i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-10-04 16:37:46 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: resolve workspace lint and regression test failures

Browse Source
This commit is contained in:
elky
2026-09-09 11:34:45 +08:00
parent 6630856061
commit 361952ada9
30 changed files with 480 additions and 457 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/aether-gateway/src/handlers/admin/auth/oauth_routes.rs
+51 -51
View File
@@ -339,57 +339,6 @@ async fn build_admin_oauth_test_payload(
}))
}
#[cfg(test)]
mod tests {
use super::{
is_fixed_linuxdo_oauth_origin, resolve_public_admin_oauth_endpoint,
validate_public_admin_oauth_resolved_addrs,
};
use std::net::SocketAddr;
#[tokio::test]
async fn oauth_test_endpoint_rejects_loopback_https_targets_before_connecting() {
let url = reqwest::Url::parse("https://127.0.0.1/oauth/token").expect("URL");
assert!(resolve_public_admin_oauth_endpoint(&url).await.is_err());
}
#[test]
fn linuxdo_builtin_origin_allows_only_benchmarking_addresses() {
let fixed = reqwest::Url::parse("https://connect.linux.do/oauth2/token")
.expect("LinuxDo URL should parse");
let fake = SocketAddr::from(([198, 18, 75, 234], 443));
assert!(is_fixed_linuxdo_oauth_origin(&fixed));
assert!(validate_public_admin_oauth_resolved_addrs(&fixed, &[fake], true).is_ok());
assert!(validate_public_admin_oauth_resolved_addrs(&fixed, &[fake], false).is_err());
assert!(validate_public_admin_oauth_resolved_addrs(
&fixed,
&[fake, SocketAddr::from(([127, 0, 0, 1], 443))],
true,
)
.is_err());
}
#[test]
fn custom_or_non_default_oauth_origins_reject_benchmarking_addresses() {
let fake = SocketAddr::from(([198, 18, 75, 234], 443));
for raw_url in [
"https://oauth.example.test/token",
"https://connect.linux.do:8443/oauth2/token",
"https://connect.linuxdo.org/oauth2/token",
"https://connect.linux.do.evil.test/oauth2/token",
"https://connect.linux.do/oauth2/token?tenant=unexpected",
] {
let url = reqwest::Url::parse(raw_url).expect("test URL should parse");
assert!(
!is_fixed_linuxdo_oauth_origin(&url),
"must not trust {raw_url}"
);
assert!(validate_public_admin_oauth_resolved_addrs(&url, &[fake], true).is_err());
}
}
}
pub(crate) async fn maybe_build_local_admin_oauth_response(
state: &AdminAppState<'_>,
request_context: &AdminRequestContext<'_>,
@@ -689,3 +638,54 @@ pub(crate) async fn maybe_build_local_admin_oauth_response(
Ok(None)
}
#[cfg(test)]
mod tests {
use super::{
is_fixed_linuxdo_oauth_origin, resolve_public_admin_oauth_endpoint,
validate_public_admin_oauth_resolved_addrs,
};
use std::net::SocketAddr;
#[tokio::test]
async fn oauth_test_endpoint_rejects_loopback_https_targets_before_connecting() {
let url = reqwest::Url::parse("https://127.0.0.1/oauth/token").expect("URL");
assert!(resolve_public_admin_oauth_endpoint(&url).await.is_err());
}
#[test]
fn linuxdo_builtin_origin_allows_only_benchmarking_addresses() {
let fixed = reqwest::Url::parse("https://connect.linux.do/oauth2/token")
.expect("LinuxDo URL should parse");
let fake = SocketAddr::from(([198, 18, 75, 234], 443));
assert!(is_fixed_linuxdo_oauth_origin(&fixed));
assert!(validate_public_admin_oauth_resolved_addrs(&fixed, &[fake], true).is_ok());
assert!(validate_public_admin_oauth_resolved_addrs(&fixed, &[fake], false).is_err());
assert!(validate_public_admin_oauth_resolved_addrs(
&fixed,
&[fake, SocketAddr::from(([127, 0, 0, 1], 443))],
true,
)
.is_err());
}
#[test]
fn custom_or_non_default_oauth_origins_reject_benchmarking_addresses() {
let fake = SocketAddr::from(([198, 18, 75, 234], 443));
for raw_url in [
"https://oauth.example.test/token",
"https://connect.linux.do:8443/oauth2/token",
"https://connect.linuxdo.org/oauth2/token",
"https://connect.linux.do.evil.test/oauth2/token",
"https://connect.linux.do/oauth2/token?tenant=unexpected",
] {
let url = reqwest::Url::parse(raw_url).expect("test URL should parse");
assert!(
!is_fixed_linuxdo_oauth_origin(&url),
"must not trust {raw_url}"
);
assert!(validate_public_admin_oauth_resolved_addrs(&url, &[fake], true).is_err());
}
}
}
apps/aether-gateway/src/handlers/admin/model/global_models/routes/core/writes.rs
+40 -40
View File
@@ -278,46 +278,6 @@ async fn build_batch_delete_global_models_response(
))
}
#[cfg(test)]
mod batch_boundary_tests {
