@bongos/core 1.23.22 → 1.24.2

package/tests/ai_studio_generate.mjs

@@ -0,0 +1,282 @@
+// tests/ai_studio_generate.mjs — submitting a sketch and generating on our key
+// (task 1004917, goal 1000136, ADR 0392):
+//   - uploads are checked the page-notes way (declared type must match the
+//     file's own bytes, size caps, SVG refused), and a request names its files;
+//   - the project context is read on the server from the instance's files;
+//   - the OpenRouter calls carry the key only in the Authorization header,
+//     bill on the cost the provider reports, and fail closed when it is missing;
+//   - a whole generation holds the full price first, charges cost x 1.08 on
+//     success, refunds everything on a provider failure, never runs on a short
+//     balance, and never says "not charged" once money was taken.
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const S = require('../modules/ai-studio/studio.js');
+const OR = require('../modules/ai-studio/openrouter.js');
+const P = require('../modules/ai-studio/pricing.js');
+const payments = require('../modules/ai-studio/payments.js');
+const { runOnOurKey } = require('../modules/ai-studio/generate.js');
+const { projectContext } = require('../modules/ai-studio/context.js');
+
+const USD = P.MICRO_PER_USD;
+const KEY = 'sk-or-v1-test-0000000000000000000000000000';
+const PNG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 13]);
+const PDF = Buffer.from('%PDF-1.7\n%test\n');
+
+// ---- uploads and requests --------------------------------------------------
+
+test('an upload is accepted only when its bytes are the type it claims', () => {
+  const ok = S.checkFile({ name: 'sketch one.png', content_type: 'image/png', data: PNG.toString('base64') });
+  assert.equal(ok.file.content_type, 'image/png');
+  assert.equal(ok.file.name, 'sketch one.png');
+  assert.ok(Buffer.isBuffer(ok.file.bytes));
+  assert.equal(S.checkFile({ content_type: 'application/pdf', data: PDF.toString('base64') }).file.content_type, 'application/pdf');
+
+  assert.equal(S.checkFile({ content_type: 'image/svg+xml', data: Buffer.from('<svg/>').toString('base64') }).error, 'unsupported_type');
+  assert.equal(S.checkFile({ content_type: 'image/jpeg', data: PNG.toString('base64') }).error, 'type_mismatch');
+  assert.equal(S.checkFile({ content_type: 'image/png', data: '' }).error, 'bad_file');
+  const big = Buffer.concat([PNG, Buffer.alloc(S.MAX_IMAGE_BYTES)]);
+  assert.equal(S.checkFile({ content_type: 'image/png', data: big.toString('base64') }).error, 'file_too_large');
+  assert.equal(S.checkFile({ name: '../../etc/x".png', content_type: 'image/png', data: PNG.toString('base64') }).file.name, '.._.._etc_x_.png');
+  for (const code of ['bad_file', 'unsupported_type', 'file_too_large', 'type_mismatch']) assert.ok(S.MESSAGES[code], code);
+});
+
+test('a request needs a real prompt and 1 to 6 file ids', () => {
+  assert.deepEqual(S.checkRequest({ prompt: '  make it moody  ', file_ids: ['4', 4, '9'] }), { prompt: 'make it moody', fileIds: ['4', '9'] });
+  assert.equal(S.checkRequest({ prompt: 'hi', file_ids: ['1'] }).error, 'prompt_required');
+  assert.equal(S.checkRequest({ prompt: 'x'.repeat(S.MAX_PROMPT + 1), file_ids: ['1'] }).error, 'prompt_too_long');
+  assert.equal(S.checkRequest({ prompt: 'a castle', file_ids: [] }).error, 'file_required');
+  assert.equal(S.checkRequest({ prompt: 'a castle', file_ids: ['1', '2', '3', '4', '5', '6', '7'] }).error, 'too_many_files');
+  assert.equal(S.checkRequest({ prompt: 'a castle', file_ids: ['1; drop table'] }).error, 'bad_file');
+});
+
+// ---- project context -------------------------------------------------------
+
+test('the project context is read on the server from the instance files', async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ai-ctx-'));
+  fs.mkdirSync(path.join(root, 'docs'));
+  fs.writeFileSync(path.join(root, 'docs', 'project-context.template.md'), 'TEMPLATE TEXT');
+  fs.writeFileSync(path.join(root, 'DESIGN.md'), 'Night room. Glass rows.');
