mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-21 22:32:22 +03:00
65e81158ab
Landed with the design call resolved per the owner's pick — **option 1**: the synced store is now endpoint-agnostic (persistDiscoveredModels and managedModelImport no longer drop non-chat models at write time), and chat selectability moved to read time (auto-pool expansion in autoStrategy applies filterChatSelectableModels; the models-route projection already had its chatOnly filter). Your discovery test now passes end-to-end (3/3): /api/show capabilities persist per connection and image/embedding requests route through the advertising host. Reconciliation notes: conflicted areas merged onto the current tip (adobe discovery import, requestedModel preflight signature, resolvedProvider fast-path coexists with the synced-route override — explicit resolution wins); carried base-red drains (#10055 memoization, #11071 test variants) dropped as already-landed; the managed-model-import exclusion test was propagated to the new contract (image/video models persist; the read filter still hides them from chat pickers — pinned by a new assertion). Full battery: 205/206 focused (the one red is a confirmed periodic-timer timing flake on the loaded devbox — 20/20 isolated), autoCombo vitest 30/30, combo suites 46/46, gates + typecheck clean. Thank you @yourspraveen — the capability probe + routing design was right; it just needed the store contract opened up. Fixes #11087.
76 lines
3.2 KiB
TypeScript
76 lines
3.2 KiB
TypeScript
/**
|
|
* GHSA-mg76-rhpx-gvw3 / GHSA-gxv4-955v-v6cm — OAuth import / auto-import routes
|
|
* create or read provider credentials. They were guarded only by isAuthenticated(),
|
|
* which (because /api/oauth/ is PUBLIC-classified) accepts ANY valid client API key.
|
|
* They must now require MANAGEMENT scope.
|
|
*/
|
|
|
|
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
|
|
const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omni-oauth-import-manage-"));
|
|
process.env.DATA_DIR = TEST_DATA_DIR;
|
|
process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "oauth-import-manage-secret";
|
|
process.env.OMNIROUTE_DISABLE_REDIS_AUTH_CACHE = "1";
|
|
|
|
const core = await import("../../src/lib/db/core.ts");
|
|
const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
|
|
const settingsDb = await import("../../src/lib/db/settings.ts");
|
|
const codexImportToken = await import("../../src/app/api/oauth/codex/import-token/route.ts");
|
|
const cursorAutoImport = await import("../../src/app/api/oauth/cursor/auto-import/route.ts");
|
|
|
|
test.before(async () => {
|
|
process.env.JWT_SECRET = "oauth-import-manage-jwt";
|
|
process.env.INITIAL_PASSWORD = "oauth-import-manage-pass";
|
|
await settingsDb.updateSettings({ requireLogin: true });
|
|
});
|
|
|
|
test.after(() => {
|
|
core.resetDbInstance();
|
|
fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
|
|
delete process.env.JWT_SECRET;
|
|
delete process.env.INITIAL_PASSWORD;
|
|
});
|
|
|
|
function post(route: { POST: (r: Request) => Promise<Response> }, key?: string) {
|
|
return route.POST(
|
|
new Request("http://localhost/api/oauth/codex/import-token", {
|
|
method: "POST",
|
|
headers: {
|
|
"content-type": "application/json",
|
|
...(key ? { authorization: `Bearer ${key}` } : {}),
|
|
},
|
|
body: JSON.stringify({ accessToken: "x", name: "poc" }),
|
|
})
|
|
);
|
|
}
|
|
|
|
function get(route: { GET: (r: Request) => Promise<Response> }, key?: string) {
|
|
return route.GET(
|
|
new Request("http://localhost/api/oauth/cursor/auto-import", {
|
|
headers: key ? { authorization: `Bearer ${key}` } : {},
|
|
})
|
|
);
|
|
}
|
|
|
|
test("codex/import-token: non-manage key → 403, no key → 401, manage key passes the auth gate (GHSA-mg76)", async () => {
|
|
const nonManage = await apiKeysDb.createApiKey("client", "machine-client", []);
|
|
const manage = await apiKeysDb.createApiKey("admin", "machine-admin", ["manage"]);
|
|
|
|
assert.equal((await post(codexImportToken, nonManage.key)).status, 403, "non-manage key rejected");
|
|
assert.equal((await post(codexImportToken)).status, 401, "no credential rejected");
|
|
|
|
const withManage = await post(codexImportToken, manage.key);
|
|
assert.notEqual(withManage.status, 401, "manage key must clear the auth gate");
|
|
assert.notEqual(withManage.status, 403, "manage key must clear the auth gate");
|
|
});
|
|
|
|
test("cursor/auto-import: a non-manage key cannot read the host's Cursor token (GHSA-gxv4)", async () => {
|
|
const nonManage = await apiKeysDb.createApiKey("client2", "machine-client2", []);
|
|
assert.equal((await get(cursorAutoImport, nonManage.key)).status, 403, "non-manage key rejected");
|
|
assert.equal((await get(cursorAutoImport)).status, 401, "no credential rejected");
|
|
});
|