mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-25 14:53:34 +00:00
* feat: Add secure prompt-based skills system (Phase 1 MVP) Implement a skills system that extends the agent with prompt-level instructions from local directories. Skills declare activation criteria, tool permissions, and trust tiers that determine authority attenuation. Core security model: the minimum trust level of any active skill determines a tool ceiling -- tools above the ceiling are removed from the LLM's tool list entirely at the API level, preventing prompt-based manipulation. New modules: - skills/mod.rs: Core types (SkillTrust, SkillManifest, LoadedSkill) - skills/scanner.rs: Content scanner for manipulation detection - skills/registry.rs: Filesystem discovery and manifest parsing - skills/selector.rs: Deterministic two-phase prefilter (no LLM) - skills/attenuation.rs: Trust-based tool filtering Integration: - Agent loop selects skills per-turn and applies tool attenuation - Reasoning engine injects skill context with structural isolation - Config supports SKILLS_ENABLED, SKILLS_DIR, SKILLS_MAX_ACTIVE, SKILLS_MAX_CONTEXT_TOKENS environment variables - Disabled by default (SKILLS_ENABLED=false) 41 new tests covering all modules. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: Address all adversarial review findings for skills system Security fixes: - Escape skill name/version in XML attributes to prevent trust spoofing - Escape prompt content to prevent </skill> tag breakout - Require integrity hash for Verified/Community tier skills - Validate skill names against [a-zA-Z0-9][a-zA-Z0-9._-]{0,63} - Add 64 KiB file size limit on prompt.md Bug fixes: - Use actual SkillsConfig from AgentDeps instead of SkillsConfig::default() - Add skills_config field to AgentDeps, wired through from main.rs Performance: - Pre-compile regex patterns at load time (cached on LoadedSkill) - Selector uses pre-compiled patterns instead of recompiling per message - Switch all std::fs to tokio::fs for non-blocking async I/O Hardening: - Cap keyword score at 30 points to prevent keyword stuffing attacks - Enforce max 20 keywords and 5 patterns per skill - Normalize line endings (CRLF/CR to LF) before hashing - Also includes cargo fmt formatting fixes for adjacent code Tests: 54 skills tests pass (up from 41), zero new clippy warnings. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: Address medium/low severity findings from adversarial review Fixes all 18 medium/low severity findings identified by the security review: - mod.rs: Add MAX_TAGS_PER_SKILL cap (10) in enforce_limits(); use RegexBuilder with 64 KiB size_limit to prevent ReDoS; replace case-enumerated escape_skill_content with regex matching all case variants plus whitespace/null byte injection between </ and skill; document allowed_patterns as unenforced until Phase 2; document Marketplace URL validation as Phase 3 concern - registry.rs: Add MAX_MANIFEST_FILE_SIZE (16 KiB) check before reading; add symlink detection via symlink_metadata to reject symlinks in discover_local; add MAX_DISCOVERED_SKILLS (100) cap; validate prompt_hash format (sha256: + 64 hex chars); warn on name collision before overwriting; accept SkillSource parameter in load_skill instead of always using Local; add InvalidHashFormat, ManifestTooLarge, SymlinkDetected error variants - selector.rs: Add MAX_TAG_SCORE (15) cap parallel to keyword cap; warn when declared max_context_tokens diverges >2x from actual prompt size - scanner.rs: Add mixed-script homoglyph detection (Cyrillic, Greek, Armenian unicode ranges); document token-boundary bypass and semantic paraphrasing as known limitations - attenuation.rs: Document READ_ONLY_TOOLS maintenance requirements - agent_loop.rs: Surface scan warnings via structured tracing; add structured audit events for skill activation and tool attenuation 61 tests pass, 0 new clippy warnings. