275 lines
10 KiB
Go
275 lines
10 KiB
Go
package config
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func validManagedEdgeConfig() EdgeConfig {
|
|
return EdgeConfig{
|
|
TLS: TLSConf{Enabled: true, Cert: "/cert", Key: "/key", CA: "/ca", PeerRole: "node"},
|
|
ControlPlane: EdgeControlPlaneConf{
|
|
Enabled: true, WireAddr: "control-plane:19081",
|
|
TLS: TLSConf{Enabled: true, Cert: "/cert", Key: "/key", CA: "/ca", ServerName: "control-plane", PeerRole: "control-plane"},
|
|
},
|
|
CredentialPlane: EdgeCredentialPlaneConf{Enabled: true, LeaseTTLSeconds: 30, LeaseCacheSize: 256},
|
|
}
|
|
}
|
|
|
|
func TestCredentialPlaneModeIsSingleExplicitSourceSelector(t *testing.T) {
|
|
for _, tc := range []struct {
|
|
name string
|
|
conf EdgeCredentialPlaneConf
|
|
want CredentialPlaneMode
|
|
}{
|
|
{name: "omitted", conf: EdgeCredentialPlaneConf{}, want: CredentialPlaneModeLegacy},
|
|
{name: "explicit false", conf: EdgeCredentialPlaneConf{Enabled: false}, want: CredentialPlaneModeLegacy},
|
|
{name: "explicit true", conf: EdgeCredentialPlaneConf{Enabled: true}, want: CredentialPlaneModeManaged},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
if got := tc.conf.Mode(); got != tc.want {
|
|
t.Fatalf("mode = %v, want %v", got, tc.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestCredentialPlaneDisabledPreservesLegacySources(t *testing.T) {
|
|
for _, enabledLine := range []string{"", "credential_plane:\n enabled: false\n"} {
|
|
path := filepath.Join(t.TempDir(), "edge.yaml")
|
|
yaml := enabledLine + `
|
|
server:
|
|
listen: "127.0.0.1:9090"
|
|
openai:
|
|
bearer_token: "legacy-iop-token"
|
|
principal_tokens:
|
|
- token_ref: "legacy-ref"
|
|
token_hash_sha256: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
|
principal_ref: "legacy-principal"
|
|
provider_auth:
|
|
enabled: true
|
|
`
|
|
if err := os.WriteFile(path, []byte(yaml), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
cfg, err := LoadEdge(path)
|
|
if err != nil {
|
|
t.Fatalf("legacy config rejected: %v", err)
|
|
}
|
|
if cfg.CredentialPlane.Mode() != CredentialPlaneModeLegacy || cfg.OpenAI.BearerToken != "legacy-iop-token" || len(cfg.OpenAI.PrincipalTokens) != 1 || !cfg.OpenAI.ProviderAuth.Enabled {
|
|
t.Fatalf("legacy source changed during load: %+v", cfg.OpenAI)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestCredentialPlaneEnabledRejectsEveryCompetingSource(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
edit func(*EdgeConfig)
|
|
want string
|
|
}{
|
|
{name: "legacy bearer", edit: func(c *EdgeConfig) { c.OpenAI.BearerToken = "legacy" }, want: "legacy principal or provider auth"},
|
|
{name: "static principal mapping", edit: func(c *EdgeConfig) { c.OpenAI.PrincipalTokens = []OpenAIPrincipalTokenConf{{TokenRef: "ref"}} }, want: "legacy principal or provider auth"},
|
|
{name: "caller provider auth", edit: func(c *EdgeConfig) { c.OpenAI.ProviderAuth.Enabled = true }, want: "legacy principal or provider auth"},
|
|
{name: "provider authorization header", edit: func(c *EdgeConfig) {
|
|
c.Nodes = []NodeDefinition{{Providers: []NodeProviderConf{{Headers: map[string]string{"Authorization": "redacted-fixture"}}}}}
|
|
}, want: "providers[0].headers"},
|
|
{name: "provider URL user info", edit: func(c *EdgeConfig) {
|
|
c.Nodes = []NodeDefinition{{Providers: []NodeProviderConf{{BaseURL: "https://user:redacted-fixture@provider.invalid"}}}}
|
|
}, want: "providers[0].base_url"},
|
|
{name: "custom effective auth header match", edit: func(c *EdgeConfig) {
|
|
c.Nodes = []NodeDefinition{{Providers: []NodeProviderConf{