+  const branding = { identity: { productName: 'Moonfall', worldName: 'Tidelands' }, theme: { colors: { accent: '#7af' } } };
+
+  let ctx = await projectContext({ root, branding });
+  assert.match(ctx, /Moonfall, set in the world of Tidelands/);
+  assert.match(ctx, /#7af/);
+  assert.match(ctx, /TEMPLATE TEXT/, 'falls back to the template when no project doc is written');
+  assert.match(ctx, /Night room\. Glass rows\./);
+
+  fs.writeFileSync(path.join(root, 'docs', 'project-context.md'), 'REAL PROJECT DOC');
+  ctx = await projectContext({ root, branding });
+  assert.match(ctx, /REAL PROJECT DOC/);
+  assert.doesNotMatch(ctx, /TEMPLATE TEXT/);
+
+  fs.writeFileSync(path.join(root, 'DESIGN.md'), 'd'.repeat(S.CONTEXT_BUDGET.design + 500));
+  ctx = await projectContext({ root, branding });
+  assert.match(ctx, /cut for length/, 'a long doc is clipped to its budget');
+});
+
+// ---- the OpenRouter calls --------------------------------------------------
+
+function fakeFetch(responses) {
+  const calls = [];
+  const fn = async (url, init) => {
+    calls.push({ url, init, body: JSON.parse(init.body) });
+    const r = responses.shift();
+    if (r instanceof Error) throw r;
+    return { ok: r.status ? r.status < 400 : true, status: r.status || 200, json: async () => r.json };
+  };
+  fn.calls = calls;
+  return fn;
+}
+const replyJson = (text, cost) => ({ choices: [{ message: { content: text } }], usage: { cost } });
+const imageJson = (cost) => ({
+  choices: [{ message: { content: '', images: [{ image_url: { url: `data:image/png;base64,${PNG.toString('base64')}` } }] } }],
+  usage: { cost },
+});
+const files = [S.forProvider({ name: 's.png', content_type: 'image/png', bytes: PNG }), S.forProvider({ name: 'd.pdf', content_type: 'application/pdf', bytes: PDF })];
+
+test('the reply call sends the key only as a header and bills on the reported cost', async () => {
+  const f = fakeFetch([{ json: replyJson('Lovely silhouette.', 0.0123456) }]);
+  const out = await OR.reply({ fetchImpl: f, key: KEY, system: 'CTX', prompt: 'a castle', files });
+  assert.deepEqual(out, { text: 'Lovely silhouette.', costMicro: 12346 });
+  const c = f.calls[0];
+  assert.equal(c.url, OR.ENDPOINT);
+  assert.equal(c.init.headers.authorization, `Bearer ${KEY}`);
+  assert.ok(!c.init.body.includes(KEY), 'the key is never in the request body');
+  assert.deepEqual(c.body.usage, { include: true });
+  assert.equal(c.body.messages[0].content, 'CTX');
+  const parts = c.body.messages[1].content;
+  assert.equal(parts[1].type, 'image_url');
+  assert.equal(parts[2].type, 'file');
+});
+
+test('the image call returns the images and leaves PDFs out of the drawing brief', async () => {
+  const f = fakeFetch([{ json: imageJson(0.04) }]);
+  const out = await OR.images({ fetchImpl: f, key: KEY, system: 'CTX', brief: 'draw', files });
+  assert.equal(out.costMicro, 40000);
+  assert.equal(out.images.length, 1);
+  assert.equal(out.images[0].content_type, 'image/png');
+  assert.deepEqual(f.calls[0].body.modalities, ['image', 'text']);
+  assert.equal(f.calls[0].body.messages[1].content.filter((p) => p.type === 'file').length, 0);
+});
+
+test('a provider answer with no cost, an error, or no images fails, and no failure echoes the key', async () => {
+  const cases = [
+    [() => OR.reply({ fetchImpl: fakeFetch([{ json: { choices: [{ message: { content: 'x' } }] } }]), key: KEY, system: '', prompt: 'p', files: [] }), 'provider_cost_unknown'],
+    [() => OR.reply({ fetchImpl: fakeFetch([{ status: 401, json: { error: { message: `bad key ${KEY}` } } }]), key: KEY, system: '', prompt: 'p', files: [] }), 'provider_error'],
+    [() => OR.reply({ fetchImpl: fakeFetch([new Error(`socket ${KEY}`)]), key: KEY, system: '', prompt: 'p', files: [] }), 'provider_unreachable'],
+    [() => OR.images({ fetchImpl: fakeFetch([{ json: replyJson('no pictures', 0.01) }]), key: KEY, system: '', brief: 'b', files: [] }), 'provider_no_images'],
+  ];
+  for (const [call, code] of cases) {
+    await assert.rejects(call, (err) => {
+      assert.equal(err.code, code);
