@vellumai/assistant 0.6.3 → 0.6.4

package/src/runtime/routes/__tests__/migration-import-credential-filter.test.ts

@@ -0,0 +1,208 @@
+/**
+ * Tests for platform credential filtering during bundle import.
+ *
+ * The filtering logic in migration-routes.ts uses the PLATFORM_CREDENTIAL_PREFIX
+ * constant ("vellum:") to exclude platform-identity credentials from being
+ * written to the credential store during import. Since the filtering is a simple
+ * array filter, we test the logic directly using the same prefix constant and
+ * extractCredentialsFromBundle function — without needing to drive the full
+ * HTTP handler (which has heavy transitive dependencies).
+ *
+ * Covers:
+ * - vellum:* credentials are excluded when filtering with the prefix
+ * - User credentials (without vellum: prefix) pass through unchanged
+ * - Mixed bundles correctly split platform vs user credentials
+ * - skippedPlatform count is accurate
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import { extractCredentialsFromBundle } from "../../migrations/vbundle-importer.js";
+import type {
+  ManifestType,
+  VBundleTarEntry,
+} from "../../migrations/vbundle-validator.js";
+
+// ---------------------------------------------------------------------------
+// The same constant used by migration-routes.ts
+// ---------------------------------------------------------------------------
+
+const PLATFORM_CREDENTIAL_PREFIX = "vellum:";
+
+// ---------------------------------------------------------------------------
+// Helpers (same pattern as vbundle-import-credentials.test.ts)
+// ---------------------------------------------------------------------------
+
+function makeTarEntry(data: string): VBundleTarEntry {
+  const encoded = new TextEncoder().encode(data);
+  return { name: "", data: encoded, size: encoded.length };
+}
+
+function makeManifest(paths: string[]): ManifestType {
+  return {
+    schema_version: "1.0.0",
+    created_at: new Date().toISOString(),
+    source: "test",
+    manifest_sha256: "test",
+    files: paths.map((path) => ({
+      path,
+      size: 0,
+      sha256: "test",
+    })),
+  } as ManifestType;
+}
+
+/**
+ * Simulate the filtering logic from migration-routes.ts:
+ *
+ *   const userCredentials = bundleCredentials.filter(
+ *     (c) => !c.account.startsWith(PLATFORM_CREDENTIAL_PREFIX),
+ *   );
+ */
+function filterCredentials(
+  bundleCredentials: Array<{ account: string; value: string }>,
+) {
+  const userCredentials = bundleCredentials.filter(
+    (c) => !c.account.startsWith(PLATFORM_CREDENTIAL_PREFIX),
+  );
+  const skippedPlatform = bundleCredentials.length - userCredentials.length;
+  return { userCredentials, skippedPlatform };
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("migration import credential filtering", () => {
+  test("vellum:-prefixed credentials are excluded", () => {
+    const entries = new Map<string, VBundleTarEntry>();
+    entries.set("credentials/vellum:assistant_api_key", makeTarEntry("key-1"));
+    entries.set(
+      "credentials/vellum:platform_assistant_id",
+      makeTarEntry("asst-2"),
+    );
+    entries.set(
+      "credentials/vellum:platform_base_url",
+      makeTarEntry("https://example.com"),
+    );
+    entries.set(
+      "credentials/vellum:platform_organization_id",
+      makeTarEntry("org-3"),
+    );
+    entries.set("credentials/vellum:platform_user_id", makeTarEntry("user-4"));
+    entries.set("credentials/vellum:webhook_secret", makeTarEntry("whsec-5"));
+
+    const manifest = makeManifest([
+      "credentials/vellum:assistant_api_key",
+      "credentials/vellum:platform_assistant_id",
+      "credentials/vellum:platform_base_url",
+      "credentials/vellum:platform_organization_id",
