From 3e8a8f71cc089ead1adca157d2249adbfd1ce31e Mon Sep 17 00:00:00 2001 From: Benson K B Date: Mon, 17 Aug 2026 15:32:48 +0530 Subject: [PATCH] fix(providers): add PATCH handler to provider connection route (CLI rotate 405) (#10366) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(providers): add PATCH handler to provider connection route The OpenAPI spec and the CLI (omniroute providers rotate, generated api-commands) both use PATCH /api/providers/[id], but the route only implemented PUT — PATCH requests returned 405 and key rotation via the CLI silently failed while reporting success (the DB-write fallback only catches thrown exceptions, not non-OK HTTP responses). Add a PATCH handler delegating to the PUT handler: both apply the same partial-update schema, so the semantics are identical. Regression test proves the PATCH export exists and delegates into the shared auth path; verified to fail without the fix. * docs(changelog): note PATCH provider route fix (PR #10366) * fix(providers): make PATCH delegation test environment-robust The 'PATCH delegates to PUT' assertion hardcoded a 401, which only holds when management auth is enforced (dev). In the CI unit-test env auth is not required, so the flow falls through to 'Connection not found' (404) for an unknown id — the test failed on the status code while the PATCH->PUT delegation itself is correct. Assert on delegation equivalence instead: PATCH must never 405 (the regression) and must return the same status as PUT for the same input. Co-authored-by: diegosouzapw * test(providers): use fresh Request per handler in PATCH delegation test The same Request was passed to both PATCH and PUT — PUT consumes the body via request.json(), so the second call got an empty body (400 validation) vs the first (404 not-found): a false status mismatch on bases where management auth is bypassed in the test env (release v3.8.50). Fresh Request per invocation makes identical inputs produce identical statuses. --------- Co-authored-by: benzntech Co-authored-by: diegosouzapw --- CHANGELOG.md | 1 + src/app/api/providers/[id]/route.ts | 9 +++ .../unit/providers-route-patch-method.test.ts | 66 +++++++++++++++++++ 3 files changed, 76 insertions(+) create mode 100644 tests/unit/providers-route-patch-method.test.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index ff47e9757a..49668a6214 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -167,6 +167,7 @@ _Living section — regenerated 2026-08-12 from all cycle commits (cycle open `e ### 🐛 Bug Fixes +- **providers**: honor `PATCH /api/providers/[id]` so `omniroute providers rotate` stops 405ing (the OpenAPI spec and CLI already use PATCH) (PR #10366) - **executors**: fix internal timeout misclassified as client disconnect (499) for 7 niche executors — pass TimeoutError reason to controller.abort() (#8197 side-finding) - test(combo): guard auto/best-free never leaks the combo name as a model (#7754) - fix(vision-bridge): describe-model no longer returns unreachable "openai/gpt-4o-mini" when every vision-capable provider is unreachable on the instance — returns null instead and surfaces a clear error (#8430) diff --git a/src/app/api/providers/[id]/route.ts b/src/app/api/providers/[id]/route.ts index adb5840fa0..562dad0744 100644 --- a/src/app/api/providers/[id]/route.ts +++ b/src/app/api/providers/[id]/route.ts @@ -376,6 +376,15 @@ export async function PUT(request: Request, { params }: { params: Promise<{ id: } } +// PATCH /api/providers/[id] - Update connection (partial) +// The OpenAPI spec and the CLI (`omniroute providers rotate`, generated +// api-commands) both use PATCH, but only PUT was implemented — PATCH requests +// 405'd. PATCH and PUT share the same update semantics here (the schema only +// applies provided fields), so delegate to the PUT handler. +export async function PATCH(request: Request, ctx: { params: Promise<{ id: string }> }) { + return PUT(request, ctx); +} + // DELETE /api/providers/[id] - Delete connection export async function DELETE(request: Request, { params }: { params: Promise<{ id: string }> }) { const authError = await requireManagementAuth(request); diff --git a/tests/unit/providers-route-patch-method.test.ts b/tests/unit/providers-route-patch-method.test.ts new file mode 100644 index 0000000000..23b3dcd5af --- /dev/null +++ b/tests/unit/providers-route-patch-method.test.ts @@ -0,0 +1,66 @@ +import test from "node:test"; +import assert from "node:assert/strict"; + +// Regression test for the providers-route PATCH gap: the OpenAPI spec and the +// CLI (`omniroute providers rotate`, generated api-commands) both use +// PATCH /api/providers/[id], but the route only implemented PUT — PATCH +// requests 405'd and `providers rotate --new-key` silently failed while +// reporting success. See PR fix: the route now exports a PATCH handler that +// delegates to PUT (both apply the same partial-update schema). + +async function loadRoute() { + return await import(new URL("../../src/app/api/providers/[id]/route.ts", import.meta.url)); +} + +test("providers [id] route exports a PATCH handler (CLI rotate 405 regression)", async () => { + const route = await loadRoute(); + assert.equal( + typeof route.PATCH, + "function", + "PATCH handler must exist — CLI rotate sends PATCH per the OpenAPI spec" + ); +}); + +test("PATCH handler delegates to PUT (same partial-update semantics)", async () => { + const route = await loadRoute(); + // The PATCH export delegates to PUT; both share the same update logic and + // are distinct function references (wrapper). A fixed status expectation is + // environment-dependent: management auth is enforced on dev (PUT returns 401 + // without a credential) but NOT in the CI unit-test env, where the flow + // falls through to "Connection not found" (404) for an unknown id. So assert + // on delegation equivalence instead: PATCH must never 405 (the regression) + // and must return the exact same status as PUT for the same input. + const ctx = { params: Promise.resolve({ id: "test-id" }) }; + // Fresh Request per invocation: PUT reads the body via request.json(), + // which consumes the body stream — reusing one Request for both calls would + // give the second call an empty body (400 validation) vs the first (404 + // not-found), a false mismatch. Identical inputs must produce identical + // statuses. + const patchRequest = new Request("http://localhost/api/providers/test-id", { + method: "PATCH", + body: JSON.stringify({ name: "x" }), + }); + const putRequest = new Request("http://localhost/api/providers/test-id", { + method: "PUT", + body: JSON.stringify({ name: "x" }), + }); + const patchResult = await route.PATCH(patchRequest, ctx); + const putResult = await route.PUT(putRequest, ctx); + assert.ok(patchResult, "PATCH should return a response, not 405"); + assert.notEqual( + patchResult.status, + 405, + "PATCH must be routed — before the fix Next.js returned 405 Method Not Allowed" + ); + assert.equal( + patchResult.status, + putResult.status, + "PATCH must delegate to PUT's handler (identical status for the same input)" + ); +}); + +test("providers [id] route still exports PUT and DELETE handlers", async () => { + const route = await loadRoute(); + assert.equal(typeof route.PUT, "function"); + assert.equal(typeof route.DELETE, "function"); +});