mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 20:32:20 +03:00
* chore(release): continue v3.8.25 development cycle after main code-sync (r5) main fast-forwarded to release/v3.8.25 (#3863): unblocked Build+Docker via #3864, plus #3837 (mimocode proxy) and #3862 (trivy bump). This marker re-opens the umbrella PR for further v3.8.25 work. No version bump. * fix(db): persist the Keep-latest-backups retention setting (#3834) (#3867) * fix(oauth): clear GitLab Duo setup message instead of 500 (#3861) (#3868) * test(oauth): prove refresh_token preserved on real gemini-cli/antigravity dispatch (#3850) (#3869) * feat(compression-ui): unified compression config UI — per-engine pages + combos editor + menu + WS default-on (#3860) Integrated into release/v3.8.25 — feat(compression-ui): unified compression configuration UI (Compression Hub + per-engine Lite/Aggressive/Ultra pages + combos editor + sidebar entry + live-WS default-on). File-size re-baselined for sidebarVisibility.ts/chatCore.ts growth; orphan ws test relocated to a collected path. * docs(changelog): complete the v3.8.25 release notes + credit all contributors Audited every commit since v3.8.24 and filled the gaps the [3.8.25] section was missing: a New Features section (compression engines + Compression Studios #3848, compression UI #3860, injection-guard #3857, kiro discovery #3836, Veo #3839, mimocode proxy #3837, Arena ELO flag #3821), 9 more Fixed entries (#3811/#3807/#3759/#3849/#3838/#3835/#3814/#3820/#3819), a Security section (CCR IDOR #3859, supply-chain #3824), and an Internal/Quality section. Every contributor and issue reporter is now credited. * docs(changelog): restore + complete the v3.8.25 release notes Re-adds CHANGELOG.md (a prior server-side commit accidentally dropped it) with the complete, audited [3.8.25] section: New Features, the full Fixed list, Security & Hardening, and Internal/Quality — every contributor and issue reporter credited. * chore(release): finalize v3.8.25 — reconcile CHANGELOG + i18n mirrors, document OMNIROUTE_MAX_PENDING_MIGRATIONS, green the unit suite Release-gate reconciliation for v3.8.25: - CHANGELOG: dated 2026-06-14, linked #3826, rolled up file-size re-baselines (#3823/#3833), recorded the test-greening; re-synced all 41 i18n CHANGELOG mirrors. - Documented OMNIROUTE_MAX_PENDING_MIGRATIONS (#3416) in .env.example + ENVIRONMENT.md. - Greened the unit suite (was merged red on 4 CI shards): aligned 10 stale tests to this cycle's intended behavior (#3838/#3822/#3501/SOCKS5/Vertex-Express/Antigravity) and the same-provider 503 fall-through test; de-flaked the compression benchmark reproducibility and ServiceSupervisor crash tests. No production code changed. * ci(security): clear OpenSSF Scorecard code-scanning noise + harden workflow token permissions The Security tab held 155 open alerts, ALL from the advisory OpenSSF Scorecard tool (#3824) — supply-chain/posture scores, not code vulnerabilities — which drowned out real CodeQL findings. - scorecard.yml: stop uploading SARIF to the code-scanning tab (drop the upload-sarif step + the now-unused security-events: write). The run still produces the OpenSSF badge (publish_results) and a downloadable SARIF artifact. - TokenPermissions hardening (the high-severity, genuinely-valuable subset): set each workflow's top-level token to read-only and grant the exact writes at the job level that needs them — npm-publish (id-token/packages on publish jobs), docker-publish (packages on build), electron-release (contents on build/release, id-token/packages on publish-npm), build-fork (packages on build), claude (empty top-level; job grants its own). The 155 existing alerts were dismissed. Not adopting repo-wide SHA-pinning (143 PinnedDependencies advisories) — declined. * test(integration): align stale wiring/socks5 integration tests to this cycle's behavior These were red on the CI Integration job (pre-existing). No production code changed: - integration-wiring: the combos page no longer renders a per-page EmailPrivacyToggle (#3822 consolidated it into Settings → Appearance); the provider-detail test-result masking and upstream-proxy copy moved to decomposed components (#3501 BatchTestResultsModal / UpstreamProxyCard) — assertions now read the owning files. - api-routes-critical: SOCKS5 is now enabled by default (opt-out), so the disabled- rejection test must set ENABLE_SOCKS5_PROXY=false explicitly (an unset env now means enabled). (The ~32 live-Gemini integration tests are gated on OMNIROUTE_API_KEY and skip in CI; they only 'fail' locally when that key is present without a running server.)