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: Address 12 findings from second adversarial security review HIGH: - Escape opening <skill tags in prompt content (prevents fake skill block injection) - Scan manifest metadata fields (description, author, tags, reasons) not just prompt - Block trust downgrade on name collision (existing Local can't be replaced by Community) MEDIUM: - Eliminate TOCTOU gap: read files then check size instead of metadata-then-read - Reject file-level symlinks in load_skill (prompt.md, skill.toml) - Truncate and filter manifest.skill.tags (prevent unlimited tag scoring) - Cap regex pattern score at 40 (prevent 5x20=100 dominating keyword+tag) - Add doc comment about skill_list tool exposing metadata (sanitization required) - Move Community disclaimer inside <skill> tags (not outside structural boundary) - Filter keywords/tags shorter than 3 chars (prevent broad matching) LOW: - Enforce minimum token_cost of 1 (max_context_tokens=0 can't bypass budget) - Remove redundant try_exists checks in discover_local (let load_skill handle errors) 70 skills tests passing. Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: Add HTTP endpoint scoping for skills (Phase 1) Skills that declare an [http] section in skill.toml now have their HTTP requests constrained to declared endpoints at runtime. This addresses the gap where allowed_patterns was parsed but never enforced -- once the http tool was visible via attenuation, the LLM could reach any URL. Enforcement reuses EndpointPattern/AllowlistValidator from the WASM capability system. Semantics: if no active skill declares [http], all requests pass through (backward compat). If any skill declares [http], URLs must match at least one skill's allowlist (union). Community skills' [http] declarations are silently ignored (defense in depth). Shell commands using curl/wget are also validated against scopes. Scanner gains detection for known exfiltration domains (webhook.site, ngrok.io, etc.), overly broad wildcards, and credential/host mismatches. Closes #38 Co-Authored-By: Claude Opus 4.6 <[email protected]> * style: Apply cargo fmt to http_scoping.rs Co-Authored-By: Claude Opus 4.6 <[email protected]> * style: Apply cargo fmt across codebase Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: Add parameter-level permission enforcement for skills (Phase 2) Activates enforcement of `allowed_patterns` in skill.toml permissions. Previously these patterns were parsed but not enforced -- a Verified skill declaring `permissions.shell` with `allowed_patterns = [{command = "cargo *"}]` could still run any shell command. Now the enforcer validates tool parameters against declared glob patterns before execution. Key changes: - New `enforcer.rs` module with `SkillPermissionEnforcer`, `glob_to_regex()`, and `validate_tool_call()` with union semantics across active skills - Typed pattern enums (`ShellPattern`, `FilePathPattern`, `MemoryTargetPattern`) replace the previous `Vec<serde_json::Value>` in `ToolPermissionDeclaration` - Scanner gains `scan_permission_patterns()` detecting dangerous patterns (rm, sudo, curl, bare wildcards, command chaining, sensitive paths, identity files) - Registry blocks non-Local skills with critical permission pattern warnings - Agent loop threads enforcer into `execute_chat_tool` alongside HTTP scoping Trust interaction: Community patterns ignored, Verified enforced, Local without patterns unrestricted, Local with patterns enforced as guidance. Union semantics across skills -- tool call allowed if ANY skill's patterns permit it. 34 new tests. All 818 library tests pass. Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: Add worker permission enforcement and LLM behavioral analysis (Phase 3+4) Phase 3 - Worker-side permission enforcement: - Add SerializedToolPermission/SerializedPattern DTOs for HTTP boundary crossing - Extend JobDescription, ContainerHandle, and orchestrator API to carry permissions - CreateJobTool snapshots and forwards skill permissions to spawned workers - Worker runtime builds SkillPermissionEnforcer and checks before tool execution - Load-time token budget enforcement rejects prompts exceeding 2x declared budget - Deduplicate enforcer construction: from_active_skills() delegates to from_serialized() Phase 4 - LLM behavioral analysis: - BehavioralAnalyzer with cached, LLM-based semantic content analysis - Structured output parsing (FINDING|CATEGORY|SEVERITY|DESCRIPTION or CLEAN) - Content-hash caching with bounded size (MAX_CACHE_ENTRIES=256) - Graceful degradation when LLM unavailable - Integrated into load_skill() for non-Local skills; critical findings block loading Review fixes: - Real cache tests with CountingLlm mock (test_cache_hit, test_cache_miss, test_cache_bounded) - UTF-8-safe truncate() in worker runtime - Few-shot examples in behavioral analysis prompt - Documented max_context_tokens=0 opt-out and create_job() permission gap 848 tests passing, no new clippy warnings. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: Address review feedback from serrrfirat on skills-phase2 - Fix truncate_cmd UTF-8 panic: use char-boundary-aware slicing - Remove redundant effective_tools branching in reasoning.rs - Document cache eviction as known limitation (arbitrary, not LRU) - Add safety comment on SkillTrust enum ordering (security-critical) - Simplify active_skills selection (prefilter_skills handles empty input) Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address remaining skills review feedback * refactor: replace skills system with OpenClaw SKILL.md format + 2-state trust Replace the 5-gate, 3-tier trust hierarchy (scanner, behavioral analyzer, parameter-level enforcer, HTTP endpoint scoping) with a simplified 3-layer security model: gating -> attenuation -> Docker confinement. Key changes: - SKILL.md format (YAML frontmatter + markdown prompt) replaces skill.toml + prompt.md - 2-state trust (Installed/Trusted) replaces 3-tier (Community/Verified/Local) - New parser.rs for SKILL.md parsing with serde_yaml - New gating.rs for requirements checking (bins/env/config) - Simplified registry with 2-location discovery (workspace + user dirs) - Removed scanner, behavioral_analyzer, enforcer, http_scoping (~4,100 lines) - Removed skill_permissions propagation through job/orchestrator/worker pipeline - Added serde_yaml dependency for YAML frontmatter parsing Net: -5,298 lines, 59 skills tests pass, 907 total tests pass. Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: add in-app skill management tools and ClawHub catalog integration Add 4 chat-callable tools (skill_list, skill_search, skill_install, skill_remove) plus matching web gateway endpoints for managing skills at runtime. The catalog fetches from ClawHub's public registry API at runtime rather than bundling entries at compile time. Key changes: - SkillRegistry gains mutation methods (install_skill, remove_skill, reload, find_by_name) with Arc<RwLock> for concurrent access - New catalog module queries ClawHub /api/v1/search with in-memory caching (5-min TTL, configurable via CLAWHUB_REGISTRY env var) - skill_list and skill_search added to READ_ONLY_TOOLS for safe use under Installed trust ceiling - Web gateway gets /api/skills, /api/skills/search, /api/skills/install, and /api/skills/{name} DELETE endpoints Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address PR #51 review feedback from ilblackdragon Security: - Add SSRF protection to fetch_skill_content: require HTTPS, reject private/loopback/link-local IPs and internal hostnames, disable redirects. Gateway install handler now reuses the same validation. - URL-encode slug in skill_download_url to prevent query injection. - Require X-Confirm-Action header on gateway skill install/remove endpoints (equivalent to chat tool requires_approval gate). Correctness: - Eliminate all block_in_place/block_on usage in skill tools and gateway handlers. Split install into prepare_install_to_disk (static async, no lock) + commit_install (sync, brief write lock). Same pattern for remove: validate_remove + delete_skill_files + commit_remove. - Write normalized content to disk in install_skill (was writing original un-normalized content, causing hash mismatch on re-read). - Fix token estimation from 0.75 to 0.25 tokens/byte (~4 chars per token) in registry.rs, selector.rs, and standalone loader. Dependencies: - Replace deprecated serde_yaml 0.9 with serde_yml 0.0.12. - Remove unused toml dependency. Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>
483 lines
14 KiB
Rust
483 lines
14 KiB
Rust
//! Integration tests for the OpenAI-compatible API endpoints.
|
|
//!
|
|
//! Uses a mock LLM provider so no real API key is needed.