+      "credentials/vellum:platform_user_id",
+      "credentials/vellum:webhook_secret",
+    ]);
+
+    const bundleCredentials = extractCredentialsFromBundle(entries, manifest);
+    const { userCredentials, skippedPlatform } =
+      filterCredentials(bundleCredentials);
+
+    expect(userCredentials).toHaveLength(0);
+    expect(skippedPlatform).toBe(6);
+  });
+
+  test("user credentials without vellum: prefix pass through unchanged", () => {
+    const entries = new Map<string, VBundleTarEntry>();
+    entries.set("credentials/openai-key", makeTarEntry("sk-user-123"));
+    entries.set("credentials/anthropic-key", makeTarEntry("sk-ant-456"));
+
+    const manifest = makeManifest([
+      "credentials/openai-key",
+      "credentials/anthropic-key",
+    ]);
+
+    const bundleCredentials = extractCredentialsFromBundle(entries, manifest);
+    const { userCredentials, skippedPlatform } =
+      filterCredentials(bundleCredentials);
+
+    expect(userCredentials).toHaveLength(2);
+    expect(userCredentials).toContainEqual({
+      account: "openai-key",
+      value: "sk-user-123",
+    });
+    expect(userCredentials).toContainEqual({
+      account: "anthropic-key",
+      value: "sk-ant-456",
+    });
+    expect(skippedPlatform).toBe(0);
+  });
+
+  test("mixed bundle with both vellum:* and user credentials correctly splits", () => {
+    const entries = new Map<string, VBundleTarEntry>();
+    entries.set(
+      "credentials/vellum:assistant_api_key",
+      makeTarEntry("platform-key"),
+    );
+    entries.set(
+      "credentials/vellum:platform_user_id",
+      makeTarEntry("platform-user"),
+    );
+    entries.set("credentials/openai-key", makeTarEntry("sk-user-123"));
+    entries.set("credentials/anthropic-key", makeTarEntry("sk-ant-456"));
+    entries.set("credentials/github-token", makeTarEntry("ghp-789"));
+
+    const manifest = makeManifest([
+      "credentials/vellum:assistant_api_key",
+      "credentials/vellum:platform_user_id",
+      "credentials/openai-key",
+      "credentials/anthropic-key",
+      "credentials/github-token",
+    ]);
+
+    const bundleCredentials = extractCredentialsFromBundle(entries, manifest);
+    const { userCredentials, skippedPlatform } =
+      filterCredentials(bundleCredentials);
+
+    // Only user credentials should pass through
+    expect(userCredentials).toHaveLength(3);
+    const accounts = userCredentials.map((c) => c.account).sort();
+    expect(accounts).toEqual(["anthropic-key", "github-token", "openai-key"]);
+
+    // No vellum: credentials in the filtered output
+    const vellumCreds = userCredentials.filter((c) =>
+      c.account.startsWith("vellum:"),
+    );
+    expect(vellumCreds).toHaveLength(0);
+
+    expect(skippedPlatform).toBe(2);
+  });
+
+  test("skippedPlatform count is accurate with mixed credentials", () => {
+    const entries = new Map<string, VBundleTarEntry>();
+    entries.set("credentials/vellum:assistant_api_key", makeTarEntry("v1"));
+    entries.set("credentials/vellum:platform_base_url", makeTarEntry("v2"));
+    entries.set("credentials/vellum:webhook_secret", makeTarEntry("v3"));
+    entries.set("credentials/user-key", makeTarEntry("user-val"));
+
+    const manifest = makeManifest([
+      "credentials/vellum:assistant_api_key",
+      "credentials/vellum:platform_base_url",
+      "credentials/vellum:webhook_secret",
+      "credentials/user-key",
+    ]);
+
+    const bundleCredentials = extractCredentialsFromBundle(entries, manifest);
+    const { userCredentials, skippedPlatform } =
+      filterCredentials(bundleCredentials);
+
+    expect(skippedPlatform).toBe(3);
+    expect(userCredentials).toHaveLength(1);
+    expect(userCredentials[0]).toEqual({
