51 lines
3.4 KiB
JavaScript
51 lines
3.4 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import http from 'node:http';
|
|
import { createHash } from 'node:crypto';
|
|
import { ManagementClient } from '../src/client.mjs';
|
|
const id = s => createHash('sha256').update(s).digest('hex').slice(0, 12);
|
|
const raw = { api_key: 'msk-made-up-client-canary', source: 'made-up-upstream-canary', failed: true,
|
|
fail: { status_code: 503, body: 'private-body' }, tokens: { input_tokens: 7, output_tokens: 2, cache_creation_tokens: 3, cache_read_tokens: 4 },
|
|
user_agent: 'private-agent', request_id: 'private-request' };
|
|
async function fixture(t, reply = () => [raw]) {
|
|
const calls = [], receipts = [];
|
|
const server = http.createServer((req, res) => {
|
|
calls.push([req.method, req.url, req.headers.authorization]);
|
|
const answer = reply(); res.writeHead(answer.status ?? 200, answer.headers ?? {});
|
|
res.end(JSON.stringify(answer.body ?? answer));
|
|
});
|
|
await new Promise(r => server.listen(0, '127.0.0.1', r));
|
|
t.after(() => new Promise(r => server.close(r)));
|
|
return { calls, receipts, client: new ManagementClient({ baseUrl: `http://127.0.0.1:${server.address().port}`, key: 'fake-management', receipt: e => receipts.push(e) }) };
|
|
}
|
|
test('P5 queue read uses actual bounded fixed management GET and immediately drops client and upstream values', async t => {
|
|
const f = await fixture(t);
|
|
const events = await f.client.readUsageQueue();
|
|
assert.deepEqual(events, [{ keyId: id(raw.api_key), accountId: id(raw.source), managed: true, failed: true, statusCode: 503,
|
|
input: 7, output: 2, cacheWrite: 3, cacheRead: 4 }]);
|
|
assert.deepEqual(f.calls, [['GET', '/v8/management/observability/usage/queue?count=100', 'Bearer fake-management']]);
|
|
assert.deepEqual(f.receipts, [{ call: 'GET /v8/management/observability/usage/queue', status: 200, keyIds: [] }]);
|
|
for (const secret of [raw.api_key, raw.source, 'private-body', 'private-agent', 'private-request', 'fake-management'])
|
|
assert.equal(JSON.stringify([events, f.receipts]).includes(secret), false);
|
|
});
|
|
for (const [name, reply, code] of [
|
|
['bad envelope', () => ({ events: [raw] }), 'proxy-client-response'],
|
|
['over count', () => Array(101).fill(raw), 'proxy-client-response'],
|
|
['missing key', () => [{ ...raw, api_key: null }], 'proxy-client-response'],
|
|
['bad counts', () => [{ ...raw, tokens: { input_tokens: -1 } }], 'proxy-client-response'],
|
|
['redirect', () => ({ status: 302, headers: { location: 'http://127.0.0.1:8317/' }, body: raw }), 'proxy-client-redirect'],
|
|
['refusal', () => ({ status: 401, body: raw }), 'proxy-client-refused'],
|
|
]) test(`P5 ${name} refuses safely with no retry`, async t => {
|
|
const f = await fixture(t, reply);
|
|
await assert.rejects(f.client.readUsageQueue(), e => e.code === code && !e.message.includes(raw.source));
|
|
assert.equal(f.calls.length, 1);
|
|
assert.equal(JSON.stringify(f.receipts).includes(raw.api_key), false);
|
|
assert.equal(JSON.stringify(f.receipts).includes(raw.source), false);
|
|
});
|
|
|
|
test('P5 malformed event after a valid event rejects the entire queue before any credential can escape',async t=>{
|
|
const f=await fixture(t,()=>[raw,{...raw,source:'another-upstream-canary',tokens:{input_tokens:'bad-count'}}]);
|
|
await assert.rejects(f.client.readUsageQueue(),{code:'proxy-client-response'});
|
|
for(const secret of [raw.api_key,raw.source,'another-upstream-canary'])assert.equal(JSON.stringify(f.receipts).includes(secret),false);
|
|
});
|