mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 20:32:20 +03:00
* chore(release): continue v3.8.25 development cycle after main code-sync (r5) main fast-forwarded to release/v3.8.25 (#3863): unblocked Build+Docker via #3864, plus #3837 (mimocode proxy) and #3862 (trivy bump). This marker re-opens the umbrella PR for further v3.8.25 work. No version bump. * fix(db): persist the Keep-latest-backups retention setting (#3834) (#3867) * fix(oauth): clear GitLab Duo setup message instead of 500 (#3861) (#3868) * test(oauth): prove refresh_token preserved on real gemini-cli/antigravity dispatch (#3850) (#3869) * feat(compression-ui): unified compression config UI — per-engine pages + combos editor + menu + WS default-on (#3860) Integrated into release/v3.8.25 — feat(compression-ui): unified compression configuration UI (Compression Hub + per-engine Lite/Aggressive/Ultra pages + combos editor + sidebar entry + live-WS default-on). File-size re-baselined for sidebarVisibility.ts/chatCore.ts growth; orphan ws test relocated to a collected path. * docs(changelog): complete the v3.8.25 release notes + credit all contributors Audited every commit since v3.8.24 and filled the gaps the [3.8.25] section was missing: a New Features section (compression engines + Compression Studios #3848, compression UI #3860, injection-guard #3857, kiro discovery #3836, Veo #3839, mimocode proxy #3837, Arena ELO flag #3821), 9 more Fixed entries (#3811/#3807/#3759/#3849/#3838/#3835/#3814/#3820/#3819), a Security section (CCR IDOR #3859, supply-chain #3824), and an Internal/Quality section. Every contributor and issue reporter is now credited. * docs(changelog): restore + complete the v3.8.25 release notes Re-adds CHANGELOG.md (a prior server-side commit accidentally dropped it) with the complete, audited [3.8.25] section: New Features, the full Fixed list, Security & Hardening, and Internal/Quality — every contributor and issue reporter credited. * chore(release): finalize v3.8.25 — reconcile CHANGELOG + i18n mirrors, document OMNIROUTE_MAX_PENDING_MIGRATIONS, green the unit suite Release-gate reconciliation for v3.8.25: - CHANGELOG: dated 2026-06-14, linked #3826, rolled up file-size re-baselines (#3823/#3833), recorded the test-greening; re-synced all 41 i18n CHANGELOG mirrors. - Documented OMNIROUTE_MAX_PENDING_MIGRATIONS (#3416) in .env.example + ENVIRONMENT.md. - Greened the unit suite (was merged red on 4 CI shards): aligned 10 stale tests to this cycle's intended behavior (#3838/#3822/#3501/SOCKS5/Vertex-Express/Antigravity) and the same-provider 503 fall-through test; de-flaked the compression benchmark reproducibility and ServiceSupervisor crash tests. No production code changed. * ci(security): clear OpenSSF Scorecard code-scanning noise + harden workflow token permissions The Security tab held 155 open alerts, ALL from the advisory OpenSSF Scorecard tool (#3824) — supply-chain/posture scores, not code vulnerabilities — which drowned out real CodeQL findings. - scorecard.yml: stop uploading SARIF to the code-scanning tab (drop the upload-sarif step + the now-unused security-events: write). The run still produces the OpenSSF badge (publish_results) and a downloadable SARIF artifact. - TokenPermissions hardening (the high-severity, genuinely-valuable subset): set each workflow's top-level token to read-only and grant the exact writes at the job level that needs them — npm-publish (id-token/packages on publish jobs), docker-publish (packages on build), electron-release (contents on build/release, id-token/packages on publish-npm), build-fork (packages on build), claude (empty top-level; job grants its own). The 155 existing alerts were dismissed. Not adopting repo-wide SHA-pinning (143 PinnedDependencies advisories) — declined. * test(integration): align stale wiring/socks5 integration tests to this cycle's behavior These were red on the CI Integration job (pre-existing). No production code changed: - integration-wiring: the combos page no longer renders a per-page EmailPrivacyToggle (#3822 consolidated it into Settings → Appearance); the provider-detail test-result masking and upstream-proxy copy moved to decomposed components (#3501 BatchTestResultsModal / UpstreamProxyCard) — assertions now read the owning files. - api-routes-critical: SOCKS5 is now enabled by default (opt-out), so the disabled- rejection test must set ENABLE_SOCKS5_PROXY=false explicitly (an unset env now means enabled). (The ~32 live-Gemini integration tests are gated on OMNIROUTE_API_KEY and skip in CI; they only 'fail' locally when that key is present without a running server.)
