fix(content): adapters + availability honour the encrypted key store

The encrypted secrets store (secrets.py, commit fd294f4) was a sealed vault:
nothing read from it at generation time and the provider dropdown ignored it.
A key added via the web store had zero effect. This wires both ends.

- anthropic_compat / openai_compat _read_api_key: call secrets.get_secret(slug)
  (resolves store -> env -> None) instead of os.environ only. A key stored via
  the Generate panel is now actually consumed. Error message points users at
  the panel as well as the env var. Dropped the now-unused os import.
- web /content/providers: 'available' flag is now get_secret(slug) OR env var,
  so a provider with a stored-but-not-exported key shows as enabled, not greyed
  out. Bedrock's separate boto3-credential path is untouched.

TDD: 3 new tests (stored-key consumed at construction; missing-everywhere error
names both paths; provider available from store). Red confirmed before fix.
36/36 adapter+providers suites green; 66 secrets/route/content-gen regression
tests pass.

Remaining for the full feature: the Generate-panel key-entry UI (#2) — backend
secrets routes exist + tested, frontend does not call them yet.

Author: NetDevAutomate

packages/studyloop/src/studyloop/content/generators/anthropic_compat.py

@@ -29,7 +29,6 @@
 from __future__ import annotations
 
 import json
-import os
 from typing import TYPE_CHECKING, Any
 
 import httpx
@@ -153,11 +152,17 @@ def generate_quiz(self, source: str, title: str) -> QuizDeck:
     # ------------------------------------------------------------------
 
     def _read_api_key(self) -> str:
-        key = os.environ.get(self._profile.auth_env, "").strip()
+        # Resolution order (encrypted store -> env var -> None) lives in
+        # secrets.get_secret; call it so a key added via the Generate panel
+        # (encrypted store) is honoured, not just one exported in the shell.
+        from studyloop.secrets import get_secret
+
+        key = (get_secret(self._profile.slug) or "").strip()
         if not key:
             raise CardGenerationError(
-                f"{self._profile.label} requires {self._profile.auth_env} to be set "
-                f"(in shell env or in the project-root .env file)."
+                f"{self._profile.label} requires an API key. Add it in the web "
+                f"Generate panel (stored encrypted), or set {self._profile.auth_env} "
+                f"in your shell env / project-root .env file."
             )
         return key
 

packages/studyloop/src/studyloop/content/generators/openai_compat.py

@@ -35,7 +35,6 @@
 from __future__ import annotations
 
 import json
-import os
 from typing import TYPE_CHECKING, Any
 
 import httpx
@@ -146,11 +145,17 @@ def generate_quiz(self, source: str, title: str) -> QuizDeck:
     # ------------------------------------------------------------------
 
     def _read_api_key(self) -> str:
-        key = os.environ.get(self._profile.auth_env, "").strip()
+        # Resolution order (encrypted store -> env var -> None) lives in
+        # secrets.get_secret; call it so a key added via the Generate panel
+        # (encrypted store) is honoured, not just one exported in the shell.
+        from studyloop.secrets import get_secret
+
+        key = (get_secret(self._profile.slug) or "").strip()
         if not key:
             raise CardGenerationError(
-                f"{self._profile.label} requires {self._profile.auth_env} to be set "
-                f"(in shell env or in the project-root .env file)."
+                f"{self._profile.label} requires an API key. Add it in the web "
+                f"Generate panel (stored encrypted), or set {self._profile.auth_env} "
+                f"in your shell env / project-root .env file."
             )
         return key
 

packages/studyloop/src/studyloop/web/routes/content_gen.py

@@ -41,6 +41,10 @@
 
 from studyloop.content import active_gen
 from studyloop.content.job import JobRequest, run_job
+# Module-level so the providers route can OR the encrypted store into its
+# availability flag. Named import (not `import studyloop.secrets`) avoids the
+# clash with the stdlib `secrets` module already imported above for token_hex.
+from studyloop.secrets import get_secret
 from studyloop.content.scope import (
     ResolvedSource,
     ScopeRequest,
@@ -397,7 +401,12 @@ async def list_providers() -> list[dict[str, Any]]:
                 "label": profile.label,
                 "adapter": profile.adapter,
                 "auth_env": profile.auth_env,
-                "available": bool(os.environ.get(profile.auth_env, "").strip()),
+                # Available if a key is in the encrypted store OR the env var.
+                # get_secret already resolves store -> env, so it covers both;
+                # the explicit env check is kept as a defensive belt-and-braces.
+                "available": bool(
+                    get_secret(slug) or os.environ.get(profile.auth_env, "").strip()
+                ),
                 "models": [
                     {
                         "id": m.id,

