mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-18 21:22:28 +03:00
* feat(resilience): scope auto-disable banned accounts to subscriptions Prepaid API keys should stay in the routing pool after a permanent-ban signal; subscription/OAuth accounts can still be deactivated. Default scope remains all so existing installs do not change. * docs(security): document auto-disable scope and log skipped prepaid keys Keep the operator ban-detection page aligned with the new setting and reuse the shared scope enum in the settings schema and dashboard radios. * chore(changelog): name the auto-disable scope fragment for #10617 * docs(settings): treat free login seats as auto-disable targets The first-cut scope is still all vs login-style auth. Copy now states that paid subscriptions and free accounts both disable, while prepaid API keys stay in the pool until per-account overrides exist. * i18n: backfill autoDisableBannedScope keys across all locales npm run i18n:sync-ui — the 6 new autoDisableBannedScope* keys landed in en.json and vi.json but not the other 40 locales (including pt-BR), tripping the pt-BR no-drift regression test (#6695). Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Ravi Tharuma <RaviTharuma@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
165 lines
3.7 KiB
TypeScript
165 lines
3.7 KiB
TypeScript
import assert from "node:assert/strict";
|
|
import test from "node:test";
|
|
import { updateAutoDisableAccountsSchema } from "../../src/shared/validation/schemas/settings.ts";
|
|
import {
|
|
isSubscriptionStyleConnection,
|
|
normalizeAutoDisableBannedScope,
|
|
shouldAutoDisableBannedConnection,
|
|
} from "../../src/shared/utils/autoDisableBanned.ts";
|
|
|
|
test("normalizeAutoDisableBannedScope defaults unknown values to all", () => {
|
|
assert.equal(normalizeAutoDisableBannedScope(undefined), "all");
|
|
assert.equal(normalizeAutoDisableBannedScope("all"), "all");
|
|
assert.equal(normalizeAutoDisableBannedScope("subscription"), "subscription");
|
|
assert.equal(normalizeAutoDisableBannedScope("nope"), "all");
|
|
});
|
|
|
|
test("shouldAutoDisableBannedConnection is off when the feature is disabled", () => {
|
|
assert.equal(
|
|
shouldAutoDisableBannedConnection({
|
|
enabled: false,
|
|
scope: "all",
|
|
authType: "oauth",
|
|
}),
|
|
false
|
|
);
|
|
});
|
|
|
|
test("scope=all deactivates API keys and OAuth connections", () => {
|
|
assert.equal(
|
|
shouldAutoDisableBannedConnection({
|
|
enabled: true,
|
|
scope: "all",
|
|
authType: "apikey",
|
|
}),
|
|
true
|
|
);
|
|
assert.equal(
|
|
shouldAutoDisableBannedConnection({
|
|
enabled: true,
|
|
authType: "oauth",
|
|
}),
|
|
true
|
|
);
|
|
});
|
|
|
|
test("scope=subscription skips prepaid API keys", () => {
|
|
assert.equal(
|
|
shouldAutoDisableBannedConnection({
|
|
enabled: true,
|
|
scope: "subscription",
|
|
authType: "apikey",
|
|
providerId: "jina-ai",
|
|
}),
|
|
false
|
|
);
|
|
assert.equal(
|
|
shouldAutoDisableBannedConnection({
|
|
enabled: true,
|
|
scope: "subscription",
|
|
authType: "api_key",
|
|
}),
|
|
false
|
|
);
|
|
});
|
|
|
|
test("scope=subscription still deactivates OAuth and cookie accounts", () => {
|
|
assert.equal(
|
|
shouldAutoDisableBannedConnection({
|
|
enabled: true,
|
|
scope: "subscription",
|
|
authType: "oauth",
|
|
}),
|
|
true
|
|
);
|
|
assert.equal(
|
|
shouldAutoDisableBannedConnection({
|
|
enabled: true,
|
|
scope: "subscription",
|
|
authType: "cookie",
|
|
}),
|
|
true
|
|
);
|
|
assert.equal(
|
|
shouldAutoDisableBannedConnection({
|
|
enabled: true,
|
|
scope: "subscription",
|
|
authType: "access_token",
|
|
}),
|
|
true
|
|
);
|
|
assert.equal(
|
|
shouldAutoDisableBannedConnection({
|
|
enabled: true,
|
|
scope: "subscription",
|
|
authType: "session",
|
|
}),
|
|
true
|
|
);
|
|
assert.equal(
|
|
shouldAutoDisableBannedConnection({
|
|
enabled: true,
|
|
scope: "subscription",
|
|
authType: "web",
|
|
}),
|
|
true
|
|
);
|
|
});
|
|
|
|
test("scope=subscription treats web-cookie providers as subscriptions even when authType is apikey", () => {
|
|
assert.equal(
|
|
isSubscriptionStyleConnection({
|
|
authType: "apikey",
|
|
providerId: "grok-web",
|
|
webCookieProviderIds: { "grok-web": {} },
|
|
}),
|
|
true
|
|
);
|
|
assert.equal(
|
|
shouldAutoDisableBannedConnection({
|
|
enabled: true,
|
|
scope: "subscription",
|
|
authType: "apikey",
|
|
providerId: "grok-web",
|
|
webCookieProviderIds: { "grok-web": {} },
|
|
}),
|
|
true
|
|
);
|
|
});
|
|
|
|
test("auto-disable settings schema accepts scope and rejects unknown values", () => {
|
|
assert.equal(
|
|
updateAutoDisableAccountsSchema.safeParse({
|
|
enabled: true,
|
|
threshold: 2,
|
|
scope: "subscription",
|
|
}).success,
|
|
true
|
|
);
|
|
assert.equal(
|
|
updateAutoDisableAccountsSchema.safeParse({
|
|
enabled: true,
|
|
scope: "all",
|
|
}).success,
|
|
true
|
|
);
|
|
assert.equal(
|
|
updateAutoDisableAccountsSchema.safeParse({
|
|
enabled: true,
|
|
scope: "provider",
|
|
}).success,
|
|
false
|
|
);
|
|
});
|
|
|
|
test("unknown auth types stay conservative and still auto-disable", () => {
|
|
assert.equal(
|
|
shouldAutoDisableBannedConnection({
|
|
enabled: true,
|
|
scope: "subscription",
|
|
authType: "mystery",
|
|
}),
|
|
true
|
|
);
|
|
});
|