+      account: "user-key",
+      value: "user-val",
+    });
+
+    // Verify total = user + skipped
+    expect(bundleCredentials.length).toBe(
+      userCredentials.length + skippedPlatform,
+    );
+  });
+});

package/src/runtime/routes/__tests__/stt-routes.test.ts

@@ -0,0 +1,406 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Module mocks — must appear before any imports of the modules under test
+// ---------------------------------------------------------------------------
+
+mock.module("../../../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+// -- Transcriber mock -------------------------------------------------------
+
+import type { BatchTranscriber } from "../../../stt/types.js";
+import { SttError } from "../../../stt/types.js";
+
+let mockTranscriber: BatchTranscriber | null = null;
+let mockResolveError: Error | null = null;
+
+mock.module("../../../providers/speech-to-text/resolve.js", () => ({
+  resolveBatchTranscriber: async () => {
+    if (mockResolveError) throw mockResolveError;
+    return mockTranscriber;
+  },
+}));
+
+// ---------------------------------------------------------------------------
+// Import under test — after mocks
+// ---------------------------------------------------------------------------
+
+import type { RouteContext } from "../../http-router.js";
+import { sttRouteDefinitions } from "../stt-routes.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function getTranscribeHandler() {
+  const routes = sttRouteDefinitions();
+  return routes[0].handler;
+}
+
+function makeRouteContext(body: unknown): RouteContext {
+  const url = new URL("http://localhost/v1/stt/transcribe");
+  return {
+    req: new Request(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: typeof body === "string" ? body : JSON.stringify(body),
+    }),
+    url,
+    server: {} as RouteContext["server"],
+    authContext: {
+      subject: "test-user",
+      principalType: "local",
+      assistantId: "self",
+      scopeProfile: "local_v1",
+      scopes: new Set(["local.all" as const]),
+      policyEpoch: 0,
+    },
+    params: {},
+  } as unknown as RouteContext;
+}
+
+function makeInvalidJsonContext(): RouteContext {
+  const url = new URL("http://localhost/v1/stt/transcribe");
+  return {
+    req: new Request(url, {
+      method: "POST",
+      body: "not-json",
+    }),
+    url,
+    server: {} as RouteContext["server"],
+    authContext: {
+      subject: "test-user",
+      principalType: "local",
+      assistantId: "self",
+      scopeProfile: "local_v1",
+      scopes: new Set(["local.all" as const]),
+      policyEpoch: 0,
+    },
+    params: {},
+  } as unknown as RouteContext;
+}
+
+async function readErrorBody(
+  response: Response,
+): Promise<{ error: { code: string; message: string } }> {
+  return response.json();
+}
+
+/** Encode a string to base64 to simulate valid audio data. */
+function toBase64(data: string): string {
+  return Buffer.from(data).toString("base64");
+}
+
+// ---------------------------------------------------------------------------
+// Setup / teardown
+// ---------------------------------------------------------------------------
+
+const fakeTranscriber: BatchTranscriber = {
+  providerId: "openai-whisper",
+  boundaryId: "daemon-batch",
+  transcribe: async () => ({ text: "hello world" }),
+};
+
+beforeEach(() => {
+  mockTranscriber = fakeTranscriber;
+  mockResolveError = null;
+});
+
+afterEach(() => {
+  // Reset to defaults
+});
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("stt-routes", () => {
+  // -- Route metadata -------------------------------------------------------
+
+  test("exports a route definition for stt/transcribe", () => {
+    const routes = sttRouteDefinitions();
