responses-proxy 0.1.0

package/dist/server-http-rate-limit.test.js

@@ -0,0 +1,80 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+const tempDir = mkdtempSync(path.join(os.tmpdir(), "responses-proxy-server-rate-limit-"));
+const dbFile = path.join(tempDir, "app.sqlite");
+process.env.RESPONSES_PROXY_DISABLE_LISTEN = "true";
+process.env.APP_DB_PATH = dbFile;
+process.env.CUSTOMER_KEY_DB_PATH = dbFile;
+process.env.UPSTREAM_BASE_URL = "https://upstream.example/v1";
+process.env.UPSTREAM_API_KEY = "provider-key";
+process.env.PROVIDER_USAGE_CHECK_ENABLED = "false";
+process.env.CHATGPT_OAUTH_ENABLED = "false";
+process.env.LOG_LEVEL = "silent";
+process.env.HTTP_TRUST_PROXY = "false";
+process.env.HTTP_RATE_LIMIT_ENABLED = "true";
+process.env.HTTP_RATE_LIMIT_WINDOW_MS = "60000";
+process.env.HTTP_RATE_LIMIT_RESPONSES_MAX_REQUESTS = "1";
+process.env.HTTP_RATE_LIMIT_UNAUTHENTICATED_MAX_REQUESTS = "1";
+const { app } = await import("./server.js");
+test.after(async () => {
+    await app.close();
+    rmSync(tempDir, { recursive: true, force: true });
+});
+test("responses endpoint returns 429 after configured rate limit threshold", async () => {
+    const first = await app.inject({
+        method: "POST",
+        url: "/v1/responses",
+        headers: {
+            "x-forwarded-for": "203.0.113.10",
+        },
+        payload: {},
+    });
+    assert.equal(first.statusCode, 400);
+    assert.equal(first.headers["x-ratelimit-limit"], "1");
+    assert.equal(first.headers["x-ratelimit-remaining"], "0");
+    const second = await app.inject({
+        method: "POST",
+        url: "/v1/responses",
+        headers: {
+            "x-forwarded-for": "198.51.100.10",
+        },
+        payload: {},
+    });
+    assert.equal(second.statusCode, 429);
+    assert.equal(second.headers["retry-after"], "60");
+    assert.equal(second.headers["x-ratelimit-limit"], "1");
+    assert.equal(second.headers["x-ratelimit-remaining"], "0");
+    assert.equal(second.json().error.code, "HTTP_RATE_LIMIT_EXCEEDED");
+});
+test("bearer requests get separate rate limit buckets by token", async () => {
+    const firstBearer = await app.inject({
+        method: "POST",
+        url: "/v1/responses",
+        headers: {
+            authorization: "Bearer bearer-token-a",
+        },
+        payload: {},
+    });
+    assert.equal(firstBearer.statusCode, 400);
+    const secondBearer = await app.inject({
+        method: "POST",
+        url: "/v1/responses",
+        headers: {
+            authorization: "Bearer bearer-token-b",
+        },
+        payload: {},
+    });
+    assert.equal(secondBearer.statusCode, 400);
+    const thirdBearer = await app.inject({
+        method: "POST",
+        url: "/v1/responses",
+        headers: {
+            authorization: "Bearer bearer-token-a",
+        },
+        payload: {},
+    });
+    assert.equal(thirdBearer.statusCode, 429);
+});

package/dist/server-response-cache.test.js

@@ -0,0 +1,105 @@
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+const tempDir = mkdtempSync(path.join(os.tmpdir(), "responses-proxy-server-response-cache-"));
+const dbFile = path.join(tempDir, "app.sqlite");
+const upstream = createServer((request, response) => {
+    if (request.url !== "/responses") {
+        response.statusCode = 404;
+        response.end();
+        return;
+    }
+    response.setHeader("Content-Type", "application/json");
+    response.end(JSON.stringify({
+        id: `upstream-${upstreamHits + 1}`,
+        object: "response",
+        status: "completed",
+        output: [],
+        usage: {
+            input_tokens: 12,
+            output_tokens: 3,
+            total_tokens: 15,
+            input_tokens_details: { cached_tokens: 0 },
+        },
+    }));
+    upstreamHits += 1;
+});
+let upstreamHits = 0;
+process.env.RESPONSES_PROXY_DISABLE_LISTEN = "true";
+process.env.APP_DB_PATH = dbFile;
+process.env.CUSTOMER_KEY_DB_PATH = dbFile;
+process.env.UPSTREAM_BASE_URL = "http://127.0.0.1:0";
+process.env.UPSTREAM_API_KEY = "provider-key";
+process.env.PROVIDER_USAGE_CHECK_ENABLED = "false";
+process.env.CHATGPT_OAUTH_ENABLED = "false";
+process.env.LOG_LEVEL = "silent";
+process.env.RESPONSE_CACHE_ENABLED = "true";
+process.env.RESPONSE_CACHE_TTL_MS = "60000";
+process.env.RESPONSE_CACHE_MAX_PAYLOAD_BYTES = "524288";
+process.env.RESPONSES_PROXY_CLIENT_API_KEY = "provider-key";
+await new Promise((resolve) => {
+    upstream.listen(0, "127.0.0.1", () => resolve());
+});
+const upstreamAddress = upstream.address();
+if (!upstreamAddress || typeof upstreamAddress === "string") {
+    throw new Error("Upstream server did not bind to a port");
+}
+process.env.UPSTREAM_BASE_URL = `http://127.0.0.1:${upstreamAddress.port}`;
+const { app } = await import("./server.js");
+test.after(async () => {
+    await app.close();
+    await new Promise((resolve) => upstream.close(() => resolve()));
+    rmSync(tempDir, { recursive: true, force: true });
+});
+test("response cache hits on repeated non-stream requests and analytics exposes stats", async () => {
+    const payload = {
+        model: "gpt-4.1",
+        input: "hello",
+    };
+    const first = await app.inject({
+        method: "POST",
+        url: "/v1/responses",
+        headers: {
+            authorization: "Bearer provider-key",
+        },
+        payload,
+    });
+    assert.equal(first.statusCode, 200);
+    assert.equal(first.headers["x-proxy-response-cache"], undefined);
+    assert.equal(upstreamHits, 1);
+    const second = await app.inject({
+        method: "POST",
+        url: "/v1/responses",
+        headers: {
+            authorization: "Bearer provider-key",
+        },
+        payload,
+    });
+    assert.equal(second.statusCode, 200);
+    assert.equal(second.headers["x-proxy-response-cache"], "hit");
+    assert.equal(upstreamHits, 1);
+    assert.deepEqual(second.json(), first.json());
+    const analytics = await app.inject({
+        method: "GET",
+        url: "/api/analytics/cost-summary",
+        headers: {
+            authorization: "Bearer provider-key",
+        },
+    });
+    assert.equal(analytics.statusCode, 200);
+    const body = analytics.json();
+    assert.equal(body.summary.totalRequests >= 1, true);
+    assert.equal(body.responseCacheStats?.totalEntries, 1);
+    const flushed = await app.inject({
+        method: "POST",
+        url: "/api/analytics/response-cache/flush",
+        headers: {
+            authorization: "Bearer provider-key",
+        },
+    });
+    assert.equal(flushed.statusCode, 200);
+    assert.equal(flushed.json().deleted, 1);
+});

