Spaces:
Sleeping
Sleeping
File size: 5,295 Bytes
476094d 7ec990d 476094d 7ec990d 476094d 7ec990d 476094d 7ec990d 476094d | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 | import test from "node:test";
import assert from "node:assert/strict";
import fs from "node:fs/promises";
import os from "node:os";
import path from "node:path";
import { EncryptedPoolStore } from "./encrypted-pool-store.mjs";
async function makeStore() {
const root = await fs.mkdtemp(path.join(os.tmpdir(), "enc-pool-store-test-"));
const store = new EncryptedPoolStore({
dataDir: path.join(root, "data"),
cryptoKey: "test-crypto-key",
});
await store.init();
return { root, store };
}
test("EncryptedPoolStore writes encrypted payload without plaintext secrets", async () => {
const { store } = await makeStore();
await store.savePool("codex-api", [
{
name: "main",
type: "codex",
baseUrl: "https://example.com/v1",
apiKey: "sk-test-secret",
model: "gpt-5.4",
disabled: false,
},
]);
const encryptedPath = path.join(store.dataDir, "pools", "codex-api.enc");
const encrypted = await fs.readFile(encryptedPath, "utf8");
assert.doesNotMatch(encrypted, /sk-test-secret/);
const loaded = await store.loadPool("codex-api");
assert.equal(loaded.items[0].apiKey, "");
assert.ok(loaded.items[0].apiKeyMasked);
const raw = await store.loadRawPoolItems("codex-api");
assert.equal(raw[0].apiKey, "sk-test-secret");
});
test("EncryptedPoolStore preserves existing secrets when admin submits blank replacements", async () => {
const { store } = await makeStore();
await store.savePool("claude-code-api", [
{
name: "claude-main",
type: "claude-code",
baseUrl: "https://claude.example.com",
apiKey: "sk-claude-secret",
model: "claude-sonnet",
disabled: false,
},
]);
await store.savePool("claude-code-api", [
{
name: "claude-main-renamed",
type: "claude-code",
baseUrl: "https://claude.example.com",
apiKey: "",
model: "claude-sonnet",
disabled: false,
},
]);
const raw = await store.loadRawPoolItems("claude-code-api");
assert.equal(raw[0].name, "claude-main-renamed");
assert.equal(raw[0].apiKey, "sk-claude-secret");
});
test("EncryptedPoolStore can persist to a private hf dataset backend", async () => {
const root = await fs.mkdtemp(path.join(os.tmpdir(), "enc-pool-store-hf-test-"));
const files = new Map();
const fetchCalls = [];
const fetchFn = async (url, options = {}) => {
fetchCalls.push({ url, options });
if (String(url) === "https://huggingface.co/api/datasets/alice/private-db") {
return new Response("{}", { status: 200 });
}
if (String(url).includes("/resolve/")) {
const relativePath = String(url).split("/main/")[1];
if (options.method === "HEAD") {
if (!files.has(relativePath)) {
return new Response("", { status: 404 });
}
return new Response("", {
status: 200,
headers: { "last-modified": new Date("2026-04-08T00:00:00.000Z").toUTCString() },
});
}
if (!files.has(relativePath)) {
return new Response("", { status: 404 });
}
return new Response(files.get(relativePath), {
status: 200,
headers: { "last-modified": new Date("2026-04-08T00:00:00.000Z").toUTCString() },
});
}
if (String(url) === "https://huggingface.co/api/datasets/alice/private-db/commit/main") {
const body = String(options.body || "").trim().split("\n").map((line) => JSON.parse(line));
const fileOp = body.find((item) => item.key === "file");
files.set(fileOp.value.path, Buffer.from(fileOp.value.content, "base64").toString("utf8"));
return new Response(JSON.stringify({ commitOid: "abc123", commitUrl: "https://huggingface.co/commit/abc123" }), {
status: 200,
headers: { "content-type": "application/json" },
});
}
throw new Error(`Unexpected fetch: ${url}`);
};
const store = new EncryptedPoolStore({
dataDir: path.join(root, "data"),
cryptoKey: "test-crypto-key",
storageBackend: "hf-dataset",
hfDatasetRepo: "alice/private-db",
hfToken: "hf_test_token",
fetchFn,
});
await store.init();
await store.savePool("codex-api", [
{
name: "dataset-main",
type: "codex",
baseUrl: "https://example.com/v1",
apiKey: "sk-dataset-secret",
model: "gpt-5.4",
disabled: false,
},
]);
const pool = await store.loadPool("codex-api");
assert.equal(pool.pool.filePath, "hf://datasets/alice/private-db/main/pools/codex-api.enc");
assert.equal(pool.items[0].apiKey, "");
assert.ok(fetchCalls.some(({ url }) => String(url) === "https://huggingface.co/api/datasets/alice/private-db"));
assert.ok(fetchCalls.some(({ url }) => String(url) === "https://huggingface.co/api/datasets/alice/private-db/commit/main"));
});
test("EncryptedPoolStore marks hf dataset backend as read-only without HF_TOKEN", async () => {
const root = await fs.mkdtemp(path.join(os.tmpdir(), "enc-pool-store-hf-ro-test-"));
const store = new EncryptedPoolStore({
dataDir: path.join(root, "data"),
cryptoKey: "test-crypto-key",
storageBackend: "hf-dataset",
hfDatasetRepo: "alice/private-db",
});
await store.init();
assert.equal(store.readOnly, true);
assert.match(store.readOnlyReason, /HF_TOKEN is required/i);
});
|