Files
OmniRoute/tests/unit/auto-disable-banned.test.ts
Ravi Tharuma 5a44c46b1d feat(resilience): scope auto-disable banned accounts to subscriptions (#10617)
* feat(resilience): scope auto-disable banned accounts to subscriptions

Prepaid API keys should stay in the routing pool after a permanent-ban
signal; subscription/OAuth accounts can still be deactivated. Default
scope remains all so existing installs do not change.

* docs(security): document auto-disable scope and log skipped prepaid keys

Keep the operator ban-detection page aligned with the new setting and
reuse the shared scope enum in the settings schema and dashboard radios.

* chore(changelog): name the auto-disable scope fragment for #10617

* docs(settings): treat free login seats as auto-disable targets

The first-cut scope is still all vs login-style auth. Copy now states
that paid subscriptions and free accounts both disable, while prepaid
API keys stay in the pool until per-account overrides exist.

* i18n: backfill autoDisableBannedScope keys across all locales

npm run i18n:sync-ui — the 6 new autoDisableBannedScope* keys landed
in en.json and vi.json but not the other 40 locales (including
pt-BR), tripping the pt-BR no-drift regression test (#6695).

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

---------

Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
2026-08-18 10:53:24 -03:00

165 lines
3.7 KiB
TypeScript

import assert from "node:assert/strict";
import test from "node:test";
import { updateAutoDisableAccountsSchema } from "../../src/shared/validation/schemas/settings.ts";
import {
isSubscriptionStyleConnection,
normalizeAutoDisableBannedScope,
shouldAutoDisableBannedConnection,
} from "../../src/shared/utils/autoDisableBanned.ts";
test("normalizeAutoDisableBannedScope defaults unknown values to all", () => {
assert.equal(normalizeAutoDisableBannedScope(undefined), "all");
assert.equal(normalizeAutoDisableBannedScope("all"), "all");
assert.equal(normalizeAutoDisableBannedScope("subscription"), "subscription");
assert.equal(normalizeAutoDisableBannedScope("nope"), "all");
});
test("shouldAutoDisableBannedConnection is off when the feature is disabled", () => {
assert.equal(
shouldAutoDisableBannedConnection({
enabled: false,
scope: "all",
authType: "oauth",
}),
false
);
});
test("scope=all deactivates API keys and OAuth connections", () => {
assert.equal(
shouldAutoDisableBannedConnection({
enabled: true,
scope: "all",
authType: "apikey",
}),
true
);
assert.equal(
shouldAutoDisableBannedConnection({
enabled: true,
authType: "oauth",
}),
true
);
});
test("scope=subscription skips prepaid API keys", () => {
assert.equal(
shouldAutoDisableBannedConnection({
enabled: true,
scope: "subscription",
authType: "apikey",
providerId: "jina-ai",
}),
false
);
assert.equal(
shouldAutoDisableBannedConnection({
enabled: true,
scope: "subscription",
authType: "api_key",
}),
false
);
});
test("scope=subscription still deactivates OAuth and cookie accounts", () => {
assert.equal(
shouldAutoDisableBannedConnection({
enabled: true,
scope: "subscription",
authType: "oauth",
}),
true
);
assert.equal(
shouldAutoDisableBannedConnection({
enabled: true,
scope: "subscription",
authType: "cookie",
}),
true
);
assert.equal(
shouldAutoDisableBannedConnection({
enabled: true,
scope: "subscription",
authType: "access_token",
}),
true
);
assert.equal(
shouldAutoDisableBannedConnection({
enabled: true,
scope: "subscription",
authType: "session",
}),
true
);
assert.equal(
shouldAutoDisableBannedConnection({
enabled: true,
scope: "subscription",
authType: "web",
}),
true
);
});
test("scope=subscription treats web-cookie providers as subscriptions even when authType is apikey", () => {
assert.equal(
isSubscriptionStyleConnection({
authType: "apikey",
providerId: "grok-web",
webCookieProviderIds: { "grok-web": {} },
}),
true
);
assert.equal(
shouldAutoDisableBannedConnection({
enabled: true,
scope: "subscription",
authType: "apikey",
providerId: "grok-web",
webCookieProviderIds: { "grok-web": {} },
}),
true
);
});
test("auto-disable settings schema accepts scope and rejects unknown values", () => {
assert.equal(
updateAutoDisableAccountsSchema.safeParse({
enabled: true,
threshold: 2,
scope: "subscription",
}).success,
true
);
assert.equal(
updateAutoDisableAccountsSchema.safeParse({
enabled: true,
scope: "all",
}).success,
true
);
assert.equal(
updateAutoDisableAccountsSchema.safeParse({
enabled: true,
scope: "provider",
}).success,
false
);
});
test("unknown auth types stay conservative and still auto-disable", () => {
assert.equal(
shouldAutoDisableBannedConnection({
enabled: true,
scope: "subscription",
authType: "mystery",
}),
true
);
});