+      assert.ok(!String(err.message).includes(KEY), `${code} leaked the key`);
+      return true;
+    });
+  }
+});
+
+// ---- a whole generation on our key -----------------------------------------
+
+function fakeDb() {
+  const rows = { ledger: [], outputs: [], finished: null, running: null };
+  return {
+    rows,
+    appendLedger: async (r) => { rows.ledger.push(r); },
+    markRunning: async (id, src) => { rows.running = src; },
+    addOutput: async (id, builderId, img) => { rows.outputs.push({ id, builderId, img }); },
+    finishRequest: async (id, f) => { rows.finished = f; },
+  };
+}
+async function funded(usd) {
+  const b = payments.createFakeBackend();
+  if (usd) await b.topUp(7, { chargeMicro: usd * USD + 1, creditedMicro: usd * USD });
+  return b;
+}
+const request = { id: 41, builder_id: 7, prompt: 'a castle at dusk' };
+const okProviders = (calls = []) => ({
+  reply: async (a) => { calls.push(['reply', a]); return { text: 'Strong shapes.', costMicro: 12000 }; },
+  images: async (a) => { calls.push(['images', a]); return { images: [{ content_type: 'image/png', base64: PNG.toString('base64') }], costMicro: 38000 }; },
+});
+
+test('a generation charges exactly cost x 1.08 and records it apart', async () => {
+  const pay = await funded(5);
+  const db = fakeDb();
+  const calls = [];
+  const out = await runOnOurKey(request, files, { db, payments: pay, providers: okProviders(calls), fetchImpl: null, ourKey: KEY, context: 'CTX' });
+  assert.equal(out.status, 'done');
+  const cost = 12000 + 38000;
+  const price = P.priceFor(cost);
+  assert.equal(price.price_micro, 54000);
+  assert.deepEqual(
+    { c: db.rows.finished.provider_cost_micro, m: db.rows.finished.markup_micro, p: db.rows.finished.price_micro },
+    { c: 50000, m: 4000, p: 54000 });
+  assert.equal(db.rows.finished.status, 'done');
+  assert.equal(db.rows.finished.reply_md, 'Strong shapes.');
+  assert.equal(db.rows.outputs.length, 1);
+  assert.equal(db.rows.running, 'ours');
+  assert.deepEqual((await pay.balance(7)), { available_micro: 5 * USD - 54000, held_micro: 0 });
+  assert.deepEqual(db.rows.ledger.map((r) => r.kind), ['hold', 'capture']);
+  assert.ok(db.rows.ledger.every((r) => r.backend === 'fake' && r.requestId === '41'));
+  assert.equal(calls[0][1].system, 'CTX', 'the server-built context is what the provider sees');
+  assert.match(calls[1][1].brief, /Strong shapes\./, 'the image brief carries the reply');
+});
+
+test('a provider failure refunds the whole hold and says so', async () => {
+  const pay = await funded(5);
+  const db = fakeDb();
+  const providers = { ...okProviders(), images: async () => { throw new OR.ProviderError('provider_no_images', 'The AI provider returned no images.'); } };
+  const out = await runOnOurKey(request, files, { db, payments: pay, providers, ourKey: KEY, context: '' });
+  assert.equal(out.status, 'failed');
+  assert.equal(db.rows.finished.status, 'failed');
+  assert.match(db.rows.finished.error, /You were not charged\./);
+  assert.equal(db.rows.finished.price_micro, undefined);
+  assert.deepEqual(await pay.balance(7), { available_micro: 5 * USD, held_micro: 0 });
+  assert.deepEqual(db.rows.ledger.map((r) => r.kind), ['hold', 'release']);
+});
+
+test('a short balance refuses before any provider call', async () => {
+  const pay = await funded(0);
+  const db = fakeDb();
+  const calls = [];
+  const out = await runOnOurKey(request, files, { db, payments: pay, providers: okProviders(calls), ourKey: KEY, context: '' });
+  assert.equal(out.status, 'refused');
+  assert.equal(out.code, 'insufficient_funds');
+  assert.equal(calls.length, 0, 'nothing ran');
+  assert.match(db.rows.finished.error, /balance is too low/);
+  assert.deepEqual(db.rows.ledger, []);
+});
+
+test('with no key of ours configured a request is refused and no money is touched', async () => {
+  const pay = await funded(5);
+  const db = fakeDb();
+  const calls = [];
+  const out = await runOnOurKey(request, files, { db, payments: pay, providers: okProviders(calls), ourKey: '', context: '' });
