mirror of
https://github.com/hanzoai/chat.git
synced 2026-09-30 20:51:17 +00:00
zeekay
551236b1a5
Five things answered outside /v1/chat/. Four of them are chat's; they move.
/health -> /v1/chat/health
POST /oauth/iam/session-> POST /v1/chat/auth/iam/session (it is auth)
GET /oauth/openid[/callback], /oauth/error
-> /v1/chat/auth/openid[/callback], /v1/chat/auth/error
/images/ -> /v1/chat/images/
The fifth — the built assets at / and the SPA catch-all — is the SPA's, and
stays. Every caller moved in the same commit: api-endpoints (health, iamSession),
the metrics + telemetry health filter, the helm probes, the PR-preview workflow,
the PWA nav-fallback denylist. `ErrorController` matched a failed OIDC callback
by the substring '/oauth/', which the move would have silently broken; it now
matches the route.
Images are the one persisted case: a conversation stores the served path, and
history is immutable. New writes emit /v1/chat/images/…; /images/* answers one
permanent redirect; `isServedImage` (data-provider, the one place that knows the
namespace) recognises both. Local deletion maps the served path back to disk.
Two routers were written, tested, advertised to the browser — and never mounted,
so both were a guaranteed 404: skills (types say /v1/chat/skills) and the RUM
OTLP proxy (`rum/proxy` advertises /v1/chat/rum). Mounted where they said.
Deleted, with zero callers: server/experimental.js — a drifted second copy of
the whole mount table, still referencing a router that no longer exists, that
would have silently absorbed this move and diverged again; and nginx.hanzo.conf,
referenced by no compose/Dockerfile/chart, whose own /health shadowed chat's.
Gates collapsed to their one behavior, and the env deleted:
ALLOW_SOCIAL_LOGIN IAM is the one identity provider; false produced a
server with no way to sign in. socialLogins.js is now
iamLogin.js — one name for one thing.
CONTINUE_ON_UNCAUGHT_EXCEPTION keeps a process alive in an unknown state
instead of letting the kubelet replace it.
CONFIG_BYPASS_VALIDATION boots on invalid config, on request.
MCP_SKIP_CODE_CHALLENGE_CHECK turns off PKCE verification.
OPENID_JWKS_URL_CACHE_ENABLED read as `isEnabled(x) || true` — never off.
A second, differently-defaulted read lived in
remoteAgentAuth; both are now just on.
NO_INDEX a third boolean idiom for a header we always want.
DISABLE_COMPRESSION, ENABLE_IMAGE_OUTPUT_GZIP_SCAN — we write these images
ourselves, as PNG/GIF; none is gzipped on disk.
Tests fail without the change: the auth router spec (6 of 7) against the old
router, the static spec against the old env-gated one, the config spec now sets
CONFIG_BYPASS_VALIDATION=true and still expects the exit, the error spec against
the '/oauth/' matcher, and index.spec asserts the top level serves HTML — so a
probe or caller left behind fails loudly instead of looking green.
134 lines
3.9 KiB
TypeScript
134 lines
3.9 KiB
TypeScript
import crypto from 'crypto';
|
|
import path from 'path';
|
|
|
|
const DEFAULT_BASE_URL = 'http://localhost:3080';
|
|
const DEFAULT_MONGO_URI = 'mongodb://127.0.0.1:27017/Chat-e2e';
|
|
const DEFAULT_RUNTIME_ENV_PATH = path.resolve(__dirname, '../specs/.test-results/runtime-env.json');
|
|
const GENERATED_CREDS_KEY = crypto.randomBytes(32).toString('hex');
|
|
const GENERATED_CREDS_IV = crypto.randomBytes(16).toString('hex');
|
|
const GENERATED_JWT_SECRET = crypto.randomBytes(32).toString('hex');
|
|
const GENERATED_JWT_REFRESH_SECRET = crypto.randomBytes(32).toString('hex');
|
|
const PASSTHROUGH_ENV_KEYS = [
