38 lines
2.0 KiB
JavaScript
38 lines
2.0 KiB
JavaScript
// P3: catches the named OAuth-leak mutant and reuse of another session's key.
|
|
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { ENV_ALLOW, sessionEnv } from '../src/session.mjs';
|
|
|
|
const instance = {
|
|
HOME: '/fixture-home', USER: 'fixture', PATH: '/usr/bin', LANG: 'C',
|
|
CLAUDE_CODE_OAUTH_TOKEN: 'fx332-oauth', ANTHROPIC_API_KEY: 'fx332-anthropic',
|
|
ANTHROPIC_AUTH_TOKEN: 'fx332-auth', ANTHROPIC_BASE_URL: 'http://upstream.invalid',
|
|
OPENAI_API_KEY: 'fx332-openai', OPENROUTER_API_KEY: 'fx332-router', ZAI_API_KEY: 'fx332-zai',
|
|
MOSAIC_CLAUDE_BIN: '/fixture/claude', GITEA_TOKEN: 'fx332-gitea',
|
|
};
|
|
const forbidden = ['CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN',
|
|
'ANTHROPIC_BASE_URL', 'OPENAI_API_KEY', 'OPENROUTER_API_KEY', 'ZAI_API_KEY'];
|
|
|
|
test('P3 proxy sessionEnv removes every instance provider credential without widening ENV_ALLOW', () => {
|
|
const original = [...ENV_ALLOW];
|
|
const env = sessionEnv(instance, 'r332a', { baseUrl: 'http://127.0.0.1:12345', key: 'fx332-agent-a' });
|
|
for (const name of forbidden) assert.equal(Object.hasOwn(env, name), false, name);
|
|
assert.equal(env.USER, 'fixture');
|
|
assert.equal(env.MOSAIC_CLAUDE_BIN, '/fixture/claude');
|
|
assert.equal(Object.hasOwn(env, 'GITEA_TOKEN'), false);
|
|
assert.equal(env.MOSAIC_RUN_ID, 'r332a');
|
|
assert.deepEqual([...ENV_ALLOW], original);
|
|
});
|
|
|
|
test('P3 no proxy retains the full existing allowlist and run environment', () => {
|
|
const env = sessionEnv(instance, 'r332b');
|
|
assert.deepEqual(env, {
|
|
HOME: '/fixture-home', USER: 'fixture', LANG: 'C',
|
|
CLAUDE_CODE_OAUTH_TOKEN: 'fx332-oauth', ANTHROPIC_API_KEY: 'fx332-anthropic',
|
|
ANTHROPIC_AUTH_TOKEN: 'fx332-auth', ANTHROPIC_BASE_URL: 'http://upstream.invalid',
|
|
OPENAI_API_KEY: 'fx332-openai', OPENROUTER_API_KEY: 'fx332-router', ZAI_API_KEY: 'fx332-zai',
|
|
MOSAIC_CLAUDE_BIN: '/fixture/claude', PATH: env.PATH, MOSAIC_RUN_ID: 'r332b',
|
|
});
|
|
assert.ok(env.PATH.endsWith('node_modules/.bin:/usr/bin'));
|
|
});
|