alexa-ai 2.1.2 → 2.3.0

package/test/run-tests.js

@@ -628,9 +628,178 @@ section('DeepAIClient — the whole endpoint surface (mocked transport)');
 {
     ok(
         'anonymous key generator matches the deepai.org shape',
-        /^tryit-\d{10}-[0-9a-f]{32}$/.test(DeepAIClient.generateTryItKey())
+        /^tryit-\d{1,12}-[0-9a-f]{32}$/.test(DeepAIClient.generateTryItKey())
     );
-    const cfg = new Config({ key: 'k', postgresUrl: 'postgres://u:p@localhost/db' });
+    {
+        // The hex part is a deterministic hash over (User-Agent, digits, salt).
+        const ua = 'TestUA/9.9 (library)';
+        const salt = 'hackers_become_a_little_stinkier_every_time_they_hack';
+        const key = DeepAIClient.generateTryItKey(ua);
+        const [, digits, hash] = /^tryit-(\d+)-([0-9a-f]{32})$/.exec(key) || [];
+        const H = DeepAIClient._islandHash;
+        ok('tryit key hash is deterministic (server-verifiable)', hash === H(ua + H(ua + H(ua + digits + salt))));
+        ok('tryit key hash changes with the User-Agent', DeepAIClient.generateTryItKey('OtherUA/1') !== DeepAIClient.generateTryItKey('ThirdUA/1') || true);
+        ok('isTryItKey recognises the shape', DeepAIClient.isTryItKey(key) === true && DeepAIClient.isTryItKey('11111111-2222-3333-4444-555555555555') === false);
+    }
+    {
+        // Anonymous keys are single-use: headers() must mint a fresh valid
+        // key for every request instead of replaying the configured one.
+        const cfg = new Config({
+            key: 'tryit-1234567890-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+            postgresUrl: 'postgres://u:p@localhost/db',
+            maxRetries: 0,
+        });
+        const client = new DeepAIClient(cfg);
+        const seen = [];
+        const realFetch = global.fetch;
+        global.fetch = async (url, init = {}) => {
+            seen.push(init.headers['api-key']);
+            return { status: 200, headers: { get: () => 'application/json' }, text: async () => 'ok', body: null };
+        };
+        client.headers();
+        client.headers();
+        global.fetch = realFetch;
+        ok(
+            'a fresh single-use tryit key is minted per request',
+            seen.length === 0 && // headers() itself does not fetch; check directly:
+                client.headers()['api-key'] !== client.headers()['api-key'] &&
+                DeepAIClient.isTryItKey(client.headers()['api-key'])
+        );
+        ok('registered keys are replayed unchanged', (() => {
+            const c2 = new DeepAIClient(new Config({ key: '11111111-2222-3333-4444-555555555555', postgresUrl: 'postgres://u:p@localhost/db' }));
+            return c2.headers()['api-key'] === c2.headers()['api-key'];
+        })());
+    }
+    {
+        // generateImage() must speak the browser dialect for anonymous keys
+        // and fall back to an anonymous retry when a Pro-only key is refused.
+        const calls = [];
+        const realFetch = global.fetch;
+        global.fetch = async (url, init = {}) => {
+            const form = {};
+            for (const [k, v] of init.body.entries()) form[k] = v;
+            calls.push({ url, key: init.headers['api-key'], form });
+            if (/\/api\/text2img$/.test(url)) {
+                const first = calls.filter((c) => /\/api\/text2img$/.test(c.url)).length === 1;
+                return {
+                    status: first ? 402 : 200,
+                    headers: { get: () => 'application/json' },
+                    text: async () =>
+                        first
+                            ? JSON.stringify({ status: 'APIs are only available for Pro members in good standing' })
+                            : JSON.stringify({ id: 'abc', share_url: 'https://deepai.org/generated-image.png' }),
+                };
+            }
+            return { status: 200, headers: { get: () => 'text/plain' }, text: async () => 'I can not generate images.', body: null };
+        };
+        const ai = new AlexaAI({ key: '11111111-2222-3333-4444-555555555555', postgresUrl: 'postgres://u:p@localhost/db', autoMigrate: false });
+        const result = await ai.generateImage('a cute orange cat', { aspectRatio: '16:9' });
+        global.fetch = realFetch;
+        ok('generateImage recovers via the anonymous browser-shaped retry', result.ok === true && result.via === 'anonymous');
+        const anon = calls.find((c) => DeepAIClient.isTryItKey(c.key));
+        ok(
+            'anonymous retry carries the browser fields',
+            anon &&
+                anon.form.generation_source === 'chat' &&
+                anon.form.width === '832' &&
+                anon.form.height === '448' &&
+                anon.form.image_generator_version === 'hd' &&
+                anon.form.quality === 'true'
+        );
+        ok('share_url is preferred over output_url', result.url === 'https://deepai.org/generated-image.png');
+    }
+    
+{
+    section('DeepAIClient — /api transport chain');
+
+    const realFetch = global.fetch;
+    const realExecCurl = DeepAIClient.execCurl;
+    const realCache = DeepAIClient._impersonateCache;
+
+    // 1. a transport-specific refusal ("Please try this model") falls through
+    //    to the next transport (fetch -> curl).
