pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-07-31 04:12:10 +03:00
Code Issues Packages Projects Releases Wiki Activity

chore(security): scrub hardcoded live-instance creds from boundary tests (#6786)

Browse Source 
The 3 tests/boundary/*.live.test.ts files merged via #6786 hardcoded a real
Bearer API key, an auth_token JWT cookie, and a live instance URL. Replaced with
env reads (OMNIROUTE_TEST_BASE/BEARER/COOKIE), preserving the RUN_BOUNDARY_LIVE gate.
The leaked key/cookie must still be revoked/rotated on the affected instance and
purged from history separately (operator action).
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-07-12 02:53:37 -03:00
parent b5e75bb8fe
commit 2d321e1f52
4 changed files with 18 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
changelog.d/maintenance/scrub-boundary-test-creds.md Normal file
View File

@@ -0,0 +1 @@
- **chore(security):** scrub hardcoded live-instance credentials (API key + auth cookie + host URL) from the `tests/boundary/*.live.test.ts` files landed via #6786 — they now read `OMNIROUTE_TEST_BASE` / `OMNIROUTE_TEST_BEARER` / `OMNIROUTE_TEST_COOKIE` from the environment and stay gated behind `RUN_BOUNDARY_LIVE=1`.

8
tests/boundary/gemma4-multiturn.live.test.ts
View File

@@ -8,10 +8,12 @@
import test from "node:test";
import assert from "node:assert/strict";
const BASE = "https://omniroute.vhost2.harre.dynv6.net/v1";
const AUTH = "Bearer sk-7b3a9f0879f9bfcf-4f8870-d0e71799";
const BASE = process.env.OMNIROUTE_TEST_BASE || "http://localhost:20128/v1";
const AUTH = process.env.OMNIROUTE_TEST_BEARER
? `Bearer ${process.env.OMNIROUTE_TEST_BEARER}`
: "";
const COOKIE =
"auth_token=eyJhbGciOiJIUzI1NiJ9.eyJhdXRoZW50aWNhdGVkIjp0cnVlLCJleHAiOjE3ODYwMDc2Mzl9.YjGPcmh50QvtfnRJPXhsillOlJ3HKiCHRPX7kaWe5Y0";
process.env.OMNIROUTE_TEST_COOKIE || "";
const MODEL = "gemini/gemma-4-26b-a4b-it";

10
tests/boundary/gemma4-newline-investigation.live.test.ts
View File

@@ -5,15 +5,17 @@
* characterize when Gemma4 emits literal \\n (backslash-n) vs actual
* newlines (0x0A) in tool call JSON arguments.
*
* Tests hit the LIVE OmniRoute API at omniroute.vhost2.harre.dynv6.net.
* Tests hit the LIVE OmniRoute API at the configured OMNIROUTE_TEST_BASE instance.
*/
import test from "node:test";
import assert from "node:assert/strict";
const BASE = "https://omniroute.vhost2.harre.dynv6.net/v1";
const AUTH = "Bearer sk-7b3a9f0879f9bfcf-4f8870-d0e71799";
const BASE = process.env.OMNIROUTE_TEST_BASE || "http://localhost:20128/v1";
const AUTH = process.env.OMNIROUTE_TEST_BEARER
? `Bearer ${process.env.OMNIROUTE_TEST_BEARER}`
: "";
const COOKIE =
"auth_token=eyJhbGciOiJIUzI1NiJ9.eyJhdXRoZW50aWNhdGVkIjp0cnVlLCJleHAiOjE3ODYwMDc2Mzl9.YjGPcmh50QvtfnRJPXhsillOlJ3HKiCHRPX7kaWe5Y0";
process.env.OMNIROUTE_TEST_COOKIE || "";
const MODEL = "gemini/gemma-4-26b-a4b-it";

10
tests/boundary/openclaw-omniroute-tool-boundary.live.test.ts
View File

@@ -6,19 +6,21 @@
* that tool call arguments (especially multiline content like file writes)
* survive the round-trip without corruption.
*
* These tests call the LIVE OmniRoute API at omniroute.vhost2.harre.dynv6.net.
* These tests call the LIVE OmniRoute API at the configured OMNIROUTE_TEST_BASE instance.
* Prerequisites: valid auth token (from INITIAL_PASSWORD) and access to the
* remote OmniRoute instance.
*/
import test from "node:test";
import assert from "node:assert/strict";
const BASE = "https://omniroute.vhost2.harre.dynv6.net/v1";
const AUTH = "Bearer sk-7b3a9f0879f9bfcf-4f8870-d0e71799";
const BASE = process.env.OMNIROUTE_TEST_BASE || "http://localhost:20128/v1";
const AUTH = process.env.OMNIROUTE_TEST_BEARER
? `Bearer ${process.env.OMNIROUTE_TEST_BEARER}`
: "";
// Cookie obtained via INITIAL_PASSWORD login
const COOKIE =
"auth_token=eyJhbGciOiJIUzI1NiJ9.eyJhdXRoZW50aWNhdGVkIjp0cnVlLCJleHAiOjE3ODYwMDc2Mzl9.YjGPcmh50QvtfnRJPXhsillOlJ3HKiCHRPX7kaWe5Y0";
process.env.OMNIROUTE_TEST_COOKIE || "";
// Only the tests that call the live remote OmniRoute API need this gate — the
// pure parsing/stopReason-simulation tests at the bottom of the file run locally.