feast-dev
diff --git a/‎sdk/python/tests/unit/infra/offline_stores/contrib/trino_offline_store/test_trino_auth.py‎
Lines changed: 46 additions & 2 deletions b/‎sdk/python/tests/unit/infra/offline_stores/contrib/trino_offline_store/test_trino_auth.py‎
Lines changed: 46 additions & 2 deletions
@@ -1,6 +1,11 @@
-from trino.auth import JWTAuthentication, OAuth2Authentication
+from pydantic import SecretStr
+from trino.auth import BasicAuthentication, JWTAuthentication, OAuth2Authentication
 
-from feast.infra.offline_stores.contrib.trino_offline_store.trino import AuthConfig
+from feast.infra.offline_stores.contrib.trino_offline_store.trino import (
+    CLASSES_BY_AUTH_TYPE,
+    AuthConfig,
+    FeastConfigBaseModel,
+)
 
 
 def test_jwt_auth_produces_plain_str_token():
@@ -19,3 +24,42 @@ def test_oauth2_auth_unchanged():
     trino_auth = auth.to_trino_auth()
 
     assert isinstance(trino_auth, OAuth2Authentication)
+
+
+def test_basic_auth_with_plain_fields_unaffected():
+    auth = AuthConfig(type="basic", config={"username": "alice", "password": "hunter2"})
+
+    trino_auth = auth.to_trino_auth()
+
+    assert isinstance(trino_auth, BasicAuthentication)
+    assert trino_auth._username == "alice"
+    assert trino_auth._password == "hunter2"
+
+
+class _MixedAuthModel(FeastConfigBaseModel):
+    username: str
+    token: SecretStr
+
+
+class _MixedAuth:
+    def __init__(self, username: str, token: str):
+        self.username = username
+        self.token = token
+
+
+def test_to_trino_auth_unwraps_only_secret_fields_in_mixed_model(monkeypatch):
+    monkeypatch.setitem(
+        CLASSES_BY_AUTH_TYPE,
+        "jwt",
+        {"auth_model": _MixedAuthModel, "trino_auth": _MixedAuth},
+    )
+    auth = AuthConfig(
+        type="jwt", config={"username": "alice", "token": "my-secret-token"}
+    )
+
+    trino_auth = auth.to_trino_auth()
+
+    assert trino_auth.username == "alice"
+    assert trino_auth.token == "my-secret-token"
+    assert isinstance(trino_auth.username, str)
+    assert isinstance(trino_auth.token, str)