mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 04:12:10 +03:00
adbcd2c8bc
* fix(auth): gate invalid-key check on isRequireApiKeyEnabled for embeddings and web-fetch (#7785) When REQUIRE_API_KEY=false, /v1/embeddings and /v1/web/fetch still returned 401 for invalid presented keys while all other client APIs allowed anonymous access. The route-local invalid-key check was not gated on isRequireApiKeyEnabled(), unlike the /v1/combos pattern. Gate the invalid-key check on isRequireApiKeyEnabled() in both route files so anonymous access works consistently across all client APIs. Refs: https://github.com/diegosouzapw/OmniRoute/issues/7785 * fix(tests): set REQUIRE_API_KEY=true in embeddings-auth invalid-key subtest The "should return 401 when an invalid API key is provided" test now correctly sets REQUIRE_API_KEY="true" so the route-level gated check is exercised. Before, the test asserted 401 when REQUIRE_API_KEY was not set, which after #7785 fix now returns 400 (model validation fails) instead of 401. * test(auth): assert anonymous-passthrough in embeddings-auth legacy suite (#7785) Per #7785's acceptance criteria, the pre-existing embeddings regression test must assert BOTH enforcement states, not just the enforced-401 case. Add the missing REQUIRE_API_KEY=false + invalid-key subtest alongside the already-fixed REQUIRE_API_KEY=true + invalid-key subtest, matching the coverage already present in the dedicated auth-policy-embeddings-webfetch-7785.test.ts suite. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>