|
|
|
|
use std::net::SocketAddr;
|
|
use std::sync::Arc;
|
|
use std::time::Duration;
|
|
|
|
use async_trait::async_trait;
|
|
use rust_decimal::Decimal;
|
|
|
|
use ironclaw::channels::web::server::{GatewayState, start_server};
|
|
use ironclaw::channels::web::sse::SseManager;
|
|
use ironclaw::channels::web::ws::WsConnectionTracker;
|
|
use ironclaw::error::LlmError;
|
|
use ironclaw::llm::{
|
|
CompletionRequest, CompletionResponse, FinishReason, LlmProvider, ToolCompletionRequest,
|
|
ToolCompletionResponse,
|
|
};
|
|
|
|
const AUTH_TOKEN: &str = "test-openai-token";
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Mock LLM provider
|
|
// ---------------------------------------------------------------------------
|
|
|
|
struct MockLlmProvider;
|
|
|
|
#[async_trait]
|
|
impl LlmProvider for MockLlmProvider {
|
|
fn model_name(&self) -> &str {
|
|
"mock-model-v1"
|
|
}
|
|
|
|
fn cost_per_token(&self) -> (Decimal, Decimal) {
|
|
(Decimal::ZERO, Decimal::ZERO)
|
|
}
|
|
|
|
async fn complete(&self, req: CompletionRequest) -> Result<CompletionResponse, LlmError> {
|
|
// Echo the last user message back
|
|
let user_msg = req
|
|
.messages
|
|
.iter()
|
|
.rev()
|
|
.find(|m| m.role == ironclaw::llm::Role::User)
|
|
.map(|m| m.content.clone())
|
|
.unwrap_or_else(|| "no user message".to_string());
|
|
|
|
Ok(CompletionResponse {
|
|
content: format!("Mock response to: {}", user_msg),
|
|
input_tokens: 10,
|
|
output_tokens: 5,
|
|
finish_reason: FinishReason::Stop,
|
|
response_id: None,
|
|
})
|
|
}
|
|
|
|
async fn complete_with_tools(
|
|
&self,
|
|
req: ToolCompletionRequest,
|
|
) -> Result<ToolCompletionResponse, LlmError> {
|
|
// If tools are provided, return a tool call
|
|
if let Some(tool) = req.tools.first() {
|
|
Ok(ToolCompletionResponse {
|
|
content: None,
|
|
tool_calls: vec![ironclaw::llm::ToolCall {
|
|
id: "call_mock_001".to_string(),
|
|
name: tool.name.clone(),
|
|
arguments: serde_json::json!({"test": true}),
|
|
}],
|
|
input_tokens: 15,
|
|
output_tokens: 8,
|
|
finish_reason: FinishReason::ToolUse,
|
|
response_id: None,
|
|
})
|
|
} else {
|
|
Ok(ToolCompletionResponse {
|
|
content: Some("No tools available".to_string()),
|
|
tool_calls: vec![],
|
|
input_tokens: 10,
|
|
output_tokens: 4,
|
|
finish_reason: FinishReason::Stop,
|
|
response_id: None,
|
|
})
|
|
}
|
|
}
|
|
|
|
async fn list_models(&self) -> Result<Vec<String>, LlmError> {
|
|
Ok(vec![
|
|
"mock-model-v1".to_string(),
|
|
"mock-model-v2".to_string(),
|
|
])
|
|
}
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Test helpers
|
|
// ---------------------------------------------------------------------------
|
|
|
|
async fn start_test_server() -> (SocketAddr, Arc<GatewayState>) {
|
|
let state = Arc::new(GatewayState {
|
|
msg_tx: tokio::sync::RwLock::new(None),
|
|
sse: SseManager::new(),
|
|
workspace: None,
|
|
session_manager: None,
|
|
log_broadcaster: None,
|
|
extension_manager: None,
|
|
tool_registry: None,
|
|
store: None,
|
|
job_manager: None,
|
|
prompt_queue: None,
|
|
user_id: "test-user".to_string(),
|
|
shutdown_tx: tokio::sync::RwLock::new(None),
|
|
ws_tracker: Some(Arc::new(WsConnectionTracker::new())),
|
|
llm_provider: Some(Arc::new(MockLlmProvider)),
|
|
skill_registry: None,
|
|
skill_catalog: None,
|
|
