Files
stack/packages/cli/tests/model-proxy-guards.test.mjs
jason.woltje 362893d043 feat: integrate reviewed proxy page and managed model keys
Source-candidate: poe d9a564e6d20f5f0fd75ce45b12cbbf8bb4c9d568\nSource-candidate: magica38ba5762b06716db1dee00d0afec162656488f5c\nValidated321whole-file phase plus whole bus1349/model-proxy100/webui490; final gate tooling checks pending, not landed.
2026-10-26 12:04:21 -05:00

53 lines
2.9 KiB
JavaScript

// P2 RED tests: these catch fetch before eligibility and divergent key predicates.
import test from 'node:test';
import assert from 'node:assert/strict';
import { proxyCommand } from '../src/model-proxy.mjs';
import { io } from './helpers.mjs';
for (const env of [{ CODEX_THREAD_ID: 'fixture' }, { MOSAIC_AGENT_RUN: 'fixture' }]) {
test(`human-required: proxy fetch refuses ${Object.keys(env)[0]} before config or fetch`, async () => {
let touched = false;
const forbidden = () => { touched = true; throw new Error('eligibility must run first'); };
await assert.rejects(proxyCommand(['fetch'], io(env), { system: forbidden, fetch: forbidden }), e => e.code === 'human-required');
assert.equal(touched, false);
});
}
test('human-required: proxy fetch tester refuses before config or fetch', async () => {
let touched = false;
const forbidden = () => { touched = true; throw new Error('eligibility must run first'); };
await assert.rejects(proxyCommand(['fetch', '--tester'], io(), { system: forbidden, fetch: forbidden }), e => e.code === 'human-required');
assert.equal(touched, false);
});
for (const key of ['fx331-caf\u00e9', ' fx331-key', 'fx331-key ', 'fx331 key']) {
test(`proxy-key-invalid: CLI rejects non-management-key input (${JSON.stringify(key).length})`, async () => {
const x = io(); x.stdin.isTTY = true; x.stdout.isTTY = true;
let calls = 0;
await assert.rejects(proxyCommand(['init'], x, {
system: { dataRoot: '/unused-fixture' }, prompt: async () => key,
callFor: () => async () => { calls++; return { port: 18432, binary: '/fixture' }; },
}), e => e.code === 'proxy-key-invalid');
assert.equal(calls, 0);
assert.equal(x.out.text.includes(key), false);
assert.equal(x.err.text.includes(key), false);
});
}
for (const [flag, code, value] of [['--rotate-grace-minutes', 'proxy-rotate-grace-invalid', '1441'], ['--first-output-seconds', 'proxy-first-output-invalid', '3601']]) {
test(`${code}: init flag refuses before config or prompt`, async () => {
let touched = false;
const forbidden = () => { touched = true; throw new Error('must not run'); };
await assert.rejects(proxyCommand(['init', flag, value], io(), { system: forbidden, prompt: forbidden }), e => e.code === code);
assert.equal(touched, false);
});
}
test('human proxy init passes optional timing flags only through authenticated call', async () => {
const x = io(); x.stdin.isTTY = true; x.stdout.isTTY = true;
const calls = [];
await proxyCommand(['init', '--rotate-grace-minutes', '20', '--first-output-seconds', '10'], x, {
system: { dataRoot: '/unused-fixture' }, prompt: async () => 'fx331-manage',
callFor: () => async (verb, args) => { calls.push({ verb, args }); return { port: 18432, binary: '/fixture' }; },
});
assert.equal(calls.length, 1); assert.equal(calls[0].args.rotateGraceMinutes, 20); assert.equal(calls[0].args.firstOutputSeconds, 10);
assert.equal(x.out.text.includes('fx331-manage'), false);
});