From adbcd2c8bcd782e671692154607775ddfa1ac633 Mon Sep 17 00:00:00 2001 From: "Andrew B." <37745667+AndrianBalanescu@users.noreply.github.com> Date: Mon, 20 Jul 2026 08:08:19 -0500 Subject: [PATCH] fix(auth): gate invalid-key check on isRequireApiKeyEnabled for embeddings and web-fetch (#7785) (#7810) * fix(auth): gate invalid-key check on isRequireApiKeyEnabled for embeddings and web-fetch (#7785) When REQUIRE_API_KEY=false, /v1/embeddings and /v1/web/fetch still returned 401 for invalid presented keys while all other client APIs allowed anonymous access. The route-local invalid-key check was not gated on isRequireApiKeyEnabled(), unlike the /v1/combos pattern. Gate the invalid-key check on isRequireApiKeyEnabled() in both route files so anonymous access works consistently across all client APIs. Refs: https://github.com/diegosouzapw/OmniRoute/issues/7785 * fix(tests): set REQUIRE_API_KEY=true in embeddings-auth invalid-key subtest The "should return 401 when an invalid API key is provided" test now correctly sets REQUIRE_API_KEY="true" so the route-level gated check is exercised. Before, the test asserted 401 when REQUIRE_API_KEY was not set, which after #7785 fix now returns 400 (model validation fails) instead of 401. * test(auth): assert anonymous-passthrough in embeddings-auth legacy suite (#7785) Per #7785's acceptance criteria, the pre-existing embeddings regression test must assert BOTH enforcement states, not just the enforced-401 case. Add the missing REQUIRE_API_KEY=false + invalid-key subtest alongside the already-fixed REQUIRE_API_KEY=true + invalid-key subtest, matching the coverage already present in the dedicated auth-policy-embeddings-webfetch-7785.test.ts suite. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --- src/app/api/v1/embeddings/route.ts | 5 +- src/app/api/v1/web/fetch/route.ts | 6 +- ...th-policy-embeddings-webfetch-7785.test.ts | 118 ++++++++++++++++++ tests/unit/embeddings-auth.test.ts | 48 +++++-- 4 files changed, 162 insertions(+), 15 deletions(-) create mode 100644 tests/unit/auth-policy-embeddings-webfetch-7785.test.ts diff --git a/src/app/api/v1/embeddings/route.ts b/src/app/api/v1/embeddings/route.ts index 385958636b..fb87e6678b 100644 --- a/src/app/api/v1/embeddings/route.ts +++ b/src/app/api/v1/embeddings/route.ts @@ -54,12 +54,13 @@ async function postHandler(request, context) { } const body = validation.data; - // Auth check + // Auth check — when REQUIRE_API_KEY=false, ignore presented invalid keys + // so anonymous access works the same as all other client APIs (#7785). const apiKeyRaw = extractApiKey(request); if (isRequireApiKeyEnabled() && !apiKeyRaw) { return errorResponse(HTTP_STATUS.UNAUTHORIZED, "Authentication required"); } - if (apiKeyRaw && !(await isValidApiKey(apiKeyRaw))) { + if (isRequireApiKeyEnabled() && apiKeyRaw && !(await isValidApiKey(apiKeyRaw))) { return errorResponse(HTTP_STATUS.UNAUTHORIZED, "Invalid API key"); } diff --git a/src/app/api/v1/web/fetch/route.ts b/src/app/api/v1/web/fetch/route.ts index c32466ab9b..1fbfa0be5a 100644 --- a/src/app/api/v1/web/fetch/route.ts +++ b/src/app/api/v1/web/fetch/route.ts @@ -64,12 +64,14 @@ export async function POST(request: Request) { } const body = validation.data; - // Optional auth check + // Optional auth check — when REQUIRE_API_KEY=false, ignore presented + // invalid keys so anonymous access works the same as all other client + // APIs (#7785). const apiKeyRaw = extractApiKey(request); if (isRequireApiKeyEnabled() && !apiKeyRaw) { return errorResponse(HTTP_STATUS.UNAUTHORIZED, "Authentication required"); } - if (apiKeyRaw && !