mirror of
https://github.com/hanzoai/extension.git
synced 2026-10-31 21:57:06 +00:00
zooqueenandHanzo Dev
f717dd89ad
28 apps told the user to paste an `hk-` key — input placeholders, settings help text, READMEs, the error thrown when the field is empty — and five of them validated that paste against /^hk-/ before sending it as a bearer. Nothing mints that prefix any more: cloud accepts pk- and sk-, IAM mints sk-. So the guard admitted a credential that authenticates nothing, and the panel failed later at the gateway with nothing on screen to explain it. The three leak detectors keep hk- and gain sk-. Salesforce's source scan and the two Zendesk tests exist to catch a key committed to source or echoed back through a request; retired keys are still in circulation and leak exactly as badly, while a detector that only knew hk- would have gone blind to every key minted from here on. `sk-` used to be the example of the foreign key the guard screened out — an OpenAI key. It cannot mean that now, and shape alone cannot tell one vendor's sk- from another's, so those comments say what the check really proves and point at the /v1/models call that proves the rest. The three tests that pinned "sk- is rejected" now pin "hk- is rejected", which is the invariant that survived. Verified: 2029 tests pass across the 28 packages; typecheck clean on 25 of them (hubspot, jupyter and teams fail identically at HEAD on JSX and ESM type conflicts in files this does not touch); salesforce validate-source green. Co-authored-by: Hanzo Dev <[email protected]>
95 lines
3.1 KiB
TypeScript
95 lines
3.1 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import {
|
|
pickBearer,
|
|
chatCompletionsURL,
|
|
modelsURL,
|
|
accountServer,
|
|
isDocusignEnv,
|
|
readServerConfig,
|
|
OAUTH_SCOPES,
|
|
HANZO_API_BASE_URL,
|
|
ESIGN_API_VERSION,
|
|
} from '../src/config';
|
|
|
|
describe('pickBearer', () => {
|
|
it('prefers the pasted API key over the oauth token', () => {
|
|
expect(pickBearer('sk-123', 'oauth-tok')).toBe('sk-123');
|
|
});
|
|
it('falls back to the oauth token when no key', () => {
|
|
expect(pickBearer('', 'oauth-tok')).toBe('oauth-tok');
|
|
expect(pickBearer(' ', 'oauth-tok')).toBe('oauth-tok');
|
|
});
|
|
it('is empty (anonymous) when neither is present', () => {
|
|
expect(pickBearer('', '')).toBe('');
|
|
});
|
|
});
|
|
|
|
describe('gateway URLs', () => {
|
|
it('build /v1 endpoints on api.hanzo.ai with no /api/ prefix', () => {
|
|
expect(chatCompletionsURL()).toBe(`${HANZO_API_BASE_URL}/v1/chat/completions`);
|
|
expect(modelsURL()).toBe(`${HANZO_API_BASE_URL}/v1/models`);
|
|
expect(chatCompletionsURL()).not.toContain('/api/');
|
|
});
|
|
});
|
|
|
|
describe('accountServer / env', () => {
|
|
it('maps demo and production to the two DocuSign account servers', () => {
|
|
expect(accountServer('demo')).toBe('https://account-d.docusign.com');
|
|
expect(accountServer('production')).toBe('https://account.docusign.com');
|
|
});
|
|
it('narrows only demo/production', () => {
|
|
expect(isDocusignEnv('demo')).toBe(true);
|
|
expect(isDocusignEnv('production')).toBe(true);
|
|
expect(isDocusignEnv('prod')).toBe(false);
|
|
expect(isDocusignEnv(undefined)).toBe(false);
|
|
});
|
|
it('requests the signature + openid scopes', () => {
|
|
expect(OAUTH_SCOPES).toContain('signature');
|
|
expect(OAUTH_SCOPES).toContain('openid');
|
|
});
|
|
it('uses eSignature REST v2.1', () => {
|
|
expect(ESIGN_API_VERSION).toBe('v2.1');
|
|
});
|
|
});
|
|
|
|
describe('readServerConfig', () => {
|
|
const base = {
|
|
DOCUSIGN_CLIENT_ID: 'ik',
|
|
DOCUSIGN_CLIENT_SECRET: 'sk',
|
|
DOCUSIGN_REDIRECT_URI: 'https://docusign.hanzo.ai/oauth/callback',
|
|
DOCUSIGN_CONNECT_HMAC_KEY: 'hmac',
|
|
};
|
|
|
|
it('reads a full config and defaults env=demo, port=8789', () => {
|
|
const cfg = readServerConfig(base);
|
|
expect(cfg.docusignClientId).toBe('ik');
|
|
expect(cfg.docusignClientSecret).toBe('sk');
|
|
expect(cfg.connectHmacKey).toBe('hmac');
|
|
expect(cfg.docusignEnv).toBe('demo');
|
|
expect(cfg.hanzoApiKey).toBe('');
|
|
expect(cfg.port).toBe(8789);
|
|
});
|
|
|
|
it('honors DOCUSIGN_ENV=production, HANZO_API_KEY, and PORT', () => {
|
|
const cfg = readServerConfig({ ...base, DOCUSIGN_ENV: 'production', HANZO_API_KEY: 'sk-x', PORT: '9000' });
|
|
expect(cfg.docusignEnv).toBe('production');
|
|
expect(cfg.hanzoApiKey).toBe('sk-x');
|
|
expect(cfg.port).toBe(9000);
|
|
});
|
|
|
|
it('falls back to demo for an unknown DOCUSIGN_ENV', () => {
|
|
expect(readServerConfig({ ...base, DOCUSIGN_ENV: 'staging' }).docusignEnv).toBe('demo');
|
|
});
|
|
|
|
it.each([
|
|
'DOCUSIGN_CLIENT_ID',
|
|
'DOCUSIGN_CLIENT_SECRET',
|
|
'DOCUSIGN_REDIRECT_URI',
|
|
'DOCUSIGN_CONNECT_HMAC_KEY',
|
|
])('throws when %s is missing', (key) => {
|
|
const env: Record<string, string | undefined> = { ...base };
|
|
delete env[key];
|
|
expect(() => readServerConfig(env)).toThrow(key);
|
|
});
|
|
});
|