mirror of
https://github.com/hanzoai/extension.git
synced 2026-10-31 19:52:25 +00:00
zooqueenandHanzo Dev
f717dd89ad
28 apps told the user to paste an `hk-` key — input placeholders, settings help text, READMEs, the error thrown when the field is empty — and five of them validated that paste against /^hk-/ before sending it as a bearer. Nothing mints that prefix any more: cloud accepts pk- and sk-, IAM mints sk-. So the guard admitted a credential that authenticates nothing, and the panel failed later at the gateway with nothing on screen to explain it. The three leak detectors keep hk- and gain sk-. Salesforce's source scan and the two Zendesk tests exist to catch a key committed to source or echoed back through a request; retired keys are still in circulation and leak exactly as badly, while a detector that only knew hk- would have gone blind to every key minted from here on. `sk-` used to be the example of the foreign key the guard screened out — an OpenAI key. It cannot mean that now, and shape alone cannot tell one vendor's sk- from another's, so those comments say what the check really proves and point at the /v1/models call that proves the rest. The three tests that pinned "sk- is rejected" now pin "hk- is rejected", which is the invariant that survived. Verified: 2029 tests pass across the 28 packages; typecheck clean on 25 of them (hubspot, jupyter and teams fail identically at HEAD on JSX and ESM type conflicts in files this does not touch); salesforce validate-source green. Co-authored-by: Hanzo Dev <[email protected]>
60 lines
1.9 KiB
TypeScript
60 lines
1.9 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import { loadConfig, isOAuthMode } from '../src/config.js';
|
|
|
|
const BASE = { SLACK_SIGNING_SECRET: 'sign' };
|
|
|
|
describe('loadConfig', () => {
|
|
it('accepts single-workspace bot-token mode', () => {
|
|
const cfg = loadConfig({ ...BASE, SLACK_BOT_TOKEN: 'xoxb-1' });
|
|
expect(cfg.slack.botToken).toBe('xoxb-1');
|
|
expect(isOAuthMode(cfg.slack)).toBe(false);
|
|
expect(cfg.hanzo.baseURL).toBe('https://api.hanzo.ai');
|
|
expect(cfg.defaultModel).toBe('zen5');
|
|
expect(cfg.port).toBe(3000);
|
|
});
|
|
|
|
it('accepts OAuth mode with client id/secret/state', () => {
|
|
const cfg = loadConfig({
|
|
...BASE,
|
|
SLACK_CLIENT_ID: 'cid',
|
|
SLACK_CLIENT_SECRET: 'csec',
|
|
SLACK_STATE_SECRET: 'st',
|
|
});
|
|
expect(isOAuthMode(cfg.slack)).toBe(true);
|
|
});
|
|
|
|
it('requires the signing secret', () => {
|
|
expect(() => loadConfig({ SLACK_BOT_TOKEN: 'xoxb-1' })).toThrow(/SLACK_SIGNING_SECRET/);
|
|
});
|
|
|
|
it('requires either bot token or OAuth', () => {
|
|
expect(() => loadConfig({ ...BASE })).toThrow(/SLACK_BOT_TOKEN|OAuth/);
|
|
});
|
|
|
|
it('requires state secret in OAuth mode', () => {
|
|
expect(() =>
|
|
loadConfig({ ...BASE, SLACK_CLIENT_ID: 'c', SLACK_CLIENT_SECRET: 's' }),
|
|
).toThrow(/SLACK_STATE_SECRET/);
|
|
});
|
|
|
|
it('reads Hanzo + IAM overrides and PORT', () => {
|
|
const cfg = loadConfig({
|
|
...BASE,
|
|
SLACK_BOT_TOKEN: 'xoxb-1',
|
|
HANZO_API_KEY: 'sk-123',
|
|
HANZO_API_BASE_URL: 'https://api.hanzo.ai',
|
|
HANZO_DEFAULT_MODEL: 'zen5-pro',
|
|
HANZO_IAM_SERVER_URL: 'https://hanzo.id',
|
|
PORT: '8080',
|
|
});
|
|
expect(cfg.hanzo.apiKey).toBe('sk-123');
|
|
expect(cfg.defaultModel).toBe('zen5-pro');
|
|
expect(cfg.hanzo.iamServerUrl).toBe('https://hanzo.id');
|
|
expect(cfg.port).toBe(8080);
|
|
});
|
|
|
|
it('rejects an invalid PORT', () => {
|
|
expect(() => loadConfig({ ...BASE, SLACK_BOT_TOKEN: 'x', PORT: 'abc' })).toThrow(/PORT/);
|
|
});
|
|
});
|