mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-26 17:12:27 +03:00
b4776a2d84
* test(quality): fail loudly when a source-scanning guard is negative-only A negative guard — assert.doesNotMatch(src, /x/) or src.includes(x) === false — passes against an empty string. Once the code it guards is extracted into another file the parent no longer contains the string, so the assertion keeps passing while protecting nothing. The regression coverage is deleted with no test turning red, which is exactly the failure mode the god-file decomposition campaign (#8617) is about to trigger 90-odd times. Adds tests/unit/source-scanner-guards.test.ts: a hard gate (no baseline, no allowlist) requiring every test variable bound to project source to carry at least one positive anchor. Classification runs on logical statements with strings, regexes and comments blanked out, so a guard wrapped across lines cannot slip past — that folding is what exposed 3 of the 7 violations. Fixes all 7 violations across 6 files with one stable top-level export anchor each. Two were security scope guards held only by multi-line negative assertions: the SSRF guards on /api/sync/initialize (#323) and the proxy-bypass guards on chatHelpers.ts and chatCore.ts (#3226) — the latter anchored on handleChatCore precisely because that file is a decomposition target. Adds tests/_helpers/readSrc.ts, a repo-root-relative reader that throws on a missing or empty file instead of returning "". Refs #8617 * docs(changelog): number the fragment for #8619 * chore(skills): sync cli-backup-sync SKILL.md with catalog Same tip fix as #8657 so Merge integrity is green without waiting for that PR to land. Regenerated via generate-agent-skills --apply.
59 lines
2.9 KiB
TypeScript
59 lines
2.9 KiB
TypeScript
/**
|
||
* Scope guard for the deliberate NVIDIA validation proxy bypass (#3226).
|
||
*
|
||
* Context: NVIDIA's API-key validation endpoint stalls when routed through the
|
||
* global proxy/TLS-patched fetch (undici dispatcher → 504). As a documented
|
||
* exception, `directHttpsRequest()` in `src/lib/providers/validation.ts` calls
|
||
* `safeOutboundFetch({ bypassProxyPatch: true })`, which resolves the native
|
||
* fetch reference via `getOriginalFetch()` and bypasses the patch for that one
|
||
* validation call only.
|
||
*
|
||
* This test asserts that the bypass is CONFINED to the validation path and has
|
||
* NOT silently spread to the chat hot path (chatHelpers / chatCore).
|
||
*
|
||
* See also: tests/unit/nvidia-validation-bypass-proxy-3226.test.ts (mechanism seam tests).
|
||
*/
|
||
import test from "node:test";
|
||
import assert from "node:assert/strict";
|
||
import { readFileSync } from "node:fs";
|
||
|
||
test("bypassProxyPatch is present in the NVIDIA validation path (#3226 documented exception)", () => {
|
||
// After the validation.ts godfile split (#4921–#4930), bypassProxyPatch moved to the
|
||
// extracted validation/headers.ts. Assert the bypass lives in the validation LAYER
|
||
// (validation.ts + its extracted modules), not that it stayed in one file.
|
||
const validationLayer =
|
||
readFileSync("src/lib/providers/validation.ts", "utf8") +
|
||
readFileSync("src/lib/providers/validation/headers.ts", "utf8");
|
||
assert.ok(
|
||
validationLayer.includes("bypassProxyPatch"),
|
||
"expected bypassProxyPatch in the validation layer (validation/headers.ts) — the documented NVIDIA exception"
|
||
);
|
||
assert.ok(
|
||
validationLayer.includes("directHttpsRequest"),
|
||
"expected directHttpsRequest helper in the validation layer"
|
||
);
|
||
});
|
||
|
||
test("bypassProxyPatch is absent from the chat hot path (scope guard — #3226)", () => {
|
||
// The chat hot path must never bypass the proxy patch.
|
||
// If either of these assertions starts failing, a code change has silently
|
||
// extended the NVIDIA-only exception to the chat/usage egress path.
|
||
const chatHelpers = readFileSync("src/sse/handlers/chatHelpers.ts", "utf8");
|
||
// Anchor: without it, extracting the egress code into another module would make the
|
||
// negative guard below pass against a file that no longer contains the hot path.
|
||
assert.match(chatHelpers, /export async function executeChatWithBreaker\(/);
|
||
assert.ok(
|
||
!chatHelpers.includes("bypassProxyPatch"),
|
||
"chatHelpers.ts must not bypass the proxy patch — only NVIDIA validation may do this (#3226)"
|
||
);
|
||
|
||
const chatCore = readFileSync("open-sse/handlers/chatCore.ts", "utf8");
|
||
// Anchor: chatCore.ts is actively being split, so pin the entry point the route
|
||
// imports — the negative guard is worthless if this read silently misses the file.
|
||
assert.match(chatCore, /export async function handleChatCore\(/);
|
||
assert.ok(
|
||
!chatCore.includes("bypassProxyPatch"),
|
||
"chatCore.ts must not bypass the proxy patch — only NVIDIA validation may do this (#3226)"
|
||
);
|
||
});
|