use super::{ any, build_router_with_state, build_state_with_execution_runtime_override, json, start_server, to_bytes, wait_until, Arc, Body, Json, Mutex, Request, Router, StatusCode, EXECUTION_PATH_EXECUTION_RUNTIME_SYNC, EXECUTION_PATH_HEADER, TRACE_ID_HEADER, }; use crate::constants::LOCAL_EXECUTION_RUNTIME_MISS_REASON_HEADER; use aether_crypto::{encrypt_python_fernet_plaintext, DEVELOPMENT_ENCRYPTION_KEY}; use aether_data::repository::auth::{ InMemoryAuthApiKeySnapshotRepository, StoredAuthApiKeySnapshot, }; use aether_data::repository::candidate_selection::InMemoryMinimalCandidateSelectionReadRepository; use aether_data::repository::candidates::InMemoryRequestCandidateRepository; use aether_data::repository::provider_catalog::InMemoryProviderCatalogReadRepository; use aether_data_contracts::repository::candidate_selection::{ StoredMinimalCandidateSelectionRow, StoredProviderModelMapping, }; use aether_data_contracts::repository::candidates::{ RequestCandidateReadRepository, RequestCandidateStatus, RequestCandidateWriteRepository, UpsertRequestCandidateRecord, }; use aether_data_contracts::repository::provider_catalog::{ StoredProviderCatalogEndpoint, StoredProviderCatalogKey, StoredProviderCatalogProvider, }; use base64::Engine as _; use sha2::{Digest, Sha256}; const CLI_SYNC_TEST_STACK_BYTES: usize = 16 * 1024 * 1024; fn run_cli_sync_test(test_name: &'static str, make_future: F) where F: FnOnce() -> Fut + Send + 'static, Fut: std::future::Future + 'static, { let handle = std::thread::Builder::new() .name(test_name.to_string()) .stack_size(CLI_SYNC_TEST_STACK_BYTES) .spawn(move || { let runtime = tokio::runtime::Builder::new_current_thread() .enable_all() .build() .expect("test runtime should build"); runtime.block_on(make_future()); }) .expect("cli sync test thread should spawn"); if let Err(payload) = handle.join() { std::panic::resume_unwind(payload); } } #[test] fn gateway_executes_openai_responses_sync_via_local_decision_gate_with_local_sync_decision() { run_cli_sync_test( "gateway_executes_openai_responses_sync_via_local_decision_gate_with_local_sync_decision", gateway_executes_openai_responses_sync_via_local_decision_gate_with_local_sync_decision_impl, ); } async fn gateway_executes_openai_responses_sync_via_local_decision_gate_with_local_sync_decision_impl( ) { #[derive(Debug, Clone)] struct SeenExecutionRuntimeSyncRequest { trace_id: String, url: String, model: String, authorization: String, endpoint_tag: String, conditional_header: String, renamed_header: String, dropped_header_present: bool, metadata_mode: String, metadata_source: String, metadata_origin: String, store_present: bool, proxy_node_id: String, transport_profile_id: String, } fn hash_api_key(value: &str) -> String { let mut hasher = Sha256::new(); hasher.update(value.as_bytes()); format!("{:x}", hasher.finalize()) } fn sample_auth_snapshot(api_key_id: &str, user_id: &str) -> StoredAuthApiKeySnapshot { StoredAuthApiKeySnapshot::new( user_id.to_string(), "alice".to_string(), Some("alice@example.com".to_string()), "user".to_string(), "local".to_string(), true, false, Some(serde_json::json!(["openai"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), api_key_id.to_string(), Some("default".to_string()), true, false, false, Some(60), Some(5), Some(4_102_444_800_i64), Some(serde_json::json!(["openai"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), ) .expect("auth snapshot should build") } fn sample_candidate_row() -> StoredMinimalCandidateSelectionRow { StoredMinimalCandidateSelectionRow { provider_id: "provider-openai-cli-local-1".to_string(), provider_name: "openai".to_string(), provider_type: "custom".to_string(), provider_priority: 10, provider_is_active: true, endpoint_id: "endpoint-openai-cli-local-1".to_string(), endpoint_api_format: "openai:responses".to_string(), endpoint_api_family: Some("openai".to_string()), endpoint_kind: Some("cli".to_string()), endpoint_is_active: true, key_id: "key-openai-cli-local-1".to_string(), key_name: "prod".to_string(), key_auth_type: "api_key".to_string(), key_is_active: true, key_api_formats: Some(vec!["openai:responses".to_string()]), key_allowed_models: None, key_capabilities: None, key_internal_priority: 5, key_global_priority_by_format: Some(serde_json::json!({"openai:responses": 1})), model_id: "model-openai-cli-local-1".to_string(), global_model_id: "global-model-openai-cli-local-1".to_string(), global_model_name: "gpt-5".to_string(), global_model_mappings: None, global_model_supports_streaming: Some(true), model_provider_model_name: "gpt-5-upstream".to_string(), model_provider_model_mappings: Some(vec![StoredProviderModelMapping { name: "gpt-5-upstream".to_string(), priority: 1, api_formats: Some(vec!["openai:responses".to_string()]), endpoint_ids: None, }]), model_supports_streaming: Some(true), model_is_active: true, model_is_available: true, } } fn sample_provider_catalog_provider() -> StoredProviderCatalogProvider { StoredProviderCatalogProvider::new( "provider-openai-cli-local-1".to_string(), "openai".to_string(), Some("https://example.com".to_string()), "custom".to_string(), ) .expect("provider should build") .with_transport_fields( true, false, false, None, Some(2), Some(serde_json::json!({"url":"http://provider-proxy.internal:8080"})), Some(20.0), None, None, ) } fn sample_provider_catalog_endpoint() -> StoredProviderCatalogEndpoint { StoredProviderCatalogEndpoint::new( "endpoint-openai-cli-local-1".to_string(), "provider-openai-cli-local-1".to_string(), "openai:responses".to_string(), Some("openai".to_string()), Some("cli".to_string()), true, ) .expect("endpoint should build") .with_transport_fields( "https://api.openai.example".to_string(), Some(serde_json::json!([ {"action":"set","key":"x-endpoint-tag","value":"openai-cli-local"}, {"action":"set","key":"x-conditional-tag","value":"header-condition-hit","condition":{"path":"metadata.mode","op":"eq","value":"safe","source":"current"}}, {"action":"rename","from":"x-client-rename","to":"x-upstream-rename"}, {"action":"drop","key":"x-drop-me"} ])), Some(serde_json::json!([ {"action":"set","path":"metadata.mode","value":"safe","condition":{"path":"metadata.mode","op":"not_exists","source":"current"}}, {"action":"rename","from":"metadata.client","to":"metadata.source"}, {"action":"set","path":"metadata.origin","value":"from-original","condition":{"path":"metadata.client","op":"exists","source":"original"}}, {"action":"drop","path":"store"} ])), Some(2), Some("/custom/v1/responses".to_string()), None, None, None, ) .expect("endpoint transport should build") } fn sample_provider_catalog_key() -> StoredProviderCatalogKey { StoredProviderCatalogKey::new( "key-openai-cli-local-1".to_string(), "provider-openai-cli-local-1".to_string(), "prod".to_string(), "api_key".to_string(), None, true, ) .expect("key should build") .with_transport_fields( Some(serde_json::json!(["openai:responses"])), encrypt_python_fernet_plaintext(DEVELOPMENT_ENCRYPTION_KEY, "sk-upstream-openai-cli") .expect("api key should encrypt"), None, None, Some(serde_json::json!({"openai:responses": 1})), None, None, Some(serde_json::json!({"enabled": true, "node_id":"proxy-node-openai-cli-local"})), Some(serde_json::json!({"transport_profile":"chrome_136"})), ) .expect("key transport should build") } let seen_execution_runtime = Arc::new(Mutex::new(None::)); let seen_execution_runtime_clone = Arc::clone(&seen_execution_runtime); let seen_report = Arc::new(Mutex::new(false)); let seen_report_clone = Arc::clone(&seen_report); let decision_hits = Arc::new(Mutex::new(0usize)); let decision_hits_clone = Arc::clone(&decision_hits); let plan_hits = Arc::new(Mutex::new(0usize)); let plan_hits_clone = Arc::clone(&plan_hits); let public_hits = Arc::new(Mutex::new(0usize)); let public_hits_clone = Arc::clone(&public_hits); let request_candidate_repository = Arc::new(InMemoryRequestCandidateRepository::default()); let upstream = Router::new() .route( "/api/internal/gateway/resolve", any(|_request: Request| async move { Json(json!({ "action": "proxy_public", "route_class": "ai_public", "route_family": "openai", "route_kind": "cli", "auth_endpoint_signature": "openai:responses", "execution_runtime_candidate": true, "auth_context": { "user_id": "user-openai-cli-local-123", "api_key_id": "key-openai-cli-local-123", "access_allowed": true }, "public_path": "/v1/responses" })) }), ) .route( "/api/internal/gateway/decision-sync", any(move |_request: Request| { let decision_hits_inner = Arc::clone(&decision_hits_clone); async move { *decision_hits_inner.lock().expect("mutex should lock") += 1; Json(json!({"action": "proxy_public"})) } }), ) .route( "/api/internal/gateway/plan-sync", any(move |_request: Request| { let plan_hits_inner = Arc::clone(&plan_hits_clone); async move { *plan_hits_inner.lock().expect("mutex should lock") += 1; Json(json!({"action": "proxy_public"})) } }), ) .route( "/api/internal/gateway/report-sync", any(move |request: Request| { let seen_report_inner = Arc::clone(&seen_report_clone); async move { let (_parts, body) = request.into_parts(); let _raw_body = to_bytes(body, usize::MAX).await.expect("body should read"); *seen_report_inner.lock().expect("mutex should lock") = true; Json(json!({"ok": true})) } }), ) .route( "/v1/responses", any(move |_request: Request| { let public_hits_inner = Arc::clone(&public_hits_clone); async move { *public_hits_inner.lock().expect("mutex should lock") += 1; (StatusCode::IM_A_TEAPOT, Body::from("public-route-hit")) } }), ); let execution_runtime = Router::new().route( "/v1/execute/sync", any(move |request: Request| { let seen_execution_runtime_inner = Arc::clone(&seen_execution_runtime_clone); async move { let (parts, body) = request.into_parts(); let raw_body = to_bytes(body, usize::MAX).await.expect("body should read"); let payload: serde_json::Value = serde_json::from_slice(&raw_body) .expect("execution runtime payload should parse"); *seen_execution_runtime_inner .lock() .expect("mutex should lock") = Some(SeenExecutionRuntimeSyncRequest { trace_id: parts .headers .get(TRACE_ID_HEADER) .and_then(|value| value.to_str().ok()) .unwrap_or_default() .to_string(), url: payload .get("url") .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), model: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("model")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), authorization: payload .get("headers") .and_then(|value| value.get("authorization")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), endpoint_tag: payload .get("headers") .and_then(|value| value.get("x-endpoint-tag")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), conditional_header: payload .get("headers") .and_then(|value| value.get("x-conditional-tag")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), renamed_header: payload .get("headers") .and_then(|value| value.get("x-upstream-rename")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), dropped_header_present: payload .get("headers") .and_then(|value| value.get("x-drop-me")) .is_some(), metadata_mode: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("metadata")) .and_then(|value| value.get("mode")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), metadata_source: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("metadata")) .and_then(|value| value.get("source")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), metadata_origin: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("metadata")) .and_then(|value| value.get("origin")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), store_present: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("store")) .is_some(), proxy_node_id: payload .get("proxy") .and_then(|value| value.get("node_id")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), transport_profile_id: payload .get("transport_profile") .and_then(|value| value.get("profile_id")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), }); Json(json!({ "request_id": "trace-openai-cli-local-123", "status_code": 200, "headers": { "content-type": "application/json" }, "body": { "json_body": { "id": "resp-cli-local-123", "object": "response", "model": "gpt-5-upstream", "output": [], "usage": { "input_tokens": 1, "output_tokens": 2, "total_tokens": 3 } } }, "telemetry": { "elapsed_ms": 37 } })) } }), ); let client_api_key = "sk-client-openai-cli-local"; let auth_repository = Arc::new(InMemoryAuthApiKeySnapshotRepository::seed(vec![( Some(hash_api_key(client_api_key)), sample_auth_snapshot("key-openai-cli-local-123", "user-openai-cli-local-123"), )])); let candidate_selection_repository = Arc::new(InMemoryMinimalCandidateSelectionReadRepository::seed(vec![ sample_candidate_row(), ])); let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed( vec![sample_provider_catalog_provider()], vec![sample_provider_catalog_endpoint()], vec![sample_provider_catalog_key()], )); let (upstream_url, upstream_handle) = start_server(upstream).await; let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await; let gateway_state = build_state_with_execution_runtime_override(execution_runtime_url.clone()) .with_data_state_for_tests( crate::data::GatewayDataState::with_auth_candidate_selection_provider_catalog_and_request_candidate_repository_for_tests( auth_repository, candidate_selection_repository, provider_catalog_repository, Arc::clone(&request_candidate_repository), DEVELOPMENT_ENCRYPTION_KEY, ), ); let gateway = build_router_with_state(gateway_state); let (gateway_url, gateway_handle) = start_server(gateway).await; let response = reqwest::Client::new() .post(format!