toki
4c8441e6c9
사용자별 credential 저장, lease, projection, runtime 전달과 OpenAI-compatible 계약 및 검증 근거를 함께 반영한다.
491 lines
18 KiB
Go
491 lines
18 KiB
Go
package openai
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
edgeservice "iop/apps/edge/internal/service"
|
|
"iop/packages/go/config"
|
|
iop "iop/proto/gen/iop"
|
|
)
|
|
|
|
// TestResponsesProtocolProfileOperationPassthrough verifies that an explicit
|
|
// openai_responses profile admits the responses operation through the
|
|
// provider-pool tunnel and that the tunnel request carries the canonical
|
|
// operation identifier.
|
|
func TestResponsesProtocolProfileOperationPassthrough(t *testing.T) {
|
|
profile, err := config.ResolveProtocolProfile("openai", "", config.BuiltInProtocolProfileCatalog())
|
|
if err != nil {
|
|
t.Fatalf("ResolveProtocolProfile: %v", err)
|
|
}
|
|
|
|
fake := &providerFakeRunService{
|
|
tunnelFrames: staticProviderTunnelFrames(`{"id":"resp-1","object":"response","output":[]}`),
|
|
poolSelectedCandidate: edgeservice.ProviderPoolCandidate{
|
|
ProviderID: "prov-openai",
|
|
ProfileID: profile.ID,
|
|
ProfileDriver: string(profile.Driver),
|
|
ProfileCapabilities: append([]string(nil), profile.Capabilities...),
|
|
ProtocolProfile: &profile,
|
|
},
|
|
}
|
|
|
|
catalog := []config.ModelCatalogEntry{{
|
|
ID: "responses-model",
|
|
Providers: map[string]string{"prov-openai": "gpt-4-responses"},
|
|
}}
|
|
srv := NewServer(config.EdgeOpenAIConf{}, fake, nil)
|
|
srv.SetModelCatalog(catalog)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/v1/responses", strings.NewReader(`{
|
|
"model":"responses-model",
|
|
"input":"say hello via responses"
|
|
}`))
|
|
w := httptest.NewRecorder()
|
|
srv.handleResponses(w, req)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("status: got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
if len(fake.reqsSnapshot()) != 0 {
|
|
t.Fatalf("profile-backed responses must not fall back to normalized SubmitRun, got %d calls", len(fake.reqsSnapshot()))
|
|
}
|
|
reqs := fake.tunnelReqsSnapshot()
|
|
if len(reqs) != 1 {
|
|
t.Fatalf("expected 1 tunnel dispatch, got %d", len(reqs))
|
|
}
|
|
got := reqs[0]
|
|
if got.Operation != string(config.OperationResponses) {
|
|
t.Fatalf("tunnel operation: got %q want %q", got.Operation, config.OperationResponses)
|
|
}
|
|
if got.Path != "/v1/responses" {
|
|
t.Fatalf("tunnel path: got %q want /v1/responses", got.Path)
|
|
}
|
|
if got.Method != http.MethodPost {
|
|
t.Fatalf("tunnel method: got %q want POST", got.Method)
|
|
}
|
|
if got.ProviderID != "prov-openai" {
|
|
t.Fatalf("selected provider: got %q want prov-openai", got.ProviderID)
|
|
}
|
|
}
|
|
|
|
// TestResponsesProtocolProfileOperationPassthroughNonStream verifies that the
|
|
// responses profile operation admits non-streaming passthrough and that the
|
|
// provider body preserves the caller's Responses-shaped fields verbatim.
