mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-26 09:02:11 +03:00
dc32732b2a
The 9 media *ExampleCard components under media-providers/components used the masked value from useApiKey() (sk-xxxx****yyyy) as an Authorization: Bearer header, which the gateway always rejects (AUTH_002) once REQUIRE_API_KEY is enabled. Mirror the LlmChatCard fix (#3503): authenticate via the dashboard session (credentials: "same-origin") and forward the selected key's id via x-omniroute-playground-key-id instead of its secret. buildCurl now keeps the <your-api-key> placeholder instead of the masked value. Adds tests/unit/bug-9935-masked-bearer.test.ts as the permanent regression guard (asserts none of the 9 cards embed apiKey as a raw Bearer token). Refs #9935 Co-authored-by: adevwithpurpose <adevwithpurpose@users.noreply.github.com>
37 lines
1.2 KiB
TypeScript
37 lines
1.2 KiB
TypeScript
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { readFileSync } from "node:fs";
|
|
import { resolve } from "node:path";
|
|
import { maskStoredApiKey } from "../../src/lib/apiKeyExposure";
|
|
|
|
const COMPONENT_DIR = resolve("src/app/(dashboard)/dashboard/media-providers/components");
|
|
const EXAMPLE_CARDS = [
|
|
"WebSearchExampleCard.tsx",
|
|
"WebFetchExampleCard.tsx",
|
|
"ImageExampleCard.tsx",
|
|
"TtsExampleCard.tsx",
|
|
"SttExampleCard.tsx",
|
|
"OcrExampleCard.tsx",
|
|
"MusicExampleCard.tsx",
|
|
"EmbeddingExampleCard.tsx",
|
|
"VideoExampleCard.tsx",
|
|
];
|
|
const FIXED_REFERENCE = "LlmChatCard.tsx";
|
|
const MASKED_BEARER = /\bBearer\s*\$?\{?\s*apiKey/;
|
|
|
|
test("every media ExampleCard avoids sending a masked apiKey as Bearer (#9935)", () => {
|
|
for (const file of [...EXAMPLE_CARDS, FIXED_REFERENCE]) {
|
|
const src = readFileSync(resolve(COMPONENT_DIR, file), "utf8");
|
|
assert.ok(
|
|
!MASKED_BEARER.test(src),
|
|
`${file} still sends the (masked) apiKey as an Authorization: Bearer token — will 401 under REQUIRE_API_KEY`
|
|
);
|
|
}
|
|
});
|
|
|
|
test("masked value is never a real API key (repro of the 401 trigger)", () => {
|
|
const real = "sk-abcdef0123456789wxyz";
|
|
const masked = maskStoredApiKey(real);
|
|
assert.notEqual(masked, real);
|
|
});
|