+    expect(routes).toHaveLength(1);
+    expect(routes[0].endpoint).toBe("stt/transcribe");
+    expect(routes[0].method).toBe("POST");
+    expect(routes[0].policyKey).toBe("stt/transcribe");
+  });
+
+  // -- Success path ---------------------------------------------------------
+
+  test("returns transcribed text with provider and boundary ids", async () => {
+    const handler = getTranscribeHandler();
+    const res = await handler(
+      makeRouteContext({
+        audioBase64: toBase64("fake-audio-data"),
+        mimeType: "audio/wav",
+      }),
+    );
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      text: string;
+      providerId: string;
+      boundaryId: string;
+    };
+    expect(body.text).toBe("hello world");
+    expect(body.providerId).toBe("openai-whisper");
+    expect(body.boundaryId).toBe("daemon-batch");
+  });
+
+  test("accepts optional source parameter", async () => {
+    const handler = getTranscribeHandler();
+    const res = await handler(
+      makeRouteContext({
+        audioBase64: toBase64("fake-audio-data"),
+        mimeType: "audio/wav",
+        source: "dictation",
+      }),
+    );
+
+    expect(res.status).toBe(200);
+  });
+
+  // -- Malformed body -------------------------------------------------------
+
+  test("returns 400 for invalid JSON body", async () => {
+    const handler = getTranscribeHandler();
+    const res = await handler(makeInvalidJsonContext());
+
+    expect(res.status).toBe(400);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("BAD_REQUEST");
+    expect(body.error.message).toContain("Invalid JSON");
+  });
+
+  test("returns 400 when audioBase64 is missing", async () => {
+    const handler = getTranscribeHandler();
+    const res = await handler(makeRouteContext({ mimeType: "audio/wav" }));
+
+    expect(res.status).toBe(400);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("BAD_REQUEST");
+    expect(body.error.message).toContain("audioBase64");
+  });
+
+  test("returns 400 when audioBase64 is empty string", async () => {
+    const handler = getTranscribeHandler();
+    const res = await handler(
+      makeRouteContext({ audioBase64: "", mimeType: "audio/wav" }),
+    );
+
+    expect(res.status).toBe(400);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("BAD_REQUEST");
+    expect(body.error.message).toContain("audioBase64");
+  });
+
+  test("returns 400 when mimeType is missing", async () => {
+    const handler = getTranscribeHandler();
+    const res = await handler(
+      makeRouteContext({ audioBase64: toBase64("data") }),
+    );
+
+    expect(res.status).toBe(400);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("BAD_REQUEST");
+    expect(body.error.message).toContain("mimeType");
+  });
+
+  test("returns 400 when mimeType does not start with audio/", async () => {
+    const handler = getTranscribeHandler();
+    const res = await handler(
+      makeRouteContext({
+        audioBase64: toBase64("data"),
+        mimeType: "text/plain",
+      }),
+    );
+
+    expect(res.status).toBe(400);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("BAD_REQUEST");
+    expect(body.error.message).toContain("mimeType");
+    expect(body.error.message).toContain("audio/");
+  });
+
+  // -- Empty audio after decode ---------------------------------------------
+
+  test("returns 400 when decoded audio payload is empty", async () => {
+    const handler = getTranscribeHandler();
+    // An empty base64 string "" is caught by the non-empty check above.
+    // Use a base64 that decodes to empty buffer — this is actually impossible
+    // for valid base64. But we can test with a base64 of zero-length content
+    // by using the base64 of an empty string.