use super::{normalize_admin_global_model_batch_ids, MAX_ADMIN_GLOBAL_MODEL_BATCH_ITEMS};
#[test]
fn global_model_batch_ids_are_bounded_and_deduplicated() {
assert_eq!(
normalize_admin_global_model_batch_ids(
vec![
"model-2".to_string(),
"model-1".to_string(),
" model-2 ".to_string(),
" ".to_string(),
],
"ids",
)
.expect("valid ids"),
vec![
"model-2".to_string(),
"model-1".to_string(),
" ".to_string(),
]
);
assert!(normalize_admin_global_model_batch_ids(
(0..=MAX_ADMIN_GLOBAL_MODEL_BATCH_ITEMS)
.map(|index| format!("model-{index}"))
.collect(),
"ids",
)
.is_err());
assert!(normalize_admin_global_model_batch_ids(
(0..MAX_ADMIN_GLOBAL_MODEL_BATCH_ITEMS)
.map(|index| format!("provider-{index}"))
.collect(),
"provider_ids",
)
.is_ok());
}
}
async fn build_assign_to_providers_response(
state: &AdminAppState<'_>,
request_context: &AdminRequestContext<'_>,
@@ -357,3 +317,43 @@ async fn build_assign_to_providers_response(
&global_model_id,
))
}
#[cfg(test)]
mod batch_boundary_tests {
use super::{normalize_admin_global_model_batch_ids, MAX_ADMIN_GLOBAL_MODEL_BATCH_ITEMS};
#[test]
fn global_model_batch_ids_are_bounded_and_deduplicated() {
assert_eq!(
normalize_admin_global_model_batch_ids(
vec![
"model-2".to_string(),
"model-1".to_string(),
" model-2 ".to_string(),
" ".to_string(),
],
"ids",
)
.expect("valid ids"),
vec![
"model-2".to_string(),
"model-1".to_string(),
" ".to_string(),
]
);
assert!(normalize_admin_global_model_batch_ids(
(0..=MAX_ADMIN_GLOBAL_MODEL_BATCH_ITEMS)
.map(|index| format!("model-{index}"))
.collect(),
"ids",
)
.is_err());
assert!(normalize_admin_global_model_batch_ids(
(0..MAX_ADMIN_GLOBAL_MODEL_BATCH_ITEMS)
.map(|index| format!("provider-{index}"))
.collect(),
"provider_ids",
)
.is_ok());
}
}
apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/kiro.rs
+37 -37
View File
@@ -66,43 +66,6 @@ fn admin_provider_oauth_kiro_refresh_error(
}
}
#[cfg(test)]
mod refresh_error_tests {
use super::admin_provider_oauth_kiro_refresh_error;
use crate::handlers::admin::request::AdminKiroAuthConfig;
use aether_oauth::core::OAuthError;
#[test]
fn kiro_refresh_error_does_not_reflect_upstream_body() {
let auth_config = AdminKiroAuthConfig {
auth_method: None,
refresh_token: None,
expires_at: None,
profile_arn: None,
region: None,
auth_region: None,
api_region: None,
client_id: None,
client_secret: None,
machine_id: None,
kiro_version: None,
system_version: None,
node_version: None,
access_token: None,
};
let detail = admin_provider_oauth_kiro_refresh_error(
&auth_config,
OAuthError::HttpStatus {
status_code: 502,
body_excerpt: "authorization=Bearer upstream-secret".to_string(),
},
);
assert_eq!(detail, "social refresh 失败: HTTP 502");
assert!(!detail.contains("upstream-secret"));
}
}
pub(super) async fn refresh_admin_provider_oauth_kiro_auth_config(
state: &AdminAppState<'_>,
auth_config: &AdminKiroAuthConfig,
@@ -240,3 +203,40 @@ pub(super) async fn fetch_admin_provider_oauth_kiro_email(
aether_admin::provider::quota::parse_kiro_usage_response(&payload, current_unix_secs())?;
json_non_empty_string(metadata.get("email"))
}
#[cfg(test)]
mod refresh_error_tests {
use super::admin_provider_oauth_kiro_refresh_error;
use crate::handlers::admin::request::AdminKiroAuthConfig;
use aether_oauth::core::OAuthError;
#[test]
fn kiro_refresh_error_does_not_reflect_upstream_body() {
let auth_config = AdminKiroAuthConfig {
auth_method: None,
refresh_token: None,
expires_at: None,
profile_arn: None,
region: None,
auth_region: None,
api_region: None,
client_id: None,
client_secret: None,
machine_id: None,
kiro_version: None,
system_version: None,
node_version: None,
access_token: None,
};
let detail = admin_provider_oauth_kiro_refresh_error(
&auth_config,
OAuthError::HttpStatus {
status_code: 502,
body_excerpt: "authorization=Bearer upstream-secret".to_string(),
},
);
assert_eq!(detail, "social refresh 失败: HTTP 502");
assert!(!detail.contains("upstream-secret"));
}
}
apps/aether-gateway/src/handlers/proxy/mod.rs
+1 -1
View File
@@ -3228,7 +3228,7 @@ mod tests {
async fn request_body_buffer_caps_decompressed_body_at_shared_budget() {
let mut encoder = GzEncoder::new(Vec::new(), Compression::default());
encoder
.write_all(&vec![b'a'; 128])
.write_all(&[b'a'; 128])
.expect("test gzip body should encode");
let encoded = encoder.finish().expect("test gzip body should finish");