+  assert.equal(out.status, 'refused');
+  assert.equal(calls.length, 0);
+  assert.equal(db.rows.running, null);
+  assert.deepEqual(await pay.balance(7), { available_micro: 5 * USD, held_micro: 0 });
+});
+
+test('once money was taken a storage failure never claims "not charged"', async () => {
+  const pay = await funded(5);
+  const db = fakeDb();
+  db.addOutput = async () => { throw new Error('disk full'); };
+  const out = await runOnOurKey(request, files, { db, payments: pay, providers: okProviders(), ourKey: KEY, context: '' });
+  assert.equal(out.status, 'failed');
+  assert.equal(out.code, 'store_failed');
+  assert.doesNotMatch(db.rows.finished.error, /not charged/);
+  assert.equal(db.rows.finished.price_micro, 54000, 'the receipt still shows what was paid');
+  assert.deepEqual(db.rows.ledger.map((r) => r.kind), ['hold', 'capture']);
+});
+
+// ---- the builder's own key (task 1004918) ----------------------------------
+
+test('which key runs: theirs whenever they have one, unless they ask for ours', () => {
+  const K = require('../modules/ai-studio/keys.js');
+  assert.deepEqual(K.chooseKey([], undefined), { source: 'ours' });
+  assert.deepEqual(K.chooseKey(['gemini'], undefined), { source: 'own', provider: 'gemini' });
+  assert.deepEqual(K.chooseKey(['gemini', 'openrouter'], undefined), { source: 'own', provider: 'openrouter' }, 'OpenRouter first: it reports its cost');
+  assert.deepEqual(K.chooseKey(['openrouter'], 'ours'), { source: 'ours' });
+  assert.deepEqual(K.chooseKey([], 'own'), { error: 'no_own_key' });
+  assert.deepEqual(K.chooseKey(['openrouter'], 'free'), { error: 'bad_pay_with' });
+});
+
+test('on their own key no money moves: one own_key row, price 0, cost noted', async () => {
+  const { runOnOwnKey } = require('../modules/ai-studio/generate.js');
+  const db = fakeDb();
+  const out = await runOnOwnKey(request, files, { db, providers: okProviders(), key: 'their-key', provider: 'openrouter', context: '' });
+  assert.equal(out.status, 'done');
+  assert.equal(db.rows.running, 'own');
+  assert.deepEqual([db.rows.finished.provider_cost_micro, db.rows.finished.markup_micro, db.rows.finished.price_micro], [50000, 0, 0]);
+  assert.equal(db.rows.ledger.length, 1);
+  assert.deepEqual([db.rows.ledger[0].kind, db.rows.ledger[0].amountMicro, db.rows.ledger[0].providerCostMicro], ['own_key', 0, 50000]);
+});
+
+test('a failure on their own key records no ledger row and says we charged nothing', async () => {
+  const { runOnOwnKey } = require('../modules/ai-studio/generate.js');
+  const db = fakeDb();
+  const providers = { ...okProviders(), reply: async () => { throw new OR.ProviderError('provider_error', 'The AI provider refused the request (HTTP 401).'); } };
+  const out = await runOnOwnKey(request, files, { db, providers, key: 'their-key', provider: 'openrouter', context: '' });
+  assert.equal(out.status, 'failed');
+  assert.match(db.rows.finished.error, /Nothing was charged by us/);
+  assert.deepEqual(db.rows.ledger, []);
+  assert.equal(db.rows.outputs.length, 0);
+});
+
+// ---- the key never leaves the server ---------------------------------------
+
+test('the routes never send our key or log a request body', () => {
+  const src = fs.readFileSync(new URL('../modules/ai-studio/routes/ai-studio.js', import.meta.url), 'utf8');
+  const mentions = src.split('\n').filter((l) => l.includes('OPENROUTER_API_KEY') && !/^\s*\/\//.test(l));
+  assert.equal(mentions.length, 1, 'our key is read in exactly one place');
+  assert.match(mentions[0], /ourKey: process\.env\.OPENROUTER_API_KEY/);
+  assert.doesNotMatch(src, /log\.\w+\([^)]*req\.body/, 'no log line carries a request body');
+  assert.doesNotMatch(src, /res\.json\([^)]*ourKey/);
+});

package/tests/ai_studio_keys.mjs

@@ -0,0 +1,159 @@
+// tests/ai_studio_keys.mjs — a builder's own AI provider keys (task 1004919,
+// goal 1000136, ADR 0392): saved only through the Settings route, stored
+// encrypted, and NEVER sent back to the browser or written to a log.
