feat(python-client): operator credentials on acknowledge-alarm

Claude-Session: https://claude.ai/code/session_016J6isfcgqy4SB2RK3ZvFvT

clients/python/tests/test_alarms.py

@@ -34,6 +34,8 @@ async def test_acknowledge_alarm_sends_request_and_returns_reply() -> None:
             alarm_full_reference="Tank01.Level.HiHi",
             comment="investigating",
             operator_user="alice",
+            operator_password="pw-secret",
+            operator_domain="CORP",
         ),
     )
 
@@ -44,9 +46,34 @@ async def test_acknowledge_alarm_sends_request_and_returns_reply() -> None:
     assert captured_request.alarm_full_reference == "Tank01.Level.HiHi"
     assert captured_request.comment == "investigating"
     assert captured_request.operator_user == "alice"
+    assert captured_request.operator_password == "pw-secret"
+    assert captured_request.operator_domain == "CORP"
     assert stub.acknowledge_alarm.metadata == (("authorization", "Bearer mxgw_test_secret"),)
 
 
+@pytest.mark.asyncio
+async def test_acknowledge_alarm_error_redacts_operator_password() -> None:
+    stub = FakeGatewayStub()
+    stub.acknowledge_alarm.exception = FakeRpcError(
+        grpc.StatusCode.UNAUTHENTICATED, "bad credentials pw-secret",
+    )
+    client = await GatewayClient.connect(
+        ClientOptions(endpoint="fake", api_key="mxgw_test_secret", plaintext=True),
+        stub=stub,
+    )
+
+    with pytest.raises(MxGatewayAuthenticationError) as excinfo:
+        await client.acknowledge_alarm(
+            pb.AcknowledgeAlarmRequest(
+                alarm_full_reference="Tank01.Level.HiHi",
+                operator_user="alice",
+                operator_password="pw-secret",
+            ),
+        )
+
+    assert "pw-secret" not in str(excinfo.value)
+
+
 @pytest.mark.asyncio
 async def test_acknowledge_alarm_unauthenticated_raises_typed_error() -> None:
     stub = FakeGatewayStub()

clients/python/tests/test_review_findings_022_to_026.py

@@ -771,6 +771,7 @@ def test_cli_stream_alarms_positive_max_messages_remains_finite(monkeypatch) ->
 
 
 def test_cli_acknowledge_alarm_happy_path(monkeypatch) -> None:
+    monkeypatch.setenv("MXGW_TEST_OPPW", "pw-secret")
     stub = _BulkFakeStub()
     stub.acknowledge_alarm = _BulkFakeUnary(
         [
@@ -798,12 +799,19 @@ def test_cli_acknowledge_alarm_happy_path(monkeypatch) -> None:
             "investigating",
             "--operator",
             "alice",
+            "--operator-domain",
+            "CORP",
+            "--operator-password-env",
+            "MXGW_TEST_OPPW",
             "--json",
         ],
     )
 
     assert result.exit_code == 0, result.output
+    assert "pw-secret" not in result.output
     captured_request = stub.acknowledge_alarm.requests[0]
+    assert captured_request.operator_domain == "CORP"
+    assert captured_request.operator_password == "pw-secret"
     assert captured_request.alarm_full_reference == "Tank01.Level.HiHi"
     assert captured_request.comment == "investigating"
     assert captured_request.operator_user == "alice"