|
|
func TestResponsesProtocolProfileOperationPassthroughNonStream(t *testing.T) {
|
|
profile, err := config.ResolveProtocolProfile("openai", "", config.BuiltInProtocolProfileCatalog())
|
|
if err != nil {
|
|
t.Fatalf("ResolveProtocolProfile: %v", err)
|
|
}
|
|
|
|
fake := &providerFakeRunService{
|
|
tunnelFrames: staticProviderTunnelFrames(`{"id":"resp-ns","object":"response","output":[]}`),
|
|
poolSelectedCandidate: edgeservice.ProviderPoolCandidate{
|
|
ProviderID: "prov-openai-ns",
|
|
ProfileID: profile.ID,
|
|
ProfileDriver: string(profile.Driver),
|
|
ProfileCapabilities: append([]string(nil), profile.Capabilities...),
|
|
ProtocolProfile: &profile,
|
|
},
|
|
}
|
|
|
|
catalog := []config.ModelCatalogEntry{{
|
|
ID: "responses-ns",
|
|
Providers: map[string]string{"prov-openai-ns": "gpt-4-ns"},
|
|
}}
|
|
srv := NewServer(config.EdgeOpenAIConf{}, fake, nil)
|
|
srv.SetModelCatalog(catalog)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/v1/responses", strings.NewReader(`{
|
|
"model":"responses-ns",
|
|
"input":"non-stream input",
|
|
"max_output_tokens":128
|
|
}`))
|
|
w := httptest.NewRecorder()
|
|
srv.handleResponses(w, req)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("status: got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
bodies := fake.tunnelBodiesSnapshot()
|
|
if len(bodies) != 1 {
|
|
t.Fatalf("expected 1 tunnel body, got %d", len(bodies))
|
|
}
|
|
var providerReq map[string]any
|
|
if err := json.Unmarshal(bodies[0], &providerReq); err != nil {
|
|
t.Fatalf("provider body JSON: %v", err)
|
|
}
|
|
if providerReq["max_output_tokens"].(float64) != 128 {
|
|
t.Fatalf("max_output_tokens must be preserved: %+v", providerReq)
|
|
}
|
|
if _, ok := providerReq["stream"]; ok {
|
|
t.Fatalf("stream must not be injected on passthrough: %+v", providerReq)
|
|
}
|
|
}
|
|
|
|
// TestResponsesProtocolProfileOperationPassthroughStream verifies that the
|
|
// responses profile operation admits stream=true passthrough and that the
|
|
// provider tunnel carries the stream flag to the upstream provider.
|
|
func TestResponsesProtocolProfileOperationPassthroughStream(t *testing.T) {
|
|
profile, err := config.ResolveProtocolProfile("openai", "", config.BuiltInProtocolProfileCatalog())
|
|
if err != nil {
|
|
t.Fatalf("ResolveProtocolProfile: %v", err)
|
|
}
|
|
|
|
frames := make(chan *iop.ProviderTunnelFrame, 3)
|
|
frames <- &iop.ProviderTunnelFrame{Kind: iop.ProviderTunnelFrameKind_PROVIDER_TUNNEL_FRAME_KIND_RESPONSE_START, StatusCode: 200}
|
|
frames <- &iop.ProviderTunnelFrame{Kind: iop.ProviderTunnelFrameKind_PROVIDER_TUNNEL_FRAME_KIND_BODY, Body: []byte(`{"id":"resp-stream","object":"response","output":[],"delta":"chunk-1"}`)}
|
|
frames <- &iop.ProviderTunnelFrame{Kind: iop.ProviderTunnelFrameKind_PROVIDER_TUNNEL_FRAME_KIND_END, End: true}
|
|
close(frames)
|
|
|
|
fake := &providerFakeRunService{
|
|
tunnelFrames: frames,
|
|
poolSelectedCandidate: edgeservice.ProviderPoolCandidate{
|
|
ProviderID: "prov-openai-stream",
|
|
ProfileID: profile.ID,
|
|
ProfileDriver: string(profile.Driver),
|
|
ProfileCapabilities: append([]string(nil), profile.Capabilities...),
|
|
ProtocolProfile: &profile,
|
|
},
|
|
}
|
|
|
|
catalog := []config.ModelCatalogEntry{{
|
|
ID: "responses-stream",
|
|
Providers: map[string]string{"prov-openai-stream": "gpt-4-stream"},
|
|
}}
|
|
srv := NewServer(config.EdgeOpenAIConf{}, fake, nil)
|
|
srv.SetModelCatalog(catalog)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/v1/responses", strings.NewReader(`{
