Files
zeekay 19fdf55ceb feat(auth): one key scheme, minted and read in one place
A key now opens with what it is allowed to touch. `pk-` is publishable and
safe in a browser; `sk-` is secret and never leaves a server. The five marks
it replaces all began `ph` -- the upstream's initials -- and they were the
last of its brand a customer read back to us, in every SDK snippet. No word
rule could reach them, because `ph` is not a word.

The marks were also not telling the truth. The constant said `phc_` while
every live project token said `hi_`, so the middleware that routes on the
constant matched no real token at all. Two spellings existed and one was
fiction. Minting now happens in exactly one function and reading in exactly
one, so a second spelling has nowhere to live.

`phx_` (personal) and `phs_` (project secret) both become `sk-`. The mark
now says only that a value is secret; which store holds it is settled by
asking. That was already how personal keys worked -- keys minted before the
marks carry none, so the store always decided -- and both secret resolvers
already returned None on a miss and fell through, so one shared extractor
replaces the two that could drift apart.

OAuth's access and refresh tokens stay distinguishable as `at-` and `rt-`,
because the parser tells them apart before either is looked up, and the
domain-verification token becomes `vt-` rather than keeping a sixth mint of
its own.

`bin/debrand --check` now refuses the marks as a shape, so a seventh cannot
be coined. Two rules that were about to rename things that are not ours to
spell are bounded: `Lemon` no longer eats `LemonSqueezy`, and the `hog_flow`
rules no longer reach a Postgres table, a Datastore table or a route.

Keys are stored hashed, so a mark cannot be rewritten in place: the three
live project tokens have to be reminted.
2026-08-08 19:42:44 -07:00

112 lines
4.0 KiB
Python

"""
Integration tests for audio transcription using the OpenAI SDK through the gateway.
Skipped unless OPENAI_API_KEY is set and audio samples exist.
Run with: pytest tests/integration/test_openai_transcription.py -v
Add audio files to tests/integration/audio_samples/ to run these tests.
"""
import os
from pathlib import Path
import pytest
from openai import NotFoundError, OpenAI
OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY")
AUDIO_SAMPLES_DIR = Path(__file__).parent / "audio_samples"
AUDIO_EXTENSIONS = {".mp3", ".m4a", ".wav", ".webm", ".mp4", ".mpeg", ".mpga", ".oga", ".ogg", ".flac"}
skip_without_openai_key = pytest.mark.skipif(not OPENAI_API_KEY, reason="OPENAI_API_KEY not set")
pytestmark = pytest.mark.xfail(strict=False, reason="OpenAI may be rate-limited or temporarily unavailable")
@pytest.fixture
def audio_file() -> Path:
"""Get an audio file from audio_samples, skip if none exist."""
if not AUDIO_SAMPLES_DIR.exists():
pytest.skip("audio_samples directory not found")
files = [f for f in AUDIO_SAMPLES_DIR.iterdir() if f.suffix.lower() in AUDIO_EXTENSIONS]
if not files:
pytest.skip("No audio files found in tests/integration/audio_samples/")
return files[0]
@skip_without_openai_key
class TestOpenAIAudioTranscription:
def test_basic_transcription(self, openai_client: OpenAI, audio_file: Path):
with open(audio_file, "rb") as f:
response = openai_client.audio.transcriptions.create(
model="whisper-1",
file=f,
)
assert response is not None
assert response.text is not None
assert len(response.text) > 0
def test_transcription_with_language_hint(self, openai_client: OpenAI, audio_file: Path):
with open(audio_file, "rb") as f:
response = openai_client.audio.transcriptions.create(
model="whisper-1",
file=f,
language="en",
)
assert response is not None
assert response.text is not None
def test_transcription_with_product_route(self, gateway_url: str, audio_file: Path):
client = OpenAI(
api_key="sk-fake_personal_api_key",
base_url=f"{gateway_url}/llm_gateway/v1",
)
with open(audio_file, "rb") as f:
response = client.audio.transcriptions.create(
model="whisper-1",
file=f,
)
assert response is not None
assert response.text is not None
def test_response_is_text(self, openai_client: OpenAI, audio_file: Path):
with open(audio_file, "rb") as f:
response = openai_client.audio.transcriptions.create(
model="whisper-1",
file=f,
)
assert isinstance(response.text, str)
assert len(response.text.strip()) > 0
def test_sequential_transcriptions(self, openai_client: OpenAI, audio_file: Path):
with open(audio_file, "rb") as f:
response1 = openai_client.audio.transcriptions.create(model="whisper-1", file=f)
with open(audio_file, "rb") as f:
response2 = openai_client.audio.transcriptions.create(model="whisper-1", file=f)
assert response1.text is not None
assert response2.text is not None
@pytest.mark.parametrize("model", ["whisper-1", "gpt-4o-transcribe"])
def test_transcription_models(self, openai_client: OpenAI, audio_file: Path, model: str):
with open(audio_file, "rb") as f:
response = openai_client.audio.transcriptions.create(
model=model,
file=f,
)
assert response is not None
assert response.text is not None
def test_invalid_model_rejected(self, openai_client: OpenAI, audio_file: Path):
with open(audio_file, "rb") as f:
with pytest.raises(NotFoundError):
openai_client.audio.transcriptions.create(
model="invalid-model-name",
file=f,
)