okooooooo/magpie
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
c06a550b73680289d5a94de7a412356d4040297d
magpie/gateway_keys_cli_test.go
T
july_lu 47c2382467 gateway: a gateway key can be held to some accounts (#905, LCorleone) — a key could burn any account a provider had: two coding plans of one vendor, and a key given to someone had them both. A key now keeps an optional list of accounts and keys (caller-keys.json "accounts", none = every account, so older files read as before): "<provider>/<account>", an account by its stable id — the login's, set once it is written and kept through renames (logins.json's savedLogin id, written by every write and stood in for by one made of the name until then, so an entry made before stands), a key by its fingerprint — every one a provider has when the list is set, and one gone later (a key rotated, an account signed out) kept as it is, matching nothing, holding the key closer, never wider. The command line and the menu name an account by who is signed in and keep its id. Routing holds a plan to the key's accounts beside its models: a candidate whose account the key may not use is left out — through a routing group the key names no less, for naming a group is not naming its accounts — the plan's order keeping step and its left-out list marking what the key held out (Weighed's held); magpie's own calls for the key — a web search, a picture described, a Codex title — are of the models the user picked, so the models don't hold them, but their spend lands on an account all the same, and the accounts hold them too. When every account or key a model has is one the key may not use, the request is refused with a 403 in the API's own error shape naming the model and the accounts the key may use, logged as a rejected call: after a usage cap's 429 and before an account barred for the model's, itself before the no-member 404. /v1/models and the Anthropic and Gemini lists show the key only the models an account or key it may use serves (a provider's account set not to serve one, #474, is none of the key's); a provider with no account and no key (a local ollama) is one the key names no account of — its models stay listed and its asks pass — while an entry kept after its provider lost its last account or key serves none, holding the key closer. The embeddings, images and videos endpoints hold their candidate to the key's accounts the same way, and counting tokens counts on those alone (the local estimate where it may use none). System One asks its decision model of an account or key the key may use — and sends on that key, of those in use, not the provider's first, which a key held to a later one was spent on; the videos and images keyed paths send on one the key may use too, held to a later key no longer refused for the first alone. Set it in the app's menu the models are picked in — the accounts after the models, an account by who is signed in with their plan in the note, a key by its fingerprint, what the CLI kept that no provider has now kept as "Not signed in now" — or magpie gateway-key accounts <id> codex/me@example.com openai/<key id> (all takes it off); gateway-key list has an ACCOUNTS column. en/zh/ja/de, the German "{n} accounts" main already had left to it rather than written twice. The images API's fan-out over a subscription's accounts is held to the key's accounts as one: one of the key's whose plan refuses to draw no longer hands the pen to an account it may not use, and the second in the order, when it is the key's, draws what the first may not (drawOnAccounts filters the candidates, the account pinned to with the account header told plainly when the key may not use it). The Routing view's left-out list says an account the key held out for what it is, not that its plan lacks the model, in Chinese, Japanese and German too; the key's badge names its accounts by who is signed in, not by the stable ids it keeps. (#932)
2026-10-06 10:51:50 +08:00

229 lines
8.1 KiB
Go
Raw Blame History

package main
import (
"bytes"
"os"
"slices"
"strings"
"testing"
"github.com/yetone/magpie/internal/access"
"github.com/yetone/magpie/internal/provider"
"github.com/yetone/magpie/internal/settings"
)
func TestGatewayKeyCLI(t *testing.T) {
t.Setenv("HOME", t.TempDir())
t.Setenv("USERPROFILE", os.Getenv("HOME"))
t.Setenv("XDG_CONFIG_HOME", t.TempDir())
if err := settings.Save(settings.Settings{LAN: true}); err != nil {