169 lines
6.5 KiB
TypeScript
169 lines
6.5 KiB
TypeScript
/**
|
|
* TDD: per-engine compression preview via engineId param.
|
|
*
|
|
* Auth pattern mirrors tests/unit/compression/compression-preview-auth.test.ts:
|
|
* - Use makeManagementSessionRequest to create a JWT-auth'd Request.
|
|
* - Set DATA_DIR to a temp dir and run the DB setup before importing the route.
|
|
*/
|
|
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
|
|
import { makeManagementSessionRequest } from "../../helpers/managementSession.ts";
|
|
|
|
// ─── temp DB isolation ────────────────────────────────────────────────────────
|
|
|
|
const TEST_DATA_DIR = fs.mkdtempSync(
|
|
path.join(os.tmpdir(), "omniroute-compression-preview-engine-")
|
|
);
|
|
const originalDataDir = process.env.DATA_DIR;
|
|
const originalJwtSecret = process.env.JWT_SECRET;
|
|
|
|
process.env.DATA_DIR = TEST_DATA_DIR;
|
|
|
|
const core = await import("../../../src/lib/db/core.ts");
|
|
const settingsDb = await import("../../../src/lib/db/settings.ts");
|
|
const previewRoute = await import("../../../src/app/api/compression/preview/route.ts");
|
|
|
|
// ─── helpers ──────────────────────────────────────────────────────────────────
|
|
|
|
async function setupAuth(): Promise<void> {
|
|
core.resetDbInstance();
|
|
fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
|
|
fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
|
|
await settingsDb.updateSettings({
|
|
requireLogin: true,
|
|
setupComplete: true,
|
|
password: "test-password-hash",
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Build a message array whose content is a pretty-printed JSON string of a homogeneous
|
|
* array of ≥8 rows. headroom's crushText() tries the whole string as a JSON array when
|
|
* it starts with "[", so passing JSON.stringify(rows, null, 2) as content triggers
|
|
* compaction. Pretty-printed JSON has whitespace so countTokens() also gives a
|
|
* meaningful baseline to compare against the compact tabular output.
