test(destination): enable multi-tenant BDD scenarios

.env_integration_tests.example

@@ -1,47 +1,54 @@
 CLOUD_SDK_OTEL_DISABLED=true
 
-CLOUD_SDK_CFG_AUDITLOG_DEFAULT_URL=https://your-auditlog-api-url-here
-CLOUD_SDK_CFG_AUDITLOG_DEFAULT_UAA='{"url":"https://your-auth-url","clientid":"your-client-id","clientsecret":"your-client-secret"}'
-
-CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_HOST=your-objectstore-host-here
-CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_ACCESS_KEY_ID=your-access-key-id-here
-CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_SECRET_ACCESS_KEY=your-secret-access-key-here
-CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_BUCKET=your-bucket-name-here
-
-CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTID=your-destination-client-id-here
-CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTSECRET=your-destination-client-secret-here
-CLOUD_SDK_CFG_DESTINATION_DEFAULT_URL=https://your-destination-auth-url-here
-CLOUD_SDK_CFG_DESTINATION_DEFAULT_URI=https://your-destination-configuration-uri-here
-CLOUD_SDK_CFG_DESTINATION_DEFAULT_IDENTITYZONE=your-identity-zone-here
-
-CLOUD_SDK_CFG_DATA_ANONYMIZATION_DEFAULT_URL=https://your-data-anonymization-api-url-here
-CLOUD_SDK_CFG_DATA_ANONYMIZATION_DEFAULT_CERT=your-base64-encoded-client-certificate-pem
-CLOUD_SDK_CFG_DATA_ANONYMIZATION_DEFAULT_KEY=your-base64-encoded-client-private-key-pem
-# Alternative to inline base64 cert/key values:
-# CLOUD_SDK_CFG_DATA_ANONYMIZATION_DEFAULT_DESTINATION_NAME=your-client-certificate-destination-name
-
-CLOUD_SDK_CFG_SDM_DEFAULT_URI=https://your-sdm-api-uri-here
-CLOUD_SDK_CFG_SDM_DEFAULT_UAA='{"url":"https://your-auth-url","clientid":"your-client-id","clientsecret":"your-client-secret","identityzone":"your-identity-zone"}'
-
-CLOUD_SDK_CFG_HANA_AGENT_MEMORY_DEFAULT_APPLICATION_URL=https://your-agent-memory-api-url-here
-CLOUD_SDK_CFG_HANA_AGENT_MEMORY_DEFAULT_UAA='{"url":"https://your-auth-url","clientid":"your-client-id","clientsecret":"your-client-secret"}'
-
-# ADMS (Advanced Document Management Service) — integration tests against
-# a deployed ADM instance. Tests are skipped when any of these are missing.
+# ADMS
 CLOUD_SDK_CFG_ADMS_DEFAULT_CLIENTID=your-adms-client-id-here
 CLOUD_SDK_CFG_ADMS_DEFAULT_CLIENTSECRET=your-adms-client-secret-here
 CLOUD_SDK_CFG_ADMS_DEFAULT_URL=https://your-tenant.accounts.ondemand.com
 CLOUD_SDK_CFG_ADMS_DEFAULT_URI=https://your-adm-host.cfapps.eu20.hana.ondemand.com
 CLOUD_SDK_CFG_ADMS_DEFAULT_RESOURCE=urn:sap:identity:application:provider:name:your-adm-app-name
 
-CLOUD_SDK_CFG_AGW_DEFAULT_TENANT_SUBDOMAIN=your-tenant-subdomain-here
+# AGENT GATEWAY
 CLOUD_SDK_CFG_AGW_DEFAULT_LANDSCAPE=your-landscape-here
-AGW_USER_TOKEN=your-user-jwt-here
+CLOUD_SDK_CFG_AGW_DEFAULT_TENANT_SUBDOMAIN=your-tenant-subdomain-here
+CLOUD_SDK_CFG_AGW_DEFAULT_USER_TOKEN=your-user-jwt-here
+
+# AGENT MEMORY
+CLOUD_SDK_CFG_HANA_AGENT_MEMORY_DEFAULT_APPLICATION_URL=https://your-agent-memory-api-url-here
+CLOUD_SDK_CFG_HANA_AGENT_MEMORY_DEFAULT_UAA='{"url":"https://your-auth-url","clientid":"your-client-id","clientsecret":"your-client-secret"}'
 