+//
+// Drives the real router over a stubbed db and a stand-in secret box, so it
+// needs no Postgres and no master key.
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import fs from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const K = require('../modules/ai-studio/keys.js');
+const db = require('../modules/ai-studio/db.js');
+const api = require('../src/module-api.js');
+
+const SECRET = 'sk-or-v1-THIS-IS-A-TEST-KEY-abcdef0123456789WXYZ';
+
+// ---- pure ------------------------------------------------------------------
+
+test('cleanKey trims, refuses blanks, spaces and silly lengths, and never echoes the key', () => {
+  assert.deepEqual(K.cleanKey(`  ${SECRET}\n`), { key: SECRET });
+  assert.equal(K.cleanKey('').error, 'key_required');
+  assert.equal(K.cleanKey(undefined).error, 'key_required');
+  assert.equal(K.cleanKey('short').error, 'key_wrong_length');
+  assert.equal(K.cleanKey('abcdefgh ijklmnopqrstu').error, 'key_has_spaces');
+  for (const bad of ['short', 'abcdefgh ijklmnopqrstu']) assert.ok(!JSON.stringify(K.cleanKey(bad)).includes(bad));
+});
+
+test('publicKey carries no field that could hold the key or its ciphertext', () => {
+  const row = { provider: 'openrouter', key_enc: 'v1.iv.tag.CIPHERTEXT', last4: 'WXYZ', set_at: '2026-10-28T00:00:00Z', plaintext: SECRET };
+  const out = K.publicKey('openrouter', row);
+  assert.deepEqual(Object.keys(out).sort(), ['label', 'last4', 'learn_more_url', 'provider', 'set', 'set_at']);
+  assert.equal(out.set, true);
+  assert.equal(out.last4, 'WXYZ');
+  assert.ok(!JSON.stringify(out).includes('CIPHERTEXT'));
+  assert.ok(!JSON.stringify(out).includes(SECRET));
+  assert.deepEqual(K.listPublic([]).map((k) => [k.provider, k.set]), [['openrouter', false], ['gemini', false]]);
+});
+
+test('the migration stores only ciphertext and the last four, for known providers', () => {
+  const sql = fs.readFileSync(new URL('../modules/ai-studio/migrations/ai_studio_001_keys.sql', import.meta.url), 'utf8');
+  assert.match(sql, /key_enc\s+TEXT\s+NOT NULL/);
+  assert.match(sql, /CHECK \(key_enc LIKE 'v1\.%'\)/);
+  assert.match(sql, /CHECK \(provider IN \('openrouter', 'gemini'\)\)/);
+  assert.match(sql, /INSERT INTO schema_migrations \(version\) VALUES \('ai_studio_001_keys'\)/);
+  assert.deepEqual(Object.keys(K.PROVIDERS).sort(), ['gemini', 'openrouter'], 'the CHECK and PROVIDERS must name the same providers');
+});
+
+// ---- the routes ------------------------------------------------------------
+
+const store = new Map();
+db.listKeyMeta = async (builderId) => [...store.values()].filter((r) => r.builder_id === builderId).map((r) => ({ provider: r.provider, last4: r.last4, set_at: r.set_at, key_enc: true }));
+db.setKey = async (builderId, provider, keyEnc, last4) => {
+  const row = { builder_id: builderId, provider, key_enc: keyEnc, last4, set_at: '2026-10-28T00:00:00Z' };
+  store.set(`${builderId}/${provider}`, row);
+  return { provider, last4, set_at: row.set_at, key_enc: true };
+};
+db.clearKey = async (builderId, provider) => store.delete(`${builderId}/${provider}`);
+
+let configured = true;
+const box = { isConfigured: () => configured, encrypt: (p) => `v1.iv.tag.${Buffer.from(p).toString('base64url')}`, decrypt: () => { throw new Error('a route must never decrypt'); } };
+const logged = [];
+const capture = (...args) => logged.push(JSON.stringify(args));
+const fakeLog = { info: capture, warn: capture, error: capture, debug: capture, child: () => fakeLog };
+let viewer = { id: 7, rank: 'xenos' };
+for (const [name, value] of Object.entries({
+  secretBox: box,
+  logger: () => fakeLog,
+  requireBuilder: (req, res, next) => { if (!viewer) return res.status(401).json({ error: { code: 'unauthenticated' } }); req.builder = viewer; next(); },
+  requireRank: () => (req, res, next) => next(),
