From 41e322c53d7b4b796eb377d0df9c29ecd10ba431 Mon Sep 17 00:00:00 2001 From: Chia Date: Thu, 6 Aug 2026 09:29:41 +1200 Subject: feat: complete commercial control plane, billing, auth, and model catalog - add PostgreSQL control-plane persistence with Redis-degraded hot reload - implement prepaid balance, usage ledger, Stripe top-up and reconciliation - add registration, email verification, password reset, invitations and RBAC - support TOTP, Passkey MFA, device sessions, quotas and rate limits - add tenant billing profiles, audit logs and operational readiness checks - build authenticated admin console, Quickstart, Playground and usage analytics - add public model catalog with pricing, filtering and cost estimation - support OpenAI Responses providers and provider health failover - validate real upstream usage reporting and balance settlement --- internal/auth/static_test.go | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) (limited to 'internal/auth/static_test.go') diff --git a/internal/auth/static_test.go b/internal/auth/static_test.go index cf54ba6..a037ce1 100644 --- a/internal/auth/static_test.go +++ b/internal/auth/static_test.go @@ -4,6 +4,7 @@ import ( "crypto/sha256" "net/http" "testing" + "time" "aigw/internal/domain" ) @@ -74,3 +75,33 @@ func TestStaticAuthenticatorAcceptsAnthropicHeader(t *testing.T) { t.Fatal(err) } } + +func TestStaticAuthenticatorLoadsRestrictionsAndRejectsExpiredKey(t *testing.T) { + future := time.Now().Add(time.Hour).UTC().Format(time.RFC3339Nano) + authenticator, err := NewStatic(`[{"key":"sk-limited","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1","allowed_models":["model/allowed"],"monthly_spend_micros":1250000,"expires_at":"`+future+`"}]`, false) + if err != nil { + t.Fatal(err) + } + request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/v1/models", nil) + request.Header.Set("Authorization", "Bearer sk-limited") + principal, err := authenticator.Authenticate(request) + if err != nil { + t.Fatal(err) + } + if principal.MonthlySpendMicros != 1_250_000 { + t.Fatalf("monthly spend limit = %d", principal.MonthlySpendMicros) + } + if _, ok := principal.AllowedModels["model/allowed"]; !ok { + t.Fatalf("allowed model was not loaded: %+v", principal.AllowedModels) + } + + past := time.Now().Add(-time.Minute) + hash := sha256.Sum256([]byte("sk-expired")) + authenticator.ReplaceHashed([]HashedKeyRecord{{Hash: hash, Principal: domain.Principal{ + KeyID: "expired", TenantID: "tenant-1", ProjectID: "project-1", ExpiresAt: &past, + }}}) + request.Header.Set("Authorization", "Bearer sk-expired") + if _, err := authenticator.Authenticate(request); err != ErrUnauthorized { + t.Fatalf("expired key error = %v, want ErrUnauthorized", err) + } +} -- cgit v1.2.3