Ilker ManapandClaude Opus 5.5
698f82cc12
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
43 lines
1.7 KiB
Go
43 lines
1.7 KiB
Go
package router
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// Every page a browser opens with a session must get past the API-key check
|
|
// and reach its own sign-in guard. One missing from the exempt list answers a
|
|
// signed-in person with {"error": "no api key was provided"} — which is what
|
|
// /org did, and which a test that mounts the page without the middleware
|
|
// cannot see.
|
|
func TestSessionPagesAreNotAskedForAnAPIKey(t *testing.T) {
|
|
rt, _ := chatRouter(t, "http://127.0.0.1:1")
|
|
h := rt.Handler()
|
|
// The /admin pages are mounted only with a cluster view, which this
|
|
// router has none of; these are the session pages it does mount.
|
|
for _, path := range []string{"/profile", "/chat", "/images", "/org", "/org/org-x"} {
|
|
w := httptest.NewRecorder()
|
|
h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, path, nil))
|
|
if strings.Contains(w.Body.String(), "api key") {
|
|
t.Errorf("%s asked a browser for an API key: %d %s", path, w.Code, w.Body.String())
|
|
}
|
|
if w.Code != http.StatusSeeOther || w.Header().Get("Location") != "/login" {
|
|
t.Errorf("%s without a session: %d to %q, want a redirect to /login",
|
|
path, w.Code, w.Header().Get("Location"))
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestTheEditorSetupScriptNeedsNoKey(t *testing.T) {
|
|
// curl | sh from a machine that has no key in a header yet: the script
|
|
// holds none, and reads the key from the environment when it runs.
|
|
rt, _ := chatRouter(t, "http://127.0.0.1:1")
|
|
w := httptest.NewRecorder()
|
|
rt.Handler().ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/setup/codex?model=qwen", nil))
|
|
if w.Code != http.StatusOK || !strings.HasPrefix(w.Body.String(), "#!/bin/sh") {
|
|
t.Errorf("%d %s", w.Code, w.Body.String())
|
|
}
|
|
}
|