Add tests for bearer token authentication

- Options: bearer token from explicit value, env var resolution,
  preference of explicit over env, and serialize exclusion
- Provider: client returns BearerClient when token is present,
  falls back to Anthropic::BedrockClient otherwise, memoization
- BearerClient: initialization, auth_token, region, base_url,
  inheritance, and resource accessors (messages, completions, beta)

Author: Davidslv

test/providers/bedrock/bearer_client_test.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "test_helper"
+require_relative "../../../lib/active_agent/providers/bedrock_provider"
+
+class BedrockBearerClientTest < ActiveSupport::TestCase
+  test "initializes with region and bearer token" do
+    client = ActiveAgent::Providers::Bedrock::BearerClient.new(
+      aws_region: "eu-west-2",
+      bearer_token: "test-token"
+    )
+
+    assert_equal "eu-west-2", client.aws_region
+  end
+
+  test "sets auth_token from bearer_token parameter" do
+    client = ActiveAgent::Providers::Bedrock::BearerClient.new(
+      aws_region: "eu-west-2",
+      bearer_token: "test-token"
+    )
+
+    assert_equal "test-token", client.auth_token
+  end
+
+  test "sets default base_url from aws_region" do
+    client = ActiveAgent::Providers::Bedrock::BearerClient.new(
+      aws_region: "us-east-1",
+      bearer_token: "test-token"
+    )
+
+    assert_equal "us-east-1", client.aws_region
+  end
+
+  test "allows custom base_url" do
+    client = ActiveAgent::Providers::Bedrock::BearerClient.new(
+      aws_region: "eu-west-2",
+      bearer_token: "test-token",
+      base_url: "https://custom-bedrock.example.com"
+    )
+
+    assert_instance_of ActiveAgent::Providers::Bedrock::BearerClient, client
+  end
+
+  test "inherits from Anthropic::Client" do
+    assert ActiveAgent::Providers::Bedrock::BearerClient < ::Anthropic::Client
+  end
+
+  test "has messages resource" do
+    client = ActiveAgent::Providers::Bedrock::BearerClient.new(
+      aws_region: "eu-west-2",
+      bearer_token: "test-token"
+    )
+
+    assert_instance_of ::Anthropic::Resources::Messages, client.messages
+  end
+
+  test "has completions resource" do
+    client = ActiveAgent::Providers::Bedrock::BearerClient.new(
+      aws_region: "eu-west-2",
+      bearer_token: "test-token"
+    )
+
+    assert_instance_of ::Anthropic::Resources::Completions, client.completions
+  end
+
+  test "has beta resource" do
+    client = ActiveAgent::Providers::Bedrock::BearerClient.new(
+      aws_region: "eu-west-2",
+      bearer_token: "test-token"
+    )
+
+    assert_instance_of ::Anthropic::Resources::Beta, client.beta
+  end
+end

test/providers/bedrock/bedrock_provider_test.rb

@@ -61,4 +61,39 @@ class BedrockProviderTest < ActiveSupport::TestCase
 
     assert_equal "eu-west-2", client.aws_region
   end
+
+  test "client returns BearerClient when bearer token is configured" do
+    bearer_config = {
+      service: "Bedrock",
+      aws_region: "eu-west-2",
+      aws_bearer_token: "test-bearer-token",
+      model: "eu.anthropic.claude-sonnet-4-5-20250929-v1:0",
+      messages: [{ role: "user", content: "Hello" }]
+    }
+
+    provider = ActiveAgent::Providers::BedrockProvider.new(bearer_config)
+    client = provider.client
+
+    assert_instance_of ActiveAgent::Providers::Bedrock::BearerClient, client
+  end
+
+  test "client returns Anthropic::BedrockClient when no bearer token" do
+    provider = ActiveAgent::Providers::BedrockProvider.new(@valid_config)
+    client = provider.client
+
+    assert_instance_of ::Anthropic::Helpers::Bedrock::Client, client
+  end
+
+  test "bearer client is memoized" do
+    bearer_config = {
+      service: "Bedrock",
+      aws_region: "eu-west-2",
+      aws_bearer_token: "test-bearer-token",
+      model: "eu.anthropic.claude-sonnet-4-5-20250929-v1:0"
+    }
+
+    provider = ActiveAgent::Providers::BedrockProvider.new(bearer_config)
+
+    assert_same provider.client, provider.client
+  end
 end

test/providers/bedrock/options_test.rb

@@ -179,11 +179,48 @@ class BedrockOptionsTest < ActiveSupport::TestCase
     ENV["AWS_PROFILE"] = original_profile
   end
 
+  test "initializes with bearer token" do
+    options = ActiveAgent::Providers::Bedrock::Options.new(
+      aws_region: "eu-west-2",
+      aws_bearer_token: "test-bearer-token"
+    )
+
+    assert_equal "test-bearer-token", options.aws_bearer_token
+  end
+
+  test "resolves aws_bearer_token from environment variable" do
+    original_token = ENV["AWS_BEARER_TOKEN_BEDROCK"]
+    ENV["AWS_BEARER_TOKEN_BEDROCK"] = "env-bearer-token"
+
+    options = ActiveAgent::Providers::Bedrock::Options.new(
+      aws_region: "eu-west-2"
+    )
+
+    assert_equal "env-bearer-token", options.aws_bearer_token
+  ensure
+    ENV["AWS_BEARER_TOKEN_BEDROCK"] = original_token
+  end
+
+  test "prefers explicit aws_bearer_token over environment variable" do
+    original_token = ENV["AWS_BEARER_TOKEN_BEDROCK"]
+    ENV["AWS_BEARER_TOKEN_BEDROCK"] = "env-bearer-token"
+
+    options = ActiveAgent::Providers::Bedrock::Options.new(
+      aws_region: "eu-west-2",
+      aws_bearer_token: "explicit-bearer-token"
+    )
+
+    assert_equal "explicit-bearer-token", options.aws_bearer_token
+  ensure
+    ENV["AWS_BEARER_TOKEN_BEDROCK"] = original_token
+  end
+
   test "serialize excludes sensitive credential fields" do
     options = ActiveAgent::Providers::Bedrock::Options.new(
       @valid_options.merge(
         aws_session_token: "test-token",
-        aws_profile: "test-profile"
+        aws_profile: "test-profile",
+        aws_bearer_token: "test-bearer-token"
       )
     )
 
@@ -194,6 +231,7 @@ class BedrockOptionsTest < ActiveSupport::TestCase
     assert_nil serialized[:aws_secret_key]
     assert_nil serialized[:aws_session_token]
     assert_nil serialized[:aws_profile]
+    assert_nil serialized[:aws_bearer_token]
   end
 
   test "serialize includes non-credential fields" do