-# AI Core — required for Traceloop/LangGraph integration tests
+# AI CORE (required for Traceloop/LangGraph integration tests)
 AICORE_CLIENT_ID=your-aicore-client-id-here
 AICORE_CLIENT_SECRET=your-aicore-client-secret-here
 AICORE_AUTH_URL=https://your-aicore-auth-url-here/oauth/token
 AICORE_BASE_URL=https://your-aicore-api-url-here/v2
 AICORE_RESOURCE_GROUP=default
 AICORE_MODEL=anthropic--claude-3-5-haiku
+
+# AUDITLOG
+CLOUD_SDK_CFG_AUDITLOG_DEFAULT_URL=https://your-auditlog-api-url-here
+CLOUD_SDK_CFG_AUDITLOG_DEFAULT_UAA='{"url":"https://your-auth-url","clientid":"your-client-id","clientsecret":"your-client-secret"}'
+
+# DATA ANONYMIZATION
+CLOUD_SDK_CFG_DATA_ANONYMIZATION_DEFAULT_URL=https://your-data-anonymization-api-url-here
+CLOUD_SDK_CFG_DATA_ANONYMIZATION_DEFAULT_CERT=your-base64-encoded-client-certificate-pem
+CLOUD_SDK_CFG_DATA_ANONYMIZATION_DEFAULT_KEY=your-base64-encoded-client-private-key-pem
+# Alternative to inline base64 cert/key values:
+# CLOUD_SDK_CFG_DATA_ANONYMIZATION_DEFAULT_DESTINATION_NAME=your-client-certificate-destination-name
+
+# DESTINATION
+CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTID=your-destination-client-id-here
+CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTSECRET=your-destination-client-secret-here
+CLOUD_SDK_CFG_DESTINATION_DEFAULT_URL=https://your-destination-auth-url-here
+CLOUD_SDK_CFG_DESTINATION_DEFAULT_URI=https://your-destination-configuration-uri-here
+CLOUD_SDK_CFG_DESTINATION_DEFAULT_IDENTITYZONE=your-identity-zone-here
+CLOUD_SDK_CFG_DESTINATION_DEFAULT_TENANT_SUBDOMAIN=your-subscriber-tenant-subdomain-here
+
+# DMS
+CLOUD_SDK_CFG_SDM_DEFAULT_URI=https://your-sdm-api-uri-here
+CLOUD_SDK_CFG_SDM_DEFAULT_UAA='{"url":"https://your-auth-url","clientid":"your-client-id","clientsecret":"your-client-secret","identityzone":"your-identity-zone"}'
+
+# OBJECT STORE
+CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_HOST=your-objectstore-host-here
+CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_ACCESS_KEY_ID=your-access-key-id-here
+CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_SECRET_ACCESS_KEY=your-secret-access-key-here
+CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_BUCKET=your-bucket-name-here

docs/INTEGRATION_TESTS.md

@@ -26,42 +26,42 @@ uv sync --all-extras
 
 Integration tests require specific environment variables to be configured. These are managed through the `.env_integration_tests` file in the project root.
 