chat_rate_limiter: ironclaw::channels::web::server::RateLimiter::new(30, 60),
|
|
});
|
|
|
|
let addr: SocketAddr = "127.0.0.1:0".parse().unwrap();
|
|
let bound_addr = start_server(addr, state.clone(), AUTH_TOKEN.to_string())
|
|
.await
|
|
.expect("Failed to start test server");
|
|
|
|
(bound_addr, state)
|
|
}
|
|
|
|
fn client() -> reqwest::Client {
|
|
reqwest::Client::builder()
|
|
.timeout(Duration::from_secs(10))
|
|
.build()
|
|
.unwrap()
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Tests
|
|
// ---------------------------------------------------------------------------
|
|
|
|
#[tokio::test]
|
|
async fn test_chat_completions_basic() {
|
|
let (addr, _state) = start_test_server().await;
|
|
let url = format!("http://{}/v1/chat/completions", addr);
|
|
|
|
let resp = client()
|
|
.post(&url)
|
|
.bearer_auth(AUTH_TOKEN)
|
|
.json(&serde_json::json!({
|
|
"model": "mock-model-v1",
|
|
"messages": [
|
|
{"role": "user", "content": "Hello world"}
|
|
]
|
|
}))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
|
|
assert_eq!(resp.status(), 200);
|
|
|
|
let body: serde_json::Value = resp.json().await.unwrap();
|
|
assert_eq!(body["object"], "chat.completion");
|
|
assert_eq!(body["model"], "mock-model-v1");
|
|
assert_eq!(body["choices"][0]["finish_reason"], "stop");
|
|
|
|
let content = body["choices"][0]["message"]["content"].as_str().unwrap();
|
|
assert!(
|
|
content.contains("Hello world"),
|
|
"Expected echo, got: {}",
|
|
content
|
|
);
|
|
|
|
// Check usage
|
|
assert_eq!(body["usage"]["prompt_tokens"], 10);
|
|
assert_eq!(body["usage"]["completion_tokens"], 5);
|
|
assert_eq!(body["usage"]["total_tokens"], 15);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_chat_completions_with_system_message() {
|
|
let (addr, _state) = start_test_server().await;
|
|
let url = format!("http://{}/v1/chat/completions", addr);
|
|
|
|
let resp = client()
|
|
.post(&url)
|
|
.bearer_auth(AUTH_TOKEN)
|
|
.json(&serde_json::json!({
|
|
"model": "mock-model-v1",
|
|
"messages": [
|
|
{"role": "system", "content": "You are helpful."},
|
|
{"role": "user", "content": "What is 2+2?"}
|
|
],
|
|
"temperature": 0.5,
|
|
"max_tokens": 100
|
|
}))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
|
|
assert_eq!(resp.status(), 200);
|
|
let body: serde_json::Value = resp.json().await.unwrap();
|
|
let content = body["choices"][0]["message"]["content"].as_str().unwrap();
|
|
assert!(content.contains("2+2"));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_chat_completions_with_tools() {
|
|
let (addr, _state) = start_test_server().await;
|
|
let url = format!("http://{}/v1/chat/completions", addr);
|
|
|
|
let resp = client()
|
|
.post(&url)
|
|
.bearer_auth(AUTH_TOKEN)
|
|
.json(&serde_json::json!({
|
|
"model": "mock-model-v1",
|
|
"messages": [
|
|
{"role": "user", "content": "What's the weather?"}
|
|
],
|
|
"tools": [{
|
|
"type": "function",
|
|
"function": {
|
|
"name": "get_weather",
|
|
"description": "Get the weather",
|
|
"parameters": {
|
|
"type": "object",
|
|
"properties": {
|
|
"location": {"type": "string"}
|
|
}
|
|
}
|
|
}
|
|
}]
|
|
}))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
|
|
assert_eq!(resp.status(), 200);
|
|
let body: serde_json::Value = resp.json().await.unwrap();
|
|
|
|
assert_eq!(body["choices"][0]["finish_reason"], "tool_calls");
|
|
|
|