|
|
"model":"responses-stream",
|
|
"input":"stream this",
|
|
"stream":true
|
|
}`))
|
|
w := httptest.NewRecorder()
|
|
srv.handleResponses(w, req)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("status: got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
reqs := fake.tunnelReqsSnapshot()
|
|
if len(reqs) != 1 {
|
|
t.Fatalf("expected 1 tunnel dispatch, got %d", len(reqs))
|
|
}
|
|
if !reqs[0].Stream {
|
|
t.Fatal("stream tunnel request must carry stream=true")
|
|
}
|
|
}
|
|
|
|
// TestResponsesProtocolProfileUnsupportedRejectsBeforeDispatch verifies that an
|
|
// explicit profile which does not declare the responses operation is rejected
|
|
// before any candidate selection or dispatch occurs. The handler maps the typed
|
|
// operation admission failure to HTTP 400 with invalid_request_error and the
|
|
// sanitized message "no provider profile supports the requested Responses operation".
|
|
func TestResponsesProtocolProfileUnsupportedRejectsBeforeDispatch(t *testing.T) {
|
|
// Anthropic profile does not declare the responses operation.
|
|
anthropicProfile, err := config.ResolveProtocolProfile("anthropic", "", config.BuiltInProtocolProfileCatalog())
|
|
if err != nil {
|
|
t.Fatalf("ResolveProtocolProfile anthropic: %v", err)
|
|
}
|
|
|
|
fake := &providerFakeRunService{
|
|
poolDispatchPath: string(edgeservice.ProviderPoolPathTunnel),
|
|
poolSelectedCandidate: edgeservice.ProviderPoolCandidate{
|
|
ProviderID: "prov-anthropic",
|
|
ProfileID: anthropicProfile.ID,
|
|
ProfileDriver: string(anthropicProfile.Driver),
|
|
ProfileCapabilities: append([]string(nil), anthropicProfile.Capabilities...),
|
|
ProtocolProfile: &anthropicProfile,
|
|
},
|
|
}
|
|
|
|
catalog := []config.ModelCatalogEntry{{
|
|
ID: "responses-model",
|
|
Providers: map[string]string{"prov-anthropic": "claude-3"},
|
|
}}
|
|
srv := NewServer(config.EdgeOpenAIConf{}, fake, nil)
|
|
srv.SetModelCatalog(catalog)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/v1/responses", strings.NewReader(`{
|
|
"model":"responses-model",
|
|
"input":"should be rejected"
|
|
}`))
|
|
w := httptest.NewRecorder()
|
|
srv.handleResponses(w, req)
|
|
|
|
if w.Code != http.StatusBadRequest {
|
|
t.Fatalf("expected HTTP 400 for unsupported operation, got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
var resp map[string]any
|
|
if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
|
|
t.Fatalf("unmarshal error response: %v", err)
|
|
}
|
|
errObj, ok := resp["error"].(map[string]any)
|
|
if !ok {
|
|
t.Fatalf("error object missing: %v", resp)
|
|
}
|
|
if errObj["type"] != "invalid_request_error" {
|
|
t.Fatalf("error.type = %v, want invalid_request_error", errObj["type"])
|
|
}
|
|
if errObj["message"] != "no provider profile supports the requested Responses operation" {
|
|
t.Fatalf("error.message = %v, want 'no provider profile supports the requested Responses operation'", errObj["message"])
|
|
}
|
|
if len(fake.tunnelReqsSnapshot()) != 0 {
|
|
t.Fatalf("unsupported profile must not dispatch any tunnel request, got %d", len(fake.tunnelReqsSnapshot()))
|
|
}
|
|
if len(fake.reqsSnapshot()) != 0 {
|
|
t.Fatalf("unsupported profile must not dispatch any normalized run, got %d", len(fake.reqsSnapshot()))
|
|
}
|
|
}
|
|
|
|
// TestResponsesLegacyProfileFallback verifies that a legacy candidate without a
|
|
// profile still falls back to the path-based dispatch and carries the
|
|
// /v1/responses path for tunnel passthrough.
