dayuan.jiang 55a32af76a fix(security): keep EdgeOne cookies and the access code on this site ...

Two issues from before the provider refactor, found by its review.

The redirect guard dropped Authorization, cookies and the providers' key
headers when a redirect left the origin, but kept x-access-code, this site's
own access code; it is dropped too now.

edgeOneEndpoint took the request's Origin header as the site's address.
Behind a proxy the request URL is the internal one and Origin is the site's,
so Origin still wins, but only when its host matches Host or
X-Forwarded-Host; a request carrying another site's Origin now gets the
request's own origin, so the EdgeOne cookies and the access code never travel
to that site.

2026-10-12 21:17:51 +09:00

..

__snapshots__

fix(providers): apply the review of PR #988

2026-10-12 21:17:51 +09:00

admin-providers-route.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

admin-providers.test.ts

fix(providers): apply the review of PR #988

2026-10-12 21:17:51 +09:00

admin-secret-input.test.tsx

feat: MCP feature parity, the web app on the MCP core, and provider fixes (#951)

2026-10-05 22:39:32 +09:00

admin-settings.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

admin-test-model.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

ai-providers-cache.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

ai-providers-credentials.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

ai-providers-google.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

ai-providers-openai.test.ts

feat: MCP feature parity, the web app on the MCP core, and provider fixes (#951)

2026-10-05 22:39:32 +09:00

ai-providers.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

api-access-code.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

base-url.test.ts

fix(ollama): send chat requests to the /api path (#954)

2026-10-06 09:37:05 +09:00

bedrock-api-key.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

cached-responses.test.ts

feat: MCP feature parity, the web app on the MCP core, and provider fixes (#951)

2026-10-05 22:39:32 +09:00

canvas-import-boundary.test.ts

feat(mcp-server): the preview is the web app's canvas: same-origin draw.io, version cards, get_selection (#984)

2026-10-11 21:27:11 +09:00

chat-helpers.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

chat-route-abort.test.ts

fix(chat): use the AI SDK's own mechanisms for quota, retries, stops and notices (#987)

2026-10-12 12:58:52 +09:00

chat-route-edgeone.test.ts

fix(security): keep EdgeOne cookies and the access code on this site

2026-10-12 21:17:51 +09:00

chat-route-errors.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

chat-route-quota.test.ts

fix(chat): use the AI SDK's own mechanisms for quota, retries, stops and notices (#987)

2026-10-12 12:58:52 +09:00

client-ip.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

compact-cells.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

cross-site-requests.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

deprecated-params.test.ts

feat: MCP feature parity, the web app on the MCP core, and provider fixes (#951)

2026-10-05 22:39:32 +09:00

diagram-context-exports.test.tsx

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

diagram-context.test.tsx

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

diagram-diff.test.ts

fix(chat): the AI reads and draws the page the user is viewing (#974)

2026-10-10 23:30:51 +09:00

diagram-pages.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

diagram-validator.test.ts

Add VLM-based diagram validation (#602)

2026-01-20 20:52:04 +09:00

edgeone-function.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

llm-errors.test.ts

feat(chat): show a quota hint when the server's key is refused (#953)

2026-10-06 09:49:48 +09:00

log-save-route.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

mcp-core.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

mcp-node-versions.test.tsx

feat(mcp-server): the preview is the web app's canvas: same-origin draw.io, version cards, get_selection (#984)

2026-10-11 21:27:11 +09:00

mcp-preview-history.test.ts

feat(mcp-server): the preview is the web app's canvas: same-origin draw.io, version cards, get_selection (#984)

2026-10-11 21:27:11 +09:00

mcp-preview-recovery.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

mcp-shell-config.test.ts

feat(mcp-server): the preview is the web app's canvas: same-origin draw.io, version cards, get_selection (#984)

2026-10-11 21:27:11 +09:00

mcp-sync-core.test.ts

feat(mcp-server): the preview is the web app's canvas: same-origin draw.io, version cards, get_selection (#984)

2026-10-11 21:27:11 +09:00

model-catalog.test.ts

feat: MCP feature parity, the web app on the MCP core, and provider fixes (#951)

2026-10-05 22:39:32 +09:00

output-token-limit.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

parse-url-route.test.ts

feat: MCP feature parity, the web app on the MCP core, and provider fixes (#951)

2026-10-05 22:39:32 +09:00

pdf-utils.test.ts

feat: MCP feature parity, the web app on the MCP core, and provider fixes (#951)

2026-10-05 22:39:32 +09:00

port-manager.test.ts

feat: MCP feature parity, the web app on the MCP core, and provider fixes (#951)

2026-10-05 22:39:32 +09:00

provider-matrix.test.ts

fix(providers): apply the review of PR #988

2026-10-12 21:17:51 +09:00

provider-models.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

provider-setup.test.ts

fix(providers): apply the review of PR #988

2026-10-12 21:17:51 +09:00

providers.test.ts

fix(providers): apply the review of PR #988

2026-10-12 21:17:51 +09:00

redesign-helpers.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

server-credentials.test.ts

fix(providers): apply the review of PR #988

2026-10-12 21:17:51 +09:00

server-model-config.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

short-model-name.test.ts

feat(ui): canvas-first redesign with a self-hosted draw.io (#957)

2026-10-08 16:20:15 +09:00

ssrf-protection.test.ts

fix(security): keep EdgeOne cookies and the access code on this site

2026-10-12 21:17:51 +09:00

style-classes.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

template-storage.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

tool-activity.test.tsx

feat(ui): canvas-first redesign with a self-hosted draw.io (#957)

2026-10-08 16:20:15 +09:00

url-utils.test.ts

feat: MCP feature parity, the web app on the MCP core, and provider fixes (#951)

2026-10-05 22:39:32 +09:00

use-diagram-streaming.test.tsx

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

use-diagram-tool-handlers.test.tsx

fix(chat): the AI reads and draws the page the user is viewing (#974)

2026-10-10 23:30:51 +09:00

use-file-processor.test.tsx

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

use-model-config.test.tsx

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

use-session-manager.test.tsx

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

utils.test.ts

refactor: remove dead code and over-engineering found by two audits (#986)

2026-10-12 12:35:55 +09:00

validate-diagram-route.test.ts

fix(chat): use the AI SDK's own mechanisms for quota, retries, stops and notices (#987)

2026-10-12 12:58:52 +09:00

validate-model-bedrock.test.ts

feat(ui): canvas-first redesign with a self-hosted draw.io (#957)

2026-10-08 16:20:15 +09:00

validate-model-route.test.ts

refactor(providers): the UI, the connection test and the routes read the record's fields

2026-10-12 21:17:51 +09:00

version-card.test.tsx

feat(mcp-server): the preview is the web app's canvas: same-origin draw.io, version cards, get_selection (#984)

2026-10-11 21:27:11 +09:00