-### ObjectStore Integration Tests
-
-For ObjectStore integration tests, configure the following variables in `.env_integration_tests`:
-
-```bash
-# ObjectStore Configuration
-CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_HOST=your-host-here
-CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_ACCESS_KEY_ID=your-access-key-id-here
-CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_SECRET_ACCESS_KEY=your-secret-access-key-kere
-CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_BUCKET=your-bucket-here
-CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_SSL_ENABLED=false
-```
-
-### AuditLog Integration Tests
+### ADMS Integration Tests
 
-For AuditLog integration tests, configure the following variables in `.env_integration_tests`:
+For ADMS (Advanced Document Management Service) integration tests, configure the following variables in `.env_integration_tests`:
 
 ```bash
-# AuditLog Configuration
-CLOUD_SDK_CFG_AUDITLOG_DEFAULT_URL=https://your-auditlog-api-url-here
-CLOUD_SDK_CFG_AUDITLOG_DEFAULT_UAA='{"url":"https://your-auth-url","clientid":"your-client-id","clientsecret":"your-client-secret"}'
+# ADMS Configuration
+CLOUD_SDK_CFG_ADMS_DEFAULT_URL=https://your-tenant.accounts.ondemand.com
+CLOUD_SDK_CFG_ADMS_DEFAULT_URI=https://your-adm-instance.cfapps.eu20.hana.ondemand.com
+CLOUD_SDK_CFG_ADMS_DEFAULT_CLIENTID=your-ias-client-id
+CLOUD_SDK_CFG_ADMS_DEFAULT_CLIENTSECRET=your-ias-client-secret
+CLOUD_SDK_CFG_ADMS_DEFAULT_RESOURCE=urn:sap:identity:application:provider:name:your-app
 ```
 
-**Note**: AuditLog integration tests are cloud-only and require real SAP Audit Log Service credentials. The secret resolver automatically loads configuration from `/etc/secrets/appfnd` or environment variables - no manual configuration parsing needed in test code.
+`CLOUD_SDK_CFG_ADMS_DEFAULT_URI` points the tests at the target ADM service. The other `CLOUD_SDK_CFG_ADMS_DEFAULT_*` variables hold the IAS service-binding credentials used by the SDK to fetch Bearer tokens. Tests are skipped automatically when any of these are missing.
 
-### Destination Integration Tests
+### Agent Gateway Integration Tests
 
-For Destination integration tests, configure the following variables in `.env_integration_tests`:
+Agent Gateway integration tests use the LoB agent flow via the Destination Service. Configure the following variables in `.env_integration_tests`:
 
 ```bash
-# Destination Configuration
+# Destination Service (required by the LoB agent flow)
 CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTID=your-destination-client-id-here
 CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTSECRET=your-destination-client-secret-here
 CLOUD_SDK_CFG_DESTINATION_DEFAULT_URL=https://your-destination-auth-url-here
 CLOUD_SDK_CFG_DESTINATION_DEFAULT_URI=https://your-destination-configuration-uri-here
 CLOUD_SDK_CFG_DESTINATION_DEFAULT_IDENTITYZONE=your-identity-zone-here
+
+# Landscape suffix used to resolve the IAS destination name
+CLOUD_SDK_CFG_AGW_DEFAULT_LANDSCAPE=your-landscape-here
+
+# Tenant subdomain for multi-tenant lookup
+CLOUD_SDK_CFG_AGW_DEFAULT_TENANT_SUBDOMAIN=your-tenant-subdomain-here
+
+# User JWT for token exchange scenarios (get_user_auth)
+# If not set, user auth scenarios are automatically skipped
+CLOUD_SDK_CFG_AGW_DEFAULT_USER_TOKEN=your-user-jwt-here
 ```
 