(await isValidApiKey(apiKeyRaw))) { + if (isRequireApiKeyEnabled() && apiKeyRaw && !(await isValidApiKey(apiKeyRaw))) { return errorResponse(HTTP_STATUS.UNAUTHORIZED, "Invalid API key"); } diff --git a/tests/unit/auth-policy-embeddings-webfetch-7785.test.ts b/tests/unit/auth-policy-embeddings-webfetch-7785.test.ts new file mode 100644 index 0000000000..fe252cdf4a --- /dev/null +++ b/tests/unit/auth-policy-embeddings-webfetch-7785.test.ts @@ -0,0 +1,118 @@ +/** + * #7785 — Auth policy inconsistency on /v1/embeddings and /v1/web/fetch. + * + * When REQUIRE_API_KEY=false, all client APIs should allow anonymous access. + * However, embeddings and web-fetch routes still returned 401 for invalid + * presented keys because the invalid-key check was NOT gated on + * isRequireApiKeyEnabled() — unlike the combos route pattern. + * + * Fix: gate the route-local invalid-key check on isRequireApiKeyEnabled() in + * both route files, matching the /api/v1/combos pattern. + * + * These tests verify: + * 1. REQUIRE_API_KEY=false + invalid bearer key → NOT 401 (anonymous access) + * 2. REQUIRE_API_KEY=true + invalid bearer key → 401 (auth enforced) + */ + +import test from "node:test"; +import assert from "node:assert/strict"; +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; + +const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omr-auth-policy-7785-")); +process.env.DATA_DIR = TEST_DATA_DIR; +process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "auth-7785-api-secret"; +process.env.JWT_SECRET = "auth-7785-jwt-secret"; + +// Ensure no env-var API key interferes with isValidApiKey results. +delete process.env.OMNIROUTE_API_KEY; +delete process.env.ROUTER_API_KEY; + +const core = await import("../../src/lib/db/core.ts"); +const { createProviderNode } = await import("../../src/lib/db/providers/nodes.ts"); +const { POST: embeddingsPOST } = await import("../../src/app/api/v1/embeddings/route.ts"); +const { POST: webFetchPOST } = await import("../../src/app/api/v1/web/fetch/route.ts"); + +const INVALID_BEARER = "Bearer sk-invalid-key-that-does-not-exist-7785"; + +test.after(() => { + core.resetDbInstance(); + fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true }); +}); + +function embeddingsRequest(): Request { + return new Request("http://localhost/v1/embeddings", { + method: "POST", + headers: { + "Content-Type": "application/json", + Authorization: INVALID_BEARER, + }, + body: JSON.stringify({ model: "lanembed7785/nomic-embed-text", input: "hello" }), + }); +} + +function webFetchRequest(): Request { + return new Request("http://localhost/v1/web/fetch", { + method: "POST", + headers: { + "Content-Type": "application/json", + Authorization: INVALID_BEARER, + }, + body: JSON.stringify({ url: "https://example.com" }), + }); +} + +// ── Embeddings route ────────────────────────────────────────────────────── + +test("#7785 embeddings: REQUIRE_API_KEY=false + invalid key → not 401", async () => { + process.env.REQUIRE_API_KEY = "false"; + + await createProviderNode({ + type: "openai-compatible-embeddings", + name: "LAN Embed 7785", + prefix: "lanembed7785", + apiType: "embeddings", + baseUrl: "http://10.10.0.182:11434/v1", + }); + + const originalFetch = globalThis.fetch; + globalThis.fetch = async () => + new Response( + JSON.stringify({ + data: [{ object: "embedding", embedding: [0.1, 0.2], index: 0 }], + usage: { prompt_tokens: 3, total_tokens: 3 }, + }), + { status: 200, headers: { "content-type": "application/json" } } + ); + + try { + const res = await embeddingsPOST(embeddingsRequest(), {}); + assert.notEqual(res.status, 401, "invalid key must NOT cause 401 when REQUIRE_API_KEY=false"); + } finally { + globalThis.fetch = originalFetch; + } +}); + +test("#7785 embeddings: REQUIRE_API_KEY=true + invalid key → 401", async () => { + process.env.REQUIRE_API_KEY = "true"; + + const res = await embeddingsPOST(embeddingsRequest(), {}); + assert.equal(res.status, 401, "invalid key must cause 401 when REQUIRE_API_KEY=true"); +}); + +// ── Web-fetch route ─────────────────────────────────────────────────────── + +test("#7785 web-fetch: REQUIRE_API_KEY=false + invalid key → not 401", async () => { + process.env.REQUIRE_API_KEY = "false"; + + const res = await webFetchPOST(webFetchRequest()); + assert.notEqual(res.status, 401, "invalid key must NOT cause 401 when REQUIRE_API_KEY=false"); +}); + +test("#7785 web-fetch: REQUIRE_API_KEY=true + invalid key → 401", async () => { + process.env.REQUIRE_API_KEY = "true"; + + const res = await webFetchPOST(webFetchRequest()); + assert.equal(res.status, 401, "invalid key must cause 401 when REQUIRE_API_KEY=true"); +}); diff --git a/tests/unit/embeddings-auth.test.ts b/tests/unit/embeddings-auth.test.ts index 7034f709ed..4c0798e49a 100644 --- a/tests/unit/embeddings-auth.test.ts +++ b/tests/unit/embeddings-auth.test.ts @@ -53,17 +53,43 @@ test("POST /v1/embeddings authentication", async (t) => { const originalRequireApiKey = process.env.REQUIRE_API_KEY; const originalOmniKey = process.env.OMNIROUTE_API_KEY; - await t.test("should return 401 when an invalid API key is provided", async () => { - process.env.OMNIROUTE_API_KEY = "valid-key"; - const req = new Request("http://localhost/v1/embeddings", { - method: "POST", - headers: { Authorization: "Bearer invalid-key" }, - body: JSON.stringify({ model: "mistral/mistral-embed", input: "test" }), - }); - const res = await POST(req); - assert.strictEqual(res.status, 401); - delete process.env.OMNIROUTE_API_KEY; - }); + await t.test( + "should return 401 when an invalid API key is provided and REQUIRE_API_KEY is true", + async () => { + process.env.REQUIRE_API_KEY = "true"; + process.env.OMNIROUTE_API_KEY = "valid-key"; + const req = new Request("http://localhost/v1/embeddings", { + method: "POST", + headers: { Authorization: "Bearer invalid-key" }, + body: JSON.stringify({ model: "mistral/mistral-embed", input: "test" }), + }); + const res = await POST(req); + assert.strictEqual(res.status, 401); + delete process.env.OMNIROUTE_API_KEY; + delete process.env.REQUIRE_API_KEY; + } + ); + + await t.test( + "should NOT return 401 when an invalid API key is provided and REQUIRE_API_KEY is false (#7785)", + async () => { + process.env.REQUIRE_API_KEY = "false"; + process.env.OMNIROUTE_API_KEY = "valid-key"; + const req = new Request("http://localhost/v1/embeddings", { + method: "POST", + headers: { Authorization: "Bearer invalid-key" }, + body: JSON.stringify({ model: "mistral/mistral-embed", input: "test" }), + }); + const res = await POST(req); + assert.notStrictEqual( + res.status, + 401, + "an invalid presented key must not 401 when REQUIRE_API_KEY=false (anonymous access)" + ); + delete process.env.OMNIROUTE_API_KEY; + delete process.env.REQUIRE_API_KEY; + } + ); await t.test( "should return 401 when no API key is provided and REQUIRE_API_KEY is true",