Ilker ManapandClaude Opus 5.5
f989e67e1a
The account page makes a key for Continue, Codex or Cline and shows what the tool needs with the key, this gateway's address and a served model in it: Continue's assistant file, written to its own place under ~/.continue/assistants so the person's config.yaml is not touched; Codex's provider and profile, added to ~/.codex/config.toml without changing its default model; and for Cline, whose settings live in VS Code's secret storage, the four fields to paste. Continue and Codex get a one-line command whose script, served without a session, holds no secret - the key comes from the environment, never a URL - keeps a copy of whatever it replaces, and leaves the rest of the file as it was. POST /v1/responses translates the Responses API, which Codex speaks, to chat completions and back: instructions, messages, function tools and Codex's free-form custom tools, their calls and outputs, and usage, as a response object or as its stream of typed events. It goes down the same path as any request - quotas, admission, routing, usage. Server-side tools and stored responses have no equivalent and are ignored. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
43 lines
1.7 KiB
Go
43 lines
1.7 KiB
Go
package router
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// Every page a browser opens with a session must get past the API-key check
|
|
// and reach its own sign-in guard. One missing from the exempt list answers a
|
|
// signed-in person with {"error": "no api key was provided"} — which is what
|
|
// /org did, and which a test that mounts the page without the middleware
|
|
// cannot see.
|
|
func TestSessionPagesAreNotAskedForAnAPIKey(t *testing.T) {
|
|
rt, _ := chatRouter(t, "http://127.0.0.1:1")
|
|
h := rt.Handler()
|
|
// The /admin pages are mounted only with a cluster view, which this
|
|
// router has none of; these are the session pages it does mount.
|
|
for _, path := range []string{"/profile", "/chat", "/org", "/org/org-x"} {
|
|
w := httptest.NewRecorder()
|
|
h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, path, nil))
|
|
if strings.Contains(w.Body.String(), "api key") {
|
|
t.Errorf("%s asked a browser for an API key: %d %s", path, w.Code, w.Body.String())
|
|
}
|
|
if w.Code != http.StatusSeeOther || w.Header().Get("Location") != "/login" {
|
|
t.Errorf("%s without a session: %d to %q, want a redirect to /login",
|
|
path, w.Code, w.Header().Get("Location"))
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestTheEditorSetupScriptNeedsNoKey(t *testing.T) {
|
|
// curl | sh from a machine that has no key in a header yet: the script
|
|
// holds none, and reads the key from the environment when it runs.
|
|
rt, _ := chatRouter(t, "http://127.0.0.1:1")
|
|
w := httptest.NewRecorder()
|
|
rt.Handler().ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/setup/codex?model=qwen", nil))
|
|
if w.Code != http.StatusOK || !strings.HasPrefix(w.Body.String(), "#!/bin/sh") {
|
|
t.Errorf("%d %s", w.Code, w.Body.String())
|
|
}
|
|
}
|