("{gateway_url}/v1/responses")) .header(http::header::CONTENT_TYPE, "application/json") .header( http::header::AUTHORIZATION, format!("Bearer {client_api_key}"), ) .header("x-client-rename", "rename-openai-cli") .header("x-drop-me", "drop-openai-cli") .header(TRACE_ID_HEADER, "trace-openai-cli-local-123") .body("{\"model\":\"gpt-5\",\"input\":\"hello\",\"metadata\":{\"client\":\"desktop-openai-cli\"},\"store\":false}") .send() .await .expect("request should succeed"); eprintln!("codex oauth response status: {}", response.status()); assert_eq!(response.status(), StatusCode::OK); assert_eq!( response .headers() .get(EXECUTION_PATH_HEADER) .and_then(|value| value.to_str().ok()), Some(EXECUTION_PATH_EXECUTION_RUNTIME_SYNC) ); let response_json: serde_json::Value = response.json().await.expect("body should parse"); assert_eq!(response_json["model"], "gpt-5-upstream"); let seen_execution_runtime_request = seen_execution_runtime .lock() .expect("mutex should lock") .clone() .expect("execution runtime sync should be captured"); assert_eq!( seen_execution_runtime_request.trace_id, "trace-openai-cli-local-123" ); assert_eq!( seen_execution_runtime_request.url, "https://api.openai.example/custom/v1/responses" ); assert_eq!(seen_execution_runtime_request.model, "gpt-5-upstream"); assert_eq!( seen_execution_runtime_request.authorization, "Bearer sk-upstream-openai-cli" ); assert_eq!( seen_execution_runtime_request.endpoint_tag, "openai-cli-local" ); assert_eq!( seen_execution_runtime_request.conditional_header, "header-condition-hit" ); assert_eq!( seen_execution_runtime_request.renamed_header, "rename-openai-cli" ); assert!(!seen_execution_runtime_request.dropped_header_present); assert_eq!(seen_execution_runtime_request.metadata_mode, "safe"); assert_eq!( seen_execution_runtime_request.metadata_source, "desktop-openai-cli" ); assert_eq!( seen_execution_runtime_request.metadata_origin, "from-original" ); assert!(!seen_execution_runtime_request.store_present); assert_eq!( seen_execution_runtime_request.proxy_node_id, "proxy-node-openai-cli-local" ); assert_eq!( seen_execution_runtime_request.transport_profile_id, "chrome_136" ); let stored_candidates = request_candidate_repository .list_by_request_id("trace-openai-cli-local-123") .await .expect("request candidate trace should read"); assert_eq!(stored_candidates.len(), 1); assert_eq!(stored_candidates[0].status, RequestCandidateStatus::Success); assert_eq!( stored_candidates[0] .extra_data .as_ref() .and_then(|value| value.get("proxy")) .and_then(|value| value.get("node_id")) .and_then(serde_json::Value::as_str), Some("proxy-node-openai-cli-local") ); assert_eq!( stored_candidates[0] .extra_data .as_ref() .and_then(|value| value.get("proxy")) .and_then(|value| value.get("source")) .and_then(serde_json::Value::as_str), Some("key") ); tokio::time::sleep(std::time::Duration::from_millis(100)).await; assert!( !*seen_report.lock().expect("mutex should lock"), "report-sync should stay local when request candidate persistence is available" ); assert_eq!(*decision_hits.lock().expect("mutex should lock"), 0); assert_eq!(*plan_hits.lock().expect("mutex should lock"), 0); assert_eq!(*public_hits.lock().expect("mutex should lock"), 0); gateway_handle.abort(); execution_runtime_handle.abort(); upstream_handle.abort(); } #[test] fn gateway_waits_for_api_key_concurrency_slot_then_executes_openai_responses_sync() { run_cli_sync_test( "gateway_waits_for_api_key_concurrency_slot_then_executes_openai_responses_sync", gateway_waits_for_api_key_concurrency_slot_then_executes_openai_responses_sync_impl, ); } async fn gateway_waits_for_api_key_concurrency_slot_then_executes_openai_responses_sync_impl() { fn hash_api_key(value: &str) -> String { let mut hasher = Sha256::new(); hasher.update(value.as_bytes()); format!("{:x}", hasher.finalize()) } fn sample_auth_snapshot(api_key_id: &str, user_id: &str) -> StoredAuthApiKeySnapshot { StoredAuthApiKeySnapshot::new( user_id.to_string(), "alice".to_string(), Some("alice@example.com".to_string()), "user".to_string(), "local".to_string(), true, false, Some(serde_json::json!(["openai"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), api_key_id.to_string(), Some("default".to_string()), true, false, false, Some(60), Some(5), Some(4_102_444_800), Some(serde_json::json!(["openai"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), ) .expect("auth snapshot should build") } fn sample_candidate_row() -> StoredMinimalCandidateSelectionRow { StoredMinimalCandidateSelectionRow { provider_id: "provider-openai-cli-local-limit-1".to_string(), provider_name: "openai".to_string(), provider_type: "custom".to_string(), provider_priority: 10, provider_is_active: true, endpoint_id: "endpoint-openai-cli-local-limit-1".to_string(), endpoint_api_format: "openai:responses".to_string(), endpoint_api_family: Some("openai".to_string()), endpoint_kind: Some("cli".to_string()), endpoint_is_active: true, key_id: "key-openai-cli-local-limit-1".to_string(), key_name: "prod".to_string(), key_auth_type: "api_key".to_string(), key_is_active: true, key_api_formats: Some(vec!["openai:responses".to_string()]), key_allowed_models: None, key_capabilities: None, key_internal_priority: 5, key_global_priority_by_format: Some(serde_json::json!({"openai:responses": 1})), model_id: "model-openai-cli-local-limit-1".to_string(), global_model_id: "global-model-openai-cli-local-limit-1".to_string(), global_model_name: "gpt-5".to_string(), global_model_mappings: None, global_model_supports_streaming: Some(true), model_provider_model_name: "gpt-5-upstream".to_string(), model_provider_model_mappings: Some(vec![StoredProviderModelMapping { name: "gpt-5-upstream".to_string(), priority: 1, api_formats: Some(vec!["openai:responses".to_string()]), endpoint_ids: None, }]), model_supports_streaming: Some(true), model_is_active: true, model_is_available: true, } } fn sample_provider_catalog_provider() -> StoredProviderCatalogProvider { StoredProviderCatalogProvider::new( "provider-openai-cli-local-limit-1".to_string(), "openai".to_string(), Some("https://example.com".to_string()), "custom".to_string(), ) .expect("provider should build") .with_transport_fields( true, false, false, None, Some(2), None, Some(20.0), None, None, ) } fn sample_provider_catalog_endpoint() -> StoredProviderCatalogEndpoint { StoredProviderCatalogEndpoint::new( "endpoint-openai-cli-local-limit-1".to_string(), "provider-openai-cli-local-limit-1".to_string(), "openai:responses".to_string(), Some("openai".to_string()), Some("cli".to_string()), true, ) .expect("endpoint should build") .with_transport_fields( "https://api.openai.example/custom/v1/responses".to_string(), None, None, Some(2), Some("/custom/v1/responses".to_string()), None, None, None, ) .expect("endpoint transport should build") } fn sample_provider_catalog_key() -> StoredProviderCatalogKey { StoredProviderCatalogKey::new( "key-openai-cli-local-limit-1".to_string(), "provider-openai-cli-local-limit-1".to_string(), "prod".to_string(), "api_key".to_string(), None, true, ) .expect("key should build") .with_transport_fields( Some(serde_json::json!(["openai:responses"])), encrypt_python_fernet_plaintext( DEVELOPMENT_ENCRYPTION_KEY, "sk-upstream-openai-cli-limit", ) .expect("api key should encrypt"), None, None, Some(serde_json::json!({"openai:responses": 1})), None, None, None, None, ) .expect("key transport should build") } let execution_runtime_hits = Arc::new(Mutex::new(0usize)); let execution_runtime_hits_clone = Arc::clone(&execution_runtime_hits); let public_hits = Arc::new(Mutex::new(0usize)); let public_hits_clone = Arc::clone(&public_hits); let now_unix_ms = chrono::Utc::now().timestamp_millis().max(0); let request_candidate_repository = Arc::new(InMemoryRequestCandidateRepository::seed(vec![ aether_data_contracts::repository::candidates::StoredRequestCandidate::new( "cand-pending-openai-cli-local-limit-1".to_string(), "req-inflight-openai-cli-local-limit-1".to_string(), Some("user-openai-cli-local-limit-123".to_string()), Some("key-openai-cli-local-limit-123".to_string()), Some("alice".to_string()), Some("default".to_string()), 0, 0, Some("provider-openai-cli-local-limit-1".to_string()), Some("endpoint-openai-cli-local-limit-1".to_string()), Some("key-openai-cli-local-limit-1".to_string()), RequestCandidateStatus::Pending, None, false, None, None, None, None, None, None, None, now_unix_ms, Some(now_unix_ms), None, ) .expect("pending candidate should build"), ])); let upstream = Router::new() .route( "/api/internal/gateway/resolve", any(|_request: Request| async move { Json(json!({ "action": "proxy_public", "route_class": "ai_public", "route_family": "openai", "route_kind": "cli", "auth_endpoint_signature": "openai:responses", "execution_runtime_candidate": true, "auth_context": { "user_id": "user-openai-cli-local-limit-123", "api_key_id": "key-openai-cli-local-limit-123", "api_key_concurrent_limit": 1, "access_allowed": true }, "public_path": "/v1/responses" })) }), ) .route( "/api/internal/gateway/decision-sync", any(|_request: Request| async move { Json(json!({"action": "proxy_public"})) }), ) .route( "/api/internal/gateway/plan-sync", any(|_request: Request| async move { Json(json!({"action": "proxy_public"})) }), ) .route( "/v1/responses", any(move |_request: Request| { let public_hits_inner = Arc::clone(&public_hits_clone); async move { *public_hits_inner.lock().expect("mutex should lock") += 1; (StatusCode::IM_A_TEAPOT, Body::from("public-route-hit")) } }), ); let execution_runtime = Router::new().route( "/v1/execute/sync", any(move |_request: Request| { let execution_runtime_hits_inner = Arc::clone(&execution_runtime_hits_clone); async move { *execution_runtime_hits_inner .lock() .expect("mutex should lock") += 1; Json(json!({ "request_id": "trace-openai-cli-local-limit-123", "status_code": 200, "headers": { "content-type": "application/json" }, "body": { "json_body": { "id": "resp-cli-local-limit-123", "object": "response", "model": "gpt-5-upstream", "output": [], "usage": { "input_tokens": 1, "output_tokens": 2, "total_tokens": 3 } } }, "telemetry": { "elapsed_ms": 21 } })) } }), ); let mut auth_snapshot = sample_auth_snapshot( "key-openai-cli-local-limit-123", "user-openai-cli-local-limit-123", ); auth_snapshot.api_key_concurrent_limit = Some(1); let auth_repository = Arc::new(InMemoryAuthApiKeySnapshotRepository::seed(vec![( Some(hash_api_key("sk-client-openai-cli-local-limit")), auth_snapshot, )])); let candidate_selection_repository = Arc::new(InMemoryMinimalCandidateSelectionReadRepository::seed(vec![ sample_candidate_row(), ])); let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed( vec![sample_provider_catalog_provider()], vec![sample_provider_catalog_endpoint()], vec![sample_provider_catalog_key()], )); let (_upstream_url, upstream_handle) = start_server(upstream).await; let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await; let gateway_state = build_state_with_execution_runtime_override(execution_runtime_url) .with_data_state_for_tests( crate::data::GatewayDataState::with_auth_candidate_selection_provider_catalog_and_request_candidate_repository_for_tests( auth_repository, candidate_selection_repository, provider_catalog_repository, Arc::clone(&request_candidate_repository), DEVELOPMENT_ENCRYPTION_KEY, ), ); let gateway = build_router_with_state(gateway_state); let (gateway_url, gateway_handle) = start_server(gateway).await; let request_candidate_repository_for_release = Arc::clone(&request_candidate_repository); let release_inflight_candidate = tokio::spawn(async move { tokio::time::sleep(std::time::Duration::from_millis(25)).await; let pending = request_candidate_repository_for_release .list_by_request_id("req-inflight-openai-cli-local-limit-1") .await .expect("inflight candidates should read") .into_iter() .find(|candidate| candidate.id == "cand-pending-openai-cli-local-limit-1") .expect("seeded inflight candidate should exist"); request_candidate_repository_for_release .upsert(UpsertRequestCandidateRecord { id: pending.id, request_id: pending.request_id, user_id: pending.user_id, api_key_id: pending.api_key_id, username: pending.username, api_key_name: pending.api_key_name, candidate_index: pending.candidate_index, retry_index: pending.retry_index, provider_id: pending.provider_id, endpoint_id: pending.endpoint_id, key_id: pending.key_id, status: RequestCandidateStatus::Success, skip_reason: None, is_cached: Some(false), status_code: Some(200), error_type: None, error_message: None, latency_ms: Some(1), concurrent_requests: pending.concurrent_requests, extra_data: pending.extra_data, required_capabilities: pending.required_capabilities, created_at_unix_ms: Some(pending.created_at_unix_ms), started_at_unix_ms: pending.started_at_unix_ms, finished_at_unix_ms: Some(pending.created_at_unix_ms.saturating_add(25)), }) .await .expect("inflight candidate should update"); }); let response = reqwest::Client::new() .post(format!("{gateway_url}/v1/responses")) .header(http::header::CONTENT_TYPE, "application/json") .header( http::header::AUTHORIZATION, "Bearer sk-client-openai-cli-local-limit", ) .header(TRACE_ID_HEADER, "trace-openai-cli-local-limit-123") .body("{\"model\":\"gpt-5\",\"input\":\"hello\",\"store\":false}") .send() .await .expect("request should succeed"); assert_eq!(response.status(), StatusCode::OK); assert_eq!( response .headers() .get(EXECUTION_PATH_HEADER) .and_then(|value| value.to_str().ok()), Some(EXECUTION_PATH_EXECUTION_RUNTIME_SYNC) ); assert_eq!