Jesse_Chen
11 lines
2.1 KiB
TypeScript
11 lines
2.1 KiB
TypeScript
import assert from "node:assert/strict";
|
|
import test from "node:test";
|
|
import { readFileSync } from "node:fs";
|
|
import { decryptModelProviderApiKey, encryptModelProviderApiKey, modelProviderModelsUrl, modelProviderRequestHeaders } from "../src/lib/model-provider-policy.ts";
|
|
|
|
const key=Buffer.alloc(32,7).toString("base64");
|
|
test("model provider credentials use the dedicated AES-GCM master key",()=>{const encrypted=encryptModelProviderApiKey("provider-secret",{MODEL_PROVIDER_CONFIG_ENCRYPTION_KEY:key});assert.notEqual(encrypted,"provider-secret");assert.equal(decryptModelProviderApiKey({encryptedApiKey:encrypted},{MODEL_PROVIDER_CONFIG_ENCRYPTION_KEY:key}),"provider-secret");assert.throws(()=>decryptModelProviderApiKey({encryptedApiKey:encrypted},{MODEL_PROVIDER_CONFIG_ENCRYPTION_KEY:Buffer.alloc(32,8).toString("base64")}));});
|
|
test("Anthropic discovery uses its official endpoint and headers",()=>{assert.equal(modelProviderModelsUrl({providerType:"anthropic",baseUrl:null}),"https://api.anthropic.com/v1/models");assert.deepEqual(modelProviderRequestHeaders("anthropic","secret"),{"x-api-key":"secret","anthropic-version":"2023-06-01"});assert.deepEqual(modelProviderRequestHeaders("openai","secret"),{authorization:"Bearer secret"});});
|
|
test("runtime and admin APIs do not parse legacy provider credential env vars",()=>{for(const file of ["../src/lib/model-catalog.ts","../src/mastra/model.ts","../src/app/api/admin/models/route.ts"]){const source=readFileSync(new URL(file,import.meta.url),"utf8");assert.doesNotMatch(source,/OPENAI_API_KEY|DEEPSEEK_API_KEY|LLM_API_KEY|secret_ref/);}});
|
|
test("discovery stays on the DNS-pinned bounded HTTPS helper",()=>{const route=readFileSync(new URL("../src/app/api/admin/models/discover/route.ts",import.meta.url),"utf8");const gateway=readFileSync(new URL("../src/lib/epay/gateway-policy.ts",import.meta.url),"utf8");assert.match(route,/requestAllowedModelProvider/);assert.doesNotMatch(route,/\bfetch\s*\(/);assert.match(gateway,/lookup: \(_hostname, _options, callback\)/);assert.match(gateway,/不允许重定向/);assert.match(route,/maxResponseBytes:256\*1024/);});
|