|
|
{
|
|
ID: "custom-provider",
|
|
Type: "openai_api",
|
|
Headers: map[string]string{
|
|
"X-Custom-Key": "redacted-fixture",
|
|
},
|
|
RuntimeProfile: &ConcreteProtocolProfile{
|
|
ID: "openai",
|
|
ProtocolProfileConf: ProtocolProfileConf{
|
|
Auth: ProtocolAuthConf{Header: "X-Custom-Key"},
|
|
},
|
|
},
|
|
}},
|
|
}}
|
|
}, want: "providers[0].headers"},
|
|
{name: "resolved profile base URL user info", edit: func(c *EdgeConfig) {
|
|
c.Nodes = []NodeDefinition{{Providers: []NodeProviderConf{
|
|
{
|
|
ID: "profile-provider",
|
|
Type: "openai_api",
|
|
RuntimeProfile: &ConcreteProtocolProfile{
|
|
ID: "openai",
|
|
ProtocolProfileConf: ProtocolProfileConf{
|
|
Auth: ProtocolAuthConf{Header: "Authorization"},
|
|
BaseURL: "https://user:redacted-fixture@profile.invalid/v1",
|
|
},
|
|
},
|
|
}},
|
|
}}
|
|
}, want: "profile[\"openai\"].base_url"},
|
|
{name: "resolved absolute operation URL user info", edit: func(c *EdgeConfig) {
|
|
c.Nodes = []NodeDefinition{{Providers: []NodeProviderConf{
|
|
{
|
|
ID: "op-provider",
|
|
Type: "openai_api",
|
|
RuntimeProfile: &ConcreteProtocolProfile{
|
|
ID: "openai",
|
|
ProtocolProfileConf: ProtocolProfileConf{
|
|
Auth: ProtocolAuthConf{Header: "Authorization"},
|
|
Operations: map[string]string{
|
|
"chat_completions": "https://user:redacted-fixture@op.invalid/v1/chat/completions",
|
|
},
|
|
},
|
|
},
|
|
}},
|
|
}}
|
|
}, want: "profile[\"openai\"].operations"},
|
|
{name: "legacy adapter authorization header", edit: func(c *EdgeConfig) {
|
|
c.Nodes = []NodeDefinition{{Adapters: AdaptersConf{OpenAICompat: OpenAICompatConf{Headers: map[string]string{"Authorization": "redacted-fixture"}}}}}
|
|
}, want: "openai_compat.headers"},
|
|
{name: "adapter authorization header", edit: func(c *EdgeConfig) {
|
|
c.Nodes = []NodeDefinition{{Adapters: AdaptersConf{OpenAICompatInstances: []OpenAICompatInstanceConf{{Headers: map[string]string{"x-api-key": "redacted-fixture"}}}}}}
|
|
}, want: "openai_compat_instances[0].headers"},
|
|
{name: "inherited custom auth header match on named backing adapter", edit: func(c *EdgeConfig) {
|
|
c.Nodes = []NodeDefinition{{
|
|
Providers: []NodeProviderConf{
|
|
{
|
|
ID: "custom-provider",
|
|
Type: "openai_api",
|
|
Adapter: "named-backing",
|
|
RuntimeProfile: &ConcreteProtocolProfile{
|
|
ID: "openai",
|
|
ProtocolProfileConf: ProtocolProfileConf{
|
|
Auth: ProtocolAuthConf{Header: "X-Custom-Key"},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
Adapters: AdaptersConf{
|
|
OpenAICompatInstances: []OpenAICompatInstanceConf{
|
|
{
|
|
Name: "named-backing",
|
|
Enabled: true,
|
|
Headers: map[string]string{"x-custom-key": "redacted-fixture"},
|
|
},
|
|
},
|
|
},
|
|
}}
|
|
}, want: "openai_compat_instances[0].headers"},
|
|
{name: "inherited custom auth header match on legacy type-fallback backing adapter", edit: func(c *EdgeConfig) {
|
|
c.Nodes = []NodeDefinition{{
|
|
Providers: []NodeProviderConf{
|
|
{
|
|
ID: "custom-provider",
|
|
Type: "openai_api",
|
|
Adapter: "openai_compat",
|
|
RuntimeProfile: &ConcreteProtocolProfile{
|
|
ID: "openai",
|
|
ProtocolProfileConf: ProtocolProfileConf{
|
|
Auth: ProtocolAuthConf{Header: "X-Custom-Key"},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
Adapters: AdaptersConf{
|
|
OpenAICompatInstances: []OpenAICompatInstanceConf{
|
|
{
|
|
Name: "fallback-backing",
|
|
Enabled: true,
|
|
Headers: map[string]string{"x-custom-key": "redacted-fixture"},
|
|
},
|
|
},
|
|
},
|
|
}}
|
|
}, want: "openai_compat_instances[0].headers"},