+    const res = await handler(
+      makeRouteContext({
+        audioBase64: Buffer.from("").toString("base64"), // ""
+        mimeType: "audio/wav",
+      }),
+    );
+
+    // The empty base64 "" is caught by the non-empty string check
+    expect(res.status).toBe(400);
+  });
+
+  // -- Missing provider (503) -----------------------------------------------
+
+  test("returns 503 when no STT provider is configured", async () => {
+    mockTranscriber = null;
+
+    const handler = getTranscribeHandler();
+    const res = await handler(
+      makeRouteContext({
+        audioBase64: toBase64("audio-data"),
+        mimeType: "audio/wav",
+      }),
+    );
+
+    expect(res.status).toBe(503);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("SERVICE_UNAVAILABLE");
+    expect(body.error.message).toContain("configured");
+  });
+
+  test("returns 503 when transcriber resolution throws", async () => {
+    mockResolveError = new Error("credential store unavailable");
+
+    const handler = getTranscribeHandler();
+    const res = await handler(
+      makeRouteContext({
+        audioBase64: toBase64("audio-data"),
+        mimeType: "audio/wav",
+      }),
+    );
+
+    expect(res.status).toBe(503);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("SERVICE_UNAVAILABLE");
+    expect(body.error.message).toContain("not available");
+  });
+
+  // -- Timeout --------------------------------------------------------------
+
+  test("returns 504 when transcription times out", async () => {
+    mockTranscriber = {
+      providerId: "openai-whisper",
+      boundaryId: "daemon-batch",
+      transcribe: async (_request) => {
+        // Simulate timeout by checking if abort signal fires
+        const err = new Error("The operation was aborted");
+        err.name = "AbortError";
+        throw err;
+      },
+    };
+
+    const handler = getTranscribeHandler();
+    const res = await handler(
+      makeRouteContext({
+        audioBase64: toBase64("audio-data"),
+        mimeType: "audio/wav",
+      }),
+    );
+
+    expect(res.status).toBe(504);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("INTERNAL_ERROR");
+    expect(body.error.message).toContain("timed out");
+  });
+
+  // -- Provider failure (various categories) --------------------------------
+
+  test("returns 401 for auth errors from provider", async () => {
+    mockTranscriber = {
+      providerId: "openai-whisper",
+      boundaryId: "daemon-batch",
+      transcribe: async () => {
+        throw new SttError("auth", "Invalid API key (401)");
+      },
+    };
+
+    const handler = getTranscribeHandler();
+    const res = await handler(
+      makeRouteContext({
+        audioBase64: toBase64("audio-data"),
+        mimeType: "audio/wav",
+      }),
+    );
+
+    expect(res.status).toBe(401);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("UNAUTHORIZED");
+    expect(body.error.message).toContain("credentials");
+  });
+
+  test("returns 429 for rate-limit errors from provider", async () => {
+    mockTranscriber = {
+      providerId: "openai-whisper",
+      boundaryId: "daemon-batch",
+      transcribe: async () => {
+        throw new SttError("rate-limit", "Rate limited (429)");
+      },
+    };
+
+    const handler = getTranscribeHandler();
+    const res = await handler(
+      makeRouteContext({
+        audioBase64: toBase64("audio-data"),
+        mimeType: "audio/wav",
+      }),
+    );
+
+    expect(res.status).toBe(429);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("RATE_LIMITED");
+    expect(body.error.message).toContain("rate limit");
+  });
+
+  test("returns 400 for invalid-audio errors from provider", async () => {
+    mockTranscriber = {
+      providerId: "openai-whisper",
+      boundaryId: "daemon-batch",
+      transcribe: async () => {
+        throw new SttError("invalid-audio", "Unsupported audio format (400)");
+      },
+    };
+
+    const handler = getTranscribeHandler();
+    const res = await handler(
+      makeRouteContext({
+        audioBase64: toBase64("audio-data"),
+        mimeType: "audio/wav",
+      }),
+    );
+
+    expect(res.status).toBe(400);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("BAD_REQUEST");
+    expect(body.error.message).toContain("rejected");
+  });
+
+  test("returns 502 for generic provider errors", async () => {
+    mockTranscriber = {
+      providerId: "openai-whisper",
+      boundaryId: "daemon-batch",
+      transcribe: async () => {
+        throw new Error("upstream kaboom");
+      },
+    };
+
+    const handler = getTranscribeHandler();
+    const res = await handler(
+      makeRouteContext({
+        audioBase64: toBase64("audio-data"),
+        mimeType: "audio/wav",
+      }),
+    );
+
+    expect(res.status).toBe(502);
+    const body = await readErrorBody(res);
+    expect(body.error.code).toBe("INTERNAL_ERROR");
+    expect(body.error.message).toContain("provider error");
+  });
+});