let tool_calls = &body["choices"][0]["message"]["tool_calls"];
|
|
assert!(tool_calls.is_array());
|
|
assert_eq!(tool_calls[0]["id"], "call_mock_001");
|
|
assert_eq!(tool_calls[0]["type"], "function");
|
|
assert_eq!(tool_calls[0]["function"]["name"], "get_weather");
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_chat_completions_streaming() {
|
|
let (addr, _state) = start_test_server().await;
|
|
let url = format!("http://{}/v1/chat/completions", addr);
|
|
|
|
let resp = client()
|
|
.post(&url)
|
|
.bearer_auth(AUTH_TOKEN)
|
|
.json(&serde_json::json!({
|
|
"model": "mock-model-v1",
|
|
"messages": [
|
|
{"role": "user", "content": "Stream test"}
|
|
],
|
|
"stream": true
|
|
}))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
|
|
assert_eq!(resp.status(), 200);
|
|
|
|
// Check simulated streaming header
|
|
assert_eq!(
|
|
resp.headers()
|
|
.get("x-ironclaw-streaming")
|
|
.and_then(|v| v.to_str().ok()),
|
|
Some("simulated"),
|
|
"Expected x-ironclaw-streaming: simulated header"
|
|
);
|
|
|
|
let text = resp.text().await.unwrap();
|
|
|
|
// Should contain SSE data lines
|
|
assert!(
|
|
text.contains("data:"),
|
|
"Expected SSE data lines, got: {}",
|
|
text
|
|
);
|
|
// Should end with [DONE]
|
|
assert!(
|
|
text.contains("[DONE]"),
|
|
"Expected [DONE] sentinel, got: {}",
|
|
text
|
|
);
|
|
// Should contain the role chunk
|
|
assert!(
|
|
text.contains("\"role\":\"assistant\""),
|
|
"Expected role chunk, got: {}",
|
|
text
|
|
);
|
|
|
|
// Collect all content from the chunks
|
|
let mut full_content = String::new();
|
|
for line in text.lines() {
|
|
if let Some(data) = line.strip_prefix("data:") {
|
|
let data = data.trim();
|
|
if data == "[DONE]" {
|
|
continue;
|
|
}
|
|
if let Ok(chunk) = serde_json::from_str::<serde_json::Value>(data)
|
|
&& let Some(content) = chunk["choices"][0]["delta"]["content"].as_str()
|
|
{
|
|
full_content.push_str(content);
|
|
}
|
|
}
|
|
}
|
|
assert!(
|
|
full_content.contains("Stream test"),
|
|
"Expected reassembled content to contain 'Stream test', got: '{}'",
|
|
full_content
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_chat_completions_empty_messages() {
|
|
let (addr, _state) = start_test_server().await;
|
|
let url = format!("http://{}/v1/chat/completions", addr);
|
|
|
|
let resp = client()
|
|
.post(&url)
|
|
.bearer_auth(AUTH_TOKEN)
|
|
.json(&serde_json::json!({
|
|
"model": "mock-model-v1",
|
|
"messages": []
|
|
}))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
|
|
assert_eq!(resp.status(), 400);
|
|
let body: serde_json::Value = resp.json().await.unwrap();
|
|
assert!(body["error"]["message"].as_str().unwrap().contains("empty"));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_chat_completions_model_mismatch() {
|
|
let (addr, _state) = start_test_server().await;
|
|
let url = format!("http://{}/v1/chat/completions", addr);
|
|
|
|
let resp = client()
|
|
.post(&url)
|
|
.bearer_auth(AUTH_TOKEN)
|
|
.json(&serde_json::json!({
|
|
"model": "gpt-4",
|
|
"messages": [{"role": "user", "content": "Hi"}]
|
|
}))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
|
|
assert_eq!(resp.status(), 404);
|
|
let body: serde_json::Value = resp.json().await.unwrap();
|
|
assert_eq!(body["error"]["code"], "model_not_found");
|
|
assert!(
|
|
body["error"]["message"]
|
|
.as_str()
|
|
.unwrap()
