pytest.mark.parametrize(
     "image,tag,username,password",
@@ -79,6 +83,8 @@ def test_pull_from_private_registry_creates_container(image, tag, username, pass
         client = DockerClient()
         container = client.create(full_image)
 
+    # Auth config was honored at client init.
+    mock_client.login.assert_called_once_with(registry=registry_url, username=username, password=password)
     # Image was not cached locally, so it must be pulled from the registry...
     mock_client.images.pull.assert_called_once_with(full_image)
     # ...and the container is then created from it.