mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-15 11:22:15 +03:00
65e81158ab
Landed with the design call resolved per the owner's pick — **option 1**: the synced store is now endpoint-agnostic (persistDiscoveredModels and managedModelImport no longer drop non-chat models at write time), and chat selectability moved to read time (auto-pool expansion in autoStrategy applies filterChatSelectableModels; the models-route projection already had its chatOnly filter). Your discovery test now passes end-to-end (3/3): /api/show capabilities persist per connection and image/embedding requests route through the advertising host. Reconciliation notes: conflicted areas merged onto the current tip (adobe discovery import, requestedModel preflight signature, resolvedProvider fast-path coexists with the synced-route override — explicit resolution wins); carried base-red drains (#10055 memoization, #11071 test variants) dropped as already-landed; the managed-model-import exclusion test was propagated to the new contract (image/video models persist; the read filter still hides them from chat pickers — pinned by a new assertion). Full battery: 205/206 focused (the one red is a confirmed periodic-timer timing flake on the loaded devbox — 20/20 isolated), autoCombo vitest 30/30, combo suites 46/46, gates + typecheck clean. Thank you @yourspraveen — the capability probe + routing design was right; it just needed the store contract opened up. Fixes #11087.
67 lines
2.8 KiB
TypeScript
67 lines
2.8 KiB
TypeScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
|
|
import {
|
|
getInternalServiceAuthHeaders,
|
|
INTERNAL_SERVICE_AUTH_HEADER,
|
|
isInternalServiceRequest,
|
|
isTrustedLoopbackInternalServiceRequest,
|
|
} from "../../src/lib/api/internalServiceAuth.ts";
|
|
import { AUTHZ_HEADER_PEER_LOCALITY } from "../../src/server/authz/headers.ts";
|
|
|
|
const originalInline = process.env.OMNIROUTE_INTERNAL_SERVICE_TOKEN;
|
|
const originalFile = process.env.OMNIROUTE_INTERNAL_SERVICE_TOKEN_FILE;
|
|
|
|
test.afterEach(() => {
|
|
if (originalInline === undefined) delete process.env.OMNIROUTE_INTERNAL_SERVICE_TOKEN;
|
|
else process.env.OMNIROUTE_INTERNAL_SERVICE_TOKEN = originalInline;
|
|
if (originalFile === undefined) delete process.env.OMNIROUTE_INTERNAL_SERVICE_TOKEN_FILE;
|
|
else process.env.OMNIROUTE_INTERNAL_SERVICE_TOKEN_FILE = originalFile;
|
|
});
|
|
|
|
test("internal service auth is disabled when no token is configured", () => {
|
|
delete process.env.OMNIROUTE_INTERNAL_SERVICE_TOKEN;
|
|
delete process.env.OMNIROUTE_INTERNAL_SERVICE_TOKEN_FILE;
|
|
assert.deepEqual(getInternalServiceAuthHeaders(), {});
|
|
assert.equal(isInternalServiceRequest(new Request("http://localhost")), false);
|
|
});
|
|
|
|
test("internal service auth preserves a separate constant-time token channel", () => {
|
|
process.env.OMNIROUTE_INTERNAL_SERVICE_TOKEN = "test-internal-token-0123456789";
|
|
delete process.env.OMNIROUTE_INTERNAL_SERVICE_TOKEN_FILE;
|
|
const headers = new Headers({
|
|
...getInternalServiceAuthHeaders(),
|
|
[AUTHZ_HEADER_PEER_LOCALITY]: "loopback",
|
|
});
|
|
const request = new Request("http://localhost", { headers });
|
|
assert.equal(headers.get(INTERNAL_SERVICE_AUTH_HEADER), "test-internal-token-0123456789");
|
|
assert.equal(isInternalServiceRequest(request), true);
|
|
assert.equal(isTrustedLoopbackInternalServiceRequest(request), true);
|
|
|
|
const remote = new Request("https://example.test", {
|
|
headers: {
|
|
[INTERNAL_SERVICE_AUTH_HEADER]: "test-internal-token-0123456789",
|
|
[AUTHZ_HEADER_PEER_LOCALITY]: "remote",
|
|
},
|
|
});
|
|
assert.equal(isTrustedLoopbackInternalServiceRequest(remote), false);
|
|
});
|
|
|
|
test("internal service token file is read without exposing it to process env", () => {
|
|
const directory = fs.mkdtempSync(path.join(os.tmpdir(), "omr-internal-auth-"));
|
|
const tokenFile = path.join(directory, "token");
|
|
try {
|
|
fs.writeFileSync(tokenFile, "file-backed-token-0123456789\n", { mode: 0o600 });
|
|
delete process.env.OMNIROUTE_INTERNAL_SERVICE_TOKEN;
|
|
process.env.OMNIROUTE_INTERNAL_SERVICE_TOKEN_FILE = tokenFile;
|
|
assert.deepEqual(getInternalServiceAuthHeaders(), {
|
|
[INTERNAL_SERVICE_AUTH_HEADER]: "file-backed-token-0123456789",
|
|
});
|
|
} finally {
|
|
fs.rmSync(directory, { recursive: true, force: true });
|
|
}
|
|
});
|