t.Fatal(err)
}
call := func(args ...string) string {
t.Helper()
var out bytes.Buffer
if err := gatewayKeysTo(&out, append([]string{"gateway-key"}, args...)); err != nil {
t.Fatal(err)
}
return strings.TrimSpace(out.String())
}
if got := call("list"); !strings.Contains(got, "GATEWAY KEY") {
t.Fatal(got)
}
secret := call("add", "Remote laptop")
keys, _ := access.List()
if len(keys) != 1 {
t.Fatal(keys)
}
id := keys[0].ID
if who, ok := access.Authenticate(secret); !ok || who.KeyID != id || who.KeyName != "Remote laptop" {
t.Fatal(who, ok)
}
if got := call(); strings.Contains(got, secret) || !strings.Contains(got, id) || !strings.Contains(got, "Remote laptop") {
t.Fatal("list must mask credentials", got)
}
next := call("rotate", id)
if next == secret {
t.Fatal("rotation reused the secret")
}
if _, ok := access.Authenticate(secret); ok {
t.Fatal("old credential works after rotation")
}
if who, ok := access.Authenticate(next); !ok || who.KeyID != id {
t.Fatal("rotation changed identity", who, ok)
}
call("remove", id)
if _, ok := access.Authenticate(next); ok {
t.Fatal("removed credential still works")
}
for _, args := range [][]string{{"add"}, {"add", ""}, {"list", "extra"}, {"rotate", "missing"}, {"remove", "missing"}, {"unknown", "x"}} {
if err := gatewayKeysTo(&bytes.Buffer{}, append([]string{"gateway-key"}, args...)); err == nil {
t.Error("accepted", args)
}
}
}
func TestGatewayKeyListWithReadOnlyMigration(t *testing.T) {
t.Setenv("XDG_CONFIG_HOME", t.TempDir())
s := settings.Settings{LAN: true, LANKey: "sk-magpie-fixture-cli"}
if err := settings.Save(s); err != nil {
t.Fatal(err)
}
if err := os.Chmod(settings.Path(), 0o400); err != nil {
t.Fatal(err)
}
t.Cleanup(func() { os.Chmod(settings.Path(), 0o600) })
if err := settings.Save(s); err == nil {
t.Skip("settings.json remains writable")
}
var out bytes.Buffer
if err := gatewayKeysTo(&out, []string{"gateway-key", "list"}); err != nil || !strings.Contains(out.String(), "Magpie") {
t.Fatal("read-only migration blocked CLI list", out.String(), err)
}
}
// magpie gateway-key limit sets, shows and takes off a key's limit, and
// list says what each key has used of its own (#585).
func TestGatewayKeyLimitCLI(t *testing.T) {
t.Setenv("HOME", t.TempDir())
t.Setenv("USERPROFILE", os.Getenv("HOME"))
t.Setenv("XDG_CONFIG_HOME", t.TempDir())
if err := settings.Save(settings.Settings{LAN: true}); err != nil {
t.Fatal(err)
}
call := func(args ...string) (string, error) {
var out bytes.Buffer
err := gatewayKeysTo(&out, append([]string{"gateway-key"}, args...))
return out.String(), err
}
if _, err := call("add", "Phone"); err != nil {
t.Fatal(err)
}
keys, _ := access.List()
id := keys[0].ID
if got, err := call("limit", id); err != nil || !strings.Contains(got, "no limit") {
t.Fatal(got, err)
}
got, err := call("limit", id, "week", "--tokens", "2m", "--cost=5", "--cache-reads")
if err != nil {
t.Fatal(err)
}
keys, _ = access.List()
if l := keys[0].Limit; l == nil || l.Period != "week" || l.Tokens != 2_000_000 || l.Cost != 5 || !l.CacheReads {
t.Fatalf("limit kept as %+v", keys[0].Limit)
}
for _, want := range []string{"0 used of 2000000, 2000000 left", "cache reads", "$0.00 used of $5.00", "State", "open"} {
if !strings.Contains(got, want) {
t.Fatalf("limit shows %q, without %q", got, want)
}
}
if got, _ := call("list"); !strings.Contains(got, "LIMIT") || !strings.Contains(got, "0/2000000 tokens $0.00/$5.00 per week") {
t.Fatal(got)
}
for _, args := range [][]string{{"limit"}, {"limit", id, "hour", "--tokens", "5"}, {"limit", id, "day"}, {"limit", id, "day", "--tokens", "lots"},
{"limit", id, "day", "--cost"}, {"limit", id, "day", "--what"}, {"limit", "missing", "day", "--tokens", "5"}, {"limit", id, "off", "extra"}} {
if _, err := call(args...); err == nil {
t.Error("accepted", args)
}
}
if got, err := call("limit", id, "off"); err != nil || !strings.Contains(got, "no limit") {
t.Fatal(got, err)
}
if keys, _ = access.List(); keys[0].Limit != nil {
t.Fatal("off kept", keys[0].Limit)
}
}
func TestGatewayKeyModelsCLI(t *testing.T) {
t.Setenv("HOME", t.TempDir())
t.Setenv("USERPROFILE", os.Getenv("HOME"))
t.Setenv("XDG_CONFIG_HOME", t.TempDir())
if err := settings.Save(settings.Settings{LAN: true}); err != nil {
t.Fatal(err)
}
call := func(args ...string) (string, error) {
var out bytes.Buffer
err := gatewayKeysTo(&out, append([]string{"gateway-key"}, args...))
