fix(runtime): require Cloud control secrets (#2418)

Co-authored-by: Chan <dadachann@users.noreply.github.com>

tests/unit_tests/box/test_box_connector.py

@@ -24,7 +24,7 @@ from langbot.pkg.box.connector import BoxRuntimeConnector
 _CONTROL_TOKEN = 'box-control-token-that-is-longer-than-32-bytes'
 
 
-def make_app(logger: Mock, runtime_endpoint: str = ''):
+def make_app(logger: Mock, runtime_endpoint: str = '', *, cloud: bool = False):
     return SimpleNamespace(
         logger=logger,
         workspace_service=SimpleNamespace(instance_uuid='instance-a'),
@@ -42,6 +42,7 @@ def make_app(logger: Mock, runtime_endpoint: str = ''):
                 }
             }
         ),
+        deployment=SimpleNamespace(mode='cloud' if cloud else 'oss'),
     )
 
 
@@ -315,6 +316,14 @@ def test_external_box_runtime_control_headers_are_tokenless_when_secret_is_unset
     assert connector.get_control_headers() == {BOX_INSTANCE_HEADER: 'instance-a'}
 
 
+def test_cloud_box_runtime_rejects_missing_control_secret(monkeypatch: pytest.MonkeyPatch):
+    monkeypatch.delenv(BOX_CONTROL_TOKEN_ENV, raising=False)
+    connector = BoxRuntimeConnector(make_app(Mock(), runtime_endpoint='http://box-runtime:5410', cloud=True))
+
+    with pytest.raises(BoxRuntimeUnavailableError, match=BOX_CONTROL_TOKEN_ENV):
+        connector.get_control_headers()
+
+
 def test_external_box_runtime_rejects_invalid_configured_control_token(monkeypatch: pytest.MonkeyPatch):
     monkeypatch.setenv(BOX_CONTROL_TOKEN_ENV, 'too-short')
     connector = BoxRuntimeConnector(make_app(Mock(), runtime_endpoint='http://box-runtime:5410'))