packages/studyloop/tests/test_anthropic_compat_generator.py

@@ -73,11 +73,47 @@ def test_missing_env_var_raises_with_actionable_message(
         self, monkeypatch: pytest.MonkeyPatch
     ) -> None:
         monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
+        # Ensure the encrypted store also has nothing (else the store would
+        # satisfy the key and no error would be raised).
+        monkeypatch.setattr("studyloop.secrets.get_secret", lambda name: None)
         with pytest.raises(CardGenerationError) as exc:
             _make_generator("anthropic", "claude-haiku-4-5")
         msg = str(exc.value)
         assert "ANTHROPIC_API_KEY" in msg
-        assert ".env" in msg
+
+    def test_reads_key_from_encrypted_store_when_env_unset(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        """A key in the encrypted store must be consumed even with no env var.
+
+        Regression for the audit gap: adapters read os.environ only and ignored
+        the encrypted store, so a key added via the Generate panel had zero
+        effect on generation.
+        """
+        monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
+        # Simulate a key present in the encrypted store (get_secret resolves
+        # store -> env -> None; here the store wins).
+        monkeypatch.setattr(
+            "studyloop.secrets.get_secret",
+            lambda name: "stored-key-xyz" if name == "anthropic" else None,
+        )
+        gen = _make_generator("anthropic", "claude-haiku-4-5")
+        try:
+            assert gen._client.headers["x-api-key"] == "stored-key-xyz"
+        finally:
+            gen.close()
+
+    def test_missing_everywhere_raises_actionable_message(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        """No env var AND no stored key -> actionable error naming both paths."""
+        monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
+        monkeypatch.setattr("studyloop.secrets.get_secret", lambda name: None)
+        with pytest.raises(CardGenerationError) as exc:
+            _make_generator("anthropic", "claude-haiku-4-5")
+        msg = str(exc.value)
+        assert "ANTHROPIC_API_KEY" in msg  # names the env var
+        assert "Generate panel" in msg  # points at the new UI affordance
 
     @pytest.mark.usefixtures("anthropic_key")
     def test_x_api_key_header_set(self) -> None:

packages/studyloop/tests/test_web_content_providers.py

@@ -66,6 +66,34 @@ def test_stub_not_in_provider_list(self, client: TestClient) -> None:
             "stub is a CI-only backend and must be hidden from the user-facing dropdown."
         )
 
+    def test_provider_available_from_encrypted_store(
+        self, monkeypatch: MonkeyPatch
+    ) -> None:
+        """A key in the encrypted store (no env var) makes the provider available.
+
+        Regression for the audit gap: the availability flag checked os.environ
+        only, so a key added via the Generate panel still showed the provider
+        as disabled in the dropdown.
+        """
+        for var in _PROVIDER_ENV_VARS:
+            monkeypatch.delenv(var, raising=False)
+        # openai has a stored key; everything else has nothing.
+        with (
+            patch(
+                "studyloop.web.routes.content_gen._bedrock_credentials_available",
+                return_value=False,
+            ),
+            patch(
+                "studyloop.web.routes.content_gen.get_secret",
+                side_effect=lambda name: "stored" if name == "openai" else None,
+            ),
+        ):
+            cl = TestClient(create_app(study_dirs=[]))
+            data = cl.get("/api/content/providers").json()
+        by_slug = {e["slug"]: e for e in data}
+        assert by_slug["openai"]["available"] is True, "stored key should enable openai"
+        assert by_slug["anthropic"]["available"] is False, "no key -> still disabled"
+
     def test_bedrock_in_provider_list(self, monkeypatch: MonkeyPatch) -> None:
         """Bug D: Bedrock (boto3 path) must appear as a selectable provider."""
         for var in _PROVIDER_ENV_VARS: