offrouter-core 0.2.1 → 0.2.2

package/src/secrets.test.ts

@@ -1,271 +0,0 @@
-import { afterEach, describe, expect, it } from "vitest";
-import {
-  chmod,
-  mkdtemp,
-  readFile,
-  readdir,
-  rm,
-  stat,
-  writeFile,
-} from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import {
-  FileSecretStore,
-  KeychainSecretStore,
-  KeychainUnavailableError,
-  redact,
-  type SecretStore,
-} from "./secrets.js";
-
-const tempDirs: string[] = [];
-
-afterEach(async () => {
-  await Promise.all(
-    tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })),
-  );
-});
-
-async function makeTempDir(): Promise<string> {
-  const dir = await mkdtemp(join(tmpdir(), "offrouter-secrets-"));
-  tempDirs.push(dir);
-  return dir;
-}
-
-async function makeFileStore(): Promise<{
-  dir: string;
-  path: string;
-  store: FileSecretStore;
-}> {
-  const dir = await makeTempDir();
-  const path = join(dir, "secrets.json");
-  const store = new FileSecretStore({ filePath: path });
-  return { dir, path, store };
-}
-
-describe("FileSecretStore", () => {
-  it("stores and reads provider keys by provider id", async () => {
-    const { store } = await makeFileStore();
-
-    await store.set("openai", "sk-live-test-openai-key-001");
-    await store.set("anthropic", "sk-ant-test-anthropic-key-002");
-
-    await expect(store.get("openai")).resolves.toBe(
-      "sk-live-test-openai-key-001",
-    );
-    await expect(store.get("anthropic")).resolves.toBe(
-      "sk-ant-test-anthropic-key-002",
-    );
-    await expect(store.get("missing")).resolves.toBeUndefined();
-
-    const providers = await store.listProviders();
-    expect(providers.sort()).toEqual(["anthropic", "openai"]);
-  });
-
-  it("deletes provider keys by provider id", async () => {
-    const { store } = await makeFileStore();
-    await store.set("openai", "sk-delete-me");
-    await store.delete("openai");
-    await expect(store.get("openai")).resolves.toBeUndefined();
-    await expect(store.listProviders()).resolves.toEqual([]);
-  });
-
-  it("persists across store instances sharing the same file", async () => {
-    const { path, store } = await makeFileStore();
-    await store.set("gemini", "AIzaSyTestpersistedkey1234567890");
-
-    const reloaded = new FileSecretStore({ filePath: path });
-    await expect(reloaded.get("gemini")).resolves.toBe(
-      "AIzaSyTestpersistedkey1234567890",
-    );
-  });
-
-  it("never returns secrets from toJSON", async () => {
-    const secret = "sk-super-secret-value-never-json";
-    const { store } = await makeFileStore();
-    await store.set("openai", secret);
-
-    const json = store.toJSON();
-    const serialized = JSON.stringify(json);
-
-    expect(serialized).not.toContain(secret);
-    expect(serialized).not.toMatch(/sk-super-secret/);
-    // Metadata about presence is fine; values are not.
-    expect(json).toMatchObject({
-      kind: "file",
-      providers: ["openai"],
-    });
-    expect("secrets" in json).toBe(false);
-    expect("values" in json).toBe(false);
-  });
-
-  it("JSON.stringify on the store itself never leaks secrets", async () => {
-    const secret = "sk-json-stringify-leak-check-xyz";
-    const { store } = await makeFileStore();
-    await store.set("openai", secret);
-
-    const out = JSON.stringify(store);
-    expect(out).not.toContain(secret);
-    expect(out).not.toMatch(/sk-json-stringify/);
-  });
-
-  it("writes secrets file with mode 0600 on POSIX", async () => {
-    if (process.platform === "win32") {
-      // Windows does not use POSIX permission bits the same way.
