mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-26 17:12:27 +03:00
65e81158ab
Landed with the design call resolved per the owner's pick — **option 1**: the synced store is now endpoint-agnostic (persistDiscoveredModels and managedModelImport no longer drop non-chat models at write time), and chat selectability moved to read time (auto-pool expansion in autoStrategy applies filterChatSelectableModels; the models-route projection already had its chatOnly filter). Your discovery test now passes end-to-end (3/3): /api/show capabilities persist per connection and image/embedding requests route through the advertising host. Reconciliation notes: conflicted areas merged onto the current tip (adobe discovery import, requestedModel preflight signature, resolvedProvider fast-path coexists with the synced-route override — explicit resolution wins); carried base-red drains (#10055 memoization, #11071 test variants) dropped as already-landed; the managed-model-import exclusion test was propagated to the new contract (image/video models persist; the read filter still hides them from chat pickers — pinned by a new assertion). Full battery: 205/206 focused (the one red is a confirmed periodic-timer timing flake on the loaded devbox — 20/20 isolated), autoCombo vitest 30/30, combo suites 46/46, gates + typecheck clean. Thank you @yourspraveen — the capability probe + routing design was right; it just needed the store contract opened up. Fixes #11087.
68 lines
2.8 KiB
TypeScript
68 lines
2.8 KiB
TypeScript
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { createHmac } from "node:crypto";
|
|
|
|
import { extractChatMessage } from "../../src/lib/telegram/botApi";
|
|
import { verifyInitData } from "../../src/lib/telegram/initData";
|
|
|
|
const BOT_TOKEN = "1234567890:ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij";
|
|
|
|
function buildValidInitData(botToken: string, fields: Record<string, string>): string {
|
|
const pairs = Object.entries(fields).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
|
|
const dataCheckString = pairs.map(([k, v]) => `${k}=${v}`).join("\n");
|
|
const secretKey = createHmac("sha256", "WebAppData").update(botToken).digest();
|
|
const hash = createHmac("sha256", secretKey).update(dataCheckString).digest("hex");
|
|
const withHash = [...pairs, ["hash", hash]];
|
|
return withHash.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&");
|
|
}
|
|
|
|
test("extractChatMessage returns chatId/text/messageId for a text message", () => {
|
|
const chat = extractChatMessage({
|
|
update_id: 1,
|
|
message: {
|
|
message_id: 42,
|
|
chat: { id: 123456789, type: "private" },
|
|
text: "/start",
|
|
from: { id: 123456789, first_name: "Benson" },
|
|
},
|
|
});
|
|
assert.deepEqual(chat, { chatId: 123456789, text: "/start", messageId: 42 });
|
|
});
|
|
|
|
test("extractChatMessage returns null for non-message updates", () => {
|
|
const chat = extractChatMessage({ update_id: 2, callback_query: { id: "q", from: { id: 1 } } });
|
|
assert.equal(chat, null);
|
|
});
|
|
|
|
test("extractChatMessage returns null when text is missing", () => {
|
|
const chat = extractChatMessage({
|
|
update_id: 3,
|
|
message: { message_id: 1, chat: { id: 1, type: "private" } },
|
|
});
|
|
assert.equal(chat, null);
|
|
});
|
|
|
|
test("Mini App initData with real user payload verifies end-to-end", () => {
|
|
const initData = buildValidInitData(BOT_TOKEN, {
|
|
auth_date: String(Math.floor(Date.now() / 1000)),
|
|
query_id: "AAHdF6IQAAAAAN0XohDhrOrc",
|
|
user: '{"id":279058397,"first_name":"Benson","last_name":"KB","username":"benzntech"}',
|
|
});
|
|
assert.equal(verifyInitData(initData, BOT_TOKEN), true);
|
|
// The same initData must fail with a different token (route would 401).
|
|
assert.equal(verifyInitData(initData, "9876543210:ZYXWVUTSRQPONMLKJIHGFEDCBAzyxwvu"), false);
|
|
});
|
|
|
|
test("Mini App initData fails when user field is swapped after signing", () => {
|
|
const initData = buildValidInitData(BOT_TOKEN, {
|
|
auth_date: String(Math.floor(Date.now() / 1000)),
|
|
user: '{"id":279058397,"first_name":"Benson"}',
|
|
});
|
|
// Tamper with the user payload but keep the original hash.
|
|
const parts = initData.split("&").filter((p) => !p.startsWith("hash="));
|
|
const tampered = [...parts, "user=%7B%22id%22%3A1%2C%22first_name%22%3A%22Attacker%22%7D"].join(
|
|
"&"
|
|
);
|
|
assert.equal(verifyInitData(tampered, BOT_TOKEN), false);
|
|
});
|