+})) Object.defineProperty(api, name, { value, configurable: true, writable: true });
+
+const express = require('express');
+const app = express();
+app.use((req, res, next) => {
+  res.fail = (code, opts) => res.status(typeof opts === 'number' ? opts : (opts && opts.status) || 400).json({ error: { code, message: opts && opts.message } });
+  next();
+});
+app.use(express.json({ limit: '64kb' }));
+app.use('/api/bongos', require('../modules/ai-studio/routes/ai-studio.js')());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+test.after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : JSON.stringify(body);
+    const req = http.request(`${base}${path}`, { method, headers: data ? { 'content-type': 'application/json', 'content-length': Buffer.byteLength(data) } : {} }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => { const raw = Buffer.concat(chunks).toString(); resolve({ status: res.statusCode, raw, body: JSON.parse(raw) }); });
+    });
+    req.on('error', reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+test('THE WHOLE PATH: save a key, list it, replace it, remove it, and the key never comes back', async () => {
+  const saved = await call('PUT', '/ai-studio/keys/openrouter', { key: SECRET });
+  assert.equal(saved.status, 200);
+  assert.equal(saved.body.key.set, true);
+  assert.equal(saved.body.key.last4, 'WXYZ');
+
+  // It is stored encrypted, never as the plaintext.
+  const row = store.get('7/openrouter');
+  assert.ok(row.key_enc.startsWith('v1.'));
+  assert.notEqual(row.key_enc, SECRET);
+
+  const listed = await call('GET', '/ai-studio/keys');
+  assert.equal(listed.status, 200);
+  assert.equal(listed.body.storage_configured, true);
+  assert.deepEqual(listed.body.keys.map((k) => [k.provider, k.set, k.last4]), [['openrouter', true, 'WXYZ'], ['gemini', false, null]]);
+
+  const removed = await call('DELETE', '/ai-studio/keys/openrouter');
+  assert.equal(removed.body.removed, true);
+  assert.equal(removed.body.key.set, false);
+
+  // Nothing any route answered, and nothing logged, holds the key or its ciphertext.
+  for (const r of [saved, listed, removed]) {
+    assert.ok(!r.raw.includes(SECRET), 'a response carried the key');
+    assert.ok(!r.raw.includes(row.key_enc), 'a response carried the ciphertext');
+  }
+  assert.ok(logged.length > 0, 'the routes do log, so the next check is not vacuous');
+  for (const line of logged) {
+    assert.ok(!line.includes(SECRET), 'a log line carried the key');
+    assert.ok(!line.includes('WXYZ') || !line.includes(SECRET.slice(0, 12)), 'a log line carried part of the key');
+  }
+});
+
+test('a builder only ever sees their own keys', async () => {
+  viewer = { id: 7, rank: 'xenos' };
+  await call('PUT', '/ai-studio/keys/gemini', { key: SECRET });
+  viewer = { id: 8, rank: 'xenos' };
+  const other = await call('GET', '/ai-studio/keys');
+  assert.deepEqual(other.body.keys.map((k) => k.set), [false, false]);
+  viewer = { id: 7, rank: 'xenos' };
+  await call('DELETE', '/ai-studio/keys/gemini');
+});
+
+test('refusals: unknown provider, bad key, no storage, signed out', async () => {
+  assert.equal((await call('PUT', '/ai-studio/keys/acme', { key: SECRET })).status, 404);
+  const bad = await call('PUT', '/ai-studio/keys/openrouter', { key: 'nope' });
+  assert.equal(bad.status, 400);
+  assert.ok(!bad.raw.includes('nope'));
+  configured = false;
+  const off = await call('PUT', '/ai-studio/keys/openrouter', { key: SECRET });
+  assert.equal(off.status, 409);
+  assert.equal(off.body.error.code, 'storage_not_configured');
+  assert.equal(store.size, 0, 'nothing is stored when storage is not set up');
+  configured = true;
+  viewer = null;
+  assert.equal((await call('GET', '/ai-studio/keys')).status, 401);
+  viewer = { id: 7, rank: 'xenos' };
+});