iop/packages/go/config/credential_plane_config_test.go

275 lines
10 KiB
Go

package config
import (
"os"
"path/filepath"
"strings"
"testing"
)
func validManagedEdgeConfig() EdgeConfig {
return EdgeConfig{
TLS: TLSConf{Enabled: true, Cert: "/cert", Key: "/key", CA: "/ca", PeerRole: "node"},
ControlPlane: EdgeControlPlaneConf{
Enabled: true, WireAddr: "control-plane:19081",
TLS: TLSConf{Enabled: true, Cert: "/cert", Key: "/key", CA: "/ca", ServerName: "control-plane", PeerRole: "control-plane"},
},
CredentialPlane: EdgeCredentialPlaneConf{Enabled: true, LeaseTTLSeconds: 30, LeaseCacheSize: 256},
}
}
func TestCredentialPlaneModeIsSingleExplicitSourceSelector(t *testing.T) {
for _, tc := range []struct {
name string
conf EdgeCredentialPlaneConf
want CredentialPlaneMode
}{
{name: "omitted", conf: EdgeCredentialPlaneConf{}, want: CredentialPlaneModeLegacy},
{name: "explicit false", conf: EdgeCredentialPlaneConf{Enabled: false}, want: CredentialPlaneModeLegacy},
{name: "explicit true", conf: EdgeCredentialPlaneConf{Enabled: true}, want: CredentialPlaneModeManaged},
} {
t.Run(tc.name, func(t *testing.T) {
if got := tc.conf.Mode(); got != tc.want {
t.Fatalf("mode = %v, want %v", got, tc.want)
}
})
}
}
func TestCredentialPlaneDisabledPreservesLegacySources(t *testing.T) {
for _, enabledLine := range []string{"", "credential_plane:\n enabled: false\n"} {
path := filepath.Join(t.TempDir(), "edge.yaml")
yaml := enabledLine + `
server:
listen: "127.0.0.1:9090"
openai:
bearer_token: "legacy-iop-token"
principal_tokens:
- token_ref: "legacy-ref"
token_hash_sha256: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
principal_ref: "legacy-principal"
provider_auth:
enabled: true
`
if err := os.WriteFile(path, []byte(yaml), 0o600); err != nil {
t.Fatal(err)
}
cfg, err := LoadEdge(path)
if err != nil {
t.Fatalf("legacy config rejected: %v", err)
}
if cfg.CredentialPlane.Mode() != CredentialPlaneModeLegacy || cfg.OpenAI.BearerToken != "legacy-iop-token" || len(cfg.OpenAI.PrincipalTokens) != 1 || !cfg.OpenAI.ProviderAuth.Enabled {
t.Fatalf("legacy source changed during load: %+v", cfg.OpenAI)
}
}
}
func TestCredentialPlaneEnabledRejectsEveryCompetingSource(t *testing.T) {
tests := []struct {
name string
edit func(*EdgeConfig)
want string
}{
{name: "legacy bearer", edit: func(c *EdgeConfig) { c.OpenAI.BearerToken = "legacy" }, want: "legacy principal or provider auth"},
{name: "static principal mapping", edit: func(c *EdgeConfig) { c.OpenAI.PrincipalTokens = []OpenAIPrincipalTokenConf{{TokenRef: "ref"}} }, want: "legacy principal or provider auth"},
{name: "caller provider auth", edit: func(c *EdgeConfig) { c.OpenAI.ProviderAuth.Enabled = true }, want: "legacy principal or provider auth"},
{name: "provider authorization header", edit: func(c *EdgeConfig) {
c.Nodes = []NodeDefinition{{Providers: []NodeProviderConf{{Headers: map[string]string{"Authorization": "redacted-fixture"}}}}}
}, want: "providers[0].headers"},
{name: "provider URL user info", edit: func(c *EdgeConfig) {
c.Nodes = []NodeDefinition{{Providers: []NodeProviderConf{{BaseURL: "https://user:redacted-fixture@provider.invalid"}}}}
}, want: "providers[0].base_url"},
