mirror of
https://github.com/hanzoai/extension.git
synced 2026-10-31 21:57:06 +00:00
zooqueenandHanzo Dev
f717dd89ad
28 apps told the user to paste an `hk-` key — input placeholders, settings help text, READMEs, the error thrown when the field is empty — and five of them validated that paste against /^hk-/ before sending it as a bearer. Nothing mints that prefix any more: cloud accepts pk- and sk-, IAM mints sk-. So the guard admitted a credential that authenticates nothing, and the panel failed later at the gateway with nothing on screen to explain it. The three leak detectors keep hk- and gain sk-. Salesforce's source scan and the two Zendesk tests exist to catch a key committed to source or echoed back through a request; retired keys are still in circulation and leak exactly as badly, while a detector that only knew hk- would have gone blind to every key minted from here on. `sk-` used to be the example of the foreign key the guard screened out — an OpenAI key. It cannot mean that now, and shape alone cannot tell one vendor's sk- from another's, so those comments say what the check really proves and point at the /v1/models call that proves the rest. The three tests that pinned "sk- is rejected" now pin "hk- is rejected", which is the invariant that survived. Verified: 2029 tests pass across the 28 packages; typecheck clean on 25 of them (hubspot, jupyter and teams fail identically at HEAD on JSX and ESM type conflicts in files this does not touch); salesforce validate-source green. Co-authored-by: Hanzo Dev <[email protected]>
47 lines
1.5 KiB
TypeScript
47 lines
1.5 KiB
TypeScript
import { describe, it, expect } from "vitest";
|
|
import {
|
|
HANZO_API_BASE_URL,
|
|
DEFAULT_MODEL,
|
|
STORE_KEY,
|
|
chatCompletionsURL,
|
|
modelsURL,
|
|
isHanzoKey,
|
|
} from "../src/config";
|
|
|
|
describe("gateway constants", () => {
|
|
it("points at api.hanzo.ai with no /api/ prefix", () => {
|
|
expect(HANZO_API_BASE_URL).toBe("https://api.hanzo.ai");
|
|
expect(chatCompletionsURL()).toBe("https://api.hanzo.ai/v1/chat/completions");
|
|
expect(modelsURL()).toBe("https://api.hanzo.ai/v1/models");
|
|
expect(chatCompletionsURL()).not.toContain("/api/");
|
|
});
|
|
|
|
it("defaults to a Zen model", () => {
|
|
expect(DEFAULT_MODEL).toBe("zen5");
|
|
});
|
|
|
|
it("names the local store key", () => {
|
|
expect(STORE_KEY).toBe("hanzo.desktop.settings");
|
|
});
|
|
});
|
|
|
|
describe("isHanzoKey", () => {
|
|
it("accepts a well-formed sk- key", () => {
|
|
expect(isHanzoKey("sk-" + "a".repeat(16))).toBe(true);
|
|
expect(isHanzoKey("sk-Abc123._-Abc123._-")).toBe(true);
|
|
});
|
|
|
|
it("trims surrounding whitespace before matching", () => {
|
|
expect(isHanzoKey(" sk-" + "b".repeat(20) + " ")).toBe(true);
|
|
});
|
|
|
|
it("rejects the wrong prefix, too-short, or non-string", () => {
|
|
expect(isHanzoKey("hk-" + "a".repeat(20))).toBe(false); // the retired prefix
|
|
expect(isHanzoKey("sk-short")).toBe(false); // < 16 body chars
|
|
expect(isHanzoKey("eyJhbGciOiJI.jwt.token")).toBe(false); // an IAM JWT
|
|
expect(isHanzoKey("")).toBe(false);
|
|
expect(isHanzoKey(undefined)).toBe(false);
|
|
expect(isHanzoKey(null)).toBe(false);
|
|
});
|
|
});
|