Spaces:
Paused
Paused
| /** | |
| * Build verification for Flux Studio — Zero GPU. | |
| * | |
| * Runs as `npm run build` inside the Docker image (and locally before | |
| * every push). It fails loudly if anything in the app is broken, so a | |
| * broken build can never reach the Hugging Face builder silently. | |
| * | |
| * Checks: | |
| * 1. All required files exist. | |
| * 2. server.mjs parses and imports cleanly (no listen — import only). | |
| * 3. Config defaults match the spec | |
| * (flux-2-pro-preview primary, flux-2-klein-9b fallback, | |
| * https://api.bfl.ai base, port 7860). | |
| * 4. Placeholder-key detection behaves. | |
| * 5. Request validation behaves (accepts good input, rejects bad). | |
| * 6. The image proxy host allowlist blocks non-BFL hosts. | |
| * 7. The static client ships index.html/app.js/style.css and the | |
| * client never references the API key. | |
| */ | |
| import fs from 'node:fs'; | |
| import path from 'node:path'; | |
| import { fileURLToPath } from 'node:url'; | |
| const __dirname = path.dirname(fileURLToPath(import.meta.url)); | |
| const root = path.resolve(__dirname, '..'); | |
| const failures = []; | |
| function check(name, fn) { | |
| try { | |
| fn(); | |
| console.log(` ok ${name}`); | |
| } catch (err) { | |
| failures.push({ name, message: err.message }); | |
| console.error(` FAIL ${name}: ${err.message}`); | |
| } | |
| } | |
| function assert(cond, msg) { | |
| if (!cond) throw new Error(msg); | |
| } | |
| /* 1. Required files --------------------------------------------------- */ | |
| const REQUIRED = [ | |
| 'server.mjs', | |
| 'package.json', | |
| 'package-lock.json', | |
| 'Dockerfile', | |
| 'README.md', | |
| 'public/index.html', | |
| 'public/style.css', | |
| 'public/app.js', | |
| ]; | |
| check('required files exist', () => { | |
| for (const f of REQUIRED) { | |
| assert(fs.existsSync(path.join(root, f)), `missing file: ${f}`); | |
| } | |
| }); | |
| /* 2/3. Server module imports cleanly with spec defaults --------------- */ | |
| const server = await import(path.join(root, 'server.mjs')); | |
| check('config defaults match the spec', () => { | |
| const { config } = server; | |
| assert(config.modelId === 'flux-2-pro-preview', `modelId=${config.modelId}, expected flux-2-pro-preview`); | |
| assert(config.fallbackModelId === 'flux-2-klein-9b', `fallbackModelId=${config.fallbackModelId}, expected flux-2-klein-9b`); | |
| assert(config.apiBaseHost === 'api.bfl.ai', `apiBaseHost=${config.apiBaseHost}, expected api.bfl.ai`); | |
| assert(config.port === 7860, `port=${config.port}, expected 7860`); | |
| assert(typeof config.ready === 'boolean', 'config.ready should be boolean'); | |
| }); | |
| /* 4. Placeholder detection -------------------------------------------- */ | |
| check('placeholder key detection', () => { | |
| assert(server.isPlaceholderKey('') === true, 'empty key must count as placeholder'); | |
| assert(server.isPlaceholderKey('placeholder-replace-with-real-bfl-key') === true, 'placeholder value must count'); | |
| assert(server.isPlaceholderKey('sk-1234567890abcdef') === false, 'normal-looking key must not count'); | |
| }); | |
| /* 5. Validation -------------------------------------------------------- */ | |
| check('request validation', () => { | |
| const good = server.validateBody({ prompt: 'a cat', aspectRatio: '16:9', outputFormat: 'jpeg' }); | |
| assert(good.width === 1344 && good.height === 768, `aspect preset wrong: ${good.width}x${good.height}`); | |
| const seeded = server.validateBody({ prompt: 'a cat', width: 1024, height: 1024, seed: '42' }); | |
| assert(seeded.seed === 42, 'seed coercion failed'); | |
| let threw = false; | |
| try { | |
| server.validateBody({ prompt: '', width: 99999 }); | |
| } catch { | |
| threw = true; | |
| } | |
| assert(threw, 'invalid body must throw'); | |
| const payload = server.buildPayload({ prompt: 'x', width: 256, height: 256, outputFormat: 'png', seed: 7 }); | |
| assert(payload.seed === 7 && payload.output_format === 'png', 'BFL payload mapping wrong'); | |
| }); | |
| /* 6. Image proxy allowlist --------------------------------------------- */ | |
| check('image proxy host allowlist', () => { | |
| assert(server.isAllowedDeliveryHost('delivery.bfl.ai') === true, 'delivery.bfl.ai should be allowed'); | |
| assert(server.isAllowedDeliveryHost('bflai.blob.core.windows.net') === true, 'azure blob host should be allowed'); | |
| assert(server.isAllowedDeliveryHost('evil.example.com') === false, 'random host must be blocked'); | |
| assert(server.isAllowedDeliveryHost('bfl.ai.evil.com') === false, 'suffix spoof must be blocked'); | |
| }); | |
| /* 7. Client hygiene ---------------------------------------------------- */ | |
| check('client has no server secret access', () => { | |
| const appJs = fs.readFileSync(path.join(root, 'public/app.js'), 'utf8'); | |
| assert(!/BFL_API_KEY\s*=/.test(appJs), 'client must not assign BFL_API_KEY'); | |
| assert(!/x-key/i.test(appJs), 'client must not set the x-key header'); | |
| }); | |
| /* ---------------------------------------------------------------------- */ | |
| console.log(''); | |
| if (failures.length) { | |
| console.error(`BUILD FAILED — ${failures.length} check(s) failed.`); | |
| process.exit(1); | |
| } else { | |
| console.log('BUILD OK — all checks passed.'); | |
| process.exit(0); | |
| } | |