1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
package auth
import (
"crypto/sha256"
"net/http"
"testing"
"aigw/internal/domain"
)
func TestStaticAuthenticator(t *testing.T) {
raw := `[{"key":"sk-client","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1","scopes":["inference"]}]`
authenticator, err := NewStatic(raw, false)
if err != nil {
t.Fatal(err)
}
request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/v1/models", nil)
request.Header.Set("Authorization", "Bearer sk-client")
principal, err := authenticator.Authenticate(request)
if err != nil {
t.Fatal(err)
}
if principal.TenantID != "tenant-1" || principal.ProjectID != "project-1" || principal.KeyID != "key-1" {
t.Fatalf("unexpected principal: %+v", principal)
}
request.Header.Set("Authorization", "Bearer wrong")
if _, err := authenticator.Authenticate(request); err != ErrUnauthorized {
t.Fatalf("expected ErrUnauthorized, got %v", err)
}
}
func TestDynamicAuthenticatorReplacesSnapshot(t *testing.T) {
oldHash := sha256.Sum256([]byte("sk-old"))
newHash := sha256.Sum256([]byte("sk-new"))
authenticator := NewDynamic([]HashedKeyRecord{{
Hash: oldHash,
Principal: domain.Principal{
KeyID: "old", TenantID: "tenant-1", ProjectID: "project-1", Scopes: []string{"inference"},
},
}}, false)
request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/v1/models", nil)
request.Header.Set("Authorization", "Bearer sk-old")
if _, err := authenticator.Authenticate(request); err != nil {
t.Fatalf("old key should initially authenticate: %v", err)
}
authenticator.ReplaceHashed([]HashedKeyRecord{{
Hash: newHash,
Principal: domain.Principal{
KeyID: "new", TenantID: "tenant-1", ProjectID: "project-1", Scopes: []string{"inference"},
},
}})
if _, err := authenticator.Authenticate(request); err != ErrUnauthorized {
t.Fatalf("old key remained valid after snapshot replacement: %v", err)
}
request.Header.Set("Authorization", "Bearer sk-new")
principal, err := authenticator.Authenticate(request)
if err != nil || principal.KeyID != "new" {
t.Fatalf("new key was not loaded: principal=%+v err=%v", principal, err)
}
}
func TestStaticAuthenticatorAcceptsAnthropicHeader(t *testing.T) {
authenticator, err := NewStatic(`[{"key":"sk-client","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1"}]`, false)
if err != nil {
t.Fatal(err)
}
request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/anthropic/v1/models", nil)
request.Header.Set("x-api-key", "sk-client")
if _, err := authenticator.Authenticate(request); err != nil {
t.Fatal(err)
}
}
|
