offrouter-core 0.0.0

package/src/config.test.ts

@@ -0,0 +1,415 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import {
+  ConfigError,
+  defaultConfig,
+  loadConfig,
+  resolveOffRouterHome,
+} from "./config.js";
+import { evaluatePolicy } from "./policy.js";
+import type { ProviderCandidate, RouteRequest } from "./types.js";
+
+async function makeHome(): Promise<string> {
+  return mkdtemp(join(tmpdir(), "offrouter-home-"));
+}
+
+async function makeProject(): Promise<string> {
+  return mkdtemp(join(tmpdir(), "offrouter-project-"));
+}
+
+const tempDirs: string[] = [];
+
+afterEach(async () => {
+  await Promise.all(
+    tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })),
+  );
+});
+
+async function trackDir(maker: () => Promise<string>): Promise<string> {
+  const dir = await maker();
+  tempDirs.push(dir);
+  return dir;
+}
+
+function baseRequest(
+  profile: string,
+  workspace: { cwd: string; trusted: boolean },
+): RouteRequest {
+  return {
+    protocolVersion: "offrouter.route.v1",
+    requestId: "req_config",
+    harness: { kind: "claude", profile },
+    task: {
+      promptPreview: "explain this",
+      promptDigest: "sha256:config",
+      kind: "explain",
+      risk: "low",
+    },
+    workspace,
+    constraints: {
+      subscriptionFirst: true,
+      allowApiKeyFallback: false,
+    },
+  };
+}
+
+function subscriptionCandidate(): ProviderCandidate {
+  return {
+    providerId: "claude",
+    modelId: "sonnet",
+    authTier: "subscription",
+    authScope: "first-party",
+    subscriptionStatus: "active",
+    health: "healthy",
+    supportsTools: true,
+    supportsStreaming: true,
+    supportsJson: true,
+    supportsImages: false,
+  };
+}
+
+describe("defaultConfig", () => {
+  it("denies *-work profiles and has no providers by default", () => {
+    const config = defaultConfig();
+
+    expect(config.policy.deniedProfilePatterns).toContain("*-work");
+    expect(config.policy.allowlistedProfiles).toEqual([]);
+    expect(config.providers).toEqual({});
+    expect(Object.keys(config.profiles)).toEqual([]);
+
+    const decision = evaluatePolicy(
+      baseRequest("claude-work", { cwd: "/tmp/p", trusted: true }),
+      [subscriptionCandidate()],
+      config.policy,
+    );
+    expect(decision.allowed).toEqual([]);
+    expect(decision.denials.some((d) => d.code === "work_profile_denied")).toBe(
+      true,
+    );
+  });
+});
+
+describe("resolveOffRouterHome", () => {
+  it("prefers OFFROUTER_HOME over ~/.offrouter", () => {
+    const home = resolveOffRouterHome({
+      env: { OFFROUTER_HOME: "/custom/offrouter-home" },
+      homedir: () => "/Users/example",
+    });
+    expect(home).toBe("/custom/offrouter-home");
+  });
+
+  it("normalizes relative OFFROUTER_HOME values", () => {
+    const home = resolveOffRouterHome({
+      env: { OFFROUTER_HOME: "relative-offrouter-home" },
+      homedir: () => "/Users/example",
+    });
+    expect(home).toBe(resolve("relative-offrouter-home"));
+  });
+
+  it("falls back to ~/.offrouter when OFFROUTER_HOME is unset", () => {
+    const home = resolveOffRouterHome({
+      env: {},
+      homedir: () => "/Users/example",
+    });
+    expect(home).toBe(join("/Users/example", ".offrouter"));
+  });
+});
+
+describe("loadConfig", () => {
+  it("loads user config from temp OFFROUTER_HOME", async () => {
+    const home = await trackDir(makeHome);
+    await writeFile(
+      join(home, "config.toml"),
+      `
+allowlisted_profiles = ["claude-personal", "codex-personal"]
+denied_profile_patterns = ["*-work", "secret-*"]
+
+[policy]
+subscription_first = true
+allow_api_key_fallback = true
+allow_third_party_subscription_adapters = false
+denied_providers = ["shadow"]
+
+[providers.claude]
+enabled = true
+`,
+      "utf8",
+    );
+
+    const config = await loadConfig({
+      env: { OFFROUTER_HOME: home },
+    });
+
+    expect(config.homeDir).toBe(home);
+    expect(config.sources).toContain(join(home, "config.toml"));
