rootandClaude Opus 5.5
f48e1aac96
- POST /approvals and PATCH /approvals/{id} require a console admin session
(EndpointDef auth:"session"); API keys incl. admin scope get 403, so an
organize.execute key can no longer approve its own plan (S1)
- tests for single-use approval checks: expired, revision/payload hash
mismatch, consumed, revoked, pending/rejected, plan mismatch; re-approve
after plan change succeeds once and cannot be replayed (S4)
- one redact key table in @umt/contracts shared by server logger and agent
redactForModel: rsskey, torrent_pass, authkey, downhash, c_secure_pass,
passkey variants, x-api-key, cookie headers, nested objects/arrays (S2)
- TMDB network errors: message and cause redacted via redactUrl (S3)
- web Agent ?mock=1 only in DEV builds or when pi.provider is fake (S7)
- EndpointDef auth annotations for /auth/*, asserted against
PUBLIC_AUTH_PATHS (S10); doc drift fixes (S11)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
99 lines
3.6 KiB
TypeScript
99 lines
3.6 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { buildSystemPrompt, REDACTED, redactForModel, redactString, summarizeForLog } from "../src/index.ts";
|
|
|
|
describe("redactForModel", () => {
|
|
it("遮蔽敏感键、含 passkey 的 URL、Bearer、请求头、URL 账号密码", () => {
|
|
const input = {
|
|
title: "Dune",
|
|
cookie: "uid=1; pass=abc",
|
|
apiKey: "sk-ant-1234567890abcd",
|
|
api_key: "k",
|
|
Authorization: "Bearer abcdefghijk",
|
|
accessToken: "t0k3n",
|
|
passkey: "p",
|
|
usage: { totalTokens: 100, inputTokens: 20, maxTokens: 5 },
|
|
links: [
|
|
"https://pt.example/download.php?id=9&passkey=0123456789abcdef",
|
|
"https://mt.example/api/rss?sign=abc&t=1",
|
|
"http://admin:[email protected]:8080/api/v2",
|
|
],
|
|
log: "fetch failed: Authorization: Basic dXNlcjpwYXNz\nnext",
|
|
text: "use token=abcdef and key sk-live-ABCDEFGH1234",
|
|
nested: new Map([["set-cookie", "a=b"]]),
|
|
};
|
|
const out = redactForModel(input);
|
|
const text = JSON.stringify(out);
|
|
for (const secret of [
|
|
"uid=1",
|
|
"sk-ant-",
|
|
"abcdefghijk",
|
|
"t0k3n",
|
|
"0123456789abcdef",
|
|
"sign=abc",
|
|
"hunter2",
|
|
"dXNlcjpwYXNz",
|
|
"=abcdef",
|
|
"sk-live",
|
|
]) {
|
|
expect(text).not.toContain(secret);
|
|
}
|
|
expect(out.cookie).toBe(REDACTED);
|
|
expect(out.passkey).toBe(REDACTED);
|
|
expect(out.usage).toEqual({ totalTokens: 100, inputTokens: 20, maxTokens: 5 });
|
|
expect(out.links[0]).toBe(`https://pt.example/download.php?id=9&passkey=${REDACTED}`);
|
|
expect(out.links[2]).toContain("qb.local:8080");
|
|
expect(out.title).toBe("Dune");
|
|
expect(input.cookie).toBe("uid=1; pass=abc");
|
|
});
|
|
|
|
it("字符串与摘要截断", () => {
|
|
expect(redactString("rss https://a.b/rss?rsskey=XYZ&x=1")).toBe(`rss https://a.b/rss?rsskey=${REDACTED}&x=1`);
|
|
const s = summarizeForLog({ long: "x".repeat(1000) }, 50);
|
|
expect(s.length).toBeLessThan(80);
|
|
expect(s).toContain("more");
|
|
const circular: Record<string, unknown> = { a: 1 };
|
|
circular.self = circular;
|
|
expect(summarizeForLog(circular)).toContain("[Circular]");
|
|
});
|
|
});
|
|
|
|
describe("buildSystemPrompt", () => {
|
|
it("包含证据、授权、已提交≠已入库、不可信外部内容、凭证禁令与约束", () => {
|
|
const p = buildSystemPrompt({
|
|
role: "媒体库自动化助手",
|
|
goal: "把 Dune 1080p 收进来",
|
|
constraints: ["只给方案,不执行"],
|
|
});
|
|
expect(p).toContain("你是媒体库自动化助手");
|
|
expect(p).toContain("把 Dune 1080p 收进来");
|
|
expect(p).toContain("证据");
|
|
expect(p).toContain("不得声称用户已授权");
|
|
expect(p).toContain("“已提交”不等于“已入库”");
|
|
expect(p).toMatch(/网页、RSS.*不可信数据/);
|
|
expect(p).toMatch(/不得输出.*凭证.*passkey/);
|
|
expect(p).toContain("- 只给方案,不执行");
|
|
});
|
|
});
|
|
|
|
describe("redactForModel:站点凭证键全集(与服务端 logger 同一键表)", () => {
|
|
it("rsskey / torrent_pass / authkey / downhash / c_secure_pass / passkey 变体 / x-api-key / cookie", () => {
|
|
const input = {
|
|
rsskey: "S1",
|
|
torrent_pass: "S2",
|
|
authKey: "S3",
|
|
downhash: "S4",
|
|
c_secure_pass: "S5",
|
|
"Pass-Key": "S6",
|
|
"x-api-key": "S7",
|
|
Cookie: "S8",
|
|
nested: [{ pass_key: "S9" }],
|
|
url: "https://x/rss?rsskey=S10&torrent_pass=S11&authkey=S12&downhash=S13&c_secure_pass=S14&PassKey=S15",
|
|
usage: { totalTokens: 10 },
|
|
};
|
|
const out = JSON.stringify(redactForModel(input));
|
|
expect(out).not.toMatch(/S\d+"/);
|
|
expect(out).not.toMatch(/=S\d+/);
|
|
expect(out).toContain('"totalTokens":10');
|
|
});
|
|
});
|