( response .headers() .get(LOCAL_EXECUTION_RUNTIME_MISS_REASON_HEADER) .and_then(|value| value.to_str().ok()), None ); let payload: serde_json::Value = response.json().await.expect("body should parse"); assert_eq!(payload["model"], "gpt-5-upstream"); let stored_candidates = request_candidate_repository .list_by_request_id("trace-openai-cli-local-limit-123") .await .expect("request candidate trace should read"); assert_eq!(stored_candidates.len(), 1); assert_eq!(stored_candidates[0].status, RequestCandidateStatus::Success); assert_eq!(stored_candidates[0].skip_reason.as_deref(), None); assert_eq!( *execution_runtime_hits.lock().expect("mutex should lock"), 1 ); assert_eq!(*public_hits.lock().expect("mutex should lock"), 0); release_inflight_candidate .await .expect("release task should complete"); gateway_handle.abort(); execution_runtime_handle.abort(); upstream_handle.abort(); } #[test] fn gateway_executes_openai_responses_sync_after_api_key_concurrency_wait_budget_elapses() { run_cli_sync_test( "gateway_executes_openai_responses_sync_after_api_key_concurrency_wait_budget_elapses", gateway_executes_openai_responses_sync_after_api_key_concurrency_wait_budget_elapses_impl, ); } async fn gateway_executes_openai_responses_sync_after_api_key_concurrency_wait_budget_elapses_impl() { fn hash_api_key(value: &str) -> String { let mut hasher = Sha256::new(); hasher.update(value.as_bytes()); format!("{:x}", hasher.finalize()) } fn sample_auth_snapshot(api_key_id: &str, user_id: &str) -> StoredAuthApiKeySnapshot { StoredAuthApiKeySnapshot::new( user_id.to_string(), "alice".to_string(), Some("alice@example.com".to_string()), "user".to_string(), "local".to_string(), true, false, Some(serde_json::json!(["openai"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), api_key_id.to_string(), Some("default".to_string()), true, false, false, Some(60), Some(5), Some(4_102_444_800), Some(serde_json::json!(["openai"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), ) .expect("auth snapshot should build") } fn sample_candidate_row() -> StoredMinimalCandidateSelectionRow { StoredMinimalCandidateSelectionRow { provider_id: "provider-openai-cli-local-timeout-1".to_string(), provider_name: "openai".to_string(), provider_type: "custom".to_string(), provider_priority: 10, provider_is_active: true, endpoint_id: "endpoint-openai-cli-local-timeout-1".to_string(), endpoint_api_format: "openai:responses".to_string(), endpoint_api_family: Some("openai".to_string()), endpoint_kind: Some("cli".to_string()), endpoint_is_active: true, key_id: "key-openai-cli-local-timeout-1".to_string(), key_name: "prod".to_string(), key_auth_type: "api_key".to_string(), key_is_active: true, key_api_formats: Some(vec!["openai:responses".to_string()]), key_allowed_models: None, key_capabilities: None, key_internal_priority: 5, key_global_priority_by_format: Some(serde_json::json!({"openai:responses": 1})), model_id: "model-openai-cli-local-timeout-1".to_string(), global_model_id: "global-model-openai-cli-local-timeout-1".to_string(), global_model_name: "gpt-5".to_string(), global_model_mappings: None, global_model_supports_streaming: Some(true), model_provider_model_name: "gpt-5-upstream".to_string(), model_provider_model_mappings: Some(vec![StoredProviderModelMapping { name: "gpt-5-upstream".to_string(), priority: 1, api_formats: Some(vec!["openai:responses".to_string()]), endpoint_ids: None, }]), model_supports_streaming: Some(true), model_is_active: true, model_is_available: true, } } fn sample_provider_catalog_provider() -> StoredProviderCatalogProvider { StoredProviderCatalogProvider::new( "provider-openai-cli-local-timeout-1".to_string(), "openai".to_string(), Some("https://example.com".to_string()), "custom".to_string(), ) .expect("provider should build") .with_transport_fields( true, false, false, None, Some(2), None, Some(20.0), None, None, ) } fn sample_provider_catalog_endpoint() -> StoredProviderCatalogEndpoint { StoredProviderCatalogEndpoint::new( "endpoint-openai-cli-local-timeout-1".to_string(), "provider-openai-cli-local-timeout-1".to_string(), "openai:responses".to_string(), Some("openai".to_string()), Some("cli".to_string()), true, ) .expect("endpoint should build") .with_transport_fields( "https://api.openai.example/custom/v1/responses".to_string(), None, None, Some(2), Some("/custom/v1/responses".to_string()), None, None, None, ) .expect("endpoint transport should build") } fn sample_provider_catalog_key() -> StoredProviderCatalogKey { StoredProviderCatalogKey::new( "key-openai-cli-local-timeout-1".to_string(), "provider-openai-cli-local-timeout-1".to_string(), "prod".to_string(), "api_key".to_string(), None, true, ) .expect("key should build") .with_transport_fields( Some(serde_json::json!(["openai:responses"])), encrypt_python_fernet_plaintext( DEVELOPMENT_ENCRYPTION_KEY, "sk-upstream-openai-cli-timeout", ) .expect("api key should encrypt"), None, None, Some(serde_json::json!({"openai:responses": 1})), None, None, None, None, ) .expect("key transport should build") } let execution_runtime_hits = Arc::new(Mutex::new(0usize)); let execution_runtime_hits_clone = Arc::clone(&execution_runtime_hits); let public_hits = Arc::new(Mutex::new(0usize)); let public_hits_clone = Arc::clone(&public_hits); let request_candidate_repository = Arc::new(InMemoryRequestCandidateRepository::default()); let upstream = Router::new() .route( "/api/internal/gateway/resolve", any(|_request: Request| async move { Json(json!({ "action": "proxy_public", "route_class": "ai_public", "route_family": "openai", "route_kind": "cli", "auth_endpoint_signature": "openai:responses", "execution_runtime_candidate": true, "auth_context": { "user_id": "user-openai-cli-local-timeout-123", "api_key_id": "key-openai-cli-local-timeout-123", "api_key_concurrent_limit": 1, "access_allowed": true }, "public_path": "/v1/responses" })) }), ) .route( "/api/internal/gateway/decision-sync", any(|_request: Request| async move { Json(json!({"action": "proxy_public"})) }), ) .route( "/api/internal/gateway/plan-sync", any(|_request: Request| async move { Json(json!({"action": "proxy_public"})) }), ) .route( "/v1/responses", any(move |_request: Request| { let public_hits_inner = Arc::clone(&public_hits_clone); async move { *public_hits_inner.lock().expect("mutex should lock") += 1; (StatusCode::IM_A_TEAPOT, Body::from("public-route-hit")) } }), ); let execution_runtime = Router::new().route( "/v1/execute/sync", any(move |_request: Request| { let execution_runtime_hits_inner = Arc::clone(&execution_runtime_hits_clone); async move { *execution_runtime_hits_inner .lock() .expect("mutex should lock") += 1; tokio::time::sleep(std::time::Duration::from_millis(300)).await; Json(json!({ "request_id": "trace-openai-cli-local-timeout-123", "status_code": 200, "headers": { "content-type": "application/json" }, "body": { "json_body": { "id": "resp-cli-local-timeout-123", "object": "response", "model": "gpt-5-upstream", "output": [], "usage": { "input_tokens": 1, "output_tokens": 2, "total_tokens": 3 } } }, "telemetry": { "elapsed_ms": 21 } })) } }), ); let mut auth_snapshot = sample_auth_snapshot( "key-openai-cli-local-timeout-123", "user-openai-cli-local-timeout-123", ); auth_snapshot.api_key_concurrent_limit = Some(1); let auth_repository = Arc::new(InMemoryAuthApiKeySnapshotRepository::seed(vec![( Some(hash_api_key("sk-client-openai-cli-local-timeout")), auth_snapshot, )])); let candidate_selection_repository = Arc::new(InMemoryMinimalCandidateSelectionReadRepository::seed(vec![ sample_candidate_row(), ])); let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed( vec![sample_provider_catalog_provider()], vec![sample_provider_catalog_endpoint()], vec![sample_provider_catalog_key()], )); let (_upstream_url, upstream_handle) = start_server(upstream).await; let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await; let gateway_state = build_state_with_execution_runtime_override(execution_runtime_url) .with_data_state_for_tests( crate::data::GatewayDataState::with_auth_candidate_selection_provider_catalog_and_request_candidate_repository_for_tests( auth_repository, candidate_selection_repository, provider_catalog_repository, Arc::clone(&request_candidate_repository), DEVELOPMENT_ENCRYPTION_KEY, ), ); let gateway = build_router_with_state(gateway_state); let (gateway_url, gateway_handle) = start_server(gateway).await; let client = reqwest::Client::new(); let first_client = client.clone(); let first_gateway_url = gateway_url.clone(); let first_request = tokio::spawn(async move { first_client .post(format!("{first_gateway_url}/v1/responses")) .header(http::header::CONTENT_TYPE, "application/json") .header( http::header::AUTHORIZATION, "Bearer sk-client-openai-cli-local-timeout", ) .header( TRACE_ID_HEADER, "trace-openai-cli-local-timeout-inflight-123", ) .body("{\"model\":\"gpt-5\",\"input\":\"first\",\"store\":false}") .send() .await .expect("inflight request should complete") }); wait_until(5_000, || { *execution_runtime_hits.lock().expect("mutex should lock") >= 1 }) .await; let active_deadline = tokio::time::Instant::now() + std::time::Duration::from_millis(5_000); loop { let inflight_candidates = request_candidate_repository .list_by_request_id("trace-openai-cli-local-timeout-inflight-123") .await .expect("inflight request candidate trace should read"); if inflight_candidates.iter().any(|candidate| { matches!( candidate.status, RequestCandidateStatus::Pending | RequestCandidateStatus::Streaming ) && candidate.started_at_unix_ms.is_some() }) { break; } assert!( tokio::time::Instant::now() < active_deadline, "inflight request candidate did not become active: {inflight_candidates:?}" ); tokio::time::sleep(std::time::Duration::from_millis(10)).await; } let started_at = std::time::Instant::now(); let response = client .post(format!("{gateway_url}/v1/responses")) .header(http::header::CONTENT_TYPE, "application/json") .header( http::header::AUTHORIZATION, "Bearer sk-client-openai-cli-local-timeout", ) .header(TRACE_ID_HEADER, "trace-openai-cli-local-timeout-123") .body("{\"model\":\"gpt-5\",\"input\":\"hello\",\"store\":false}") .send() .await .expect("request should complete"); assert!( started_at.elapsed() >= std::time::Duration::from_millis(100), "request should wait for the bounded concurrency window before retrying" ); assert_eq!(response.status(), StatusCode::OK); assert_eq!( response .headers() .get(EXECUTION_PATH_HEADER) .and_then(|value| value.to_str().ok()), Some(EXECUTION_PATH_EXECUTION_RUNTIME_SYNC) ); assert_eq!( response .headers() .get(LOCAL_EXECUTION_RUNTIME_MISS_REASON_HEADER) .and_then(|value| value.to_str().ok()), None ); let payload: serde_json::Value = response.json().await.expect("body should parse"); assert_eq!(payload["model"], "gpt-5-upstream"); let stored_candidates = request_candidate_repository .list_by_request_id("trace-openai-cli-local-timeout-123") .await .expect("request candidate trace should read"); assert_eq!(stored_candidates.len(), 1); assert_eq!(stored_candidates[0].status, RequestCandidateStatus::Success); assert_eq!(stored_candidates[0].skip_reason.as_deref(), None); assert_eq!( *execution_runtime_hits.lock().expect("mutex should lock"), 2 ); assert_eq!(*public_hits.lock().expect("mutex should lock"), 0); let first_response = first_request.await.expect("inflight request should join"); assert_eq!(first_response.status(), StatusCode::OK); gateway_handle.abort(); execution_runtime_handle.abort(); upstream_handle.abort(); } #[test] fn gateway_returns_openai_responses_error_for_local_sync_failure() { run_cli_sync_test( "gateway_returns_openai_responses_error_for_local_sync_failure", gateway_returns_openai_responses_error_for_local_sync_failure_impl, ); } async fn gateway_returns_openai_responses_error_for_local_sync_failure_impl() { fn hash_api_key(value: &str) -> String { let mut hasher = Sha256::new(); hasher.update(value.as_bytes()); format!("{:x}", hasher.finalize()) } fn sample_auth_snapshot(api_key_id: &str, user_id: &str) -> StoredAuthApiKeySnapshot { StoredAuthApiKeySnapshot::new( user_id.to_string(), "alice".to_string(), Some("alice@example.com".to_string()), "user".to_string(), "local".to_string(), true, false, Some(serde_json::json!(["openai"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), api_key_id.to_string(), Some("default".to_string()), true, false, false, Some(60), Some(5), Some(4_102_444_800_i64), Some(serde_json::json!(["openai"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), ) .expect("auth snapshot should build") } fn sample_candidate_row() -> StoredMinimalCandidateSelectionRow { StoredMinimalCandidateSelectionRow { provider_id: "provider-openai-cli-local-1".to_string(), provider_name: "openai".to_string(), provider_type: "custom".to_string(), provider_priority: 10, provider_is_active: true, endpoint_id: "endpoint-openai-cli-local-1".to_string(), endpoint_api_format: "openai:responses".to_string(), endpoint_api_family: Some("openai".to_string()), endpoint_kind: Some("cli".to_string()), endpoint_is_active: true, key_id: "key-openai-cli-local-1".to_string(), key_name: "prod".to_string(), key_auth_type: "bearer".to_string(), key_is_active: true, key_api_formats: Some(vec!["openai:responses".to_string()]), key_allowed_models: None, key_capabilities: None, key_internal_priority: 5, key_global_priority_by_format: Some(serde_json::json!