 ### Agent Memory Integration Tests
@@ -74,6 +74,18 @@ CLOUD_SDK_CFG_HANA_AGENT_MEMORY_DEFAULT_APPLICATION_URL=https://your-agent-memor
 CLOUD_SDK_CFG_HANA_AGENT_MEMORY_DEFAULT_UAA='{"url":"https://your-auth-url","clientid":"your-client-id","clientsecret":"your-client-secret"}'
 ```
 
+### AuditLog Integration Tests
+
+For AuditLog integration tests, configure the following variables in `.env_integration_tests`:
+
+```bash
+# AuditLog Configuration
+CLOUD_SDK_CFG_AUDITLOG_DEFAULT_URL=https://your-auditlog-api-url-here
+CLOUD_SDK_CFG_AUDITLOG_DEFAULT_UAA='{"url":"https://your-auth-url","clientid":"your-client-id","clientsecret":"your-client-secret"}'
+```
+
+**Note**: AuditLog integration tests are cloud-only and require real SAP Audit Log Service credentials. The secret resolver automatically loads configuration from `/etc/secrets/appfnd` or environment variables - no manual configuration parsing needed in test code.
+
 ### Data Anonymization Integration Tests
 
 For Data Anonymization integration tests, configure the following variables in `.env_integration_tests`:
@@ -96,6 +108,24 @@ CLOUD_SDK_CFG_DATA_ANONYMIZATION_DEFAULT_DESTINATION_NAME=your-client-certificat
 
 The destination must be configured with `ClientCertificateAuthentication` and reference a certificate bundle containing the client certificate and private key.
 
+### Destination Integration Tests
+
+For Destination integration tests, configure the following variables in `.env_integration_tests`:
+
+```bash
+# Destination Configuration
+CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTID=your-destination-client-id-here
+CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTSECRET=your-destination-client-secret-here
+CLOUD_SDK_CFG_DESTINATION_DEFAULT_URL=https://your-destination-auth-url-here
+CLOUD_SDK_CFG_DESTINATION_DEFAULT_URI=https://your-destination-configuration-uri-here
+CLOUD_SDK_CFG_DESTINATION_DEFAULT_IDENTITYZONE=your-identity-zone-here
+
+# Optional: subscriber tenant subdomain for multi-tenant scenarios
+# When set, scenarios using SUBSCRIBER_FIRST, SUBSCRIBER_ONLY, and PROVIDER_FIRST are executed.
+# When not set, those scenarios are automatically skipped.
+CLOUD_SDK_CFG_DESTINATION_DEFAULT_TENANT_SUBDOMAIN=your-subscriber-tenant-subdomain-here
+```
+
 ### DMS Integration Tests
 
 For DMS (Document Management Service) integration tests, configure the following variables in `.env_integration_tests`:
@@ -108,42 +138,17 @@ CLOUD_SDK_CFG_SDM_DEFAULT_UAA='{"url":"https://your-auth-url","clientid":"your-c
 
 **Note**: The test fixture automatically onboards test repositories (standard and version-enabled) at session start and cleans them up on teardown. No pre-existing repositories are required.
 
-### ADMS Integration Tests
-
-For ADMS (Advanced Document Management Service) integration tests, configure the following variables in `.env_integration_tests`:
-
-```bash
-# ADMS Configuration
-CLOUD_SDK_CFG_ADMS_DEFAULT_URL=https://your-tenant.accounts.ondemand.com
-CLOUD_SDK_CFG_ADMS_DEFAULT_URI=https://your-adm-instance.cfapps.eu20.hana.ondemand.com
-CLOUD_SDK_CFG_ADMS_DEFAULT_CLIENTID=your-ias-client-id
-CLOUD_SDK_CFG_ADMS_DEFAULT_CLIENTSECRET=your-ias-client-secret
-CLOUD_SDK_CFG_ADMS_DEFAULT_RESOURCE=urn:sap:identity:application:provider:name:your-app
-```
-
-`CLOUD_SDK_CFG_ADMS_DEFAULT_URI` points the tests at the target ADM service. The other `CLOUD_SDK_CFG_ADMS_DEFAULT_*` variables hold the IAS service-binding credentials used by the SDK to fetch Bearer tokens. Tests are skipped automatically when any of these are missing.
-
-### Agent Gateway Integration Tests
+### ObjectStore Integration Tests
 
-Agent Gateway integration tests use the LoB agent flow via the Destination Service. Configure the following variables in `.env_integration_tests`:
+For ObjectStore integration tests, configure the following variables in `.env_integration_tests`:
 
