File size: 6,341 Bytes
d04f74a | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 | import { describe, expect, it } from 'vitest'
import { Context } from '@deepseek-ai/cordis'
import type { CredentialInfo } from '@deepseek-ai/dsh-credentials/types'
import { remoteErrorOf, remoteMethods } from '@deepseek-ai/dsh-typert-protocol'
import CredentialsController from '../src/credentials.ts'
import { MemoryCredentials } from '../../../credentials/credentials/tests/memory.ts'
/** A store whose `describe` carries more than the view declares, as a foreign provider might. */
class LeakyCredentials extends MemoryCredentials {
override describe(): Promise<CredentialInfo> {
return Promise.resolve(
{ configured: true, source: 'memory', writable: true, value: 'sk-leaked' } as CredentialInfo,
)
}
}
/** A store whose write rejects with a bare string, the way some client libraries do. */
class LiteralRejectingCredentials extends MemoryCredentials {
override async set(): Promise<void> {
throw 'the store refused'
}
}
/** A store whose provider-owned policy rejects an otherwise valid write. */
class RejectingCredentials extends MemoryCredentials {
override set(): Promise<void> {
return Promise.reject(new Error('a read-only source shadows this reference'))
}
}
async function boot(
seed: Record<string, string> = {},
provider: typeof MemoryCredentials = MemoryCredentials,
): Promise<CredentialsController> {
const ctx = new Context()
await ctx.plugin(provider, seed)
await ctx.plugin(CredentialsController)
return ctx.credentialsController
}
describe('the credentials Remote namespace a configuration surface calls', () => {
it('publishes the credentials namespace from its own service key', async () => {
const controller = await boot()
const binding = controller.typertRemote
expect(binding.serviceKey).toBe('credentialsController')
expect(binding.namespace).toBe('credentials')
expect(remoteMethods(controller)).toEqual([
{ method: 'describe', invocation: { kind: 'direct' } },
{ method: 'set', invocation: { kind: 'direct' } },
{ method: 'unset', invocation: { kind: 'direct' } },
])
})
it('reports the actionable configuration error while no credential provider is mounted', async () => {
const ctx = new Context()
await ctx.plugin(CredentialsController)
for (const call of [
() => ctx.credentialsController.describe(['DEEPSEEK_API_KEY']),
() => ctx.credentialsController.set('DEEPSEEK_API_KEY', 'sk-live'),
() => ctx.credentialsController.unset('DEEPSEEK_API_KEY'),
]) {
const failure = await call().catch((error: unknown) => error)
expect(remoteErrorOf(failure)).toMatchObject({
code: 'gateway/internal',
message: 'credentials service is absent: this deployment does not mount a credential provider (e.g. @deepseek-ai/dsh-credentials-local) in its composition',
details: {},
})
}
})
it('describes a batch of references as one map, values excluded', async () => {
const controller = await boot({ DEEPSEEK_API_KEY: 'sk-seeded' })
const described = await controller.describe(['DEEPSEEK_API_KEY', 'OPENAI_API_KEY'])
expect(described).toEqual({
DEEPSEEK_API_KEY: { configured: true, source: 'memory', writable: true },
OPENAI_API_KEY: { configured: false, writable: true },
})
expect(JSON.stringify(described)).not.toContain('sk-seeded')
})
it('reports an invalid reference as bad-request', async () => {
const controller = await boot()
for (const call of [
() => controller.describe(['DEEPSEEK_API_KEY', 'not a var']),
() => controller.set('not a var', 'sk-live'),
() => controller.unset('not a var'),
]) {
const failure = await call().catch((error: unknown) => error)
expect(remoteErrorOf(failure)).toMatchObject({ code: 'gateway/bad-request' })
}
})
it('answers the largest batch it accepts and reports one reference more as bad-request', async () => {
const controller = await boot()
const accepted = Array.from({ length: 64 }, (_unused, index) => `REF_${String(index)}`)
expect(Object.keys(await controller.describe(accepted))).toHaveLength(64)
const failure = await controller.describe([...accepted, 'REF_64']).catch((error: unknown) => error)
expect(remoteErrorOf(failure)).toMatchObject({ code: 'gateway/bad-request' })
})
it('answers only the fields the view declares, whatever a provider returns', async () => {
const controller = await boot({}, LeakyCredentials)
const described = await controller.describe(['DEEPSEEK_API_KEY'])
expect(described.DEEPSEEK_API_KEY).toEqual({ configured: true, source: 'memory', writable: true })
expect(JSON.stringify(described)).not.toContain('sk-leaked')
})
it('stores and removes through the same references the batch describes', async () => {
const controller = await boot()
await controller.set('DEEPSEEK_API_KEY', 'sk-live')
expect(await controller.describe(['DEEPSEEK_API_KEY']))
.toEqual({ DEEPSEEK_API_KEY: { configured: true, source: 'memory', writable: true } })
await controller.unset('DEEPSEEK_API_KEY')
expect(await controller.describe(['DEEPSEEK_API_KEY']))
.toEqual({ DEEPSEEK_API_KEY: { configured: false, writable: true } })
})
it('reports a refused write as credential/rejected naming only the reference', async () => {
const controller = await boot({}, RejectingCredentials)
const failure = await controller.set('DEEPSEEK_API_KEY', 'sk-live').catch((error: unknown) => error)
const { code, message, details } = remoteErrorOf(failure) ?? {}
expect(code).toBe('credential/rejected')
expect(message).toContain('read-only source')
expect(details).toEqual({ ref: 'DEEPSEEK_API_KEY' })
})
it('reports an empty value as bad-request', async () => {
const controller = await boot()
const failure = await controller.set('DEEPSEEK_API_KEY', '').catch((error: unknown) => error)
expect(remoteErrorOf(failure)).toMatchObject({ code: 'gateway/bad-request' })
})
it('stringifies a refusal that is not an Error', async () => {
const controller = await boot({}, LiteralRejectingCredentials)
const failure = await controller.set('DEEPSEEK_API_KEY', 'sk-live').catch((error: unknown) => error)
expect(remoteErrorOf(failure)?.message).toBe('the store refused')
})
})
|