Spaces:
Sleeping
Sleeping
| // End-to-end self-test for the import + preview paths. Three scenarios: | |
| // | |
| // 1. User's real backup file (when present at the Downloads path). | |
| // 2. Synthetic passphrase-protected envelope with 64 keys — exercises | |
| // the keysByPlatform path through both preview (encrypted-with-passphrase) | |
| // and runImport (clean decrypt under FRESH_KEY). | |
| // 3. Synthetic no-passphrase envelope with foreign-key ciphertext — | |
| // exercises the safety net: preview reports `mismatch`, runImport | |
| // refuses every row with a clear error and surfaces the diagnostic. | |
| // | |
| // All scenarios run against a sandbox DB and a brand-new ENCRYPTION_KEY. | |
| // The script does NOT touch the live server DB. | |
| import crypto from 'node:crypto'; | |
| import fs from 'node:fs'; | |
| import os from 'node:os'; | |
| import path from 'node:path'; | |
| import { initDb, getDb } from '../server/src/db/index.ts'; | |
| import { runImport, previewEnvelope, probeKeyCompatibility } from '../server/src/lib/config/import.ts'; | |
| import { decrypt } from '../server/src/lib/crypto.ts'; | |
| import { encryptKeysWithPassphrase } from '../server/src/lib/config/passphrase-crypto.ts'; | |
| import type { ConfigEnvelope } from '../shared/types.ts'; | |
| const USER_BACKUP_PATH = path.join( | |
| os.homedir(), | |
| 'Downloads', | |
| 'API_Gateway-Backup-fully-functioning-2026-06-21-05-35-31.json', | |
| ); | |
| const PASSPHRASE = 'Namqul@07'; | |
| interface Scenario { | |
| name: string; | |
| build: () => ConfigEnvelope; | |
| importOptions: { passphrase?: string; mode: 'overwrite' | 'replace' | 'skip-existing'; sections?: ('api_keys')[] }; | |
| expectProbe: 'no-keys' | 'encrypted-with-passphrase' | 'plaintext' | 'compatible' | 'mismatch'; | |
| expectImportAdded: number; | |
| expectImportErrors: number; | |
| } | |
| function buildKeysCipherEnvelopes(): Scenario { | |
| return { | |
| name: 'passphrase-protected synthetic envelope (64 keys across 8 platforms)', | |
| build: () => { | |
| const platforms = ['groq', 'cerebras', 'openrouter', 'cloudflare', 'nvidia', 'cohere', 'github', 'mistral']; | |
| const rows = Array.from({ length: 64 }, (_, i) => ({ | |
| platform: platforms[i % platforms.length], | |
| label: `key-${i}`, | |
| enabled: true, | |
| // The plaintext value to wrap in keysCipher. | |
| _plain: `sk-secret-value-${i}-${crypto.randomBytes(8).toString('hex')}`, | |
| })); | |
| const cipher = encryptKeysWithPassphrase( | |
| rows.map((r) => ({ platform: r.platform, key: r._plain as string })), | |
| PASSPHRASE, | |
| ); | |
| // Build apiKey rows that ALSO carry per-row ciphertext — matches | |
| // what the exporter actually emits. The ciphertext is the row's | |
| // own plaintext re-encrypted under the test key; the keysCipher | |
| // path will prefer the keysCipher plaintext anyway, so the row | |
| // ciphertext is essentially decorative here. | |
| const apiKeys = rows.map((r) => { | |
| const plain = r._plain as string; | |
| // Encrypt under the destination's key by calling AES directly | |
| // (we can't use the shared encrypt() here because the import | |
| // service caches the destination key at module load). | |
| const key = Buffer.from(process.env.ENCRYPTION_KEY ?? '', 'hex'); | |
| const iv = crypto.randomBytes(16); | |
| const enc = crypto.createCipheriv('aes-256-gcm', key, iv); | |
| const ct = Buffer.concat([enc.update(Buffer.from(plain, 'utf8')), enc.final()]); | |
| return { | |
| platform: r.platform, | |
| label: r.label, | |
| enabled: true, | |
| encryptedKey: ct.toString('hex'), | |
| iv: iv.toString('hex'), | |
| authTag: enc.getAuthTag().toString('hex'), | |
| }; | |
| }); | |
| return { | |
| schemaVersion: 1, | |
| generator: 'api-gateway', | |
| exportedAt: new Date().toISOString(), | |
| sections: { apiKeys }, | |
| keysCipher: cipher, | |
| }; | |
| }, | |
| importOptions: { passphrase: PASSPHRASE, mode: 'overwrite', sections: ['api_keys'] }, | |
| expectProbe: 'encrypted-with-passphrase', | |
| expectImportAdded: 64, | |
| expectImportErrors: 0, | |
| }; | |
| } | |
| function buildMismatchEnvelopes(): Scenario { | |
| return { | |
| name: 'no-passphrase envelope with foreign-key ciphertext', | |
| build: () => { | |
| // Ciphertext encrypted under a DIFFERENT key than the | |
| // destination's — the safety net should refuse every row. | |
| const foreign = crypto.randomBytes(32); | |
| const apiKeys = Array.from({ length: 12 }, (_, i) => { | |
| const plain = `sk-foreign-${i}`; | |
| const iv = crypto.randomBytes(16); | |
| const enc = crypto.createCipheriv('aes-256-gcm', foreign, iv); | |
| const ct = Buffer.concat([enc.update(Buffer.from(plain, 'utf8')), enc.final()]); | |
| return { | |
| platform: i % 2 === 0 ? 'groq' : 'openrouter', | |
| label: `key-${i}`, | |
| enabled: true, | |