|
|
*/
|
|
function buildHeadroomMessages(): Array<{ role: string; content: string }> {
|
|
const rows = Array.from({ length: 10 }, (_, i) => ({
|
|
id: i + 1,
|
|
name: `item-${i + 1}`,
|
|
value: (i + 1) * 100,
|
|
active: true,
|
|
}));
|
|
// Pretty-print so word-split countTokens() produces a non-trivial baseline count
|
|
return [{ role: "user", content: JSON.stringify(rows, null, 2) }];
|
|
}
|
|
|
|
// ─── lifecycle ────────────────────────────────────────────────────────────────
|
|
|
|
test.beforeEach(async () => {
|
|
process.env.DATA_DIR = TEST_DATA_DIR;
|
|
await setupAuth();
|
|
});
|
|
|
|
test.after(() => {
|
|
if (originalDataDir === undefined) delete process.env.DATA_DIR;
|
|
else process.env.DATA_DIR = originalDataDir;
|
|
if (originalJwtSecret === undefined) delete process.env.JWT_SECRET;
|
|
else process.env.JWT_SECRET = originalJwtSecret;
|
|
core.resetDbInstance();
|
|
fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
|
|
});
|
|
|
|
// ─── tests ────────────────────────────────────────────────────────────────────
|
|
|
|
test("POST /api/compression/preview with engineId=headroom returns 200 with token savings", async () => {
|
|
const messages = buildHeadroomMessages();
|
|
|
|
const request = await makeManagementSessionRequest("http://localhost/api/compression/preview", {
|
|
method: "POST",
|
|
body: {
|
|
engineId: "headroom",
|
|
messages,
|
|
mode: "stacked",
|
|
},
|
|
});
|
|
|
|
const response = await previewRoute.POST(request);
|
|
assert.equal(response.status, 200, `Expected 200, got ${response.status}`);
|
|
|
|
const body = (await response.json()) as {
|
|
originalTokens: number;
|
|
compressedTokens: number;
|
|
tokensSaved: number;
|
|
savingsPct: number;
|
|
techniquesUsed: string[];
|
|
original: string;
|
|
compressed: string;
|
|
mode: string;
|
|
};
|
|
|
|
assert.ok(
|
|
typeof body.originalTokens === "number" && body.originalTokens > 0,
|
|
`originalTokens should be > 0, got: ${body.originalTokens}`
|
|
);
|
|
assert.ok(
|
|
typeof body.compressedTokens === "number",
|
|
`compressedTokens should be a number, got: ${body.compressedTokens}`
|
|
);
|
|
assert.ok(
|
|
body.compressedTokens < body.originalTokens,
|
|
`compressedTokens (${body.compressedTokens}) should be < originalTokens (${body.originalTokens}) — headroom should compact a 10-row homogeneous JSON array`
|
|
);
|
|
assert.ok(body.tokensSaved > 0, `tokensSaved should be > 0, got: ${body.tokensSaved}`);
|
|
assert.ok(body.savingsPct > 0, `savingsPct should be > 0, got: ${body.savingsPct}`);
|
|
|
|
// Response shape completeness checks
|
|
assert.ok(typeof body.original === "string", "should have original field");
|
|
assert.ok(typeof body.compressed === "string", "should have compressed field");
|
|
assert.ok(Array.isArray(body.techniquesUsed), "techniquesUsed should be an array");
|
|
});
|
|
|
|
test("POST /api/compression/preview with engineId but no mode still works (mode defaults to stacked)", async () => {
|
|
const messages = buildHeadroomMessages();
|
|
|
|
const request = await makeManagementSessionRequest("http://localhost/api/compression/preview", {
|
|
method: "POST",
|
|
body: {
|
|
engineId: "headroom",
|
|
messages,
|
|
// mode intentionally omitted — should default to "stacked" when engineId present
|
|
},
|
|
});
|
|
|
|
const response = await previewRoute.POST(request);
|
|
assert.equal(
|
|
response.status,
|
|
200,
|
|
`Expected 200 when mode omitted with engineId, got ${response.status}`
|
|
);
|
|
|
|
const body = (await response.json()) as { tokensSaved: number };
|
|
assert.ok(body.tokensSaved > 0, `tokensSaved should be > 0 even without explicit mode`);
|
|
});
|
|
|
|
test("POST /api/compression/preview without engineId still works (existing path untouched)", async () => {
|
|
const request = await makeManagementSessionRequest("http://localhost/api/compression/preview", {
|
|
method: "POST",
|
|
body: {
|
|
messages: [{ role: "user", content: "Hello world" }],
|
|
mode: "standard",
|
|
},
|
|
});
|
|
|
|
const response = await previewRoute.POST(request);
|
|
assert.equal(
|
|
response.status,
|
|
200,
|
|
`Existing path should still return 200, got ${response.status}`
|
|
);
|
|
|
|
const body = (await response.json()) as { original: string; mode: string };
|
|
assert.ok(typeof body.original === "string", "should have original field");
|
|
assert.equal(body.mode, "standard", "mode field should reflect the requested mode");
|
|
});
|