({"openai:responses": 1})), model_id: "model-openai-cli-local-1".to_string(), global_model_id: "global-model-openai-cli-local-1".to_string(), global_model_name: "gpt-5".to_string(), global_model_mappings: None, global_model_supports_streaming: Some(true), model_provider_model_name: "gpt-5-upstream".to_string(), model_provider_model_mappings: Some(vec![StoredProviderModelMapping { name: "gpt-5-upstream".to_string(), priority: 1, api_formats: Some(vec!["openai:responses".to_string()]), endpoint_ids: None, }]), model_supports_streaming: Some(true), model_is_active: true, model_is_available: true, } } fn sample_provider_catalog_provider() -> StoredProviderCatalogProvider { StoredProviderCatalogProvider::new( "provider-openai-cli-local-1".to_string(), "openai".to_string(), Some("https://example.com".to_string()), "custom".to_string(), ) .expect("provider should build") .with_transport_fields( true, false, false, None, Some(2), Some(serde_json::json!({"url":"http://provider-proxy.internal:8080"})), Some(20.0), None, None, ) } fn sample_provider_catalog_endpoint() -> StoredProviderCatalogEndpoint { StoredProviderCatalogEndpoint::new( "endpoint-openai-cli-local-1".to_string(), "provider-openai-cli-local-1".to_string(), "openai:responses".to_string(), Some("openai".to_string()), Some("cli".to_string()), true, ) .expect("endpoint should build") .with_transport_fields( "https://api.openai.example".to_string(), Some(serde_json::json!([ {"action":"set","key":"x-endpoint-tag","value":"openai-cli-local"} ])), Some(serde_json::json!([ {"action":"set","path":"metadata.mode","value":"safe","condition":{"path":"metadata.mode","op":"not_exists","source":"current"}}, {"action":"rename","from":"metadata.client","to":"metadata.source"}, {"action":"drop","path":"store"} ])), Some(2), Some("/custom/v1/responses".to_string()), None, None, None, ) .expect("endpoint transport should build") } fn sample_provider_catalog_key() -> StoredProviderCatalogKey { StoredProviderCatalogKey::new( "key-openai-cli-local-1".to_string(), "provider-openai-cli-local-1".to_string(), "prod".to_string(), "bearer".to_string(), None, true, ) .expect("key should build") .with_transport_fields( Some(serde_json::json!(["openai:responses"])), encrypt_python_fernet_plaintext(DEVELOPMENT_ENCRYPTION_KEY, "sk-upstream-openai-cli") .expect("api key should encrypt"), None, None, Some(serde_json::json!({"openai:responses": 1})), None, None, Some(serde_json::json!({"enabled": true, "node_id":"proxy-node-openai-cli-local"})), Some(serde_json::json!({"transport_profile":"chrome_136"})), ) .expect("key transport should build") } let seen_report = Arc::new(Mutex::new(false)); let seen_report_clone = Arc::clone(&seen_report); let request_candidate_repository = Arc::new(InMemoryRequestCandidateRepository::default()); let upstream = Router::new() .route( "/api/internal/gateway/resolve", any(|_request: Request| async move { Json(json!({ "action": "proxy_public", "route_class": "ai_public", "route_family": "openai", "route_kind": "cli", "auth_endpoint_signature": "openai:responses", "execution_runtime_candidate": true, "auth_context": { "user_id": "user-openai-cli-local-error-123", "api_key_id": "key-openai-cli-local-error-123", "access_allowed": true }, "public_path": "/v1/responses" })) }), ) .route( "/api/internal/gateway/report-sync", any(move |request: Request| { let seen_report_inner = Arc::clone(&seen_report_clone); async move { let (_parts, body) = request.into_parts(); let _raw_body = to_bytes(body, usize::MAX).await.expect("body should read"); *seen_report_inner.lock().expect("mutex should lock") = true; Json(json!({"ok": true})) } }), ); let execution_runtime = Router::new().route( "/v1/execute/sync", any(move |_request: Request| async move { Json(json!({ "request_id": "trace-openai-cli-local-error-123", "status_code": 200, "headers": { "content-type": "application/json" }, "body": { "json_body": { "error": { "message": "quota reached", "type": "rate_limit_error" } } }, "telemetry": { "elapsed_ms": 37 } })) }), ); let client_api_key = "sk-client-openai-cli-local-error"; let auth_repository = Arc::new(InMemoryAuthApiKeySnapshotRepository::seed(vec![( Some(hash_api_key(client_api_key)), sample_auth_snapshot( "key-openai-cli-local-error-123", "user-openai-cli-local-error-123", ), )])); let candidate_selection_repository = Arc::new(InMemoryMinimalCandidateSelectionReadRepository::seed(vec![ sample_candidate_row(), ])); let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed( vec![sample_provider_catalog_provider()], vec![sample_provider_catalog_endpoint()], vec![sample_provider_catalog_key()], )); let (_upstream_url, upstream_handle) = start_server(upstream).await; let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await; let gateway_state = build_state_with_execution_runtime_override(execution_runtime_url.clone()) .with_data_state_for_tests( crate::data::GatewayDataState::with_auth_candidate_selection_provider_catalog_and_request_candidate_repository_for_tests( auth_repository, candidate_selection_repository, provider_catalog_repository, Arc::clone(&request_candidate_repository), DEVELOPMENT_ENCRYPTION_KEY, ), ); let gateway = build_router_with_state(gateway_state); let (gateway_url, gateway_handle) = start_server(gateway).await; let response = reqwest::Client::new() .post(format!("{gateway_url}/v1/responses")) .header(http::header::CONTENT_TYPE, "application/json") .header( http::header::AUTHORIZATION, format!("Bearer {client_api_key}"), ) .header(TRACE_ID_HEADER, "trace-openai-cli-local-error-123") .body("{\"model\":\"gpt-5\",\"input\":\"hello\",\"metadata\":{\"client\":\"desktop-openai-cli\"},\"store\":false}") .send() .await .expect("request should succeed"); assert_eq!(response.status(), StatusCode::TOO_MANY_REQUESTS); assert_eq!( response .headers() .get(EXECUTION_PATH_HEADER) .and_then(|value| value.to_str().ok()), Some(EXECUTION_PATH_EXECUTION_RUNTIME_SYNC) ); let response_json: serde_json::Value = response.json().await.expect("body should parse"); assert_eq!( response_json, json!({ "error": { "message": "quota reached", "type": "rate_limit_error" } }) ); let stored_candidates = request_candidate_repository .list_by_request_id("trace-openai-cli-local-error-123") .await .expect("request candidate trace should read"); assert_eq!(stored_candidates.len(), 1); assert_eq!(stored_candidates[0].status, RequestCandidateStatus::Failed); tokio::time::sleep(std::time::Duration::from_millis(100)).await; assert!( !*seen_report.lock().expect("mutex should lock"), "report-sync should stay local when request candidate persistence is available" ); gateway_handle.abort(); execution_runtime_handle.abort(); upstream_handle.abort(); } #[test] fn gateway_returns_openai_responses_error_for_local_cross_format_gemini_cli_sync_failure() { run_cli_sync_test( "gateway_returns_openai_responses_error_for_local_cross_format_gemini_cli_sync_failure", gateway_returns_openai_responses_error_for_local_cross_format_gemini_cli_sync_failure_impl, ); } async fn gateway_returns_openai_responses_error_for_local_cross_format_gemini_cli_sync_failure_impl( ) { #[derive(Debug, Clone)] struct SeenExecutionRuntimeSyncRequest { trace_id: String, url: String, authorization: String, endpoint_tag: String, has_contents: bool, outer_model: String, user_prompt_id: String, inner_model_present: bool, } fn hash_api_key(value: &str) -> String { let mut hasher = Sha256::new(); hasher.update(value.as_bytes()); format!("{:x}", hasher.finalize()) } fn sample_auth_snapshot(api_key_id: &str, user_id: &str) -> StoredAuthApiKeySnapshot { StoredAuthApiKeySnapshot::new( user_id.to_string(), "alice".to_string(), Some("alice@example.com".to_string()), "user".to_string(), "local".to_string(), true, false, Some(serde_json::json!(["openai", "gemini", "gemini_cli"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), api_key_id.to_string(), Some("default".to_string()), true, false, false, Some(60), Some(5), Some(4_102_444_800_i64), Some(serde_json::json!(["openai", "gemini", "gemini_cli"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), ) .expect("auth snapshot should build") } fn sample_candidate_row() -> StoredMinimalCandidateSelectionRow { StoredMinimalCandidateSelectionRow { provider_id: "provider-openai-cli-gemini-local-1".to_string(), provider_name: "gemini_cli".to_string(), provider_type: "gemini_cli".to_string(), provider_priority: 10, provider_is_active: true, endpoint_id: "endpoint-openai-cli-gemini-local-1".to_string(), endpoint_api_format: "gemini:generate_content".to_string(), endpoint_api_family: Some("gemini".to_string()), endpoint_kind: Some("cli".to_string()), endpoint_is_active: true, key_id: "key-openai-cli-gemini-local-1".to_string(), key_name: "oauth".to_string(), key_auth_type: "oauth".to_string(), key_is_active: true, key_api_formats: Some(vec!["gemini:generate_content".to_string()]), key_allowed_models: None, key_capabilities: None, key_internal_priority: 5, key_global_priority_by_format: Some(serde_json::json!({"gemini:generate_content": 1})), model_id: "model-openai-cli-gemini-local-1".to_string(), global_model_id: "global-model-openai-cli-gemini-local-1".to_string(), global_model_name: "gpt-5".to_string(), global_model_mappings: None, global_model_supports_streaming: Some(true), model_provider_model_name: "gemini-cli-upstream".to_string(), model_provider_model_mappings: Some(vec![StoredProviderModelMapping { name: "gemini-cli-upstream".to_string(), priority: 1, api_formats: Some(vec!["gemini:generate_content".to_string()]), endpoint_ids: None, }]), model_supports_streaming: Some(true), model_is_active: true, model_is_available: true, } } fn sample_provider_catalog_provider() -> StoredProviderCatalogProvider { StoredProviderCatalogProvider::new( "provider-openai-cli-gemini-local-1".to_string(), "gemini_cli".to_string(), Some("https://example.com".to_string()), "gemini_cli".to_string(), ) .expect("provider should build") .with_transport_fields( true, false, true, None, Some(2), None, Some(20.0), None, None, ) } fn sample_provider_catalog_endpoint() -> StoredProviderCatalogEndpoint { StoredProviderCatalogEndpoint::new( "endpoint-openai-cli-gemini-local-1".to_string(), "provider-openai-cli-gemini-local-1".to_string(), "gemini:generate_content".to_string(), Some("gemini".to_string()), Some("cli".to_string()), true, ) .expect("endpoint should build") .with_transport_fields( "https://cloudcode-pa.googleapis.com".to_string(), Some(serde_json::json!([ {"action":"set","key":"x-endpoint-tag","value":"openai-cli-gemini-cross-format"} ])), None, Some(2), None, None, None, None, ) .expect("endpoint transport should build") } fn sample_provider_catalog_key() -> StoredProviderCatalogKey { StoredProviderCatalogKey::new( "key-openai-cli-gemini-local-1".to_string(), "provider-openai-cli-gemini-local-1".to_string(), "oauth".to_string(), "oauth".to_string(), None, true, ) .expect("key should build") .with_transport_fields( Some(serde_json::json!(["gemini:generate_content"])), encrypt_python_fernet_plaintext( DEVELOPMENT_ENCRYPTION_KEY, "sk-upstream-openai-cli-gemini", ) .expect("api key should encrypt"), None, None, Some(serde_json::json!({"gemini:generate_content": 1})), None, None, None, None, ) .expect("key transport should build") } let seen_execution_runtime = Arc::new(Mutex::new(None::)); let seen_execution_runtime_clone = Arc::clone(&seen_execution_runtime); let seen_report = Arc::new(Mutex::new(false)); let seen_report_clone = Arc::clone(&seen_report); let request_candidate_repository = Arc::new(InMemoryRequestCandidateRepository::default()); let upstream = Router::new() .route( "/api/internal/gateway/resolve", any(|_request: Request| async move { Json(json!({ "action": "proxy_public", "route_class": "ai_public", "route_family": "openai", "route_kind": "cli", "auth_endpoint_signature": "openai:responses", "execution_runtime_candidate": true, "auth_context": { "user_id": "user-openai-cli-gemini-local-error-123", "api_key_id": "key-openai-cli-gemini-local-error-123", "access_allowed": true }, "public_path": "/v1/responses" })) }), ) .route( "/api/internal/gateway/report-sync", any(move |request: Request| { let seen_report_inner = Arc::clone(&seen_report_clone); async move { let (_parts, body) = request.into_parts(); let _raw_body = to_bytes(body, usize::MAX).await.expect("body should read"); *seen_report_inner.lock().expect("mutex should lock") = true; Json(json!({"ok": true})) } }), ); let execution_runtime = Router::new().route( "/v1/execute/sync", any(move |request: Request| { let seen_execution_runtime_inner = Arc::clone(&seen_execution_runtime_clone); async move { let (parts, body) = request.into_parts(); let raw_body = to_bytes(body, usize::MAX).await.expect("body should read"); let payload: serde_json::Value = serde_json::from_slice(&raw_body) .expect("execution runtime payload should parse"); *seen_execution_runtime_inner .lock() .expect("mutex should lock") = Some(SeenExecutionRuntimeSyncRequest { trace_id: parts .headers .get(TRACE_ID_HEADER) .and_then(|value| value.to_str().ok()) .unwrap_or_default() .to_string(), url: payload .get("url") .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), authorization: payload .get("headers") .and_then(|value| value.get("authorization")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), endpoint_tag: payload .get("headers") .and_then(|value| value.get("x-endpoint-tag")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), has_contents: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("request")) .and_then(|value| value.get("contents")) .is_some(), outer_model: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("model")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), user_prompt_id: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("user_prompt_id")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), inner_model_present: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("request")) .and_then(|value| value.get("model")) .is_some(), }); Json(json!