204 lines
7.0 KiB
TypeScript
204 lines
7.0 KiB
TypeScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
|
|
const usage = await import("../../open-sse/services/usage.ts");
|
|
const { USAGE_SUPPORTED_PROVIDERS } = await import("../../src/shared/constants/providers.ts");
|
|
|
|
test("USAGE_SUPPORTED_PROVIDERS includes opencode-go", () => {
|
|
assert.ok(
|
|
(USAGE_SUPPORTED_PROVIDERS as string[]).includes("opencode-go"),
|
|
"opencode-go must be in the usage-supported providers allowlist"
|
|
);
|
|
});
|
|
|
|
test("getUsageForProvider returns helpful message when opencode-go has no apiKey", async () => {
|
|
let called = false;
|
|
const originalFetch = globalThis.fetch;
|
|
globalThis.fetch = async () => {
|
|
called = true;
|
|
return new Response("unexpected", { status: 500 });
|
|
};
|
|
|
|
try {
|
|
const result = (await usage.getUsageForProvider({
|
|
id: "opencode-go-no-key",
|
|
provider: "opencode-go",
|
|
apiKey: "",
|
|
})) as { message?: string };
|
|
|
|
assert.equal(called, false, "quota fetch must not run without an API key");
|
|
assert.match(result.message ?? "", /OpenCode Go/);
|
|
} finally {
|
|
globalThis.fetch = originalFetch;
|
|
}
|
|
});
|
|
|
|
test("getUsageForProvider exposes OpenCode Go 5h, weekly, and monthly quotas", async () => {
|
|
const originalFetch = globalThis.fetch;
|
|
const reset5h = Date.now() + 2 * 60 * 60 * 1000;
|
|
const resetWeekly = Date.now() + 4 * 24 * 60 * 60 * 1000;
|
|
const resetMonthly = Date.now() + 20 * 24 * 60 * 60 * 1000;
|
|
let requestUrl = "";
|
|
let requestHeaders: Headers | null = null;
|
|
|
|
globalThis.fetch = async (input, init) => {
|
|
requestUrl = String(input);
|
|
requestHeaders = new Headers(init?.headers as HeadersInit | undefined);
|
|
|
|
return new Response(
|
|
JSON.stringify({
|
|
code: 200,
|
|
success: true,
|
|
data: {
|
|
level: "pro",
|
|
limits: [
|
|
{
|
|
type: "TOKENS_LIMIT",
|
|
unit: 3,
|
|
number: 5,
|
|
percentage: 25,
|
|
nextResetTime: reset5h,
|
|
},
|
|
{
|
|
type: "TOKENS_LIMIT",
|
|
unit: 6,
|
|
number: 1,
|
|
percentage: 50,
|
|
nextResetTime: resetWeekly,
|
|
},
|
|
{
|
|
type: "TIME_LIMIT",
|
|
percentage: 10,
|
|
currentValue: 6,
|
|
usage: 60,
|
|
nextResetTime: resetMonthly,
|
|
usageDetails: [{ modelCode: "search-prime", usage: 3 }],
|
|
},
|
|
],
|
|
},
|
|
}),
|
|
{ status: 200, headers: { "content-type": "application/json" } }
|
|
);
|
|
};
|
|
|
|
try {
|
|
const result = (await usage.getUsageForProvider({
|
|
id: "opencode-go-usage",
|
|
provider: "opencode-go",
|
|
apiKey: "Bearer opencode-go-key",
|
|
})) as {
|
|
plan?: string | null;
|
|
quotas?: Record<
|
|
string,
|
|
{
|
|
used: number;
|
|
total: number;
|
|
remaining: number;
|
|
remainingPercentage: number;
|
|
resetAt: string | null;
|
|
displayName?: string;
|
|
currency?: string;
|
|
details?: Array<{ name: string; used: number }>;
|
|
}
|
|
>;
|
|
};
|
|
|
|
assert.equal(requestUrl, "https://api.z.ai/api/monitor/usage/quota/limit");
|
|
assert.equal(requestHeaders?.get("Authorization"), "opencode-go-key");
|
|
assert.equal(requestHeaders?.get("Content-Type"), "application/json");
|
|
assert.equal(result.plan, "OpenCode Go Pro");
|
|
assert.deepEqual(Object.keys(result.quotas ?? {}), ["session", "weekly", "mcp_monthly"]);
|
|
|
|
assert.equal(result.quotas!.session.displayName, "5-hour rolling");
|
|
assert.equal(result.quotas!.session.currency, "USD");
|
|
assert.equal(result.quotas!.session.used, 3);
|
|
assert.equal(result.quotas!.session.total, 12);
