mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekayandHanzo Dev
d7e864494f
The HTTP path addressed /v1/kms/orgs/{org}/secrets. The server mounts
/v1/kms/secrets and takes the org from the credential the request is made with,
so every HTTP-transport call reached nothing — measured against the live edge,
where the mounted path answers a JSON 403 and the org path a bare 404.
Reading the tenant from the credential is also the only place it can be trusted
from: a segment is a name the caller picks, and one identity naming another
org's secrets should not be a request this client can compose.
The four tests that covered these calls asserted the org path against a mock
server, which answers whatever path it is sent — so they were green the whole
time the transport was broken. They now pin what the server mounts, and a test
beside them fails if an org ever steers the URL again.
Co-authored-by: Hanzo Dev <[email protected]>
33 lines
1.3 KiB
Go
33 lines
1.3 KiB
Go
// Copyright 2026 Hanzo AI, Inc.
|
|
// SPDX-License-Identifier: MIT OR Apache-2.0
|
|
|
|
package kmsclient
|
|
|
|
import "testing"
|
|
|
|
// The server mounts /v1/kms/secrets and reads the org from the credential. A URL
|
|
// carrying an org segment reaches nothing — and would be asking the server to
|
|
// take the caller's word for the tenant, which is the one thing it must not do.
|
|
func TestSecretURLCarriesNoOrgSegment(t *testing.T) {
|
|
c := &Client{endpoint: "https://api.hanzo.ai", org: "hanzo"}
|
|
|
|
got := c.secretPath("", "OPENROUTER_API_KEY")
|
|
if want := "https://api.hanzo.ai/v1/kms/secrets/OPENROUTER_API_KEY"; got != want {
|
|
t.Fatalf("secretPath = %q, want %q", got, want)
|
|
}
|
|
if nested := c.secretPath("ci", "DB"); nested != "https://api.hanzo.ai/v1/kms/secrets/ci/DB" {
|
|
t.Fatalf("a nested path should ride under secrets, got %q", nested)
|
|
}
|
|
}
|
|
|
|
// The org travels in the credential, so naming a different one changes nothing
|
|
// about where the request goes. If this ever fails, the client has started
|
|
// letting a caller address another tenant by writing its name down.
|
|
func TestTheOrgDoesNotSteerTheURL(t *testing.T) {
|
|
mine := (&Client{endpoint: "https://api.hanzo.ai", org: "hanzo"}).secretPath("", "K")
|
|
theirs := (&Client{endpoint: "https://api.hanzo.ai", org: "someone-else"}).secretPath("", "K")
|
|
if mine != theirs {
|
|
t.Fatalf("the org steered the URL: %q vs %q", mine, theirs)
|
|
}
|
|
}
|