i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-02 17:30:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

Support per-format provider key auth

Browse Source
This commit is contained in:
fawney19
2026-04-29 15:46:50 +08:00
parent 07a319259b
commit e751289dfb
67 changed files with 1244 additions and 420 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
apps/aether-gateway/src/tests/control/admin/endpoints/keys.rs
View File

@@ -799,7 +799,10 @@ async fn gateway_updates_admin_provider_key_locally_with_trusted_admin_principal
assert!(!reloaded[0].is_active);
let decrypted = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
&reloaded[0].encrypted_api_key,
reloaded[0]
.encrypted_api_key
.as_deref()
.expect("api key should be present"),
)
.expect("ciphertext should decrypt");
assert_eq!(decrypted, "sk-updated-openai");

82
apps/aether-gateway/src/tests/control/admin/oauth.rs
View File

@@ -421,9 +421,14 @@ async fn gateway_handles_admin_provider_oauth_device_poll_locally_with_trusted_a
persisted.proxy,
Some(json!({"node_id": "proxy-node-kiro", "enabled": true}))
);
let decrypted_api_key =
decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &persisted.encrypted_api_key)
.expect("api key should decrypt");
let decrypted_api_key = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
persisted
.encrypted_api_key
.as_deref()
.expect("api key should be present"),
)
.expect("api key should decrypt");
assert_eq!(decrypted_api_key, expected_access_token);
let decrypted_auth_config = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
@@ -729,9 +734,14 @@ async fn gateway_revalidates_kiro_device_poll_via_idc_refresh_and_backfills_emai
persisted.proxy,
Some(json!({"node_id": "proxy-node-kiro", "enabled": true}))
);
let decrypted_api_key =
decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &persisted.encrypted_api_key)
.expect("api key should decrypt");
let decrypted_api_key = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
persisted
.encrypted_api_key
.as_deref()
.expect("api key should be present"),
)
.expect("api key should decrypt");
assert_eq!(decrypted_api_key, expected_refreshed_access_token);
let decrypted_auth_config = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
@@ -1473,9 +1483,14 @@ async fn gateway_batch_imports_admin_provider_oauth_locally_with_trusted_admin_p
persisted.proxy,
Some(json!({"node_id": "proxy-node-batch-import", "enabled": true}))
);
let decrypted_api_key =
decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &persisted.encrypted_api_key)
.expect("api key should decrypt");
let decrypted_api_key = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
persisted
.encrypted_api_key
.as_deref()
.expect("api key should be present"),
)
.expect("api key should decrypt");
assert_eq!(decrypted_api_key, "batch-imported-codex-access-token");
gateway_handle.abort();
@@ -1919,9 +1934,14 @@ async fn gateway_completes_admin_provider_oauth_key_locally_with_trusted_admin_p
.await
.expect("keys should load");
let persisted = reloaded.first().expect("persisted key should exist");
let decrypted_api_key =
decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &persisted.encrypted_api_key)
.expect("api key should decrypt");
let decrypted_api_key = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
persisted
.encrypted_api_key
.as_deref()
.expect("api key should be present"),
)
.expect("api key should decrypt");
assert_eq!(decrypted_api_key, "new-codex-access-token");
let decrypted_auth_config = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
@@ -2104,9 +2124,14 @@ async fn gateway_completes_admin_provider_oauth_provider_locally_with_trusted_ad
persisted.proxy,
Some(json!({"node_id": "proxy-node-codex-oauth", "enabled": true}))
);
let decrypted_api_key =
decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &persisted.encrypted_api_key)
.expect("api key should decrypt");
let decrypted_api_key = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
persisted
.encrypted_api_key
.as_deref()
.expect("api key should be present"),
)
.expect("api key should decrypt");
assert_eq!(decrypted_api_key, "provider-codex-access-token");
let decrypted_auth_config = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
@@ -2275,9 +2300,14 @@ async fn gateway_imports_admin_provider_oauth_refresh_token_locally_with_trusted
persisted.proxy,
Some(json!({"node_id": "proxy-node-codex-import", "enabled": true}))
);
let decrypted_api_key =
decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &persisted.encrypted_api_key)
.expect("api key should decrypt");
let decrypted_api_key = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
persisted
.encrypted_api_key
.as_deref()
.expect("api key should be present"),
)
.expect("api key should decrypt");
assert_eq!(decrypted_api_key, "imported-codex-access-token");
let decrypted_auth_config = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
@@ -2452,9 +2482,14 @@ async fn gateway_imports_admin_provider_oauth_refresh_token_over_active_expired_
);
assert_eq!(persisted.oauth_invalid_at_unix_secs, None);
assert_eq!(persisted.oauth_invalid_reason, None);
let decrypted_api_key =
decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &persisted.encrypted_api_key)
.expect("api key should decrypt");
let decrypted_api_key = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
persisted
.encrypted_api_key
.as_deref()
.expect("api key should be present"),
)
.expect("api key should decrypt");
assert_eq!(decrypted_api_key, "imported-expired-codex-access-token");
let decrypted_auth_config = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
@@ -4105,7 +4140,10 @@ async fn gateway_refreshes_admin_provider_oauth_key_locally_with_trusted_admin_p
.expect("refreshed key should exist");
let decrypted_api_key = decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
stored_key.encrypted_api_key.as_str(),
stored_key
.encrypted_api_key
.as_deref()
.expect("api key should be present"),
)
.expect("refreshed api key should decrypt");
assert_eq!(decrypted_api_key, "refreshed-codex-access-token");