| encryptedKey: ct.toString('hex'), | |
| iv: iv.toString('hex'), | |
| authTag: enc.getAuthTag().toString('hex'), | |
| }; | |
| }); | |
| return { | |
| schemaVersion: 1, | |
| generator: 'api-gateway', | |
| exportedAt: new Date().toISOString(), | |
| sections: { apiKeys }, | |
| }; | |
| }, | |
| importOptions: { mode: 'overwrite', sections: ['api_keys'] }, | |
| expectProbe: 'mismatch', | |
| expectImportAdded: 0, | |
| expectImportErrors: 12, | |
| }; | |
| } | |
| function buildUserBackupScenario(env: ConfigEnvelope): Scenario { | |
| return { | |
| name: "user's real backup file (apiKeys + keysCipher + non-key sections)", | |
| build: () => env, | |
| importOptions: { passphrase: PASSPHRASE, mode: 'overwrite' }, | |
| expectProbe: env.keysCipher ? 'encrypted-with-passphrase' : 'compatible', | |
| expectImportAdded: (env.sections.apiKeys || []).length, | |
| expectImportErrors: 0, | |
| }; | |
| } | |
| async function runScenario(s: Scenario): Promise<{ pass: boolean; notes: string[] }> { | |
| const notes: string[] = []; | |
| const envelope = s.build(); | |
| // ── Preview path ───────────────────────────────────────────────────── | |
| const probe = probeKeyCompatibility(envelope); | |
| notes.push(`probe=${probe}`); | |
| if (probe !== s.expectProbe) { | |
| return { pass: false, notes: [...notes, `expected probe=${s.expectProbe}`] }; | |
| } | |
| const preview = previewEnvelope(envelope); | |
| if (preview.keyCompatibility !== s.expectProbe) { | |
| return { pass: false, notes: [...notes, `previewEnvelope returned ${preview.keyCompatibility}`] }; | |
| } | |
| // ── Import path ────────────────────────────────────────────────────── | |
| const SANDBOX_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'gateway-verify-')); | |
| const SANDBOX_DB = path.join(SANDBOX_DIR, 'sandbox.db'); | |
| process.env.ENCRYPTION_KEY = crypto.randomBytes(32).toString('hex'); | |
| try { | |
| initDb(SANDBOX_DB); | |
| const result = runImport({ envelope, options: s.importOptions }); | |
| const ak = result.sections.api_keys; | |
| const errors = ak?.errors?.length ?? 0; | |
| notes.push(`added=${ak?.added ?? 0}, errors=${errors}`); | |
| notes.push(`summary.keyCompatibility=${JSON.stringify(result.keyCompatibility)}`); | |
| if ((ak?.added ?? 0) !== s.expectImportAdded) { | |
| return { pass: false, notes: [...notes, `expected added=${s.expectImportAdded}`] }; | |
| } | |
| if (errors !== s.expectImportErrors) { | |
| return { pass: false, notes: [...notes, `expected errors=${s.expectImportErrors}`] }; | |
| } | |
| // For the success path, verify every row actually decrypts under | |
| // the freshly generated key. | |
| if (errors === 0 && (ak?.added ?? 0) > 0) { | |
| const db = getDb(); | |
| const rows = db.prepare('SELECT encrypted_key, iv, auth_tag FROM api_keys').all() as Array<{ | |
| encrypted_key: string; iv: string; auth_tag: string; | |
| }>; | |
| let decryptedOk = 0; | |
| for (const r of rows) { | |
| try { decrypt(r.encrypted_key, r.iv, r.auth_tag); decryptedOk++; } catch { /* ignore */ } | |
| } | |
| notes.push(`post-import decrypt=${decryptedOk}/${rows.length}`); | |
| if (decryptedOk !== rows.length) { | |
| return { pass: false, notes: [...notes, 'not every row decrypts'] }; | |
| } | |
| } | |
| // For the mismatch path, verify keyCompatibility reports it. | |
| if (s.expectImportErrors > 0 && result.keyCompatibility?.status !== 'mismatch') { | |
| return { pass: false, notes: [...notes, 'keyCompatibility should be mismatch'] }; | |
| } | |
| } finally { | |
| try { fs.rmSync(SANDBOX_DIR, { recursive: true, force: true }); } catch { /* best-effort */ } | |
| } | |
| return { pass: true, notes }; | |
| } | |
| async function main(): Promise<void> { | |
| process.env.NODE_ENV = 'development'; | |
| const scenarios: Scenario[] = [buildKeysCipherEnvelopes(), buildMismatchEnvelopes()]; | |
| if (fs.existsSync(USER_BACKUP_PATH)) { | |
| const userEnvelope = JSON.parse(fs.readFileSync(USER_BACKUP_PATH, 'utf8')) as ConfigEnvelope; | |
| scenarios.unshift(buildUserBackupScenario(userEnvelope)); | |
| console.log('User backup file found:', USER_BACKUP_PATH); | |
| } else { | |
| console.log('User backup file NOT found at', USER_BACKUP_PATH, '— running synthetic scenarios only.'); | |
| } | |
| let pass = 0; | |
| let fail = 0; | |
| for (const s of scenarios) { | |
| console.log(''); | |
| console.log('▶', s.name); | |
| const r = await runScenario(s); | |
| for (const n of r.notes) console.log(' ·', n); | |
| if (r.pass) { | |
| pass++; | |
| console.log(' ✓ PASS'); | |
| } else { | |
| fail++; | |
| console.log(' ✗ FAIL'); | |
| } | |
| } | |
| console.log(''); | |
| console.log(`Scenarios: ${pass} passed, ${fail} failed`); | |
| process.exit(fail > 0 ? 1 : 0); | |
| } | |
| main().catch((err) => { | |
| console.error('verify-import crashed:', err); | |
| process.exit(2); | |
| }); | |