pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-07-31 04:12:10 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(sse): don't mark a valid Qoder PAT expired on a generic Cosy 500 (#3247) (#3283)

Browse Source 
A working Qoder PAT was reported as "expired". The validator probes the Cosy endpoint
(api1.qoder.sh) — which IS the correct PAT path (the executor falls back to it after the
expected 401 from api.qoder.com). The bug was the verdict: isCosyAppError (added by #2860)
marked ANY Cosy 500 with "success":false as an auth failure, including a generic
{..."msgCode":500,"message":"Internal Server Error"} server fault — contradicting the
older #1391 "5xx = valid bypass" rule.

Narrow it: a Cosy 500 only marks the PAT invalid when the body carries an EXPLICIT auth
signal (unauthorized/forbidden/expired/token invalid/...); a generic Internal Server Error
falls back to valid-bypass. #2860's protection for genuine auth rejections is preserved.

Regression test: tests/unit/qoder-cli.test.ts — the two pre-existing generic-500 cases now
assert valid:true (they encoded the #3247 bug) + a new explicit-auth-signal case asserts
valid:false. 13/13 green.
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-06-06 03:11:58 -03:00
committed by GitHub
parent 36932b62a7
commit a7e445edea
3 changed files with 44 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
tests/unit/qoder-cli.test.ts
View File

@@ -365,37 +365,59 @@ test("validateQoderCliPat treats 5xx HTTP failures as valid bypass", async () =>
}
});
test("validateQoderCliPat rejects 500 HTTP failures if response is Cosy app-level auth error", async () => {
// #3247: a generic Cosy 500 (`{"success":false,...,"msgCode":500,"message":"Internal
// Server Error"}`) is a SERVER fault, not a reliable auth verdict — a PAT that works in
// the Qoder CLI was being wrongly marked "expired". Per the older #1391 rule, a generic
// 5xx is now a valid bypass; only an explicit auth signal in the body marks it invalid.
test("validateQoderCliPat treats a generic Cosy 500 (no auth signal) as a valid bypass (#3247)", async () => {
const originalFetch = globalThis.fetch;
globalThis.fetch = async (url) => {
if (String(url).includes("/ping")) return new Response("pong", { status: 200 });
return new Response(
' { "success" : false, "traceId": "a4e5de61929400b9243b4f6e49756906", "msgCode" : 500 } ',
'{"success":false,"traceId":"a4e5de61929400b9243b4f6e49756906","msgCode":500,"msgInfo":"Internal Server Error","message":"Internal Server Error"}',
{ status: 500 }
);
};
try {
const result = await qoderCli.validateQoderCliPat({ apiKey: "invalid-pat" });
assert.equal(result.valid, false);
assert.match(result.error!, /Authentication failed \(HTTP 500\)/);
const result = await qoderCli.validateQoderCliPat({ apiKey: "pt-valid-token" });
assert.equal(result.valid, true);
assert.match(result.error!, /treating PAT as valid/);
} finally {
globalThis.fetch = originalFetch;
}
});
test("validateQoderCliPat rejects 500 HTTP failures using regex for Internal Server Error with whitespace", async () => {
test("validateQoderCliPat treats a generic 'Internal Server Error' 500 as a valid bypass (#3247)", async () => {
const originalFetch = globalThis.fetch;
globalThis.fetch = async (url) => {
if (String(url).includes("/ping")) return new Response("pong", { status: 200 });
return new Response(' { "success" : false, "error": "Internal Server Error" } ', {
status: 500,
});
};
try {
const result = await qoderCli.validateQoderCliPat({ apiKey: "pt-valid-token" });
assert.equal(result.valid, true);
assert.match(result.error!, /treating PAT as valid/);
} finally {
globalThis.fetch = originalFetch;
}
});
test("validateQoderCliPat still rejects a Cosy 500 that carries an explicit auth signal (#2860)", async () => {
const originalFetch = globalThis.fetch;
globalThis.fetch = async (url) => {
if (String(url).includes("/ping")) return new Response("pong", { status: 200 });
return new Response(
' { "success" : false, "error": "Internal Server Error" } ',
'{"success":false,"msgCode":500,"message":"token invalid or unauthorized"}',
{ status: 500 }
);
};
try {
const result = await qoderCli.validateQoderCliPat({ apiKey: "invalid-pat" });
const result = await qoderCli.validateQoderCliPat({ apiKey: "pt-bad-token" });
assert.equal(result.valid, false);
assert.match(result.error!, /Authentication failed \(HTTP 500\)/);
} finally {