mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-17 12:22:34 +03:00
db6feb6fad
Merged as part of the owner batch of 2026-09-11. This PR had a live worktree in another session, so it sat outside the main 39. Merged on your explicit call, validated first rather than taken on trust: boarded with the other 10 worktree-held PRs into a consolidated worktree off `release/v3.8.51`. - ESLint over every changed file: no errors - `typecheck:core` clean; `check:dashboard-typecheck` OK; `check:changelog-integrity` OK - complexity 2821 / baseline 3218 and cognitive-complexity 1272 / baseline 1437 - 203 of 208 assertions green. The 5 remaining (`guide-settings-route` ×4, `hard-session-lease-bypass-inventory` ×1) reproduce on the pure tip with nothing from this batch applied. - `imageGeneration.ts` rebaselined 3259 → 3293 for #12945's image-only-model guard, landed separately in #13392 so nothing was pushed onto a live branch. ⚠️ base-red inherited: #12732 — provider count 356 vs 358 and `open-sse/utils/stream.ts` 3115 > frozen 3098, both reproducing on the pure tip.
79 lines
2.7 KiB
TypeScript
79 lines
2.7 KiB
TypeScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { SignJWT } from "jose";
|
|
|
|
const keysRoute = await import("../../src/app/api/keys/route.ts");
|
|
const cliToolsKeysRoute = await import("../../src/app/api/cli-tools/keys/route.ts");
|
|
const { createApiKey, deleteApiKey } = await import("../../src/lib/db/apiKeys.ts");
|
|
|
|
const originalJwtSecret = process.env.JWT_SECRET;
|
|
const originalApiKeySecret = process.env.API_KEY_SECRET;
|
|
|
|
async function createAuthCookie() {
|
|
process.env.JWT_SECRET = "test-cli-tools-keys-secret";
|
|
const secret = new TextEncoder().encode(process.env.JWT_SECRET);
|
|
const token = await new SignJWT({ authenticated: true, sub: "test-user" })
|
|
.setProtectedHeader({ alg: "HS256" })
|
|
.setIssuedAt()
|
|
.setExpirationTime("1h")
|
|
.sign(secret);
|
|
|
|
return `auth_token=${token}`;
|
|
}
|
|
|
|
test.afterEach(() => {
|
|
if (originalJwtSecret === undefined) delete process.env.JWT_SECRET;
|
|
else process.env.JWT_SECRET = originalJwtSecret;
|
|
if (originalApiKeySecret === undefined) delete process.env.API_KEY_SECRET;
|
|
else process.env.API_KEY_SECRET = originalApiKeySecret;
|
|
});
|
|
|
|
test("CLI tools key list can return unmasked keys for authenticated internal consumers", async () => {
|
|
process.env.API_KEY_SECRET = "test-api-key-secret";
|
|
const created = await createApiKey("CLI Tools Test Key", "test-machine-cli-tools");
|
|
|
|
try {
|
|
const cookie = await createAuthCookie();
|
|
const request = new Request("http://localhost/api/cli-tools/keys", {
|
|
headers: {
|
|
cookie,
|
|
},
|
|
});
|
|
|
|
const response = await cliToolsKeysRoute.GET(request);
|
|
assert.equal(response.status, 200);
|
|
const payload = await response.json();
|
|
const key = payload.keys.find((entry) => entry.id === created.id);
|
|
|
|
assert.ok(key, "created key should be present");
|
|
assert.notEqual(key.key, created.key);
|
|
assert.match(key.key, /^.{8}\*\*\*\*.*$/);
|
|
assert.equal(key.rawKey, created.key);
|
|
} finally {
|
|
await deleteApiKey(created.id);
|
|
}
|
|
});
|
|
|
|
test("general keys route stays masked for non-CLI consumers", async () => {
|
|
process.env.API_KEY_SECRET = "test-api-key-secret";
|
|
const created = await createApiKey("Masked Key Test", "test-machine-masked");
|
|
|
|
try {
|
|
const cookie = await createAuthCookie();
|
|
const request = new Request("http://localhost/api/keys", {
|
|
headers: { cookie },
|
|
});
|
|
|
|
const response = await keysRoute.GET(request);
|
|
assert.equal(response.status, 200);
|
|
const payload = await response.json();
|
|
const key = payload.keys.find((entry) => entry.id === created.id);
|
|
|
|
assert.ok(key, "created key should be present");
|
|
assert.notEqual(key.key, created.key);
|
|
assert.match(key.key, /^.{8}\*\*\*\*.*$/);
|
|
} finally {
|
|
await deleteApiKey(created.id);
|
|
}
|
|
});
|