mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-15 19:32:20 +03:00
65e81158ab
Landed with the design call resolved per the owner's pick — **option 1**: the synced store is now endpoint-agnostic (persistDiscoveredModels and managedModelImport no longer drop non-chat models at write time), and chat selectability moved to read time (auto-pool expansion in autoStrategy applies filterChatSelectableModels; the models-route projection already had its chatOnly filter). Your discovery test now passes end-to-end (3/3): /api/show capabilities persist per connection and image/embedding requests route through the advertising host. Reconciliation notes: conflicted areas merged onto the current tip (adobe discovery import, requestedModel preflight signature, resolvedProvider fast-path coexists with the synced-route override — explicit resolution wins); carried base-red drains (#10055 memoization, #11071 test variants) dropped as already-landed; the managed-model-import exclusion test was propagated to the new contract (image/video models persist; the read filter still hides them from chat pickers — pinned by a new assertion). Full battery: 205/206 focused (the one red is a confirmed periodic-timer timing flake on the loaded devbox — 20/20 isolated), autoCombo vitest 30/30, combo suites 46/46, gates + typecheck clean. Thank you @yourspraveen — the capability probe + routing design was right; it just needed the store contract opened up. Fixes #11087.
70 lines
2.5 KiB
TypeScript
70 lines
2.5 KiB
TypeScript
/**
|
|
* GHSA-v54m-6rm3-p565 — /a2a sits outside the authz proxy matcher, so it never
|
|
* saw the REQUIRE_API_KEY posture and accepted every caller when OMNIROUTE_API_KEY
|
|
* was unset (the default). authenticate() now honors REQUIRE_API_KEY directly.
|
|
*/
|
|
|
|
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
|
|
const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omni-a2a-require-key-"));
|
|
process.env.DATA_DIR = TEST_DATA_DIR;
|
|
process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "a2a-require-key-secret";
|
|
process.env.OMNIROUTE_DISABLE_REDIS_AUTH_CACHE = "1";
|
|
|
|
const core = await import("../../src/lib/db/core.ts");
|
|
const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
|
|
const route = await import("../../src/app/a2a/route.ts");
|
|
|
|
const ORIGINAL_REQUIRE = process.env.REQUIRE_API_KEY;
|
|
const ORIGINAL_A2A_KEY = process.env.OMNIROUTE_API_KEY;
|
|
|
|
test.after(() => {
|
|
core.resetDbInstance();
|
|
fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
|
|
if (ORIGINAL_REQUIRE === undefined) delete process.env.REQUIRE_API_KEY;
|
|
else process.env.REQUIRE_API_KEY = ORIGINAL_REQUIRE;
|
|
if (ORIGINAL_A2A_KEY === undefined) delete process.env.OMNIROUTE_API_KEY;
|
|
else process.env.OMNIROUTE_API_KEY = ORIGINAL_A2A_KEY;
|
|
});
|
|
|
|
function post(key?: string) {
|
|
return route.POST(
|
|
new Request("http://localhost/a2a", {
|
|
method: "POST",
|
|
headers: {
|
|
"content-type": "application/json",
|
|
...(key ? { authorization: `Bearer ${key}` } : {}),
|
|
},
|
|
body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "message/send", params: {} }),
|
|
}) as never
|
|
);
|
|
}
|
|
|
|
async function isUnauthorized(res: Response) {
|
|
const body = (await res.clone().json()) as { error?: { code?: number } };
|
|
return body.error?.code === -32600;
|
|
}
|
|
|
|
test("REQUIRE_API_KEY=true rejects an unkeyed /a2a call (GHSA-v54m)", async () => {
|
|
delete process.env.OMNIROUTE_API_KEY;
|
|
process.env.REQUIRE_API_KEY = "true";
|
|
assert.equal(await isUnauthorized(await post()), true, "no key must be rejected");
|
|
|
|
const key = await apiKeysDb.createApiKey("a2a-client", "machine-a2a", []);
|
|
assert.equal(
|
|
await isUnauthorized(await post(key.key)),
|
|
false,
|
|
"a valid key must clear the /a2a auth gate"
|
|
);
|
|
});
|
|
|
|
test("keyless local-first default still allows /a2a (posture preserved)", async () => {
|
|
delete process.env.REQUIRE_API_KEY;
|
|
delete process.env.OMNIROUTE_API_KEY;
|
|
assert.equal(await isUnauthorized(await post()), false, "keyless default must not 401");
|
|
});
|