package/dist/server-routes-alias.test.js

@@ -0,0 +1,39 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+const tempDir = mkdtempSync(path.join(os.tmpdir(), "responses-proxy-server-routes-alias-"));
+const dbFile = path.join(tempDir, "app.sqlite");
+process.env.RESPONSES_PROXY_DISABLE_LISTEN = "true";
+process.env.APP_DB_PATH = dbFile;
+process.env.CUSTOMER_KEY_DB_PATH = dbFile;
+process.env.UPSTREAM_BASE_URL = "https://upstream.example/v1";
+process.env.UPSTREAM_API_KEY = "provider-key";
+process.env.PROVIDER_USAGE_CHECK_ENABLED = "false";
+process.env.CHATGPT_OAUTH_ENABLED = "false";
+process.env.LOG_LEVEL = "silent";
+const { app } = await import("./server.js");
+test.after(async () => {
+    await app.close();
+    rmSync(tempDir, { recursive: true, force: true });
+});
+test("route alias /v1/chat/completions routes to responses handler and fails validation with 400", async () => {
+    const response = await app.inject({
+        method: "POST",
+        url: "/v1/chat/completions",
+        payload: {},
+    });
+    // If it was a 404, it would return 404. Returning 400 means it hit the handler and failed validation.
+    assert.equal(response.statusCode, 400);
+    assert.equal(response.json().error?.code, "INVALID_RESPONSES_REQUEST");
+});
+test("route alias /v1/completions routes to responses handler and fails validation with 400", async () => {
+    const response = await app.inject({
+        method: "POST",
+        url: "/v1/completions",
+        payload: {},
+    });
+    assert.equal(response.statusCode, 400);
+    assert.equal(response.json().error?.code, "INVALID_RESPONSES_REQUEST");
+});

package/dist/server-sepay-webhook-security.test.js

@@ -0,0 +1,59 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+const tempDir = mkdtempSync(path.join(os.tmpdir(), "responses-proxy-server-sepay-"));
+const dbFile = path.join(tempDir, "app.sqlite");
+process.env.RESPONSES_PROXY_DISABLE_LISTEN = "true";
+process.env.APP_DB_PATH = dbFile;
+process.env.CUSTOMER_KEY_DB_PATH = dbFile;
+process.env.UPSTREAM_BASE_URL = "https://upstream.example/v1";
+process.env.UPSTREAM_API_KEY = "provider-key";
+process.env.PROVIDER_USAGE_CHECK_ENABLED = "false";
+process.env.CHATGPT_OAUTH_ENABLED = "false";
+process.env.LOG_LEVEL = "silent";
+process.env.SEPAY_WEBHOOK_ENABLED = "true";
+process.env.SEPAY_WEBHOOK_SECRET = "webhook-secret";
+process.env.HTTP_TRUST_PROXY = "true";
+process.env.SEPAY_WEBHOOK_ALLOWED_IPS = "203.0.113.10,198.51.100.0/24";
+const { app } = await import("./server.js");
+test.after(async () => {
+    await app.close();
+    rmSync(tempDir, { recursive: true, force: true });
+});
+test("sepay webhook rejects non-allowed source ip", async () => {
+    const response = await app.inject({
+        method: "POST",
+        url: "/api/sepay/webhook",
+        headers: {
+            authorization: "Bearer webhook-secret",
+            "x-forwarded-for": "192.0.2.10",
+        },
+        payload: {},
+    });
+    assert.equal(response.statusCode, 403);
+    assert.equal(response.json().error.code, "SEPAY_WEBHOOK_IP_FORBIDDEN");
+});
+test("sepay webhook accepts allowed exact ip and cidr", async () => {
+    const exact = await app.inject({
+        method: "POST",
+        url: "/api/sepay/webhook",
+        headers: {
+            authorization: "Bearer webhook-secret",
+            "x-forwarded-for": "203.0.113.10",
+        },
+        payload: {},
+    });
+    assert.equal(exact.statusCode, 200);
+    const cidr = await app.inject({
+        method: "POST",
+        url: "/api/sepay/webhook",
+        headers: {
+            authorization: "Bearer webhook-secret",
+            "x-forwarded-for": "198.51.100.42",
+        },
+        payload: {},
+    });
+    assert.equal(cidr.statusCode, 200);
+});