 ```bash
-# Destination Service (required by the LoB agent flow)
-CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTID=your-destination-client-id-here
-CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTSECRET=your-destination-client-secret-here
-CLOUD_SDK_CFG_DESTINATION_DEFAULT_URL=https://your-destination-auth-url-here
-CLOUD_SDK_CFG_DESTINATION_DEFAULT_URI=https://your-destination-configuration-uri-here
-CLOUD_SDK_CFG_DESTINATION_DEFAULT_IDENTITYZONE=your-identity-zone-here
-
-# Landscape suffix used to resolve the IAS destination name
-APPFND_CONHOS_LANDSCAPE=your-landscape-here
-
-# Tenant subdomain for multi-tenant lookup
-TENANT_SUBDOMAIN=your-tenant-subdomain-here
-
-# User JWT for token exchange scenarios (get_user_auth)
-# If not set, user auth scenarios are automatically skipped
-AGW_USER_TOKEN=your-user-jwt-here
+# ObjectStore Configuration
+CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_HOST=your-host-here
+CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_ACCESS_KEY_ID=your-access-key-id-here
+CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_SECRET_ACCESS_KEY=your-secret-access-key-kere
+CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_BUCKET=your-bucket-here
+CLOUD_SDK_CFG_OBJECTSTORE_DEFAULT_SSL_ENABLED=false
 ```
 
 ## Running Integration Tests
@@ -153,14 +158,14 @@ AGW_USER_TOKEN=your-user-jwt-here
 uv run pytest tests/ -m integration -v
 
 # Run specific module integration tests
+uv run pytest tests/adms/integration/ -v
+uv run pytest tests/agentgateway/integration/ -v
+uv run pytest tests/agent_memory/integration/ -v
 uv run pytest tests/core/integration/auditlog -v
 uv run pytest tests/core/integration/data_anonymization -v
-uv run pytest tests/objectstore/integration/ -v
 uv run pytest tests/destination/integration/ -v
 uv run pytest tests/dms/integration/ -v
-uv run pytest tests/agent_memory/integration/ -v
-uv run pytest tests/adms/integration/ -v
-uv run pytest tests/agentgateway/integration/ -v
+uv run pytest tests/objectstore/integration/ -v
 ```
 
 ### BDD Scenarios

tests/agentgateway/integration/test_agw_bdd.py

@@ -4,12 +4,12 @@
 
     CLOUD_SDK_CFG_AGW_DEFAULT_TENANT_SUBDOMAIN=<tenant-subdomain> \\
     CLOUD_SDK_CFG_AGW_DEFAULT_LANDSCAPE=<landscape> \\
+    CLOUD_SDK_CFG_AGW_DEFAULT_USER_TOKEN=<user-jwt> \\
     CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTID=... \\
     CLOUD_SDK_CFG_DESTINATION_DEFAULT_CLIENTSECRET=... \\
     CLOUD_SDK_CFG_DESTINATION_DEFAULT_URL=... \\
     CLOUD_SDK_CFG_DESTINATION_DEFAULT_URI=... \\
     CLOUD_SDK_CFG_DESTINATION_DEFAULT_IDENTITYZONE=... \\
-    AGW_USER_TOKEN=<user-jwt> \\
     pytest tests/agentgateway/integration/ -v
 """
 
@@ -72,9 +72,9 @@ def agent_gateway_client_available(agw_client: AgentGatewayClient):
 @given("I have a valid user token")
 def have_valid_user_token(context: ScenarioContext):
     """Load user token from environment variable."""
-    token = os.environ.get("AGW_USER_TOKEN", "")
+    token = os.environ.get("CLOUD_SDK_CFG_AGW_DEFAULT_USER_TOKEN", "")
     if not token:
-        pytest.skip("AGW_USER_TOKEN is not set — skipping user auth scenario")
+        pytest.skip("CLOUD_SDK_CFG_AGW_DEFAULT_USER_TOKEN is not set — skipping user auth scenario")
     context.user_token = token