From 32470f3f1516993d9a927afa40d2fb7da27ac67c Mon Sep 17 00:00:00 2001 From: Xiangzhe Date: Tue, 25 Aug 2026 22:04:32 -0300 Subject: [PATCH] test(api): accept the post-#9320 auth gate on the /v1/models e2e check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit b07182c72a (#9320) inverted the catalog auth rule: /v1/models now requires auth whenever management auth is configured, unless requireAuthForModels is explicitly false. The e2e harness boots with INITIAL_PASSWORD set, so the endpoint has been answering 401 since 2026-08-04 and this check has been red ever since — invisible only because the job kept being cancelled behind Build. Mirror the sibling /api/providers check in this same file: assert the catalog shape whenever the catalog is actually served, and otherwise pin the auth gate by status AND error type, so a 401 from an unrelated misroute cannot pass for the deliberate one. --- tests/e2e/api.spec.ts | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/tests/e2e/api.spec.ts b/tests/e2e/api.spec.ts index 08738d6b8b..2b3b3d8a2f 100644 --- a/tests/e2e/api.spec.ts +++ b/tests/e2e/api.spec.ts @@ -8,12 +8,26 @@ test.describe("API Health Checks", () => { expect(body).toHaveProperty("status"); }); - test("GET /api/v1/models returns model list", async ({ request }) => { + test("GET /api/v1/models returns model list or requires auth", async ({ request }) => { const res = await request.get("/api/v1/models"); - expect(res.ok()).toBeTruthy(); - const body = (await res.json()) as any; - expect(body).toHaveProperty("data"); - expect(Array.isArray(body.data)).toBe(true); + // Since #9320 the catalog requires auth whenever management auth is configured + // (unless `requireAuthForModels` is explicitly false). The E2E harness boots with + // INITIAL_PASSWORD set, so 401 is the correct, deliberate answer here — not a + // failure. The shape assertion still runs whenever the catalog IS served, which + // is what keeps this from degrading into a mere reachability check. + if (res.ok()) { + const body = (await res.json()) as any; + expect(body).toHaveProperty("data"); + expect(Array.isArray(body.data)).toBe(true); + } else { + expect([401, 403, 307]).toContain(res.status()); + if (res.status() === 401) { + // Positive anchor: it must be the catalog's auth gate answering, not some + // unrelated 401 from a misrouted request. + const body = (await res.json()) as { error?: { type?: string } }; + expect(body.error?.type).toBe("invalid_api_key"); + } + } }); test("GET /api/providers returns provider list or requires auth", async ({ request }) => {