39
apps/aether-gateway/src/tests/control/admin/system_import.rs
View File

@@ -348,8 +348,14 @@ async fn gateway_imports_admin_system_config_locally_and_persists_data() {
.expect("keys should load");
assert_eq!(keys.len(), 1);
assert_eq!(
decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &keys[0].encrypted_api_key)
.expect("api key should decrypt"),
decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
keys[0]
.encrypted_api_key
.as_deref()
.expect("api key should be present"),
)
.expect("api key should decrypt"),
"sk-import-123"
);
@@ -1018,8 +1024,14 @@ async fn gateway_imports_oauth_provider_key_credentials_from_admin_system_config
assert_eq!(keys.len(), 1);
assert_eq!(keys[0].auth_type, "oauth");
assert_eq!(
decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &keys[0].encrypted_api_key)
.expect("oauth access token should decrypt"),
decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
keys[0]
.encrypted_api_key
.as_deref()
.expect("api key should be present"),
)
.expect("oauth access token should decrypt"),
"oauth-access-token-1"
);
let auth_config = decrypt_python_fernet_ciphertext(
@@ -1108,8 +1120,14 @@ async fn gateway_overwrites_oauth_provider_key_credentials_from_admin_system_imp
assert_eq!(keys.len(), 1);
assert_eq!(keys[0].name, "oauth-primary");
assert_eq!(
decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &keys[0].encrypted_api_key)
.expect("oauth access token should decrypt"),
decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
keys[0]
.encrypted_api_key
.as_deref()
.expect("api key should be present"),
)
.expect("oauth access token should decrypt"),
"oauth-access-token-new"
);
let auth_config = decrypt_python_fernet_ciphertext(
@@ -1282,8 +1300,13 @@ async fn gateway_overwrites_oauth_provider_key_credentials_from_admin_system_imp
assert_eq!(key.oauth_invalid_reason, None);
assert!(key.expires_at_unix_secs.is_some());
assert_eq!(
decrypt_python_fernet_ciphertext(DEVELOPMENT_ENCRYPTION_KEY, &key.encrypted_api_key)
.expect("oauth access token should decrypt"),
decrypt_python_fernet_ciphertext(
DEVELOPMENT_ENCRYPTION_KEY,
key.encrypted_api_key
.as_deref()
.expect("api key should be present"),
)
.expect("oauth access token should decrypt"),
"oauth-access-token-refreshed"
);