{name: "custom effective auth header match", edit: func(c *EdgeConfig) {
c.Nodes = []NodeDefinition{{Providers: []NodeProviderConf{
{
ID: "custom-provider",
Type: "openai_api",
Headers: map[string]string{
"X-Custom-Key": "redacted-fixture",
},
RuntimeProfile: &ConcreteProtocolProfile{
ID: "openai",
ProtocolProfileConf: ProtocolProfileConf{
Auth: ProtocolAuthConf{Header: "X-Custom-Key"},
},
},
}},
}}
}, want: "providers[0].headers"},
{name: "resolved profile base URL user info", edit: func(c *EdgeConfig) {
c.Nodes = []NodeDefinition{{Providers: []NodeProviderConf{
{
ID: "profile-provider",
Type: "openai_api",
RuntimeProfile: &ConcreteProtocolProfile{
ID: "openai",
ProtocolProfileConf: ProtocolProfileConf{
Auth: ProtocolAuthConf{Header: "Authorization"},
BaseURL: "https://user:redacted-fixture@profile.invalid/v1",
},
},
}},
}}
}, want: "profile[\"openai\"].base_url"},
{name: "resolved absolute operation URL user info", edit: func(c *EdgeConfig) {
c.Nodes = []NodeDefinition{{Providers: []NodeProviderConf{
{
ID: "op-provider",
Type: "openai_api",
RuntimeProfile: &ConcreteProtocolProfile{
ID: "openai",
ProtocolProfileConf: ProtocolProfileConf{
Auth: ProtocolAuthConf{Header: "Authorization"},
Operations: map[string]string{
"chat_completions": "https://user:redacted-fixture@op.invalid/v1/chat/completions",
},
},
},
}},
}}
}, want: "profile[\"openai\"].operations"},
{name: "legacy adapter authorization header", edit: func(c *EdgeConfig) {
c.Nodes = []NodeDefinition{{Adapters: AdaptersConf{OpenAICompat: OpenAICompatConf{Headers: map[string]string{"Authorization": "redacted-fixture"}}}}}
}, want: "openai_compat.headers"},
{name: "adapter authorization header", edit: func(c *EdgeConfig) {
c.Nodes = []NodeDefinition{{Adapters: AdaptersConf{OpenAICompatInstances: []OpenAICompatInstanceConf{{Headers: map[string]string{"x-api-key": "redacted-fixture"}}}}}}
}, want: "openai_compat_instances[0].headers"},
{name: "inherited custom auth header match on named backing adapter", edit: func(c *EdgeConfig) {
c.Nodes = []NodeDefinition{{
Providers: []NodeProviderConf{
{
ID: "custom-provider",
Type: "openai_api",
Adapter: "named-backing",
RuntimeProfile: &ConcreteProtocolProfile{
ID: "openai",
ProtocolProfileConf: ProtocolProfileConf{
Auth: ProtocolAuthConf{Header: "X-Custom-Key"},
},
},
},
},
Adapters: AdaptersConf{
OpenAICompatInstances: []OpenAICompatInstanceConf{
{
Name: "named-backing",
Enabled: true,
Headers: map[string]string{"x-custom-key": "redacted-fixture"},
},
},
},
}}
}, want: "openai_compat_instances[0].headers"},
{name: "inherited custom auth header match on legacy type-fallback backing adapter", edit: func(c *EdgeConfig) {
c.Nodes = []NodeDefinition{{
Providers: []NodeProviderConf{
{
ID: "custom-provider",
Type: "openai_api",
Adapter: "openai_compat",
RuntimeProfile: &ConcreteProtocolProfile{
ID: "openai",
ProtocolProfileConf: ProtocolProfileConf{
Auth: ProtocolAuthConf{Header: "X-Custom-Key"},
},
},
},
},
Adapters: AdaptersConf{
OpenAICompatInstances: []OpenAICompatInstanceConf{
{
Name: "fallback-backing",
Enabled: true,
Headers: map[string]string{"x-custom-key": "redacted-fixture"},
},
},
},
}}