({ "request_id": "trace-openai-cli-gemini-local-error-123", "status_code": 200, "headers": { "content-type": "application/json" }, "body": { "json_body": { "error": { "message": "quota reached", "status": "RESOURCE_EXHAUSTED" } } }, "telemetry": { "elapsed_ms": 31 } })) } }), ); let auth_repository = Arc::new(InMemoryAuthApiKeySnapshotRepository::seed(vec![( Some(hash_api_key("sk-client-openai-cli-gemini-error")), sample_auth_snapshot( "key-openai-cli-gemini-local-error-123", "user-openai-cli-gemini-local-error-123", ), )])); let candidate_selection_repository = Arc::new(InMemoryMinimalCandidateSelectionReadRepository::seed(vec![ sample_candidate_row(), ])); let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed( vec![sample_provider_catalog_provider()], vec![sample_provider_catalog_endpoint()], vec![sample_provider_catalog_key()], )); let (_upstream_url, upstream_handle) = start_server(upstream).await; let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await; let gateway_state = build_state_with_execution_runtime_override(execution_runtime_url.clone()) .with_data_state_for_tests( crate::data::GatewayDataState::with_auth_candidate_selection_provider_catalog_and_request_candidate_repository_for_tests( auth_repository, candidate_selection_repository, provider_catalog_repository, Arc::clone(&request_candidate_repository), DEVELOPMENT_ENCRYPTION_KEY, ), ); let gateway = build_router_with_state(gateway_state); let (gateway_url, gateway_handle) = start_server(gateway).await; let response = reqwest::Client::new() .post(format!("{gateway_url}/v1/responses")) .header(http::header::CONTENT_TYPE, "application/json") .header( http::header::AUTHORIZATION, "Bearer sk-client-openai-cli-gemini-error", ) .header(TRACE_ID_HEADER, "trace-openai-cli-gemini-local-error-123") .body( "{\"model\":\"gpt-5\",\"input\":\"hello\",\"metadata\":{\"client\":\"desktop-openai-cli\"},\"store\":false}", ) .send() .await .expect("request should succeed"); assert_eq!(response.status(), StatusCode::TOO_MANY_REQUESTS); assert_eq!( response .headers() .get(EXECUTION_PATH_HEADER) .and_then(|value| value.to_str().ok()), Some(EXECUTION_PATH_EXECUTION_RUNTIME_SYNC) ); let response_json: serde_json::Value = response.json().await.expect("body should parse"); assert_eq!( response_json, json!({ "error": { "message": "quota reached", "type": "rate_limit_error", "code": "RESOURCE_EXHAUSTED" } }) ); let seen_execution_runtime_request = seen_execution_runtime .lock() .expect("mutex should lock") .clone() .expect("execution runtime sync should be captured"); assert_eq!( seen_execution_runtime_request.trace_id, "trace-openai-cli-gemini-local-error-123" ); assert_eq!( seen_execution_runtime_request.url, "https://cloudcode-pa.googleapis.com/v1internal:generateContent" ); assert_eq!( seen_execution_runtime_request.authorization, "Bearer sk-upstream-openai-cli-gemini" ); assert_eq!( seen_execution_runtime_request.endpoint_tag, "openai-cli-gemini-cross-format" ); assert!(seen_execution_runtime_request.has_contents); assert_eq!( seen_execution_runtime_request.outer_model, "gemini-cli-upstream" ); assert_eq!( seen_execution_runtime_request.user_prompt_id, "trace-openai-cli-gemini-local-error-123" ); assert!(!seen_execution_runtime_request.inner_model_present); let stored_candidates = request_candidate_repository .list_by_request_id("trace-openai-cli-gemini-local-error-123") .await .expect("request candidate trace should read"); assert_eq!(stored_candidates.len(), 1); assert_eq!(stored_candidates[0].status, RequestCandidateStatus::Failed); tokio::time::sleep(std::time::Duration::from_millis(100)).await; assert!( !*seen_report.lock().expect("mutex should lock"), "report-sync should stay local when request candidate persistence is available" ); gateway_handle.abort(); execution_runtime_handle.abort(); upstream_handle.abort(); } #[test] fn gateway_returns_openai_responses_error_for_local_cross_format_claude_sync_failure() { run_cli_sync_test( "gateway_returns_openai_responses_error_for_local_cross_format_claude_sync_failure", gateway_returns_openai_responses_error_for_local_cross_format_claude_sync_failure_impl, ); } async fn gateway_returns_openai_responses_error_for_local_cross_format_claude_sync_failure_impl() { #[derive(Debug, Clone)] struct SeenExecutionRuntimeSyncRequest { trace_id: String, url: String, authorization: String, endpoint_tag: String, model: String, has_messages: bool, } fn hash_api_key(value: &str) -> String { let mut hasher = Sha256::new(); hasher.update(value.as_bytes()); format!("{:x}", hasher.finalize()) } fn sample_auth_snapshot(api_key_id: &str, user_id: &str) -> StoredAuthApiKeySnapshot { StoredAuthApiKeySnapshot::new( user_id.to_string(), "alice".to_string(), Some("alice@example.com".to_string()), "user".to_string(), "local".to_string(), true, false, Some(serde_json::json!(["openai", "claude"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), api_key_id.to_string(), Some("default".to_string()), true, false, false, Some(60), Some(5), Some(4_102_444_800_i64), Some(serde_json::json!(["openai", "claude"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), ) .expect("auth snapshot should build") } fn sample_candidate_row() -> StoredMinimalCandidateSelectionRow { StoredMinimalCandidateSelectionRow { provider_id: "provider-openai-cli-claude-local-1".to_string(), provider_name: "claude".to_string(), provider_type: "custom".to_string(), provider_priority: 10, provider_is_active: true, endpoint_id: "endpoint-openai-cli-claude-local-1".to_string(), endpoint_api_format: "claude:messages".to_string(), endpoint_api_family: Some("claude".to_string()), endpoint_kind: Some("cli".to_string()), endpoint_is_active: true, key_id: "key-openai-cli-claude-local-1".to_string(), key_name: "prod".to_string(), key_auth_type: "bearer".to_string(), key_is_active: true, key_api_formats: Some(vec!["claude:messages".to_string()]), key_allowed_models: None, key_capabilities: None, key_internal_priority: 5, key_global_priority_by_format: Some(serde_json::json!({"claude:messages": 1})), model_id: "model-openai-cli-claude-local-1".to_string(), global_model_id: "global-model-openai-cli-claude-local-1".to_string(), global_model_name: "gpt-5".to_string(), global_model_mappings: None, global_model_supports_streaming: Some(true), model_provider_model_name: "claude-code-upstream".to_string(), model_provider_model_mappings: Some(vec![StoredProviderModelMapping { name: "claude-code-upstream".to_string(), priority: 1, api_formats: Some(vec!["claude:messages".to_string()]), endpoint_ids: None, }]), model_supports_streaming: Some(true), model_is_active: true, model_is_available: true, } } fn sample_provider_catalog_provider() -> StoredProviderCatalogProvider { StoredProviderCatalogProvider::new( "provider-openai-cli-claude-local-1".to_string(), "claude".to_string(), Some("https://example.com".to_string()), "custom".to_string(), ) .expect("provider should build") .with_transport_fields( true, false, true, None, Some(2), None, Some(20.0), None, None, ) } fn sample_provider_catalog_endpoint() -> StoredProviderCatalogEndpoint { StoredProviderCatalogEndpoint::new( "endpoint-openai-cli-claude-local-1".to_string(), "provider-openai-cli-claude-local-1".to_string(), "claude:messages".to_string(), Some("claude".to_string()), Some("cli".to_string()), true, ) .expect("endpoint should build") .with_transport_fields( "https://api.anthropic.example".to_string(), Some(serde_json::json!([ {"action":"set","key":"x-endpoint-tag","value":"openai-cli-claude-cross-format"} ])), None, Some(2), Some("/custom/v1/messages".to_string()), None, None, None, ) .expect("endpoint transport should build") } fn sample_provider_catalog_key() -> StoredProviderCatalogKey { StoredProviderCatalogKey::new( "key-openai-cli-claude-local-1".to_string(), "provider-openai-cli-claude-local-1".to_string(), "prod".to_string(), "bearer".to_string(), None, true, ) .expect("key should build") .with_transport_fields( Some(serde_json::json!(["claude:messages"])), encrypt_python_fernet_plaintext( DEVELOPMENT_ENCRYPTION_KEY, "sk-upstream-openai-cli-claude", ) .expect("api key should encrypt"), None, None, Some(serde_json::json!({"claude:messages": 1})), None, None, None, None, ) .expect("key transport should build") } let seen_execution_runtime = Arc::new(Mutex::new(None::)); let seen_execution_runtime_clone = Arc::clone(&seen_execution_runtime); let seen_report = Arc::new(Mutex::new(false)); let seen_report_clone = Arc::clone(&seen_report); let request_candidate_repository = Arc::new(InMemoryRequestCandidateRepository::default()); let upstream = Router::new() .route( "/api/internal/gateway/resolve", any(|_request: Request| async move { Json(json!({ "action": "proxy_public", "route_class": "ai_public", "route_family": "openai", "route_kind": "cli", "auth_endpoint_signature": "openai:responses", "execution_runtime_candidate": true, "auth_context": { "user_id": "user-openai-cli-claude-local-error-123", "api_key_id": "key-openai-cli-claude-local-error-123", "access_allowed": true }, "public_path": "/v1/responses" })) }), ) .route( "/api/internal/gateway/report-sync", any(move |request: Request| { let seen_report_inner = Arc::clone(&seen_report_clone); async move { let (_parts, body) = request.into_parts(); let _raw_body = to_bytes(body, usize::MAX).await.expect("body should read"); *seen_report_inner.lock().expect("mutex should lock") = true; Json(json!({"ok": true})) } }), ); let execution_runtime = Router::new().route( "/v1/execute/sync", any(move |request: Request| { let seen_execution_runtime_inner = Arc::clone(&seen_execution_runtime_clone); async move { let (parts, body) = request.into_parts(); let raw_body = to_bytes(body, usize::MAX).await.expect("body should read"); let payload: serde_json::Value = serde_json::from_slice(&raw_body) .expect("execution runtime payload should parse"); *seen_execution_runtime_inner .lock() .expect("mutex should lock") = Some(SeenExecutionRuntimeSyncRequest { trace_id: parts .headers .get(TRACE_ID_HEADER) .and_then(|value| value.to_str().ok()) .unwrap_or_default() .to_string(), url: payload .get("url") .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), authorization: payload .get("headers") .and_then(|value| value.get("authorization")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), endpoint_tag: payload .get("headers") .and_then(|value| value.get("x-endpoint-tag")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), model: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("model")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), has_messages: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("messages")) .is_some(), }); Json(json!({ "request_id": "trace-openai-cli-claude-local-error-123", "status_code": 200, "headers": { "content-type": "application/json" }, "body": { "json_body": { "type": "error", "error": { "type": "rate_limit_error", "message": "slow down" } } }, "telemetry": { "elapsed_ms": 28 } })) } }), ); let auth_repository = Arc::new(InMemoryAuthApiKeySnapshotRepository::seed(vec![( Some(hash_api_key("sk-client-openai-cli-claude-error")), sample_auth_snapshot( "key-openai-cli-claude-local-error-123", "user-openai-cli-claude-local-error-123", ), )])); let candidate_selection_repository = Arc::new(InMemoryMinimalCandidateSelectionReadRepository::seed(vec![ sample_candidate_row(), ])); let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed( vec![sample_provider_catalog_provider()], vec![sample_provider_catalog_endpoint()], vec![sample_provider_catalog_key()], )); let (_upstream_url, upstream_handle) = start_server(upstream).await; let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await; let gateway_state = build_state_with_execution_runtime_override(execution_runtime_url.clone()) .with_data_state_for_tests( crate::data::GatewayDataState::with_auth_candidate_selection_provider_catalog_and_request_candidate_repository_for_tests( auth_repository, candidate_selection_repository, provider_catalog_repository, Arc::clone(&request_candidate_repository), DEVELOPMENT_ENCRYPTION_KEY, ), ); let gateway = build_router_with_state(gateway_state); let (gateway_url, gateway_handle) = start_server(gateway).await; let response = reqwest::Client::new() .post(format!("{gateway_url}/v1/responses")) .header(http::header::CONTENT_TYPE, "application/json") .header( http::header::AUTHORIZATION, "Bearer sk-client-openai-cli-claude-error", ) .header(TRACE_ID_HEADER, "trace-openai-cli-claude-local-error-123") .body( "{\"model\":\"gpt-5\",\"input\":\"hello\",\"metadata\":{\"client\":\"desktop-openai-cli\"},\"store\":false}", ) .send() .await .expect("request should succeed"); assert_eq!(response.status(), StatusCode::TOO_MANY_REQUESTS); assert_eq!( response .headers() .get(EXECUTION_PATH_HEADER) .and_then(|value| value.to_str().ok()), Some(EXECUTION_PATH_EXECUTION_RUNTIME_SYNC) ); let response_json: serde_json::Value = response.json().await.expect("body should parse"); assert_eq!( response_json, json!({ "error": { "message": "slow down", "type": "rate_limit_error" } }) ); let seen_execution_runtime_request = seen_execution_runtime .lock() .expect("mutex should lock") .clone() .expect("execution runtime sync should be captured"); assert_eq!