return out.String(), err
}
if _, err := call("add", "Phone"); err != nil {
t.Fatal(err)
}
keys, _ := access.List()
id := keys[0].ID
if got, err := call("models", id); err != nil || got != "Phone: every model\n" {
t.Fatal(got, err)
}
if got, err := call("models", id, "openai/gpt-5", "anthropic/*"); err != nil || got != "Phone: only openai/gpt-5, anthropic/*\n" {
t.Fatal(got, err)
}
if keys, _ = access.List(); !slices.Equal(keys[0].Models, []string{"openai/gpt-5", "anthropic/*"}) {
t.Fatal("kept", keys[0].Models)
}
if got, _ := call("list"); !strings.Contains(got, "MODELS") || !strings.Contains(got, "openai/gpt-5,anthropic/*") {
t.Fatal(got)
}
for _, args := range [][]string{{"models"}, {"models", id, "gpt-5"}, {"models", "missing", "a/b"}, {"models", "missing"}} {
if _, err := call(args...); err == nil {
t.Error("accepted", args)
}
}
if got, err := call("models", id, "all"); err != nil || got != "Phone: every model\n" {
t.Fatal(got, err)
}
if keys, _ = access.List(); keys[0].Models != nil {
t.Fatal("all kept", keys[0].Models)
}
}
// magpie gateway-key accounts sets, shows and takes off a key's account
// whitelist, and refuses an account no provider has (#905). An account's
// stable id, named by who is signed in, is exercised against a real
// sign-in in the gateway's tests; a key's fingerprint is one here.
func TestGatewayKeyAccountsCLI(t *testing.T) {
t.Setenv("HOME", t.TempDir())
t.Setenv("USERPROFILE", os.Getenv("HOME"))
t.Setenv("XDG_CONFIG_HOME", t.TempDir())
if err := settings.Save(settings.Settings{LAN: true}); err != nil {
t.Fatal(err)
}
if err := provider.Save(provider.Provider{ID: "relay", Name: "Relay", Chat: "http://127.0.0.1:1/v1", Keys: []provider.KeyAccount{{Key: "sk-1", Name: "First"}, {Key: "sk-2", Name: "Second"}}}); err != nil {
t.Fatal(err)
}
k1, k2 := provider.KeyID("sk-1"), provider.KeyID("sk-2")
call := func(args ...string) (string, error) {
var out bytes.Buffer
err := gatewayKeysTo(&out, append([]string{"gateway-key"}, args...))
return out.String(), err
}
if _, err := call("add", "Phone"); err != nil {
t.Fatal(err)
}
keys, _ := access.List()
id := keys[0].ID
if got, err := call("accounts", id); err != nil || got != "Phone: every account\n" {
t.Fatal(got, err)
}
// named by the name it is shown by, kept by its fingerprint
if got, err := call("accounts", id, "relay/First", "relay/"+k2); err != nil || got != "Phone: only relay/First, relay/Second\n" {
t.Fatal(got, err)
}
if keys, _ = access.List(); !slices.Equal(keys[0].Accounts, []string{"relay/" + k1, "relay/" + k2}) {
t.Fatal("kept", keys[0].Accounts)
}
if got, _ := call("list"); !strings.Contains(got, "ACCOUNTS") || !strings.Contains(got, "relay/First,relay/Second") {
t.Fatal(got)
}
for _, args := range [][]string{{"accounts"}, {"accounts", id, "sk-1"}, {"accounts", id, "relay/" + provider.KeyID("sk-9")}, {"accounts", "missing", "relay/First"}, {"accounts", "missing"}} {
if _, err := call(args...); err == nil {
t.Error("accepted", args)
}
}
if got, err := call("accounts", id, "all"); err != nil || got != "Phone: every account\n" {
t.Fatal(got, err)
}
if keys, _ = access.List(); keys[0].Accounts != nil {
t.Fatal("all kept accounts", keys[0].Accounts)
}
}
Reference in new issue View Git Blame Copy Permalink