i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-10-09 10:57:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: restore security hardening compatibility and validation

Browse Source 
Restore authorized rule reveal, explicit full HTTP capture and retention, video task business fields, and valid payment URLs. Add opt-in credential preservation for trusted recovery, fix frontend type contracts and async races, and eliminate PostgreSQL test fixture resource leaks. Document audit coverage and successful fmt and CI-scoped Clippy checks.
This commit is contained in:
elky
2026-09-07 21:14:27 +08:00
parent a5c3699ae9
commit a90d564931
191 changed files with 6785 additions and 1643 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/aether-oauth/src/provider/providers/generic.rs
+78 -48
View File
@@ -244,9 +244,15 @@ impl GenericProviderOAuthAdapter {
fn resolve_client_secret(&self, configured: Option<String>) -> Result<String, OAuthError> {
let configured = configured.or_else(|| {
(self.template.provider_type == "antigravity"
&& self.client_id() == self.template.client_id)
.then(|| "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".to_string())
let default_template = template_for_provider_type(self.template.provider_type)?;
if self.client_id() != default_template.client_id {
return None;
}
match self.template.provider_type {
"gemini_cli" => Some("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".to_string()),
"antigravity" => Some("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".to_string()),
_ => None,
}
});
required_client_secret(
self.template
@@ -973,54 +979,78 @@ mod tests {
}
#[tokio::test]
async fn antigravity_default_credentials_support_authorization_and_refresh() {
let mut template = template_for_provider_type("antigravity").expect("template");
template.client_id_env = None;
template.client_secret_env = Some("AETHER_TEST_UNUSED_ANTIGRAVITY_SECRET");
let adapter = GenericProviderOAuthAdapter::new(template);
let ctx = transport_context("antigravity");
adapter
.build_authorize_url(&ctx, "state", None)
.expect("authorize");
let seen_request = Arc::new(Mutex::new(None));
let executor = StaticExecutor {
seen_request: Arc::clone(&seen_request),
response_payload: json!({"access_token": "new-token", "expires_in": 3600}),
};
adapter
.refresh(&executor, &ctx, &oauth_account("antigravity"))
.await
.expect("refresh");
let seen = seen_request.lock().expect("lock").clone().expect("request");
let body = seen.body_bytes.expect("body");
let fields = url::form_urlencoded::parse(&body)
.into_owned()
.collect::<BTreeMap<_, _>>();
assert_eq!(fields["client_id"], template.client_id);
assert_eq!(
fields["client_secret"],
adapter.resolve_client_secret(None).expect("default")
);
assert_eq!(fields["refresh_token"], "old-refresh-token");
assert!(!format!("{adapter:?}").contains(&fields["client_secret"]));
async fn google_default_credentials_support_authorization_and_refresh() {
for provider_type in ["gemini_cli", "antigravity"] {
let mut template = template_for_provider_type(provider_type).expect("template");
template.client_id_env = None;
template.client_secret_env = Some("AETHER_TEST_UNUSED_ANTIGRAVITY_SECRET");
let adapter = GenericProviderOAuthAdapter::new(template);
let ctx = transport_context(provider_type);
adapter
.build_authorize_url(&ctx, "state", None)
.expect("authorize");
let seen_request = Arc::new(Mutex::new(None));
let executor = StaticExecutor {
seen_request: Arc::clone(&seen_request),
response_payload: json!({"access_token": "new-token", "expires_in": 3600}),
};
adapter
.refresh(&executor, &ctx, &oauth_account(provider_type))
.await
.expect("refresh");
let seen = seen_request.lock().expect("lock").clone().expect("request");
let body = seen.body_bytes.expect("body");
let fields = url::form_urlencoded::parse(&body)
.into_owned()
.collect::<BTreeMap<_, _>>();
assert_eq!(fields["client_id"], template.client_id);
assert_eq!(
fields["client_secret"],
adapter.resolve_client_secret(None).expect("default")
);
assert_eq!(fields["refresh_token"], "old-refresh-token");
assert!(!format!("{adapter:?}").contains(&fields["client_secret"]));
}
}
#[test]
fn antigravity_custom_client_requires_its_own_secret() {
let adapter = GenericProviderOAuthAdapter::for_provider_type("antigravity")
.expect("adapter")
.with_oauth_credentials_for_tests("custom-client", "custom-secret");
assert!(adapter.resolve_client_secret(None).is_err());
assert_eq!(
adapter
.resolve_client_secret(Some("custom-secret".to_string()))
.expect("configured secret"),
"custom-secret"
);
assert_eq!(
adapter.client_secret().expect("override"),
Some("custom-secret".to_string())
);
fn google_custom_client_requires_its_own_secret() {
for provider_type in ["gemini_cli", "antigravity"] {
let adapter = GenericProviderOAuthAdapter::for_provider_type(provider_type)
.expect("adapter")
.with_oauth_credentials_for_tests("custom-client", "custom-secret");
assert!(adapter.resolve_client_secret(None).is_err());
assert_eq!(
adapter
.resolve_client_secret(Some("custom-secret".to_string()))
.expect("configured secret"),
"custom-secret"
);
assert_eq!(
adapter.client_secret().expect("override"),
Some("custom-secret".to_string())
);
}
}
#[test]
fn google_configured_secret_overrides_the_native_app_default() {
for provider_type in ["gemini_cli", "antigravity"] {
let adapter =
GenericProviderOAuthAdapter::for_provider_type(provider_type).expect("adapter");
assert_eq!(
adapter
.resolve_client_secret(Some("configured-secret".to_string()))
.unwrap(),
"configured-secret"
);
let mut template = template_for_provider_type(provider_type).expect("template");
template.client_id = "custom-template-client";
template.client_id_env = None;
assert!(GenericProviderOAuthAdapter::new(template)
.resolve_client_secret(None)
.is_err());
}
}
#[test]