( seen_execution_runtime_request.trace_id, "trace-openai-cli-claude-local-error-123" ); assert_eq!( seen_execution_runtime_request.url, "https://api.anthropic.example/custom/v1/messages" ); assert_eq!( seen_execution_runtime_request.authorization, "Bearer sk-upstream-openai-cli-claude" ); assert_eq!( seen_execution_runtime_request.endpoint_tag, "openai-cli-claude-cross-format" ); assert_eq!(seen_execution_runtime_request.model, "claude-code-upstream"); assert!(seen_execution_runtime_request.has_messages); let stored_candidates = request_candidate_repository .list_by_request_id("trace-openai-cli-claude-local-error-123") .await .expect("request candidate trace should read"); assert_eq!(stored_candidates.len(), 1); assert_eq!(stored_candidates[0].status, RequestCandidateStatus::Failed); tokio::time::sleep(std::time::Duration::from_millis(100)).await; assert!( !*seen_report.lock().expect("mutex should lock"), "report-sync should stay local when request candidate persistence is available" ); gateway_handle.abort(); execution_runtime_handle.abort(); upstream_handle.abort(); } #[test] fn gateway_returns_openai_responses_error_for_local_cross_format_claude_chat_sync_failure() { run_cli_sync_test( "gateway_returns_openai_responses_error_for_local_cross_format_claude_chat_sync_failure", gateway_returns_openai_responses_error_for_local_cross_format_claude_chat_sync_failure_impl, ); } async fn gateway_returns_openai_responses_error_for_local_cross_format_claude_chat_sync_failure_impl( ) { #[derive(Debug, Clone)] struct SeenExecutionRuntimeSyncRequest { trace_id: String, url: String, auth_header_value: String, endpoint_tag: String, model: String, has_messages: bool, } fn hash_api_key(value: &str) -> String { let mut hasher = Sha256::new(); hasher.update(value.as_bytes()); format!("{:x}", hasher.finalize()) } fn sample_auth_snapshot(api_key_id: &str, user_id: &str) -> StoredAuthApiKeySnapshot { StoredAuthApiKeySnapshot::new( user_id.to_string(), "alice".to_string(), Some("alice@example.com".to_string()), "user".to_string(), "local".to_string(), true, false, Some(serde_json::json!(["openai", "claude"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), api_key_id.to_string(), Some("default".to_string()), true, false, false, Some(60), Some(5), Some(4_102_444_800_i64), Some(serde_json::json!(["openai", "claude"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), ) .expect("auth snapshot should build") } fn sample_candidate_row() -> StoredMinimalCandidateSelectionRow { StoredMinimalCandidateSelectionRow { provider_id: "provider-openai-cli-claude-chat-local-1".to_string(), provider_name: "claude".to_string(), provider_type: "custom".to_string(), provider_priority: 10, provider_is_active: true, endpoint_id: "endpoint-openai-cli-claude-chat-local-1".to_string(), endpoint_api_format: "claude:messages".to_string(), endpoint_api_family: Some("claude".to_string()), endpoint_kind: Some("chat".to_string()), endpoint_is_active: true, key_id: "key-openai-cli-claude-chat-local-1".to_string(), key_name: "prod".to_string(), key_auth_type: "api_key".to_string(), key_is_active: true, key_api_formats: Some(vec!["claude:messages".to_string()]), key_allowed_models: None, key_capabilities: None, key_internal_priority: 5, key_global_priority_by_format: Some(serde_json::json!({"claude:messages": 1})), model_id: "model-openai-cli-claude-chat-local-1".to_string(), global_model_id: "global-model-openai-cli-claude-chat-local-1".to_string(), global_model_name: "gpt-5".to_string(), global_model_mappings: None, global_model_supports_streaming: Some(true), model_provider_model_name: "claude-sonnet-4-5-upstream".to_string(), model_provider_model_mappings: Some(vec![StoredProviderModelMapping { name: "claude-sonnet-4-5-upstream".to_string(), priority: 1, api_formats: Some(vec!["claude:messages".to_string()]), endpoint_ids: None, }]), model_supports_streaming: Some(true), model_is_active: true, model_is_available: true, } } fn sample_provider_catalog_provider() -> StoredProviderCatalogProvider { StoredProviderCatalogProvider::new( "provider-openai-cli-claude-chat-local-1".to_string(), "claude".to_string(), Some("https://example.com".to_string()), "custom".to_string(), ) .expect("provider should build") .with_transport_fields( true, false, true, None, Some(2), None, Some(20.0), None, None, ) } fn sample_provider_catalog_endpoint() -> StoredProviderCatalogEndpoint { StoredProviderCatalogEndpoint::new( "endpoint-openai-cli-claude-chat-local-1".to_string(), "provider-openai-cli-claude-chat-local-1".to_string(), "claude:messages".to_string(), Some("claude".to_string()), Some("chat".to_string()), true, ) .expect("endpoint should build") .with_transport_fields( "https://api.anthropic.example".to_string(), Some(serde_json::json!([ {"action":"set","key":"x-endpoint-tag","value":"openai-cli-claude-chat-cross-format"} ])), None, Some(2), Some("/custom/v1/messages".to_string()), None, None, None, ) .expect("endpoint transport should build") } fn sample_provider_catalog_key() -> StoredProviderCatalogKey { StoredProviderCatalogKey::new( "key-openai-cli-claude-chat-local-1".to_string(), "provider-openai-cli-claude-chat-local-1".to_string(), "prod".to_string(), "api_key".to_string(), None, true, ) .expect("key should build") .with_transport_fields( Some(serde_json::json!(["claude:messages"])), encrypt_python_fernet_plaintext( DEVELOPMENT_ENCRYPTION_KEY, "sk-upstream-openai-cli-claude-chat", ) .expect("api key should encrypt"), None, None, Some(serde_json::json!({"claude:messages": 1})), None, None, None, None, ) .expect("key transport should build") } let seen_execution_runtime = Arc::new(Mutex::new(None::)); let seen_execution_runtime_clone = Arc::clone(&seen_execution_runtime); let seen_report = Arc::new(Mutex::new(false)); let seen_report_clone = Arc::clone(&seen_report); let request_candidate_repository = Arc::new(InMemoryRequestCandidateRepository::default()); let upstream = Router::new() .route( "/api/internal/gateway/resolve", any(|_request: Request| async move { Json(json!({ "action": "proxy_public", "route_class": "ai_public", "route_family": "openai", "route_kind": "cli", "auth_endpoint_signature": "openai:responses", "execution_runtime_candidate": true, "auth_context": { "user_id": "user-openai-cli-claude-chat-local-error-123", "api_key_id": "key-openai-cli-claude-chat-local-error-123", "access_allowed": true }, "public_path": "/v1/responses" })) }), ) .route( "/api/internal/gateway/report-sync", any(move |request: Request| { let seen_report_inner = Arc::clone(&seen_report_clone); async move { let (_parts, body) = request.into_parts(); let _raw_body = to_bytes(body, usize::MAX).await.expect("body should read"); *seen_report_inner.lock().expect("mutex should lock") = true; Json(json!({"ok": true})) } }), ); let execution_runtime = Router::new().route( "/v1/execute/sync", any(move |request: Request| { let seen_execution_runtime_inner = Arc::clone(&seen_execution_runtime_clone); async move { let (parts, body) = request.into_parts(); let raw_body = to_bytes(body, usize::MAX).await.expect("body should read"); let payload: serde_json::Value = serde_json::from_slice(&raw_body) .expect("execution runtime payload should parse"); *seen_execution_runtime_inner .lock() .expect("mutex should lock") = Some(SeenExecutionRuntimeSyncRequest { trace_id: parts .headers .get(TRACE_ID_HEADER) .and_then(|value| value.to_str().ok()) .unwrap_or_default() .to_string(), url: payload .get("url") .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), auth_header_value: payload .get("headers") .and_then(|value| value.get("x-api-key")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), endpoint_tag: payload .get("headers") .and_then(|value| value.get("x-endpoint-tag")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), model: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("model")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), has_messages: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("messages")) .is_some(), }); Json(json!({ "request_id": "trace-openai-cli-claude-chat-local-error-123", "status_code": 200, "headers": { "content-type": "application/json" }, "body": { "json_body": { "type": "error", "error": { "type": "rate_limit_error", "message": "slow down" } } }, "telemetry": { "elapsed_ms": 22 } })) } }), ); let auth_repository = Arc::new(InMemoryAuthApiKeySnapshotRepository::seed(vec![( Some(hash_api_key("sk-client-openai-cli-claude-chat-error")), sample_auth_snapshot( "key-openai-cli-claude-chat-local-error-123", "user-openai-cli-claude-chat-local-error-123", ), )])); let candidate_selection_repository = Arc::new(InMemoryMinimalCandidateSelectionReadRepository::seed(vec![ sample_candidate_row(), ])); let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed( vec![sample_provider_catalog_provider()], vec![sample_provider_catalog_endpoint()], vec![sample_provider_catalog_key()], )); let (_upstream_url, upstream_handle) = start_server(upstream).await; let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await; let gateway_state = build_state_with_execution_runtime_override(execution_runtime_url.clone()) .with_data_state_for_tests( crate::data::GatewayDataState::with_auth_candidate_selection_provider_catalog_and_request_candidate_repository_for_tests( auth_repository, candidate_selection_repository, provider_catalog_repository, Arc::clone(&request_candidate_repository), DEVELOPMENT_ENCRYPTION_KEY, ), ); let gateway = build_router_with_state(gateway_state); let (gateway_url, gateway_handle) = start_server(gateway).await; let response = reqwest::Client::new() .post(format!("{gateway_url}/v1/responses")) .header(http::header::CONTENT_TYPE, "application/json") .header( http::header::AUTHORIZATION, "Bearer sk-client-openai-cli-claude-chat-error", ) .header(TRACE_ID_HEADER, "trace-openai-cli-claude-chat-local-error-123") .body( "{\"model\":\"gpt-5\",\"input\":\"hello\",\"metadata\":{\"client\":\"desktop-openai-cli\"},\"store\":false}", ) .send() .await .expect("request should succeed"); assert_eq!(response.status(), StatusCode::TOO_MANY_REQUESTS); assert_eq!( response .headers() .get(EXECUTION_PATH_HEADER) .and_then(|value| value.to_str().ok()), Some(EXECUTION_PATH_EXECUTION_RUNTIME_SYNC) ); let response_json: serde_json::Value = response.json().await.expect("body should parse"); assert_eq!( response_json, json!({ "error": { "message": "slow down", "type": "rate_limit_error" } }) ); let seen_execution_runtime_request = seen_execution_runtime .lock() .expect("mutex should lock") .clone() .expect("execution runtime sync should be captured"); assert_eq!( seen_execution_runtime_request.trace_id, "trace-openai-cli-claude-chat-local-error-123" ); assert_eq!( seen_execution_runtime_request.url, "https://api.anthropic.example/custom/v1/messages" ); assert_eq!( seen_execution_runtime_request.auth_header_value, "sk-upstream-openai-cli-claude-chat" ); assert_eq!( seen_execution_runtime_request.endpoint_tag, "openai-cli-claude-chat-cross-format" ); assert_eq!( seen_execution_runtime_request.model, "claude-sonnet-4-5-upstream" ); assert!(seen_execution_runtime_request.has_messages); let stored_candidates = request_candidate_repository .list_by_request_id("trace-openai-cli-claude-chat-local-error-123") .await .expect("request candidate trace should read"); assert_eq!(stored_candidates.len(), 1); assert_eq!(stored_candidates[0].status, RequestCandidateStatus::Failed); tokio::time::sleep(std::time::Duration::from_millis(100)).await; assert!( !*seen_report.lock().expect("mutex should lock"), "report-sync should stay local when request candidate persistence is available" ); gateway_handle.abort(); execution_runtime_handle.abort(); upstream_handle.abort(); } #[test] fn gateway_returns_openai_responses_error_for_local_cross_format_gemini_chat_sync_failure() { run_cli_sync_test( "gateway_returns_openai_responses_error_for_local_cross_format_gemini_chat_sync_failure", gateway_returns_openai_responses_error_for_local_cross_format_gemini_chat_sync_failure_impl, ); } async fn gateway_returns_openai_responses_error_for_local_cross_format_gemini_chat_sync_failure_impl( ) { #[derive(Debug, Clone)] struct SeenExecutionRuntimeSyncRequest { trace_id: String, url: String, auth_header_value: String, endpoint_tag: String, model: String, has_contents: bool, } fn hash_api_key(value: &str) -> String { let mut hasher = Sha256::new(); hasher.update(value.as_bytes()); format!("{:x}", hasher.finalize()) } fn sample_auth_snapshot(api_key_id: &str, user_id: &str) -> StoredAuthApiKeySnapshot { StoredAuthApiKeySnapshot::new( user_id.to_string(), "alice".to_string(), Some("alice@example.com".to_string()), "user".to_string(), "local".to_string(), true, false, Some(serde_json::json!(["openai", "gemini"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), api_key_id.to_string(), Some("default".to_string()), true, false, false, Some(60), Some(5), Some(4_102_444_800_i64), Some(serde_json::json!(["openai", "gemini"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5"])), ) .expect("auth snapshot should build") } fn sample_candidate_row() -> StoredMinimalCandidateSelectionRow { StoredMinimalCandidateSelectionRow { provider_id: "provider-openai-cli-gemini-chat-local-1".to_string(), provider_name: "gemini".to_string(), provider_type: "custom".to_string(), provider_priority: 10, provider_is_active: true, endpoint_id: "endpoint-openai-cli-gemini-chat-local-1".to_string(), endpoint_api_format: "gemini:generate_content".to_string(), endpoint_api_family: Some("gemini".to_string()), endpoint_kind: Some("chat".to_string()), endpoint_is_active: true, key_id: "key-openai-cli-gemini-chat-local-1".to_string(), key_name: "prod".to_string(), key_auth_type: "api_key".to_string(), key_is_active: true, key_api_formats: Some(vec!