-      return;
-    }
-
-    const { path, store } = await makeFileStore();
-    await store.set("openai", "sk-mode-check-value");
-
-    const info = await stat(path);
-    expect(info.mode & 0o777).toBe(0o600);
-  });
-
-  it("preserves / reasserts 0600 even if file previously had looser perms", async () => {
-    if (process.platform === "win32") {
-      return;
-    }
-
-    const dir = await makeTempDir();
-    const path = join(dir, "secrets.json");
-    await writeFile(
-      path,
-      JSON.stringify({ version: 1, secrets: {} }),
-      "utf8",
-    );
-    await chmod(path, 0o644);
-
-    const store = new FileSecretStore({ filePath: path });
-    await store.set("openai", "sk-tightened-perms");
-
-    const info = await stat(path);
-    expect(info.mode & 0o777).toBe(0o600);
-  });
-
-  it("does not write secrets as plain object dump keys other than provider map", async () => {
-    const { path, store } = await makeFileStore();
-    await store.set("openai", "sk-file-format-check");
-
-    const raw = JSON.parse(await readFile(path, "utf8")) as {
-      version: number;
-      secrets: Record<string, string>;
-    };
-    expect(raw.version).toBe(1);
-    expect(raw.secrets.openai).toBe("sk-file-format-check");
-  });
-});
-
-describe("redaction", () => {
-  it("replaces API key patterns in log strings via standalone redact()", () => {
-    const log =
-      'provider error: invalid key sk-ant-api03-abcdefghijklmnopqrstuv and sk-live-abcdefghijklmnopqrstuv';
-    const redacted = redact(log);
-    expect(redacted).not.toContain("sk-ant-api03-abcdefghijklmnopqrstuv");
-    expect(redacted).not.toContain("sk-live-abcdefghijklmnopqrstuv");
-    expect(redacted).toMatch(/\[REDACTED\]/);
-  });
-
-  it("replaces stored provider secrets appearing in logs via SecretStore.redact", async () => {
-    const { store } = await makeFileStore();
-    const secret = "lr-custom-token-not-matching-prefix-patterns-zzzz";
-    await store.set("local-provider", secret);
-
-    const log = `downstream failed auth with ${secret} mid-message`;
-    const redacted = store.redact(log);
-
-    expect(redacted).not.toContain(secret);
-    expect(redacted).toContain("[REDACTED]");
-    expect(redacted).toContain("downstream failed auth with");
-  });
-
-  it("redacts file-backed secrets before the async cache is warm", async () => {
-    const { path, store } = await makeFileStore();
-    const secret = "lr-cold-cache-token-not-matching-prefix-patterns-zzzz";
-    await store.set("local-provider", secret);
-
-    const coldStore = new FileSecretStore({ filePath: path });
-    const redacted = coldStore.redact(`downstream failed with ${secret}`);
-
-    expect(redacted).not.toContain(secret);
-    expect(redacted).toContain("[REDACTED]");
-  });
-
-  it("removes temporary files when persisting fails after writing the temp secret", async () => {
-    const dir = await makeTempDir();
-    const path = join(dir, "secrets.json");
-    const store = new FileSecretStore({
-      filePath: path,
-      fileSystem: {
-        async rename() {
-          throw new Error("simulated rename failure");
-        },
-      },
-    });
-
-    await expect(store.set("openai", "sk-temp-cleanup-value")).rejects.toThrow();
-
-    const entries = await readdir(dir);
-    expect(entries.filter((entry) => entry.includes(".tmp"))).toEqual([]);
-  });
-
-  it("redacts bearer tokens and google-style api keys", () => {
-    const log =
-      "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.abc.def and key AIzaSyA-abcdefghijklmnopqrstuvwxyz012345";
-    const redacted = redact(log);
-    expect(redacted).not.toContain("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9");
-    expect(redacted).not.toContain("AIzaSyA-abcdefghijklmnopqrstuvwxyz012345");
-    expect(redacted).toMatch(/\[REDACTED\]/);
-  });
-
-  it("is idempotent on already-redacted text", () => {
-    const once = redact("using sk-abcdefghijklmnopqrstuvwxyz0123 now");
-    const twice = redact(once);
-    expect(twice).toBe(once);
-  });
-});
-
-describe("KeychainSecretStore", () => {
-  it("exposes the SecretStore boundary without scraping CLI credentials", async () => {
-    const store: SecretStore = new KeychainSecretStore({
-      service: "offrouter-test",
-    });
-
-    // Stub must refuse get/set until a real OS keychain backend is wired.
-    // It must never read foreign CLI credential stores.
-    await expect(store.get("openai")).rejects.toBeInstanceOf(
-      KeychainUnavailableError,
-    );
-    await expect(store.set("openai", "sk-should-not-store")).rejects.toBeInstanceOf(
-      KeychainUnavailableError,
-    );
-    await expect(store.delete("openai")).rejects.toBeInstanceOf(
-      KeychainUnavailableError,
-    );
-    await expect(store.listProviders()).rejects.toBeInstanceOf(
-      KeychainUnavailableError,
-    );
-  });
-
-  it("never returns secrets from toJSON", () => {
-    const store = new KeychainSecretStore({ service: "offrouter-test" });
-    const json = store.toJSON();
-    const serialized = JSON.stringify(store);
-
-    expect(json).toMatchObject({
-      kind: "keychain",
-      service: "offrouter-test",
-      available: false,
-    });
-    expect(serialized).not.toMatch(/sk-/);
-    expect("secrets" in json).toBe(false);
-    expect("values" in json).toBe(false);
-  });
-
-  it("still redacts common API key patterns without stored secrets", () => {
-    const store = new KeychainSecretStore({ service: "offrouter-test" });
-    const log = "leak sk-abcdefghijklmnopqrstuvwxyz0123 here";
-    expect(store.redact(log)).not.toContain("sk-abcdefghijklmnopqrstuvwxyz0123");
-    expect(store.redact(log)).toContain("[REDACTED]");
-  });
-});