+    expect(config.policy.allowlistedProfiles).toEqual([
+      "claude-personal",
+      "codex-personal",
+    ]);
+    expect(config.policy.deniedProfilePatterns).toEqual([
+      "*-work",
+      "secret-*",
+    ]);
+    expect(config.policy.allowThirdPartySubscriptionAdapters).toBe(false);
+    expect(config.policy.deniedProviders).toEqual(["shadow"]);
+    expect(config.policyDefaults.subscriptionFirst).toBe(true);
+    expect(config.policyDefaults.allowApiKeyFallback).toBe(true);
+    expect(config.providers).toEqual({
+      claude: { id: "claude", enabled: true },
+    });
+
+    const allowed = evaluatePolicy(
+      baseRequest("claude-personal", { cwd: "/tmp/p", trusted: true }),
+      [subscriptionCandidate()],
+      config.policy,
+    );
+    expect(allowed.allowed).toHaveLength(1);
+  });
+
+  it("loads named profile overlays from profiles/*.toml", async () => {
+    const home = await trackDir(makeHome);
+    await writeFile(
+      join(home, "config.toml"),
+      `allowlisted_profiles = ["claude-personal"]
+`,
+      "utf8",
+    );
+    await mkdir(join(home, "profiles"), { recursive: true });
+    await writeFile(
+      join(home, "profiles", "claude-personal.toml"),
+      `
+id = "claude-personal"
+denied_providers = ["openai"]
+`,
+      "utf8",
+    );
+
+    const config = await loadConfig({ env: { OFFROUTER_HOME: home } });
+
+    expect(config.sources).toContain(
+      join(home, "profiles", "claude-personal.toml"),
+    );
+    expect(config.profiles["claude-personal"]).toEqual({
+      id: "claude-personal",
+      deniedProviders: ["openai"],
+    });
+  });
+
+  it("warns when profile files declare duplicate ids", async () => {
+    const home = await trackDir(makeHome);
+    await mkdir(join(home, "profiles"), { recursive: true });
+    await writeFile(
+      join(home, "profiles", "one.toml"),
+      `
+id = "claude-personal"
+denied_providers = ["first"]
+`,
+      "utf8",
+    );
+    await writeFile(
+      join(home, "profiles", "two.toml"),
+      `
+id = "claude-personal"
+denied_providers = ["second"]
+`,
+      "utf8",
+    );
+
+    const config = await loadConfig({ env: { OFFROUTER_HOME: home } });
+
+    expect(config.profiles["claude-personal"]).toEqual({
+      id: "claude-personal",
+      deniedProviders: ["second"],
+    });
+    expect(config.warnings).toContainEqual(
+      expect.objectContaining({
+        path: "profiles.claude-personal",
+      }),
+    );
+  });
+
+  it("reports file path and validation issue for invalid config", async () => {
+    const home = await trackDir(makeHome);
+    const configPath = join(home, "config.toml");
+    await writeFile(
+      configPath,
+      `
+allowlisted_profiles = "not-an-array"
+`,
+      "utf8",
+    );
+
+    await expect(
+      loadConfig({ env: { OFFROUTER_HOME: home } }),
+    ).rejects.toSatisfy((err: unknown) => {
+      expect(err).toBeInstanceOf(ConfigError);
+      const ce = err as ConfigError;
+      expect(ce.filePath).toBe(configPath);
+      expect(ce.message).toContain(configPath);
+      expect(ce.issues.length).toBeGreaterThan(0);
+      expect(ce.issues.some((issue) => /allowlisted_profiles|array/i.test(issue))).toBe(
+        true,
+      );
+      return true;
+    });
+  });
+
+  it("reports invalid profile file path and validation issue", async () => {
+    const home = await trackDir(makeHome);
+    await writeFile(join(home, "config.toml"), "", "utf8");
+    await mkdir(join(home, "profiles"), { recursive: true });
+    const profilePath = join(home, "profiles", "broken.toml");
+    await writeFile(
+      profilePath,
+      `
+denied_providers = 42
+`,
+      "utf8",
+    );
+
+    await expect(
+      loadConfig({ env: { OFFROUTER_HOME: home } }),
+    ).rejects.toSatisfy((err: unknown) => {
+      expect(err).toBeInstanceOf(ConfigError);
+      const ce = err as ConfigError;
+      expect(ce.filePath).toBe(profilePath);
+      expect(ce.message).toContain(profilePath);