["gemini:generate_content".to_string()]), key_allowed_models: None, key_capabilities: None, key_internal_priority: 5, key_global_priority_by_format: Some(serde_json::json!({"gemini:generate_content": 1})), model_id: "model-openai-cli-gemini-chat-local-1".to_string(), global_model_id: "global-model-openai-cli-gemini-chat-local-1".to_string(), global_model_name: "gpt-5".to_string(), global_model_mappings: None, global_model_supports_streaming: Some(true), model_provider_model_name: "gemini-2.5-pro-upstream".to_string(), model_provider_model_mappings: Some(vec![StoredProviderModelMapping { name: "gemini-2.5-pro-upstream".to_string(), priority: 1, api_formats: Some(vec!["gemini:generate_content".to_string()]), endpoint_ids: None, }]), model_supports_streaming: Some(true), model_is_active: true, model_is_available: true, } } fn sample_provider_catalog_provider() -> StoredProviderCatalogProvider { StoredProviderCatalogProvider::new( "provider-openai-cli-gemini-chat-local-1".to_string(), "gemini".to_string(), Some("https://example.com".to_string()), "custom".to_string(), ) .expect("provider should build") .with_transport_fields( true, false, true, None, Some(2), None, Some(20.0), None, None, ) } fn sample_provider_catalog_endpoint() -> StoredProviderCatalogEndpoint { StoredProviderCatalogEndpoint::new( "endpoint-openai-cli-gemini-chat-local-1".to_string(), "provider-openai-cli-gemini-chat-local-1".to_string(), "gemini:generate_content".to_string(), Some("gemini".to_string()), Some("chat".to_string()), true, ) .expect("endpoint should build") .with_transport_fields( "https://generativelanguage.googleapis.com".to_string(), Some(serde_json::json!([ {"action":"set","key":"x-endpoint-tag","value":"openai-cli-gemini-chat-cross-format"} ])), None, Some(2), Some("/custom/v1beta/models/gemini-2.5-pro-upstream:generateContent".to_string()), None, None, None, ) .expect("endpoint transport should build") } fn sample_provider_catalog_key() -> StoredProviderCatalogKey { StoredProviderCatalogKey::new( "key-openai-cli-gemini-chat-local-1".to_string(), "provider-openai-cli-gemini-chat-local-1".to_string(), "prod".to_string(), "api_key".to_string(), None, true, ) .expect("key should build") .with_transport_fields( Some(serde_json::json!(["gemini:generate_content"])), encrypt_python_fernet_plaintext( DEVELOPMENT_ENCRYPTION_KEY, "sk-upstream-openai-cli-gemini-chat", ) .expect("api key should encrypt"), None, None, Some(serde_json::json!({"gemini:generate_content": 1})), None, None, None, None, ) .expect("key transport should build") } let seen_execution_runtime = Arc::new(Mutex::new(None::)); let seen_execution_runtime_clone = Arc::clone(&seen_execution_runtime); let seen_report = Arc::new(Mutex::new(false)); let seen_report_clone = Arc::clone(&seen_report); let request_candidate_repository = Arc::new(InMemoryRequestCandidateRepository::default()); let upstream = Router::new() .route( "/api/internal/gateway/resolve", any(|_request: Request| async move { Json(json!({ "action": "proxy_public", "route_class": "ai_public", "route_family": "openai", "route_kind": "cli", "auth_endpoint_signature": "openai:responses", "execution_runtime_candidate": true, "auth_context": { "user_id": "user-openai-cli-gemini-chat-local-error-123", "api_key_id": "key-openai-cli-gemini-chat-local-error-123", "access_allowed": true }, "public_path": "/v1/responses" })) }), ) .route( "/api/internal/gateway/report-sync", any(move |request: Request| { let seen_report_inner = Arc::clone(&seen_report_clone); async move { let (_parts, body) = request.into_parts(); let _raw_body = to_bytes(body, usize::MAX).await.expect("body should read"); *seen_report_inner.lock().expect("mutex should lock") = true; Json(json!({"ok": true})) } }), ); let execution_runtime = Router::new().route( "/v1/execute/sync", any(move |request: Request| { let seen_execution_runtime_inner = Arc::clone(&seen_execution_runtime_clone); async move { let (parts, body) = request.into_parts(); let raw_body = to_bytes(body, usize::MAX).await.expect("body should read"); let payload: serde_json::Value = serde_json::from_slice(&raw_body) .expect("execution runtime payload should parse"); *seen_execution_runtime_inner .lock() .expect("mutex should lock") = Some(SeenExecutionRuntimeSyncRequest { trace_id: parts .headers .get(TRACE_ID_HEADER) .and_then(|value| value.to_str().ok()) .unwrap_or_default() .to_string(), url: payload .get("url") .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), auth_header_value: payload .get("headers") .and_then(|value| value.get("x-goog-api-key")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), endpoint_tag: payload .get("headers") .and_then(|value| value.get("x-endpoint-tag")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), model: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("model")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), has_contents: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("contents")) .is_some(), }); Json(json!({ "request_id": "trace-openai-cli-gemini-chat-local-error-123", "status_code": 200, "headers": { "content-type": "application/json" }, "body": { "json_body": { "error": { "message": "quota reached", "status": "RESOURCE_EXHAUSTED" } } }, "telemetry": { "elapsed_ms": 23 } })) } }), ); let auth_repository = Arc::new(InMemoryAuthApiKeySnapshotRepository::seed(vec![( Some(hash_api_key("sk-client-openai-cli-gemini-chat-error")), sample_auth_snapshot( "key-openai-cli-gemini-chat-local-error-123", "user-openai-cli-gemini-chat-local-error-123", ), )])); let candidate_selection_repository = Arc::new(InMemoryMinimalCandidateSelectionReadRepository::seed(vec![ sample_candidate_row(), ])); let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed( vec![sample_provider_catalog_provider()], vec![sample_provider_catalog_endpoint()], vec![sample_provider_catalog_key()], )); let (_upstream_url, upstream_handle) = start_server(upstream).await; let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await; let gateway_state = build_state_with_execution_runtime_override(execution_runtime_url.clone()) .with_data_state_for_tests( crate::data::GatewayDataState::with_auth_candidate_selection_provider_catalog_and_request_candidate_repository_for_tests( auth_repository, candidate_selection_repository, provider_catalog_repository, Arc::clone(&request_candidate_repository), DEVELOPMENT_ENCRYPTION_KEY, ), ); let gateway = build_router_with_state(gateway_state); let (gateway_url, gateway_handle) = start_server(gateway).await; let response = reqwest::Client::new() .post(format!("{gateway_url}/v1/responses")) .header(http::header::CONTENT_TYPE, "application/json") .header( http::header::AUTHORIZATION, "Bearer sk-client-openai-cli-gemini-chat-error", ) .header(TRACE_ID_HEADER, "trace-openai-cli-gemini-chat-local-error-123") .body( "{\"model\":\"gpt-5\",\"input\":\"hello\",\"metadata\":{\"client\":\"desktop-openai-cli\"},\"store\":false}", ) .send() .await .expect("request should succeed"); assert_eq!(response.status(), StatusCode::TOO_MANY_REQUESTS); assert_eq!( response .headers() .get(EXECUTION_PATH_HEADER) .and_then(|value| value.to_str().ok()), Some(EXECUTION_PATH_EXECUTION_RUNTIME_SYNC) ); let response_json: serde_json::Value = response.json().await.expect("body should parse"); assert_eq!( response_json, json!({ "error": { "message": "quota reached", "type": "rate_limit_error", "code": "RESOURCE_EXHAUSTED" } }) ); let seen_execution_runtime_request = seen_execution_runtime .lock() .expect("mutex should lock") .clone() .expect("execution runtime sync should be captured"); assert_eq!( seen_execution_runtime_request.trace_id, "trace-openai-cli-gemini-chat-local-error-123" ); assert_eq!( seen_execution_runtime_request.url, "https://generativelanguage.googleapis.com/custom/v1beta/models/gemini-2.5-pro-upstream:generateContent" ); assert_eq!( seen_execution_runtime_request.auth_header_value, "sk-upstream-openai-cli-gemini-chat" ); assert_eq!( seen_execution_runtime_request.endpoint_tag, "openai-cli-gemini-chat-cross-format" ); assert_eq!( seen_execution_runtime_request.model, "gemini-2.5-pro-upstream" ); assert!(seen_execution_runtime_request.has_contents); let stored_candidates = request_candidate_repository .list_by_request_id("trace-openai-cli-gemini-chat-local-error-123") .await .expect("request candidate trace should read"); assert_eq!(stored_candidates.len(), 1); assert_eq!(stored_candidates[0].status, RequestCandidateStatus::Failed); tokio::time::sleep(std::time::Duration::from_millis(100)).await; assert!( !*seen_report.lock().expect("mutex should lock"), "report-sync should stay local when request candidate persistence is available" ); gateway_handle.abort(); execution_runtime_handle.abort(); upstream_handle.abort(); } #[test] fn gateway_executes_codex_cli_sync_via_local_decision_gate_after_oauth_refresh() { run_cli_sync_test( "gateway_executes_codex_cli_sync_via_local_decision_gate_after_oauth_refresh", gateway_executes_codex_cli_sync_via_local_decision_gate_after_oauth_refresh_impl, ); } async fn gateway_executes_codex_cli_sync_via_local_decision_gate_after_oauth_refresh_impl() { #[derive(Debug, Clone)] struct SeenExecutionRuntimeSyncRequest { trace_id: String, url: String, model: String, authorization: String, x_client_request_id: String, session_id: String, thread_id: String, prompt_cache_key: String, stream_present: bool, plan_stream: bool, } #[derive(Debug, Clone)] struct SeenRefreshRequest { content_type: String, body: String, } fn hash_api_key(value: &str) -> String { let mut hasher = Sha256::new(); hasher.update(value.as_bytes()); format!("{:x}", hasher.finalize()) } fn sample_auth_snapshot(api_key_id: &str, user_id: &str) -> StoredAuthApiKeySnapshot { StoredAuthApiKeySnapshot::new( user_id.to_string(), "alice".to_string(), Some("alice@example.com".to_string()), "user".to_string(), "local".to_string(), true, false, Some(serde_json::json!(["openai", "codex"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5.4"])), api_key_id.to_string(), Some("default".to_string()), true, false, false, Some(60), Some(5), Some(4_102_444_800_i64), Some(serde_json::json!(["openai", "codex"])), Some(serde_json::json!(["openai:responses"])), Some(serde_json::json!(["gpt-5.4"])), ) .expect("auth snapshot should build") } fn sample_candidate_row() -> StoredMinimalCandidateSelectionRow { StoredMinimalCandidateSelectionRow { provider_id: "provider-codex-cli-local-1".to_string(), provider_name: "codex".to_string(), provider_type: "codex".to_string(), provider_priority: 10, provider_is_active: true, endpoint_id: "endpoint-codex-cli-local-1".to_string(), endpoint_api_format: "openai:responses".to_string(), endpoint_api_family: Some("openai".to_string()), endpoint_kind: Some("cli".to_string()), endpoint_is_active: true, key_id: "key-codex-cli-local-1".to_string(), key_name: "oauth".to_string(), key_auth_type: "oauth".to_string(), key_is_active: true, key_api_formats: Some(vec!["openai:responses".to_string()]), key_allowed_models: None, key_capabilities: None, key_internal_priority: 5, key_global_priority_by_format: Some(serde_json::json!({"openai:responses": 1})), model_id: "model-codex-cli-local-1".to_string(), global_model_id: "global-model-codex-cli-local-1".to_string(), global_model_name: "gpt-5.4".to_string(), global_model_mappings: None, global_model_supports_streaming: Some(true), model_provider_model_name: "gpt-5.4".to_string(), model_provider_model_mappings: Some(vec![StoredProviderModelMapping { name: "gpt-5.4".to_string(), priority: 1, api_formats: Some(vec!["openai:responses".to_string()]), endpoint_ids: None, }]), model_supports_streaming: Some(true), model_is_active: true, model_is_available: true, } } fn sample_provider_catalog_provider() -> StoredProviderCatalogProvider { StoredProviderCatalogProvider::new( "provider-codex-cli-local-1".to_string(), "codex".to_string(), Some("https://chatgpt.com".to_string()), "codex".to_string(), ) .expect("provider should build") .with_transport_fields( true, false, false, None, Some(2), None, Some(20.0), None, None, ) } fn sample_provider_catalog_endpoint() -> StoredProviderCatalogEndpoint { StoredProviderCatalogEndpoint::new( "endpoint-codex-cli-local-1".to_string(), "provider-codex-cli-local-1".to_string(), "openai:responses".to_string(), Some("openai".to_string()), Some("cli".to_string()), true, ) .expect("endpoint should build") .with_transport_fields( "https://chatgpt.com/backend-api/codex".to_string(), None, None, Some(2), None, None, None, None, ) .expect("endpoint transport should build") } fn sample_provider_catalog_key() -> StoredProviderCatalogKey { let encrypted_auth_config = encrypt_python_fernet_plaintext( DEVELOPMENT_ENCRYPTION_KEY, r#"{"provider_type":"codex","refresh_token":"rt-codex-local-123"}"#, ) .expect("auth config should encrypt"); StoredProviderCatalogKey::new( "key-codex-cli-local-1".to_string(), "provider-codex-cli-local-1".to_string(), "oauth".to_string(), "oauth".to_string(), None, true, ) .expect("key should build") .with_transport_fields( Some(serde_json::json!