1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
|
package controlplane
import (
"encoding/json"
"strings"
"testing"
)
func TestDeveloperModelsForFiltersScopeAndRedactsRouting(t *testing.T) {
models := []Model{
{ID: "public", PublicID: "acme/public", DisplayName: "Public", Enabled: true, Lifecycle: "active",
AllowedTenantIDs: nil, Routes: []Route{{Protocol: "openai", WireAPI: "responses", Enabled: true, ProviderEnabled: true, ProviderName: "secret-provider", UpstreamModel: "secret-model", Priority: 1, Weight: 100}}},
{ID: "tenant", PublicID: "acme/private", Enabled: true, Lifecycle: "active", AllowedTenantIDs: []string{"tenant-a"},
Routes: []Route{{Protocol: "anthropic", WireAPI: "messages", Enabled: true, ProviderEnabled: true}}},
{ID: "key", PublicID: "acme/key", Enabled: true, Lifecycle: "active", AllowedKeyIDs: []string{"key-a"},
Routes: []Route{{Protocol: "openai", Enabled: true, ProviderEnabled: true}}},
{ID: "retired", PublicID: "acme/retired", Enabled: true, Lifecycle: "retired", Routes: []Route{{Protocol: "openai", Enabled: true, ProviderEnabled: true}}},
{ID: "disabled", PublicID: "acme/disabled", Enabled: false, Lifecycle: "active", Routes: []Route{{Protocol: "openai", Enabled: true, ProviderEnabled: true}}},
{ID: "noroute", PublicID: "acme/noroute", Enabled: true, Lifecycle: "active", Routes: []Route{{Protocol: "openai", Enabled: false, ProviderEnabled: true}}},
{ID: "provider-off", PublicID: "acme/provider-off", Enabled: true, Lifecycle: "active", Routes: []Route{{Protocol: "openai", Enabled: true, ProviderEnabled: false}}},
}
got := developerModelsFor(models, "tenant-a", map[string]struct{}{"key-a": {}})
if len(got) != 3 {
t.Fatalf("developer model count = %d, want 3", len(got))
}
if got[0].PublicID != "acme/key" && got[1].PublicID != "acme/key" && got[2].PublicID != "acme/key" {
t.Fatal("key-allowlisted model was not included for an active tenant key")
}
for _, item := range got {
if len(item.SupportedWireAPIs) == 0 {
t.Fatalf("unexpected developer model: %+v", item)
}
if item.PublicID == "acme/public" && item.SupportedWireAPIs[0] != "responses" {
t.Fatalf("responses wire API was not preserved: %+v", item)
}
}
for _, item := range got {
if item.PublicID == "acme/private" && item.SupportedWireAPIs[0] != "messages" {
t.Fatalf("anthropic wire API was not preserved: %+v", item)
}
}
encoded, err := json.Marshal(got)
if err != nil {
t.Fatal(err)
}
if strings.Contains(string(encoded), "secret-provider") || strings.Contains(string(encoded), "secret-model") || strings.Contains(string(encoded), "provider_id") {
t.Fatalf("developer model response leaked routing metadata: %s", encoded)
}
}
func TestDeveloperModelsForDoesNotExposeKeyRestrictedModelsWithoutTenantKey(t *testing.T) {
models := []Model{{ID: "key", PublicID: "key-only", Enabled: true, Lifecycle: "active", AllowedKeyIDs: []string{"key-a"}, Routes: []Route{{Protocol: "openai", Enabled: true, ProviderEnabled: true}}}}
if got := developerModelsFor(models, "tenant-a", map[string]struct{}{}); len(got) != 0 {
t.Fatalf("key-restricted models visible without a matching key: %+v", got)
}
}
func TestPublicModelsForOnlyExposesUnrestrictedCatalogData(t *testing.T) {
models := []Model{
{ID: "public", PublicID: "acme/public", DisplayName: "Public", Enabled: true, Lifecycle: "active",
Routes: []Route{{ProviderID: "provider-a", ProviderName: "internal provider", Protocol: "openai", WireAPI: "responses", UpstreamModel: "secret-model", Enabled: true, ProviderEnabled: true}}},
{ID: "tenant", PublicID: "acme/tenant", Enabled: true, Lifecycle: "active", AllowedTenantIDs: []string{"tenant-a"},
Routes: []Route{{ProviderID: "provider-a", Protocol: "openai", Enabled: true, ProviderEnabled: true}}},
{ID: "key", PublicID: "acme/key", Enabled: true, Lifecycle: "active", AllowedKeyIDs: []string{"key-a"},
Routes: []Route{{ProviderID: "provider-a", Protocol: "openai", Enabled: true, ProviderEnabled: true}}},
}
got := publicModelsFor(models)
if len(got) != 1 || got[0].PublicID != "acme/public" || got[0].ProviderCount != 1 || got[0].SupportedWireAPIs[0] != "responses" {
t.Fatalf("unexpected public catalog: %+v", got)
}
encoded, err := json.Marshal(got)
if err != nil {
t.Fatal(err)
}
for _, forbidden := range []string{"secret-model", "internal provider", "provider_id", "upstream_model", "allowed_tenant"} {
if strings.Contains(string(encoded), forbidden) {
t.Fatalf("public catalog leaked %q: %s", forbidden, encoded)
}
}
}
|
