1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
|
package auth
import (
"crypto/sha256"
"net/http"
"testing"
"time"
"aigw/internal/domain"
)
func TestStaticAuthenticator(t *testing.T) {
raw := `[{"key":"sk-client","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1","scopes":["inference"]}]`
authenticator, err := NewStatic(raw, false)
if err != nil {
t.Fatal(err)
}
request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/v1/models", nil)
request.Header.Set("Authorization", "Bearer sk-client")
principal, err := authenticator.Authenticate(request)
if err != nil {
t.Fatal(err)
}
if principal.TenantID != "tenant-1" || principal.ProjectID != "project-1" || principal.KeyID != "key-1" {
t.Fatalf("unexpected principal: %+v", principal)
}
request.Header.Set("Authorization", "Bearer wrong")
if _, err := authenticator.Authenticate(request); err != ErrUnauthorized {
t.Fatalf("expected ErrUnauthorized, got %v", err)
}
}
func TestDynamicAuthenticatorReplacesSnapshot(t *testing.T) {
oldHash := sha256.Sum256([]byte("sk-old"))
newHash := sha256.Sum256([]byte("sk-new"))
authenticator := NewDynamic([]HashedKeyRecord{{
Hash: oldHash,
Principal: domain.Principal{
KeyID: "old", TenantID: "tenant-1", ProjectID: "project-1", Scopes: []string{"inference"},
},
}}, false)
request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/v1/models", nil)
request.Header.Set("Authorization", "Bearer sk-old")
if _, err := authenticator.Authenticate(request); err != nil {
t.Fatalf("old key should initially authenticate: %v", err)
}
authenticator.ReplaceHashed([]HashedKeyRecord{{
Hash: newHash,
Principal: domain.Principal{
KeyID: "new", TenantID: "tenant-1", ProjectID: "project-1", Scopes: []string{"inference"},
},
}})
if _, err := authenticator.Authenticate(request); err != ErrUnauthorized {
t.Fatalf("old key remained valid after snapshot replacement: %v", err)
}
request.Header.Set("Authorization", "Bearer sk-new")
principal, err := authenticator.Authenticate(request)
if err != nil || principal.KeyID != "new" {
t.Fatalf("new key was not loaded: principal=%+v err=%v", principal, err)
}
}
func TestStaticAuthenticatorAcceptsAnthropicHeader(t *testing.T) {
authenticator, err := NewStatic(`[{"key":"sk-client","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1"}]`, false)
if err != nil {
t.Fatal(err)
}
request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/anthropic/v1/models", nil)
request.Header.Set("x-api-key", "sk-client")
if _, err := authenticator.Authenticate(request); err != nil {
t.Fatal(err)
}
}
func TestStaticAuthenticatorLoadsRestrictionsAndRejectsExpiredKey(t *testing.T) {
future := time.Now().Add(time.Hour).UTC().Format(time.RFC3339Nano)
authenticator, err := NewStatic(`[{"key":"sk-limited","key_id":"key-1","tenant_id":"tenant-1","project_id":"project-1","allowed_models":["model/allowed"],"monthly_spend_micros":1250000,"expires_at":"`+future+`"}]`, false)
if err != nil {
t.Fatal(err)
}
request, _ := http.NewRequest(http.MethodGet, "http://gateway.test/v1/models", nil)
request.Header.Set("Authorization", "Bearer sk-limited")
principal, err := authenticator.Authenticate(request)
if err != nil {
t.Fatal(err)
}
if principal.MonthlySpendMicros != 1_250_000 {
t.Fatalf("monthly spend limit = %d", principal.MonthlySpendMicros)
}
if _, ok := principal.AllowedModels["model/allowed"]; !ok {
t.Fatalf("allowed model was not loaded: %+v", principal.AllowedModels)
}
past := time.Now().Add(-time.Minute)
hash := sha256.Sum256([]byte("sk-expired"))
authenticator.ReplaceHashed([]HashedKeyRecord{{Hash: hash, Principal: domain.Principal{
KeyID: "expired", TenantID: "tenant-1", ProjectID: "project-1", ExpiresAt: &past,
}}})
request.Header.Set("Authorization", "Bearer sk-expired")
if _, err := authenticator.Authenticate(request); err != ErrUnauthorized {
t.Fatalf("expired key error = %v, want ErrUnauthorized", err)
}
}
|