(["openai:responses"])), encrypt_python_fernet_plaintext(DEVELOPMENT_ENCRYPTION_KEY, "__placeholder__") .expect("placeholder api key should encrypt"), Some(encrypted_auth_config), None, Some(serde_json::json!({"openai:responses": 1})), None, None, None, None, ) .expect("key transport should build") } let seen_execution_runtime = Arc::new(Mutex::new(None::)); let seen_execution_runtime_clone = Arc::clone(&seen_execution_runtime); let seen_report = Arc::new(Mutex::new(false)); let seen_report_clone = Arc::clone(&seen_report); let seen_refresh = Arc::new(Mutex::new(None::)); let seen_refresh_clone = Arc::clone(&seen_refresh); let refresh_hits = Arc::new(Mutex::new(0usize)); let refresh_hits_clone = Arc::clone(&refresh_hits); let decision_hits = Arc::new(Mutex::new(0usize)); let decision_hits_clone = Arc::clone(&decision_hits); let plan_hits = Arc::new(Mutex::new(0usize)); let plan_hits_clone = Arc::clone(&plan_hits); let public_hits = Arc::new(Mutex::new(0usize)); let public_hits_clone = Arc::clone(&public_hits); let upstream = Router::new() .route( "/api/internal/gateway/decision-sync", any(move |_request: Request| { let decision_hits_inner = Arc::clone(&decision_hits_clone); async move { *decision_hits_inner.lock().expect("mutex should lock") += 1; Json(json!({"action": "proxy_public"})) } }), ) .route( "/api/internal/gateway/plan-sync", any(move |_request: Request| { let plan_hits_inner = Arc::clone(&plan_hits_clone); async move { *plan_hits_inner.lock().expect("mutex should lock") += 1; Json(json!({"action": "proxy_public"})) } }), ) .route( "/api/internal/gateway/report-sync", any(move |request: Request| { let seen_report_inner = Arc::clone(&seen_report_clone); async move { let (_parts, body) = request.into_parts(); let _raw_body = to_bytes(body, usize::MAX).await.expect("body should read"); *seen_report_inner.lock().expect("mutex should lock") = true; Json(json!({"ok": true})) } }), ) .route( "/v1/responses", any(move |_request: Request| { let public_hits_inner = Arc::clone(&public_hits_clone); async move { *public_hits_inner.lock().expect("mutex should lock") += 1; Json(json!({"unexpected": true})) } }), ); let refresh = Router::new().route( "/oauth/token", any(move |request: Request| { let seen_refresh_inner = Arc::clone(&seen_refresh_clone); let refresh_hits_inner = Arc::clone(&refresh_hits_clone); async move { *refresh_hits_inner.lock().expect("mutex should lock") += 1; let (parts, body) = request.into_parts(); let raw_body = to_bytes(body, usize::MAX).await.expect("body should read"); *seen_refresh_inner.lock().expect("mutex should lock") = Some(SeenRefreshRequest { content_type: parts .headers .get(http::header::CONTENT_TYPE) .and_then(|value| value.to_str().ok()) .unwrap_or_default() .to_string(), body: String::from_utf8(raw_body.to_vec()) .expect("refresh body should be utf8"), }); Json(json!({ "access_token": "refreshed-codex-access-token", "refresh_token": "rt-codex-local-456", "token_type": "Bearer", "expires_in": 3600 })) } }), ); let execution_runtime = Router::new().route( "/v1/execute/sync", any(move |request: Request| { let seen_execution_runtime_inner = Arc::clone(&seen_execution_runtime_clone); async move { let (parts, body) = request.into_parts(); let raw_body = to_bytes(body, usize::MAX).await.expect("body should read"); let payload: serde_json::Value = serde_json::from_slice(&raw_body) .expect("execution runtime payload should parse"); *seen_execution_runtime_inner .lock() .expect("mutex should lock") = Some(SeenExecutionRuntimeSyncRequest { trace_id: parts .headers .get(TRACE_ID_HEADER) .and_then(|value| value.to_str().ok()) .unwrap_or_default() .to_string(), url: payload .get("url") .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), model: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("model")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), authorization: payload .get("headers") .and_then(|value| value.get("authorization")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), x_client_request_id: payload .get("headers") .and_then(|value| value.get("x-client-request-id")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), session_id: payload .get("headers") .and_then(|value| value.get("session-id")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), thread_id: payload .get("headers") .and_then(|value| value.get("thread-id")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), prompt_cache_key: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("prompt_cache_key")) .and_then(|value| value.as_str()) .unwrap_or_default() .to_string(), stream_present: payload .get("body") .and_then(|value| value.get("json_body")) .and_then(|value| value.get("stream")) .and_then(|value| value.as_bool()) .unwrap_or(false), plan_stream: payload .get("stream") .and_then(|value| value.as_bool()) .unwrap_or(false), }); Json(json!({ "request_id": "trace-codex-cli-local-123", "status_code": 200, "headers": { "content-type": "text/event-stream" }, "body": { "body_bytes_b64": base64::engine::general_purpose::STANDARD.encode( concat!( "event: response.created\n", "data: {\"type\":\"response.created\",\"response\":{\"id\":\"resp-codex-local-123\",\"object\":\"response\",\"model\":\"gpt-5.4\",\"status\":\"in_progress\",\"output\":[]}}\n\n", "event: response.output_text.delta\n", "data: {\"type\":\"response.output_text.delta\",\"output_index\":0,\"content_index\":0,\"delta\":\"Hello from Codex\"}\n\n", "event: response.completed\n", "data: {\"type\":\"response.completed\",\"response\":{\"id\":\"resp-codex-local-123\",\"object\":\"response\",\"model\":\"gpt-5.4\",\"status\":\"completed\",\"output\":[],\"usage\":{\"input_tokens\":1,\"output_tokens\":2,\"total_tokens\":3}}}\n\n" ) ) }, "telemetry": { "elapsed_ms": 37 } })) } }), ); let client_api_key = "sk-client-codex-cli-local"; let auth_repository = Arc::new(InMemoryAuthApiKeySnapshotRepository::seed(vec![( Some(hash_api_key(client_api_key)), sample_auth_snapshot("key-codex-cli-local-123", "user-codex-cli-local-123"), )])); let candidate_selection_repository = Arc::new(InMemoryMinimalCandidateSelectionReadRepository::seed(vec![ sample_candidate_row(), ])); let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed( vec![sample_provider_catalog_provider()], vec![sample_provider_catalog_endpoint()], vec![sample_provider_catalog_key()], )); let (upstream_url, upstream_handle) = start_server(upstream).await; let (refresh_url, refresh_handle) = start_server(refresh).await; let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await; let oauth_refresh = crate::provider_transport::LocalOAuthRefreshCoordinator::with_adapters_for_tests(vec![ Arc::new( crate::provider_transport::oauth_refresh::GenericOAuthRefreshAdapter::default() .with_token_url_for_tests("codex", format!("{refresh_url}/oauth/token")), ), ]); let gateway_state = build_state_with_execution_runtime_override(execution_runtime_url.clone()) .with_data_state_for_tests( crate::data::GatewayDataState::with_auth_candidate_selection_provider_catalog_and_request_candidate_repository_for_tests( auth_repository.clone(), candidate_selection_repository.clone(), provider_catalog_repository.clone(), Arc::new(InMemoryRequestCandidateRepository::default()), DEVELOPMENT_ENCRYPTION_KEY, ), ) .with_oauth_refresh_coordinator_for_tests(oauth_refresh); let gateway = build_router_with_state(gateway_state); let (gateway_url, gateway_handle) = start_server(gateway).await; let response = reqwest::Client::new() .post(format!("{gateway_url}/v1/responses")) .header(http::header::CONTENT_TYPE, "application/json") .header( http::header::AUTHORIZATION, format!("Bearer {client_api_key}"), ) .header(TRACE_ID_HEADER, "trace-codex-cli-local-123") .body("{\"model\":\"gpt-5.4\",\"input\":\"hello\"}") .send() .await .expect("request should succeed"); assert_eq!(response.status(), StatusCode::OK); let response_json: serde_json::Value = response.json().await.expect("body should parse"); assert_eq!(response_json["id"], "resp-codex-local-123"); assert_eq!( response_json["output"][0]["content"][0]["text"], "Hello from Codex" ); let seen_refresh_request = seen_refresh .lock() .expect("mutex should lock") .clone() .expect("refresh request should be captured"); assert_eq!( seen_refresh_request.content_type, "application/x-www-form-urlencoded" ); assert!(seen_refresh_request .body .contains("grant_type=refresh_token")); assert!(seen_refresh_request .body .contains("client_id=app_EMoamEEZ73f0CkXaXp7hrann")); assert!(seen_refresh_request .body .contains("refresh_token=rt-codex-local-123")); assert_eq!(*refresh_hits.lock().expect("mutex should lock"), 1); let seen_execution_runtime_request = seen_execution_runtime .lock() .expect("mutex should lock") .clone() .expect("execution runtime sync should be captured"); assert_eq!( seen_execution_runtime_request.trace_id, "trace-codex-cli-local-123" ); assert_eq!( seen_execution_runtime_request.url, "https://chatgpt.com/backend-api/codex/responses" ); assert_eq!(seen_execution_runtime_request.model, "gpt-5.4"); assert_eq!( seen_execution_runtime_request.authorization, "Bearer refreshed-codex-access-token" ); assert_eq!( seen_execution_runtime_request.x_client_request_id, seen_execution_runtime_request.thread_id ); assert_eq!( seen_execution_runtime_request.session_id, seen_execution_runtime_request.thread_id ); assert!(seen_execution_runtime_request.prompt_cache_key.is_empty()); assert_ne!( seen_execution_runtime_request.thread_id, seen_execution_runtime_request.trace_id ); assert!(seen_execution_runtime_request.stream_present); assert!(seen_execution_runtime_request.plan_stream); tokio::time::sleep(std::time::Duration::from_millis(100)).await; assert!( !*seen_report.lock().expect("mutex should lock"), "report-sync should stay local when request candidate persistence is available" ); assert_eq!(*decision_hits.lock().expect("mutex should lock"), 0); assert_eq!(*plan_hits.lock().expect("mutex should lock"), 0); assert_eq!(*public_hits.lock().expect("mutex should lock"), 0); let persisted_transport_state = crate::data::GatewayDataState::with_provider_transport_reader_for_tests( provider_catalog_repository.clone(), DEVELOPMENT_ENCRYPTION_KEY, ); let persisted_transport = persisted_transport_state .read_provider_transport_snapshot( "provider-codex-cli-local-1", "endpoint-codex-cli-local-1", "key-codex-cli-local-1", ) .await .expect("provider transport should read") .expect("provider transport should exist"); assert_eq!( persisted_transport.key.decrypted_api_key, "refreshed-codex-access-token" ); assert!(persisted_transport.key.expires_at_unix_secs.is_some()); let persisted_auth_config: serde_json::Value = serde_json::from_str( persisted_transport .key .decrypted_auth_config .as_deref() .expect("persisted auth config should exist"), ) .expect("persisted auth config should parse"); assert_eq!(persisted_auth_config["provider_type"], "codex"); assert_eq!(persisted_auth_config["refresh_token"], "rt-codex-local-456"); assert_eq!(persisted_auth_config["token_type"], "Bearer"); assert!(persisted_auth_config["updated_at"].as_u64().is_some()); assert_eq!( persisted_auth_config["expires_at"].as_u64(), persisted_transport.key.expires_at_unix_secs ); *seen_execution_runtime.lock().expect("mutex should lock") = None; *seen_report.lock().expect("mutex should lock") = false; gateway_handle.abort(); let oauth_refresh = crate::provider_transport::LocalOAuthRefreshCoordinator::with_adapters_for_tests(vec![ Arc::new( crate::provider_transport::oauth_refresh::GenericOAuthRefreshAdapter::default() .with_token_url_for_tests("codex", format!("{refresh_url}/oauth/token")), ), ]); let gateway_state = build_state_with_execution_runtime_override(execution_runtime_url.clone()) .with_data_state_for_tests( crate::data::GatewayDataState::with_auth_candidate_selection_provider_catalog_and_request_candidate_repository_for_tests( auth_repository, candidate_selection_repository, provider_catalog_repository, Arc::new(InMemoryRequestCandidateRepository::default()), DEVELOPMENT_ENCRYPTION_KEY, ), ) .with_oauth_refresh_coordinator_for_tests(oauth_refresh); let gateway = build_router_with_state(gateway_state); let (gateway_url, gateway_handle) = start_server(gateway).await; let response = reqwest::Client::new() .post(format!("{gateway_url}/v1/responses")) .header(http::header::CONTENT_TYPE, "application/json") .header( http::header::AUTHORIZATION, format!("Bearer {client_api_key}"), ) .header(TRACE_ID_HEADER, "trace-codex-cli-local-456") .body("{\"model\":\"gpt-5.4\",\"input\":\"hello again\"}") .send() .await .expect("second request should succeed"); assert_eq!(response.status(), StatusCode::OK); let response_json: serde_json::Value = response.json().await.expect("body should parse"); assert_eq!(response_json["id"], "resp-codex-local-123"); assert_eq!(*refresh_hits.lock().expect("mutex should lock"), 1); let seen_execution_runtime_request = seen_execution_runtime .lock() .expect("mutex should lock") .clone() .expect("second execution runtime sync should be captured"); assert_eq!( seen_execution_runtime_request.trace_id, "trace-codex-cli-local-456" ); assert_eq!( seen_execution_runtime_request.authorization, "Bearer refreshed-codex-access-token" ); assert!(seen_execution_runtime_request.stream_present); assert!(seen_execution_runtime_request.plan_stream); tokio::time::sleep(std::time::Duration::from_millis(100)).await; assert!( !*seen_report.lock().expect("mutex should lock"), "second report-sync should stay local when request candidate persistence is available" ); gateway_handle.abort(); execution_runtime_handle.abort(); refresh_handle.abort(); upstream_handle.abort(); }