assert!(
apps/aether-gateway/src/handlers/public/support/wallet/refunds.rs
+46 -46
View File
@@ -168,52 +168,6 @@ fn wallet_public_refund_payload(mut payload: serde_json::Value) -> serde_json::V
payload
}
#[cfg(test)]
mod tests {
use super::wallet_refund_payload_from_record;
use aether_data::repository::wallet::StoredAdminWalletRefund;
use serde_json::json;
#[test]
fn public_refund_projection_excludes_payout_proof_and_upstream_payload() {
let record = StoredAdminWalletRefund {
id: "refund-1".to_string(),
refund_no: "rf_1".to_string(),
wallet_id: "wallet-1".to_string(),
user_id: Some("user-1".to_string()),
payment_order_id: Some("order-1".to_string()),
source_type: "payment_order".to_string(),
source_id: Some("order-1".to_string()),
refund_mode: "original_channel".to_string(),
amount_usd: 10.0,
status: "processing".to_string(),
reason: Some("requested".to_string()),
failure_reason: None,
gateway_refund_id: Some("gateway-refund-1".to_string()),
payout_method: None,
payout_reference: None,
payout_proof: Some(json!({
"gateway_refund": {
"id": "gateway-refund-1",
"payload": {"payer": "sensitive", "credential": "secret"}
}
})),
requested_by: Some("user-1".to_string()),
approved_by: Some("admin-1".to_string()),
processed_by: Some("admin-1".to_string()),
created_at_unix_ms: 1,
updated_at_unix_secs: 1,
processed_at_unix_secs: Some(1),
completed_at_unix_secs: None,
};
let payload = wallet_refund_payload_from_record(&record);
assert!(payload.get("payout_proof").is_none());
assert_eq!(payload["status"], "processing");
assert_eq!(payload["gateway_refund_id"], "gateway-refund-1");
}
}
pub(super) async fn handle_wallet_refunds_list(
state: &AppState,
request_context: &GatewayPublicRequestContext,
@@ -659,3 +613,49 @@ pub(super) async fn handle_wallet_create_refund(
}
}
}
#[cfg(test)]
mod tests {
use super::wallet_refund_payload_from_record;
use aether_data::repository::wallet::StoredAdminWalletRefund;
use serde_json::json;
#[test]
fn public_refund_projection_excludes_payout_proof_and_upstream_payload() {
let record = StoredAdminWalletRefund {
id: "refund-1".to_string(),
refund_no: "rf_1".to_string(),
wallet_id: "wallet-1".to_string(),
user_id: Some("user-1".to_string()),
payment_order_id: Some("order-1".to_string()),
source_type: "payment_order".to_string(),
source_id: Some("order-1".to_string()),
refund_mode: "original_channel".to_string(),
amount_usd: 10.0,
status: "processing".to_string(),
reason: Some("requested".to_string()),
failure_reason: None,
gateway_refund_id: Some("gateway-refund-1".to_string()),
payout_method: None,
payout_reference: None,
payout_proof: Some(json!({
"gateway_refund": {
"id": "gateway-refund-1",
"payload": {"payer": "sensitive", "credential": "secret"}
}
})),
requested_by: Some("user-1".to_string()),
approved_by: Some("admin-1".to_string()),
processed_by: Some("admin-1".to_string()),
created_at_unix_ms: 1,
updated_at_unix_secs: 1,
processed_at_unix_secs: Some(1),
completed_at_unix_secs: None,
};
let payload = wallet_refund_payload_from_record(&record);
assert!(payload.get("payout_proof").is_none());
assert_eq!(payload["status"], "processing");
assert_eq!(payload["gateway_refund_id"], "gateway-refund-1");
}
}
apps/aether-gateway/src/handlers/shared/email_templates.rs
+1 -1
View File
@@ -292,7 +292,7 @@ mod tests {
assert!(controls.is_err());
let template = "{{value}}".repeat(100_000);
let variables = BTreeMap::from([(String::from("value"), String::from("x".repeat(64)))]);
let variables = BTreeMap::from([(String::from("value"), "x".repeat(64))]);
let error = render_admin_email_template_html(&template, &variables)
.expect_err("rendered output must remain bounded");
assert!(format!("{error:?}").contains("exceeds"));
apps/aether-gateway/src/handlers/shared/system_config_values.rs
+1 -4
View File
@@ -199,10 +199,7 @@ pub(crate) fn normalize_ldap_transport_server_url(raw: &str, use_starttls: bool)
// Gateway unit/integration fixtures use an in-process mock endpoint. Keep
// this exception behind the gateway test configuration; production code
// always uses the strict parser without custom schemes.
return aether_admin::system::normalize_ldap_transport_server_url_for_tests(
raw,
use_starttls,
);
aether_admin::system::normalize_ldap_transport_server_url_for_tests(raw, use_starttls)
}
#[cfg(not(test))]
{