# DDR-0018: Smoketest Credential Sourcing via Environment Variables

Status: Approved
Date: 2025-12-22

## Related Architecture Decisions
- ADR-0001: Developer Tooling and Test Strategy
- ADR-0009: Security and Credential Handling
- DDR-0014: E27 Smoketest Tooling Scope

## Context

ADR-0001 establishes the need for lightweight tooling to validate E27 behavior
against real panels during development.

Hardcoding credentials in test tools violates ADR-0009 security constraints
and creates unacceptable risk for public repositories.

At the same time, the smoketest must remain scriptable and non-interactive.

## Decision

The E27 smoketest tool (`e27_smoketest.py`) MUST source credentials exclusively
from environment variables:

- `E27_ACCESS_CODE` – panel access code
- `E27_PASSPHRASE` – panel passphrase
- `E27_MN` – panel model number

The user PIN used during authentication is supplied via:
- Command-line argument (with a safe default for testing)

No secrets are hardcoded in source files.

## Consequences

- Smoketest runs are safe for public repositories
- Credentials can be rotated without code changes
- Tooling remains compatible with CI and scripted workflows

## Notes

This approach mirrors Home Assistant integration patterns and aligns with
established security practices.