|
|
.contains("mock-model-v1")
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_chat_completions_no_auth() {
|
|
let (addr, _state) = start_test_server().await;
|
|
let url = format!("http://{}/v1/chat/completions", addr);
|
|
|
|
let resp = client()
|
|
.post(&url)
|
|
// No auth header
|
|
.json(&serde_json::json!({
|
|
"model": "mock-model-v1",
|
|
"messages": [{"role": "user", "content": "Hi"}]
|
|
}))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
|
|
assert_eq!(resp.status(), 401);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_models_endpoint() {
|
|
let (addr, _state) = start_test_server().await;
|
|
let url = format!("http://{}/v1/models", addr);
|
|
|
|
let resp = client()
|
|
.get(&url)
|
|
.bearer_auth(AUTH_TOKEN)
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
|
|
assert_eq!(resp.status(), 200);
|
|
let body: serde_json::Value = resp.json().await.unwrap();
|
|
|
|
assert_eq!(body["object"], "list");
|
|
let data = body["data"].as_array().unwrap();
|
|
assert_eq!(data.len(), 2);
|
|
assert_eq!(data[0]["id"], "mock-model-v1");
|
|
assert_eq!(data[1]["id"], "mock-model-v2");
|
|
assert_eq!(data[0]["object"], "model");
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_models_no_auth() {
|
|
let (addr, _state) = start_test_server().await;
|
|
let url = format!("http://{}/v1/models", addr);
|
|
|
|
let resp = client().get(&url).send().await.unwrap();
|
|
assert_eq!(resp.status(), 401);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_no_llm_provider_returns_503() {
|
|
// Create state WITHOUT llm_provider
|
|
let state = Arc::new(GatewayState {
|
|
msg_tx: tokio::sync::RwLock::new(None),
|
|
sse: SseManager::new(),
|
|
workspace: None,
|
|
session_manager: None,
|
|
log_broadcaster: None,
|
|
extension_manager: None,
|
|
tool_registry: None,
|
|
store: None,
|
|
job_manager: None,
|
|
prompt_queue: None,
|
|
user_id: "test-user".to_string(),
|
|
shutdown_tx: tokio::sync::RwLock::new(None),
|
|
ws_tracker: Some(Arc::new(WsConnectionTracker::new())),
|
|
llm_provider: None, // No LLM!
|
|
skill_registry: None,
|
|
skill_catalog: None,
|
|
chat_rate_limiter: ironclaw::channels::web::server::RateLimiter::new(30, 60),
|
|
});
|
|
|
|
let addr: SocketAddr = "127.0.0.1:0".parse().unwrap();
|
|
let bound_addr = start_server(addr, state, AUTH_TOKEN.to_string())
|
|
.await
|
|
.unwrap();
|
|
|
|
let url = format!("http://{}/v1/chat/completions", bound_addr);
|
|
let resp = client()
|
|
.post(&url)
|
|
.bearer_auth(AUTH_TOKEN)
|
|
.json(&serde_json::json!({
|
|
"model": "mock-model-v1",
|
|
"messages": [{"role": "user", "content": "Hi"}]
|
|
}))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
|
|
assert_eq!(resp.status(), 503);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_chat_completions_body_too_large() {
|
|
let (addr, _state) = start_test_server().await;
|
|
let url = format!("http://{}/v1/chat/completions", addr);
|
|
|
|
// Build a payload over 1 MB (the gateway's DefaultBodyLimit)
|
|
let big_content = "x".repeat(2 * 1024 * 1024);
|
|
let resp = client()
|
|
.post(&url)
|
|
.bearer_auth(AUTH_TOKEN)
|
|
.json(&serde_json::json!({
|
|
"model": "mock-model-v1",
|
|
"messages": [{"role": "user", "content": big_content}]
|
|
}))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
|
|
assert_eq!(resp.status(), 413);
|
|
}
|