}, want: "openai_compat_instances[0].headers"},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
cfg := validManagedEdgeConfig()
tc.edit(&cfg)
err := validateEdgeCredentialPlane(&cfg)
if err == nil || !strings.Contains(err.Error(), tc.want) {
t.Fatalf("error = %v, want safe path containing %q", err, tc.want)
}
if strings.Contains(err.Error(), "redacted-fixture") {
t.Fatalf("validation error echoed credential value: %v", err)
}
})
}
}
func TestCredentialPlaneEnabledAcceptsUnrelatedCustomHeader(t *testing.T) {
cfg := validManagedEdgeConfig()
cfg.Nodes = []NodeDefinition{{
Providers: []NodeProviderConf{
{
ID: "custom-provider",
Type: "openai_api",
Headers: map[string]string{
"X-Custom-Key": "redacted-fixture",
},
RuntimeProfile: &ConcreteProtocolProfile{
ID: "openai",
ProtocolProfileConf: ProtocolProfileConf{
Auth: ProtocolAuthConf{Header: "Authorization"},
},
},
},
},
Adapters: AdaptersConf{
OpenAICompatInstances: []OpenAICompatInstanceConf{
{
Name: "custom-provider",
Headers: map[string]string{"X-Unrelated-Header": "redacted-fixture"},
},
},
},
}}
if err := validateEdgeCredentialPlane(&cfg); err != nil {
t.Fatalf("unrelated custom header was rejected: %v", err)
}
}
func TestCredentialPlaneEnabledRequiresCompleteSecureComposition(t *testing.T) {
valid := validManagedEdgeConfig()
valid.OpenAI.Enabled = true
valid.OpenAI.TLS = TLSConf{Enabled: true, Cert: "/cert", Key: "/key"}
if err := validateEdgeCredentialPlane(&valid); err != nil {
t.Fatalf("valid managed composition rejected: %v", err)
}
tests := []struct {
name string
edit func(*EdgeConfig)
}{
{name: "lease ttl", edit: func(c *EdgeConfig) { c.CredentialPlane.LeaseTTLSeconds = 0 }},
{name: "lease cache", edit: func(c *EdgeConfig) { c.CredentialPlane.LeaseCacheSize = 0 }},
{name: "edge node tls", edit: func(c *EdgeConfig) { c.TLS.Enabled = false }},
{name: "edge node certificate", edit: func(c *EdgeConfig) { c.TLS.Cert = "" }},
{name: "edge node key", edit: func(c *EdgeConfig) { c.TLS.Key = "" }},
{name: "edge node CA", edit: func(c *EdgeConfig) { c.TLS.CA = "" }},
{name: "control plane disabled", edit: func(c *EdgeConfig) { c.ControlPlane.Enabled = false }},
{name: "control plane address", edit: func(c *EdgeConfig) { c.ControlPlane.WireAddr = "" }},
{name: "control plane tls", edit: func(c *EdgeConfig) { c.ControlPlane.TLS.Enabled = false }},
{name: "control plane certificate", edit: func(c *EdgeConfig) { c.ControlPlane.TLS.Cert = "" }},
{name: "control plane key", edit: func(c *EdgeConfig) { c.ControlPlane.TLS.Key = "" }},
{name: "control plane CA", edit: func(c *EdgeConfig) { c.ControlPlane.TLS.CA = "" }},
{name: "control plane server name", edit: func(c *EdgeConfig) { c.ControlPlane.TLS.ServerName = "" }},
{name: "openai https", edit: func(c *EdgeConfig) { c.OpenAI.TLS.Enabled = false }},
{name: "openai certificate", edit: func(c *EdgeConfig) { c.OpenAI.TLS.Cert = "" }},
{name: "openai key", edit: func(c *EdgeConfig) { c.OpenAI.TLS.Key = "" }},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
cfg := valid
tc.edit(&cfg)
if err := validateEdgeCredentialPlane(&cfg); err == nil {
t.Fatal("incomplete managed composition was accepted")
}
})
}
}