Allow public HTTPS model provider origins

frontend/tests/model-configuration-security.test.ts

@@ -53,24 +53,50 @@ async function migrateModelConfigurationFixture(connectionString: string) {
   }
 }
 
-test("model provider URLs require a server-owned public allowlist", async () => {
-  await assertAllowedModelProviderUrl(
-    "https://models.example.com/v1",
-    { MODEL_PROVIDER_BASE_URL_ALLOWLIST: "https://models.example.com" },
-    publicLookup,
-  );
-  await assert.rejects(
-    assertAllowedModelProviderUrl("https://attacker.example/v1", {}, publicLookup),
-    /允许列表/,
+test("model provider URLs allow arbitrary public HTTPS origins but retain SSRF boundaries", async () => {
+  let lookupOptions: unknown;
+  const resolved = await assertAllowedModelProviderUrl(
+    "https://attacker.example/v1",
+    {},
+    async (_hostname, options) => {
+      lookupOptions = options;
+      return publicLookup();
+    },
   );
+  assert.equal(resolved.url.origin, "https://attacker.example");
+  assert.deepEqual(lookupOptions, { all: true, verbatim: true });
+
+  for (const value of [
+    "http://attacker.example/v1",
+    "https://user:password@attacker.example/v1",
+    "https://localhost/v1",
+    "https://service.internal/v1",
+    "https://10.0.0.1/v1",
+    "https://192.168.1.1/v1",
+    "https://169.254.169.254/v1",
+    "https://192.0.2.1/v1",
+    "https://[2001:db8::1]/v1",
+  ]) {
+    await assert.rejects(
+      assertAllowedModelProviderUrl(value, {}, publicLookup),
+      /HTTPS|本机|内网|内部域名|保留地址/,
+      value,
+    );
+  }
+
   await assert.rejects(
     assertAllowedModelProviderUrl(
-      "https://models.example.com/v1",
-      { MODEL_PROVIDER_BASE_URL_ALLOWLIST: "https://models.example.com" },
+      "https://public.example/v1",
+      {},
       async () => [{ address: "169.254.169.254", family: 4 }],
     ),
     /内网|保留地址/,
   );
+
+  const gatewayPolicy = readFileSync(new URL("../src/lib/epay/gateway-policy.ts", import.meta.url), "utf8");
+  assert.match(gatewayPolicy, /lookup: \(_hostname, _options, callback\) => callback\(null, pinned\.address, pinned\.family\)/);
+  assert.match(gatewayPolicy, /status >= 300 && status < 400/);
+  assert.match(gatewayPolicy, /不允许重定向/);
 });
 
 test("admin and runtime source expose only secretConfigured and contain no secretRef contract", () => {