|
|
assert.equal(result.quotas!.session.remaining, 9);
|
|
assert.equal(result.quotas!.session.remainingPercentage, 75);
|
|
assert.equal(result.quotas!.session.resetAt, new Date(reset5h).toISOString());
|
|
|
|
assert.equal(result.quotas!.weekly.displayName, "Weekly");
|
|
assert.equal(result.quotas!.weekly.used, 15);
|
|
assert.equal(result.quotas!.weekly.total, 30);
|
|
assert.equal(result.quotas!.weekly.remaining, 15);
|
|
assert.equal(result.quotas!.weekly.remainingPercentage, 50);
|
|
assert.equal(result.quotas!.weekly.resetAt, new Date(resetWeekly).toISOString());
|
|
|
|
assert.equal(result.quotas!.mcp_monthly.displayName, "Monthly");
|
|
assert.equal(result.quotas!.mcp_monthly.used, 6);
|
|
assert.equal(result.quotas!.mcp_monthly.total, 60);
|
|
assert.equal(result.quotas!.mcp_monthly.remaining, 54);
|
|
assert.equal(result.quotas!.mcp_monthly.remainingPercentage, 90);
|
|
assert.equal(result.quotas!.mcp_monthly.resetAt, new Date(resetMonthly).toISOString());
|
|
assert.deepEqual(result.quotas!.mcp_monthly.details, [{ name: "search-prime", used: 3 }]);
|
|
} finally {
|
|
globalThis.fetch = originalFetch;
|
|
}
|
|
});
|
|
|
|
test("getUsageForProvider returns message for invalid OpenCode Go API keys", async () => {
|
|
const originalFetch = globalThis.fetch;
|
|
globalThis.fetch = async () => new Response("nope", { status: 401 });
|
|
|
|
try {
|
|
const result = (await usage.getUsageForProvider({
|
|
id: "opencode-go-401",
|
|
provider: "opencode-go",
|
|
apiKey: "bad-key",
|
|
})) as { message: string };
|
|
assert.equal(
|
|
result.message,
|
|
"OpenCode Go does not expose a public quota API. Chat requests still work. " +
|
|
"Set OMNIROUTE_OPENCODE_GO_QUOTA_URL to a working endpoint, or follow " +
|
|
"https://github.com/anomalyco/opencode/issues/16017 for upstream status."
|
|
);
|
|
} finally {
|
|
globalThis.fetch = originalFetch;
|
|
}
|
|
});
|
|
|
|
test("getUsageForProvider returns message when OpenCode Go quota API returns 200 with auth error in body", async () => {
|
|
const originalFetch = globalThis.fetch;
|
|
globalThis.fetch = async () =>
|
|
new Response(JSON.stringify({ code: 401, msg: "token expired or incorrect", success: false }), {
|
|
status: 200,
|
|
headers: { "content-type": "application/json" },
|
|
});
|
|
|
|
try {
|
|
const result = (await usage.getUsageForProvider({
|
|
id: "opencode-go-body-401",
|
|
provider: "opencode-go",
|
|
apiKey: "sk-test-key",
|
|
})) as { message: string };
|
|
assert.equal(
|
|
result.message,
|
|
"OpenCode Go does not expose a public quota API. Chat requests still work. " +
|
|
"Set OMNIROUTE_OPENCODE_GO_QUOTA_URL to a working endpoint, or follow " +
|
|
"https://github.com/anomalyco/opencode/issues/16017 for upstream status."
|
|
);
|
|
} finally {
|
|
globalThis.fetch = originalFetch;
|
|
}
|
|
});
|
|
|
|
test("getUsageForProvider returns message when OpenCode Go quota response is invalid JSON", async () => {
|
|
const originalFetch = globalThis.fetch;
|
|
globalThis.fetch = async () =>
|
|
new Response("<html>not json</html>", {
|
|
status: 200,
|
|
headers: { "content-type": "text/html" },
|
|
});
|
|
|
|
try {
|
|
const result = (await usage.getUsageForProvider({
|
|
id: "opencode-go-bad-json",
|
|
provider: "opencode-go",
|
|
apiKey: "sk-test-key",
|
|
})) as { message: string };
|
|
assert.equal(result.message, "OpenCode Go quota response parsing failed.");
|
|
} finally {
|
|
globalThis.fetch = originalFetch;
|
|
}
|
|
});
|