Move authentication probes into the outbound adapter

This commit is contained in:
2026-11-05 14:20:04 +00:00
parent dbba1485a7
commit f745b14b71
8 changed files with 313 additions and 172 deletions

View File

@@ -26,6 +26,7 @@ func (b *measuredAuthenticationBody) Read(p []byte) (int, error) {
func (b *measuredAuthenticationBody) Close() error { b.closed = true; return nil }
func TestAuthenticationResponseRecognitionBound(t *testing.T) {
const maxAuthenticationResponseBytes = 1 << 20
valid := `{"data":{"label":"member","is_free_tier":false,"usage":0}}`
for _, test := range []struct {
name string
@@ -211,21 +212,26 @@ func TestAuthenticationProbeInterpretsOpenRouterResponses(t *testing.T) {
}
func TestAuthenticationProbeRecognizesOnlyOneCompleteJSONObject(t *testing.T) {
for _, body := range []string{
`{"data":{"label":"member","is_free_tier":false,"usage":1}} {}`,
`{"data":[]}`,
`{"data":{"label":"member","is_free_tier":false,"usage":null}}`,
`{"data":{"label":"member","is_free_tier":0,"usage":1}}`,
`{"data":{"is_free_tier":false,"usage":1}}`,
`{"data":{"label":null,"is_free_tier":false,"usage":1}}`,
for _, tc := range []struct {
body string
accepted bool
}{
{`{"data":{"label":"member","is_free_tier":false,"usage":1}} {}`, false},
{`{"data":[]}`, false},
{`{"data":{"label":"member","is_free_tier":false,"usage":null}}`, false},
{`{"data":{"label":"member","is_free_tier":0,"usage":1}}`, false},
{`{"data":{"is_free_tier":false,"usage":1}}`, false},
{`{"data":{"label":null,"is_free_tier":false,"usage":1}}`, false},
{`{"data":{"label":"","is_free_tier":false,"usage":1e2,"ignored":true},"ignored":true}`, true},
} {
if recognized, err := recognizedOpenRouterKeyResponse(strings.NewReader(body)); err != nil || recognized {
t.Errorf("recognized invalid account response %s", body)
client := reachabilityClient(t, func(*http.Request) (*http.Response, error) {
return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: ioNopCloser(tc.body)}, nil
})
outcome, err := (authenticationProbe{client: client}).run(context.Background(), backendWithAuthenticationKind("openrouter_key"), domain.SmokeTestTarget{Endpoint: "https://example.invalid/key"})
if err != nil || (outcome.credentialsAccepted != nil && *outcome.credentialsAccepted) != tc.accepted {
t.Errorf("account response %s: outcome = %+v, error = %v", tc.body, outcome, err)
}
}
if recognized, err := recognizedOpenRouterKeyResponse(strings.NewReader(`{"data":{"label":"","is_free_tier":false,"usage":1e2,"ignored":true},"ignored":true}`)); err != nil || !recognized {
t.Fatal("valid minimal identifying response was rejected")
}
}
func TestAuthenticationProbeTreatsInterruptedResponseBodyAsTransportFailure(t *testing.T) {