|
|
'APPDATA',
|
|
'CI',
|
|
'FORCE_COLOR',
|
|
'HOME',
|
|
'LOCALAPPDATA',
|
|
'NO_COLOR',
|
|
'NO_PROXY',
|
|
'NODE_OPTIONS',
|
|
'PATH',
|
|
'PLAYWRIGHT_BROWSERS_PATH',
|
|
'SHELL',
|
|
'TEMP',
|
|
'TMP',
|
|
'TMPDIR',
|
|
'USER',
|
|
'USERNAME',
|
|
'http_proxy',
|
|
'https_proxy',
|
|
'no_proxy',
|
|
'HTTP_PROXY',
|
|
'HTTPS_PROXY',
|
|
];
|
|
|
|
export function getE2EBaseURL() {
|
|
return process.env.E2E_BASE_URL ?? DEFAULT_BASE_URL;
|
|
}
|
|
|
|
export function getE2EServerAddress(baseURL = getE2EBaseURL()) {
|
|
const url = new URL(baseURL);
|
|
const host = url.hostname.replace(/^\[(.*)\]$/, '$1');
|
|
const port = url.port || (url.protocol === 'https:' ? '443' : '80');
|
|
|
|
return { host, port };
|
|
}
|
|
|
|
export function getRuntimeEnvPath() {
|
|
return process.env.E2E_RUNTIME_ENV_PATH ?? DEFAULT_RUNTIME_ENV_PATH;
|
|
}
|
|
|
|
function getPassthroughEnv(): Record<string, string> {
|
|
const env: Record<string, string> = {};
|
|
const passthroughKeys = [
|
|
...PASSTHROUGH_ENV_KEYS,
|
|
...(process.env.E2E_PASSTHROUGH_ENV?.split(',') ?? []),
|
|
];
|
|
|
|
for (const key of passthroughKeys) {
|
|
const value = process.env[key.trim()];
|
|
if (value != null) {
|
|
env[key.trim()] = value;
|
|
}
|
|
}
|
|
|
|
for (const [key, value] of Object.entries(process.env)) {
|
|
if (key.startsWith('MONGOMS_') && value != null) {
|
|
env[key] = value;
|
|
}
|
|
}
|
|
|
|
return env;
|
|
}
|
|
|
|
export function getBaseE2EEnv(): Record<string, string> {
|
|
const baseURL = getE2EBaseURL();
|
|
const { host, port } = getE2EServerAddress(baseURL);
|
|
|
|
return {
|
|
...getPassthroughEnv(),
|
|
NODE_ENV: 'CI',
|
|
HOST: process.env.E2E_HOST ?? host,
|
|
PORT: process.env.E2E_PORT ?? port,
|
|
MONGO_URI: process.env.MONGO_URI ?? DEFAULT_MONGO_URI,
|
|
DOMAIN_CLIENT: process.env.E2E_DOMAIN_CLIENT ?? baseURL,
|
|
DOMAIN_SERVER: process.env.E2E_DOMAIN_SERVER ?? baseURL,
|
|
E2E_RUNTIME_ENV_PATH: getRuntimeEnvPath(),
|
|
E2E_USE_MEMORY_MONGO: process.env.E2E_USE_MEMORY_MONGO ?? 'auto',
|
|
OPENAI_API_KEY: process.env.OPENAI_API_KEY ?? 'user_provided',
|
|
CREDS_KEY: process.env.CREDS_KEY ?? GENERATED_CREDS_KEY,
|
|
CREDS_IV: process.env.CREDS_IV ?? GENERATED_CREDS_IV,
|
|
JWT_SECRET: process.env.JWT_SECRET ?? GENERATED_JWT_SECRET,
|
|
JWT_REFRESH_SECRET: process.env.JWT_REFRESH_SECRET ?? GENERATED_JWT_REFRESH_SECRET,
|
|
EMAIL_HOST: '',
|
|
SEARCH: 'false',
|
|
SESSION_EXPIRY: '60000',
|
|
ALLOW_REGISTRATION: 'true',
|
|
REFRESH_TOKEN_EXPIRY: '300000',
|
|
};
|
|
}
|
|
|
|
export function getLocalE2EEnv(): Record<string, string> {
|
|
return {
|
|
...getBaseE2EEnv(),
|
|
TITLE_CONVO: 'false',
|
|
LOGIN_VIOLATION_SCORE: '0',
|
|
REGISTRATION_VIOLATION_SCORE: '0',
|
|
CONCURRENT_VIOLATION_SCORE: '0',
|
|
MESSAGE_VIOLATION_SCORE: '0',
|
|
NON_BROWSER_VIOLATION_SCORE: '0',
|
|
FORK_VIOLATION_SCORE: '0',
|
|
IMPORT_VIOLATION_SCORE: '0',
|
|
TTS_VIOLATION_SCORE: '0',
|
|
STT_VIOLATION_SCORE: '0',
|
|
FILE_UPLOAD_VIOLATION_SCORE: '0',
|
|
RESET_PASSWORD_VIOLATION_SCORE: '0',
|
|
VERIFY_EMAIL_VIOLATION_SCORE: '0',
|
|
TOOL_CALL_VIOLATION_SCORE: '0',
|
|
CONVO_ACCESS_VIOLATION_SCORE: '0',
|
|
ILLEGAL_MODEL_REQ_SCORE: '0',
|
|
LOGIN_MAX: '20',
|
|
LOGIN_WINDOW: '1',
|
|
REGISTER_MAX: '20',
|
|
REGISTER_WINDOW: '1',
|
|
LIMIT_CONCURRENT_MESSAGES: 'false',
|
|
CONCURRENT_MESSAGE_MAX: '20',
|
|
LIMIT_MESSAGE_IP: 'false',
|
|
MESSAGE_IP_MAX: '100',
|
|
MESSAGE_IP_WINDOW: '1',
|
|
LIMIT_MESSAGE_USER: 'false',
|
|
MESSAGE_USER_MAX: '100',
|
|
MESSAGE_USER_WINDOW: '1',
|
|
};
|
|
}
|