|
|
func TestResponsesLegacyProfileFallback(t *testing.T) {
|
|
fake := &providerFakeRunService{
|
|
tunnelFrames: staticProviderTunnelFrames(`{"id":"resp-legacy","object":"response","output":[]}`),
|
|
tunnelServedTarget: "legacy-served",
|
|
}
|
|
|
|
catalog := []config.ModelCatalogEntry{{
|
|
ID: "legacy-model",
|
|
Providers: map[string]string{"prov-legacy": "legacy-served"},
|
|
}}
|
|
srv := NewServer(config.EdgeOpenAIConf{}, fake, nil)
|
|
srv.SetModelCatalog(catalog)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/v1/responses", strings.NewReader(`{
|
|
"model":"legacy-model",
|
|
"input":"legacy input"
|
|
}`))
|
|
w := httptest.NewRecorder()
|
|
srv.handleResponses(w, req)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("status: got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
if len(fake.reqsSnapshot()) != 0 {
|
|
t.Fatalf("legacy fallback must not fall back to normalized SubmitRun, got %d calls", len(fake.reqsSnapshot()))
|
|
}
|
|
reqs := fake.tunnelReqsSnapshot()
|
|
if len(reqs) != 1 {
|
|
t.Fatalf("expected 1 tunnel dispatch, got %d", len(reqs))
|
|
}
|
|
got := reqs[0]
|
|
if got.Path != "/v1/responses" {
|
|
t.Fatalf("legacy tunnel path: got %q want /v1/responses", got.Path)
|
|
}
|
|
if got.Operation != string(config.OperationResponses) {
|
|
t.Fatalf("legacy tunnel operation: got %q want %q", got.Operation, config.OperationResponses)
|
|
}
|
|
}
|
|
|
|
// TestResponsesProtocolProfileProviderAuthInjection verifies that provider auth
|
|
// headers configured via the request header are injected into the tunnel
|
|
// request when the selected candidate carries an explicit profile.
|
|
func TestResponsesProtocolProfileProviderAuthInjection(t *testing.T) {
|
|
profile, err := config.ResolveProtocolProfile("openai", "", config.BuiltInProtocolProfileCatalog())
|
|
if err != nil {
|
|
t.Fatalf("ResolveProtocolProfile: %v", err)
|
|
}
|
|
|
|
fake := &providerFakeRunService{
|
|
tunnelFrames: staticProviderTunnelFrames(`{"id":"resp-auth","object":"response","output":[]}`),
|
|
poolSelectedCandidate: edgeservice.ProviderPoolCandidate{
|
|
ProviderID: "prov-openai-auth",
|
|
ProfileID: profile.ID,
|
|
ProfileDriver: string(profile.Driver),
|
|
ProfileCapabilities: append([]string(nil), profile.Capabilities...),
|
|
ProtocolProfile: &profile,
|
|
},
|
|
}
|
|
|
|
catalog := []config.ModelCatalogEntry{{
|
|
ID: "responses-auth",
|
|
Providers: map[string]string{"prov-openai-auth": "gpt-4-auth"},
|
|
}}
|
|
srv := NewServer(config.EdgeOpenAIConf{ProviderAuth: config.EdgeOpenAIProviderAuthConf{
|
|
Enabled: true,
|
|
FromHeader: "X-IOP-Provider-Authorization",
|
|
TargetHeader: "Authorization",
|
|
Scheme: "Bearer",
|
|
Required: true,
|
|
}}, fake, nil)
|
|
srv.SetModelCatalog(catalog)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/v1/responses", strings.NewReader(`{
|
|
"model":"responses-auth",
|
|
"input":"auth input"
|
|
}`))
|
|
req.Header.Set("X-IOP-Provider-Authorization", "request-provider-secret")
|
|
w := httptest.NewRecorder()
|
|
srv.handleResponses(w, req)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("status: got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
reqs := fake.tunnelReqsSnapshot()
|
|
if len(reqs) != 1 {
|
|
t.Fatalf("expected 1 tunnel dispatch, got %d", len(reqs))
|
|
}
|
|
got := reqs[0]
|
|
if got.Headers["Authorization"] != "Bearer request-provider-secret" {
|
|
t.Fatalf("provider auth header: got %q, want %q", got.Headers["Authorization"], "Bearer request-provider-secret")
|
|
}
|
|
}
|
|
|
|
// TestResponsesProtocolProfileProviderAuthRequiredMissing verifies that a
|
|
// required provider auth header missing from the request is rejected with a
|
|
// 400 before any tunnel dispatch is sent.