+      expect(ce.issues.length).toBeGreaterThan(0);
+      return true;
+    });
+  });
+
+  it("ignores project .offrouter/config.toml unless workspace is trusted", async () => {
+    const home = await trackDir(makeHome);
+    await writeFile(
+      join(home, "config.toml"),
+      `allowlisted_profiles = ["claude-personal"]
+`,
+      "utf8",
+    );
+
+    const project = await trackDir(makeProject);
+    await mkdir(join(project, ".offrouter"), { recursive: true });
+    await writeFile(
+      join(project, ".offrouter", "config.toml"),
+      `
+allowlisted_profiles = ["claude-personal", "project-enabled"]
+[providers.project-agent]
+enabled = true
+`,
+      "utf8",
+    );
+
+    const untrusted = await loadConfig({
+      env: { OFFROUTER_HOME: home },
+      workspaceDir: project,
+      workspaceTrusted: false,
+    });
+    expect(untrusted.policy.allowlistedProfiles).toEqual(["claude-personal"]);
+    expect(untrusted.providers).toEqual({});
+    expect(untrusted.sources).not.toContain(
+      join(project, ".offrouter", "config.toml"),
+    );
+
+    const trusted = await loadConfig({
+      env: { OFFROUTER_HOME: home },
+      workspaceDir: project,
+      workspaceTrusted: true,
+    });
+    expect(trusted.policy.allowlistedProfiles).toEqual([
+      "claude-personal",
+      "project-enabled",
+    ]);
+    expect(trusted.providers).toEqual({
+      "project-agent": { id: "project-agent", enabled: true },
+    });
+    expect(trusted.sources).toContain(
+      join(project, ".offrouter", "config.toml"),
+    );
+  });
+
+  it("accumulates denied profile patterns across user and trusted project config", async () => {
+    const home = await trackDir(makeHome);
+    await writeFile(
+      join(home, "config.toml"),
+      `
+denied_profile_patterns = ["secret-*"]
+`,
+      "utf8",
+    );
+
+    const project = await trackDir(makeProject);
+    await mkdir(join(project, ".offrouter"), { recursive: true });
+    await writeFile(
+      join(project, ".offrouter", "config.toml"),
+      `
+denied_profile_patterns = ["client-*"]
+`,
+      "utf8",
+    );
+
+    const config = await loadConfig({
+      env: { OFFROUTER_HOME: home },
+      workspaceDir: project,
+      workspaceTrusted: true,
+    });
+
+    expect(config.policy.deniedProfilePatterns).toEqual([
+      "*-work",
+      "secret-*",
+      "client-*",
+    ]);
+  });
+
+  it("emits strict unknown-key warnings without failing load", async () => {
+    const home = await trackDir(makeHome);
+    await writeFile(
+      join(home, "config.toml"),
+      `
+allowlisted_profiles = ["claude-personal"]
+mystery_knob = true
+
+[policy]
+subscription_first = true
+secret_backdoor = "nope"
+`,
+      "utf8",
+    );
+    await mkdir(join(home, "profiles"), { recursive: true });
+    await writeFile(
+      join(home, "profiles", "claude-personal.toml"),
+      `
+id = "claude-personal"
+weird_flag = 1
+`,
+      "utf8",
+    );
+
+    const config = await loadConfig({ env: { OFFROUTER_HOME: home } });
+
+    expect(config.policy.allowlistedProfiles).toEqual(["claude-personal"]);
+    expect(config.warnings.length).toBeGreaterThanOrEqual(3);
+
+    const messages = config.warnings.map((w) => w.message).join("\n");
+    expect(messages).toMatch(/mystery_knob/);
+    expect(messages).toMatch(/secret_backdoor/);
+    expect(messages).toMatch(/weird_flag/);
+
+    for (const warning of config.warnings) {
+      expect(warning.path.length).toBeGreaterThan(0);
+    }
+  });
+
+  it("uses defaults when config.toml is missing", async () => {
+    const home = await trackDir(makeHome);
+    const config = await loadConfig({ env: { OFFROUTER_HOME: home } });
+
+    expect(config.policy.deniedProfilePatterns).toContain("*-work");
+    expect(config.policy.allowlistedProfiles).toEqual([]);
+    expect(config.providers).toEqual({});
+    expect(config.sources).toEqual([]);
+    expect(config.warnings).toEqual([]);
+  });
+});