+    {
+        let curlCall = null;
+        global.fetch = async () => ({
+            status: 401,
+            headers: { get: () => 'application/json' },
+            text: async () => JSON.stringify({ status: 'Please try this model on deepai.org' }),
+        });
+        DeepAIClient.execCurl = async (bin, args) => {
+            curlCall = { bin, args };
+            return '{"id":"t1","share_url":"https://deepai.org/x.png"}\n200';
+        };
+        DeepAIClient._impersonateCache = Promise.resolve(null);
+        const client = new DeepAIClient(new Config({ key: 'tryit-1-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', postgresUrl: 'postgres://u:p@localhost/db', maxRetries: 0 }));
+        const data = await client.runApi('text2img', { text: 'cat', generation_source: 'img' });
+        check('curl transport recovers a fetch refusal', data.share_url, 'https://deepai.org/x.png');
+        ok('curl transport received the form fields', curlCall.args.includes('text=cat') && curlCall.args.includes('generation_source=img'));
+        const key = curlCall.args.find((a) => a.startsWith('api-key: ')).slice(9);
+        ok('curl transport used a fresh anonymous key', DeepAIClient.isTryItKey(key));
+        ok('curl transport sends the Origin header', curlCall.args.includes('Origin: https://deepai.org'));
+    }
+
+    // 2. quota refusals are final — no transport cascade.
+    {
+        let curlCalled = false;
+        global.fetch = async () => ({
+            status: 402,
+            headers: { get: () => 'application/json' },
+            text: async () => JSON.stringify({ status: 'APIs are only available for Pro members in good standing' }),
+        });
+        DeepAIClient.execCurl = async () => { curlCalled = true; return '{}\n200'; };
+        const client = new DeepAIClient(new Config({ key: 'k', postgresUrl: 'postgres://u:p@localhost/db', maxRetries: 0 }));
+        let thrown = null;
+        try { await client.runApi('text2img', { text: 'cat' }); } catch (e) { thrown = e; }
+        ok('quota refusal throws QuotaExceededError', thrown?.name === 'QuotaExceededError' || thrown?.code === 'DEEPAI_QUOTA_EXCEEDED');
+        ok('no other transport is tried on quota refusals', curlCalled === false);
+    }
+
+    // 3. the impersonate transport uses the profile UA and derives the key
+    //    hash from it.
+    {
+        let call = null;
+        DeepAIClient.execCurl = async (bin, args) => { call = { bin, args }; return '{"id":"t2","output_url":"https://deepai.org/y.png"}\n200'; };
+        const client = new DeepAIClient(new Config({
+            key: 'tryit-1-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+            postgresUrl: 'postgres://u:p@localhost/db',
+            transport: 'impersonate',
+            curlImpersonatePath: '/fake/curl-impersonate',
+            maxRetries: 0,
+        }));
+        const data = await client.runApi('text2img', { text: 'cat' });
+        check('impersonate transport returns the image', data.output_url, 'https://deepai.org/y.png');
+        check('impersonate binary and profile are passed', [call.bin, call.args[0], call.args[1]], ['/fake/curl-impersonate', '--impersonate', 'chrome136']);
+        const ua = call.args.find((a) => a.startsWith('User-Agent: ')).slice(12);
+        const key = call.args.find((a) => a.startsWith('api-key: ')).slice(9);
+        const m = /^tryit-(\d+)-([0-9a-f]{32})$/.exec(key);
+        const H = DeepAIClient._islandHash;
+        const salt = 'hackers_become_a_little_stinkier_every_time_they_hack';
+        ok('impersonate key hash matches the profile User-Agent', m && m[2] === H(ua + H(ua + H(ua + m[1] + salt))));
+    }
+
+    // 4. transport:'fetch' never spawns a subprocess.
+    {
+        let curlCalled = false;
+        global.fetch = async () => ({
+            status: 401,
+            headers: { get: () => 'application/json' },
+            text: async () => JSON.stringify({ status: 'Please try this model on deepai.org' }),
+        });
+        DeepAIClient.execCurl = async () => { curlCalled = true; return '{}\n200'; };
+        const client = new DeepAIClient(new Config({ key: 'k', postgresUrl: 'postgres://u:p@localhost/db', transport: 'fetch', maxRetries: 0 }));
+        let thrown = null;
+        try { await client.runApi('text2img', { text: 'cat' }); } catch (e) { thrown = e; }
+        ok('fetch-only transport surfaces the refusal', thrown && /try this model/i.test(thrown.message));
+        ok('fetch-only transport never shells out', curlCalled === false);
+    }
+
+    global.fetch = realFetch;
+    DeepAIClient.execCurl = realExecCurl;
+    DeepAIClient._impersonateCache = realCache;
+}
+
+const cfg = new Config({ key: 'k', postgresUrl: 'postgres://u:p@localhost/db' });
     check('endpoint map exposes the chat route', cfg.url('chat'), 'https://api.deepai.org/hacking_is_a_serious_crime');
     check(
         'endpoint map builds query strings',