|
|
func TestResponsesProtocolProfileProviderAuthRequiredMissing(t *testing.T) {
|
|
profile, err := config.ResolveProtocolProfile("openai", "", config.BuiltInProtocolProfileCatalog())
|
|
if err != nil {
|
|
t.Fatalf("ResolveProtocolProfile: %v", err)
|
|
}
|
|
|
|
fake := &providerFakeRunService{
|
|
poolSelectedCandidate: edgeservice.ProviderPoolCandidate{
|
|
ProviderID: "prov-openai-auth-req",
|
|
ProfileID: profile.ID,
|
|
ProfileDriver: string(profile.Driver),
|
|
ProfileCapabilities: append([]string(nil), profile.Capabilities...),
|
|
ProtocolProfile: &profile,
|
|
},
|
|
}
|
|
|
|
catalog := []config.ModelCatalogEntry{{
|
|
ID: "responses-auth-req",
|
|
Providers: map[string]string{"prov-openai-auth-req": "gpt-4-auth-req"},
|
|
}}
|
|
srv := NewServer(config.EdgeOpenAIConf{ProviderAuth: config.EdgeOpenAIProviderAuthConf{
|
|
Enabled: true,
|
|
FromHeader: "X-IOP-Provider-Authorization",
|
|
TargetHeader: "Authorization",
|
|
Scheme: "Bearer",
|
|
Required: true,
|
|
}}, fake, nil)
|
|
srv.SetModelCatalog(catalog)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/v1/responses", strings.NewReader(`{
|
|
"model":"responses-auth-req",
|
|
"input":"missing auth"
|
|
}`))
|
|
w := httptest.NewRecorder()
|
|
srv.handleResponses(w, req)
|
|
|
|
if w.Code == http.StatusOK {
|
|
t.Fatalf("expected 400 for missing required provider auth, got %d", w.Code)
|
|
}
|
|
if len(fake.tunnelReqsSnapshot()) != 0 {
|
|
t.Fatalf("missing auth must not dispatch any tunnel request, got %d", len(fake.tunnelReqsSnapshot()))
|
|
}
|
|
}
|
|
|
|
// TestResponsesProtocolProfileOperationAdmissionTable verifies the operation
|
|
// admission behavior across supported/unsupported/nil-profile scenarios by
|
|
// driving each case through the handler and asserting the dispatch outcome.
