Files
OmniRoute/tests/unit/bailian-token-plan-endpoint-parity.test.ts
Diego Rodrigues de Sa e Souza c164ed962b fix(providers): validate bailian-coding-plan against the Token Plan host (#10634)
* fix(providers): validate bailian-coding-plan against the Token Plan host

The catalog entry is the personal Alibaba Token Plan, but the region map still
resolved the retired Coding Plan hosts. #10290 moved only the open-sse registry
(inference) to token-plan.ap-southeast-1.maas.aliyuncs.com, leaving the dashboard's
key validation pointed at coding-intl.dashscope.aliyuncs.com.

That host rejects Token Plan keys with 401, and validateBailianCodingPlanProvider
maps 401/403 to "Invalid API key" — so adding a working key failed at the modal
while the same key served inference fine. Verified live 2026-08-18 with a valid
key: legacy host 401 invalid_api_key, Token Plan host 429 quota (auth OK).

- point both regions of ALIBABA_PROVIDER_ENDPOINTS at the Token Plan hosts,
  matching what docs/providers/ALIBABA-QWEN-PROVIDER-FAMILIES.md already stated
- keep the retired hosts recognized as presets, so connections saved with the old
  URL still follow the region selector instead of being pinned to a dead host
- keep image/video generation on the DashScope AIGC hosts, which the Token Plan
  host does not serve
- probe with a model this plan actually serves (qwen3-coder-plus was Coding Plan)

* test(providers): compare parsed hostnames in the legacy-host guard

CodeQL flags URL .includes() checks as js/incomplete-url-substring-sanitization.
The guard is an assertion, not a sanitizer, but comparing new URL().hostname is
strictly more precise anyway — same coverage, no substring pattern.

---------

Co-authored-by: Xiangzhe <bakryun0718@proton.me>
2026-08-18 05:51:34 -03:00

103 lines
4.1 KiB
TypeScript

/**
* bailian-coding-plan ("Alibaba Token Plan") pointed inference and validation at two
* DIFFERENT hosts.
*
* #10290 moved the open-sse registry to the Token Plan host, but the dashboard's key
* validation resolves its URL through ALIBABA_PROVIDER_REGION_ENDPOINTS, which still held
* the legacy Coding Plan host. Verified live 2026-08-18 with a valid Token Plan key:
*
* coding-intl.dashscope.aliyuncs.com → 401 invalid_api_key
* token-plan.ap-southeast-1.maas... → 429 Throttling.AllocationQuota (auth OK)
*
* validateBailianCodingPlanProvider maps 401/403 to "Invalid API key", so a perfectly
* good key was rejected at add-connection time while the very same key worked for
* inference. These tests pin the two paths together.
*/
import test from "node:test";
import assert from "node:assert/strict";
import { REGISTRY } from "../../open-sse/config/providers/index.ts";
import { PROVIDER_ENDPOINTS } from "../../src/shared/constants/config.ts";
import { DEFAULT_PROVIDER_BASE_URLS } from "../../src/app/(dashboard)/dashboard/providers/[id]/providerPageHelpers.ts";
import {
ALIBABA_PROVIDER_ENDPOINTS,
resolveAlibabaProviderBaseUrl,
} from "../../src/shared/constants/alibabaProviderRegions.ts";
const LEGACY_CODING_PLAN_HOST = "coding-intl.dashscope.aliyuncs.com";
test("validation resolves the same host the inference registry dispatches to", () => {
const registryBaseUrl = REGISTRY["bailian-coding-plan"].baseUrl;
const resolved = resolveAlibabaProviderBaseUrl("bailian-coding-plan", {
region: "global-sg",
});
assert.equal(
resolved,
registryBaseUrl,
"the dashboard would validate the key against a different host than inference uses"
);
});
test("no default endpoint still points at the Coding Plan host", () => {
// The catalog entry is a TOKEN Plan; Coding Plan keys are a different product and the
// legacy host rejects Token Plan keys outright. Compare parsed hostnames, not URL
// substrings (CodeQL js/incomplete-url-substring-sanitization).
assert.notEqual(
new URL(PROVIDER_ENDPOINTS["bailian-coding-plan"]).hostname,
LEGACY_CODING_PLAN_HOST,
"PROVIDER_ENDPOINTS still defaults to the legacy Coding Plan host"
);
assert.notEqual(
new URL(DEFAULT_PROVIDER_BASE_URLS["bailian-coding-plan"]).hostname,
LEGACY_CODING_PLAN_HOST,
"the dashboard base-URL placeholder still shows the legacy Coding Plan host"
);
for (const region of ["global-sg", "china-beijing"] as const) {
assert.notEqual(
new URL(ALIBABA_PROVIDER_ENDPOINTS["bailian-coding-plan"][region]).hostname,
LEGACY_CODING_PLAN_HOST,
`region ${region} still maps to the legacy Coding Plan host`
);
}
});
test("both regions keep the Anthropic-compatible path the claude format requires", () => {
// format: "claude" + chatPath "/messages" — a compatible-mode URL here would 404.
for (const region of ["global-sg", "china-beijing"] as const) {
assert.ok(
ALIBABA_PROVIDER_ENDPOINTS["bailian-coding-plan"][region].endsWith("/apps/anthropic/v1"),
`region ${region} must keep the /apps/anthropic/v1 root`
);
}
});
test("a saved legacy preset URL still follows the region selector", () => {
// Migration guard: connections created before the fix carry the legacy host in
// providerSpecificData.baseUrl. isFamilyPresetUrl must keep recognizing it as a
// preset — otherwise it is treated as a deliberate custom URL and the connection
// stays pinned to the host that rejects its key, with no way out but manual editing.
const legacyPreset = "https://coding-intl.dashscope.aliyuncs.com/apps/anthropic/v1";
assert.equal(
resolveAlibabaProviderBaseUrl("bailian-coding-plan", {
region: "global-sg",
baseUrl: legacyPreset,
}),
ALIBABA_PROVIDER_ENDPOINTS["bailian-coding-plan"]["global-sg"],
"a stored legacy preset must not pin the connection to the dead host"
);
});
test("a genuinely custom base URL still wins over the region preset", () => {
const custom = "https://my-gateway.internal/apps/anthropic/v1";
assert.equal(
resolveAlibabaProviderBaseUrl("bailian-coding-plan", {
region: "global-sg",
baseUrl: custom,
}),
custom
);
});