|
|
}
|
|
for _, tc := range tests {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
cfg := validManagedEdgeConfig()
|
|
tc.edit(&cfg)
|
|
err := validateEdgeCredentialPlane(&cfg)
|
|
if err == nil || !strings.Contains(err.Error(), tc.want) {
|
|
t.Fatalf("error = %v, want safe path containing %q", err, tc.want)
|
|
}
|
|
if strings.Contains(err.Error(), "redacted-fixture") {
|
|
t.Fatalf("validation error echoed credential value: %v", err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestCredentialPlaneEnabledAcceptsUnrelatedCustomHeader(t *testing.T) {
|
|
cfg := validManagedEdgeConfig()
|
|
cfg.Nodes = []NodeDefinition{{
|
|
Providers: []NodeProviderConf{
|
|
{
|
|
ID: "custom-provider",
|
|
Type: "openai_api",
|
|
Headers: map[string]string{
|
|
"X-Custom-Key": "redacted-fixture",
|
|
},
|
|
RuntimeProfile: &ConcreteProtocolProfile{
|
|
ID: "openai",
|
|
ProtocolProfileConf: ProtocolProfileConf{
|
|
Auth: ProtocolAuthConf{Header: "Authorization"},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
Adapters: AdaptersConf{
|
|
OpenAICompatInstances: []OpenAICompatInstanceConf{
|
|
{
|
|
Name: "custom-provider",
|
|
Headers: map[string]string{"X-Unrelated-Header": "redacted-fixture"},
|
|
},
|
|
},
|
|
},
|
|
}}
|
|
if err := validateEdgeCredentialPlane(&cfg); err != nil {
|
|
t.Fatalf("unrelated custom header was rejected: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestCredentialPlaneEnabledRequiresCompleteSecureComposition(t *testing.T) {
|
|
valid := validManagedEdgeConfig()
|
|
valid.OpenAI.Enabled = true
|
|
valid.OpenAI.TLS = TLSConf{Enabled: true, Cert: "/cert", Key: "/key"}
|
|
if err := validateEdgeCredentialPlane(&valid); err != nil {
|
|
t.Fatalf("valid managed composition rejected: %v", err)
|
|
}
|
|
|
|
tests := []struct {
|
|
name string
|
|
edit func(*EdgeConfig)
|
|
}{
|
|
{name: "lease ttl", edit: func(c *EdgeConfig) { c.CredentialPlane.LeaseTTLSeconds = 0 }},
|
|
{name: "lease cache", edit: func(c *EdgeConfig) { c.CredentialPlane.LeaseCacheSize = 0 }},
|
|
{name: "edge node tls", edit: func(c *EdgeConfig) { c.TLS.Enabled = false }},
|
|
{name: "edge node certificate", edit: func(c *EdgeConfig) { c.TLS.Cert = "" }},
|
|
{name: "edge node key", edit: func(c *EdgeConfig) { c.TLS.Key = "" }},
|
|
{name: "edge node CA", edit: func(c *EdgeConfig) { c.TLS.CA = "" }},
|
|
{name: "control plane disabled", edit: func(c *EdgeConfig) { c.ControlPlane.Enabled = false }},
|
|
{name: "control plane address", edit: func(c *EdgeConfig) { c.ControlPlane.WireAddr = "" }},
|
|
{name: "control plane tls", edit: func(c *EdgeConfig) { c.ControlPlane.TLS.Enabled = false }},
|
|
{name: "control plane certificate", edit: func(c *EdgeConfig) { c.ControlPlane.TLS.Cert = "" }},
|
|
{name: "control plane key", edit: func(c *EdgeConfig) { c.ControlPlane.TLS.Key = "" }},
|
|
{name: "control plane CA", edit: func(c *EdgeConfig) { c.ControlPlane.TLS.CA = "" }},
|
|
{name: "control plane server name", edit: func(c *EdgeConfig) { c.ControlPlane.TLS.ServerName = "" }},
|
|
{name: "openai https", edit: func(c *EdgeConfig) { c.OpenAI.TLS.Enabled = false }},
|
|
{name: "openai certificate", edit: func(c *EdgeConfig) { c.OpenAI.TLS.Cert = "" }},
|
|
{name: "openai key", edit: func(c *EdgeConfig) { c.OpenAI.TLS.Key = "" }},
|
|
}
|
|
for _, tc := range tests {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
cfg := valid
|
|
tc.edit(&cfg)
|
|
if err := validateEdgeCredentialPlane(&cfg); err == nil {
|
|
t.Fatal("incomplete managed composition was accepted")
|
|
}
|
|
})
|
|
}
|
|
}
|