|
|
func TestResponsesProtocolProfileOperationAdmissionTable(t *testing.T) {
|
|
openaiProfile, err := config.ResolveProtocolProfile("openai", "", config.BuiltInProtocolProfileCatalog())
|
|
if err != nil {
|
|
t.Fatalf("ResolveProtocolProfile openai: %v", err)
|
|
}
|
|
anthropicProfile, err := config.ResolveProtocolProfile("anthropic", "", config.BuiltInProtocolProfileCatalog())
|
|
if err != nil {
|
|
t.Fatalf("ResolveProtocolProfile anthropic: %v", err)
|
|
}
|
|
|
|
cases := []struct {
|
|
name string
|
|
profile *config.ConcreteProtocolProfile
|
|
profileID string
|
|
expectedStatus int
|
|
expectedErrType string
|
|
expectedErrMsg string
|
|
expectTunnelCall bool
|
|
}{
|
|
{
|
|
name: "openai profile admits responses operation",
|
|
profile: &openaiProfile,
|
|
profileID: "openai",
|
|
expectedStatus: http.StatusOK,
|
|
expectTunnelCall: true,
|
|
},
|
|
{
|
|
name: "anthropic profile rejects responses operation",
|
|
profile: &anthropicProfile,
|
|
profileID: "anthropic",
|
|
expectedStatus: http.StatusBadRequest,
|
|
expectedErrType: "invalid_request_error",
|
|
expectedErrMsg: "no provider profile supports the requested Responses operation",
|
|
expectTunnelCall: false,
|
|
},
|
|
{
|
|
name: "nil profile (legacy) admits responses via path fallback",
|
|
profile: nil,
|
|
profileID: "",
|
|
expectedStatus: http.StatusOK,
|
|
expectTunnelCall: true,
|
|
},
|
|
}
|
|
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
fake := &providerFakeRunService{
|
|
poolDispatchPath: string(edgeservice.ProviderPoolPathTunnel),
|
|
tunnelFrames: staticProviderTunnelFrames(`{"id":"resp-table","object":"response","output":[]}`),
|
|
poolSelectedCandidate: edgeservice.ProviderPoolCandidate{
|
|
ProviderID: "prov-table",
|
|
ProfileID: tc.profileID,
|
|
ProfileDriver: "",
|
|
ProtocolProfile: tc.profile,
|
|
},
|
|
}
|
|
|
|
catalog := []config.ModelCatalogEntry{{
|
|
ID: "responses-table",
|
|
Providers: map[string]string{"prov-table": "served-table"},
|
|
}}
|
|
srv := NewServer(config.EdgeOpenAIConf{}, fake, nil)
|
|
srv.SetModelCatalog(catalog)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/v1/responses", strings.NewReader(`{
|
|
"model":"responses-table",
|
|
"input":"table input"
|
|
}`))
|
|
w := httptest.NewRecorder()
|
|
srv.handleResponses(w, req)
|
|
|
|
if w.Code != tc.expectedStatus {
|
|
t.Fatalf("status: got %d, want %d (body=%s)", w.Code, tc.expectedStatus, w.Body.String())
|
|
}
|
|
|
|
if tc.expectedErrType != "" {
|
|
var resp map[string]any
|
|
if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
|
|
t.Fatalf("unmarshal error response: %v", err)
|
|
}
|
|
errObj, ok := resp["error"].(map[string]any)
|
|
if !ok {
|
|
t.Fatalf("error object missing: %v", resp)
|
|
}
|
|
if errObj["type"] != tc.expectedErrType {
|
|
t.Fatalf("error.type = %v, want %s", errObj["type"], tc.expectedErrType)
|
|
}
|
|
if errObj["message"] != tc.expectedErrMsg {
|
|
t.Fatalf("error.message = %v, want %s", errObj["message"], tc.expectedErrMsg)
|
|
}
|
|
}
|
|
|
|
tunnelReqs := fake.tunnelReqsSnapshot()
|
|
if tc.expectTunnelCall && len(tunnelReqs) != 1 {
|
|
t.Fatalf("expected 1 tunnel call, got %d", len(tunnelReqs))
|
|
}
|
|
if !tc.expectTunnelCall && len(tunnelReqs) != 0 {
|
|
t.Fatalf("expected 0 tunnel calls, got %d", len(tunnelReqs))
|
|
}
|
|
})
|
|
}
|
|
}
|