Files
yetone a8d798e2cb gateway, provider tests: the tests stay off the network (testenv.Offline in their TestMains) — after 555f5706 (#1016) routing reads a plan key's quota windows, and a test whose provider has a vendor's real base URL and a made-up key would ask the vendor in the background. Routing's own read (keyAllowance, allowances) was already stubbed in routing_test.go's init, and a survey with a dial guard found no plan-key dial, but it found others: every plugin host's first start fetched models.dev's catalog (65 dials in the gateway's plugin tests), and provider tests asked api.github.com (TestSubscriptionUsageEachAccount, TestSubscriptionUsageServesStale), chatgpt.com (TestCopilotQuotaWithoutEditorsSignIn), server.codeium.com (TestDevinSignedInOnlyInMagpie) and decide.test (TestModelTest) with made-up accounts; each passed whether the vendor answered or not. internal/testenv's Offline wraps http.DefaultTransport's DialContext (so http.DefaultClient and every transport cloned from it later): localhost, *.localhost, loopback and unspecified addresses are dialled, anything else is refused before it is looked up, said once per address on stderr ("testenv: a test asked models.dev:443, refused: tests stay off the network"). internal/gateway's TestMain and internal/provider's (kiro_main_test.go, in RunIn's setup) call it before the tests run. TestLocal (the address table) and TestOffline (a loopback httptest server answers through DefaultClient; models.dev is refused through it and through a Clone made after the call) pass -race -count=3. go test -race -tags nogui -timeout 30m ./internal/testenv ./internal/provider ./internal/gateway passes under a temp HOME (gateway 516 s). The gateway and provider test binaries were then run under sandbox-exec with every non-loopback network-outbound denied, with the kernel's Sandbox reports streamed: both PASS, Offline refused only the six addresses above, and the kernel reported no denial, so no transport outside DefaultTransport reaches the network either. go vet, gofmt -l, linux and windows (nogui) builds pass. Tests only.
2026-10-06 21:08:57 +08:00

45 lines
1.4 KiB
Go

package testenv
import (
"net/http"
"net/http/httptest"
"strings"
"testing"
)
func TestLocal(t *testing.T) {
for addr, want := range map[string]bool{
"127.0.0.1:80": true, "[::1]:443": true, "localhost:3425": true, "LOCALHOST.:1": true,
"magpie.localhost:80": true, "0.0.0.0:80": true, "[::]:80": true, "127.8.0.1:9": true,
"models.dev:443": false, "api.kimi.com:443": false, "10.0.0.132:22": false,
"192.168.1.2:80": false, "localhost.example.com:80": false, "decide.test:443": false,
} {
if got := local(addr); got != want {
t.Errorf("local(%q) = %v, want %v", addr, got, want)
}
}
}
// Offline lets a loopback server answer through http.DefaultClient and
// refuses a vendor's host without dialing it.
func TestOffline(t *testing.T) {
tr := http.DefaultTransport.(*http.Transport)
was := tr.DialContext
t.Cleanup(func() { tr.DialContext = was })
Offline()
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Write([]byte("here")) }))
defer srv.Close()
resp, err := http.Get(srv.URL)
if err != nil {
t.Fatalf("loopback refused: %v", err)
}
resp.Body.Close()
clone := tr.Clone() // a transport made from it after the call
for _, c := range []*http.Client{http.DefaultClient, {Transport: clone}} {
_, err := c.Get("https://models.dev/api.json")
if err == nil || !strings.Contains(err.Error(), "tests stay off the network") {
t.Errorf("models.dev: %v", err)
}
}
}