mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-05 03:51:54 +01:00
45 lines
4.3 KiB
TypeScript
45 lines
4.3 KiB
TypeScript
import { mkdtempSync, writeFileSync, statSync, chmodSync, rmSync } from "node:fs";
|
|
import path from "node:path";
|
|
import { tmpdir } from "node:os";
|
|
import { afterEach, expect, it } from "vitest";
|
|
import { stageChatPrivateInputs, readChatPrivateInputs, chatPrivateInputNameIdentity, scrubChatPrivateEnvironment, CHAT_PRIVATE_INPUTS_ENV } from "./chat-private-inputs.js";
|
|
import type { MatrixExecution } from "./types.js";
|
|
import type { ChatCatalogDescriptor } from "./chat-catalog-registry.js";
|
|
const roots: string[] = [];
|
|
afterEach(() => { for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true }); });
|
|
function fixture() { const root = mkdtempSync(path.join(tmpdir(), "chat-private-")); roots.push(root); return root; }
|
|
const execution = { id: "selected", profile: { credential: "CODEX_AUTH_JSON" }, environment: {} } as MatrixExecution;
|
|
it("stages only declared credentials privately and removes them from unrelated process environments", () => {
|
|
const root = fixture(), secrets: string[] = [];
|
|
const descriptor = { requiredCredentials: ["OPENAI_API_KEY"] } satisfies Pick<ChatCatalogDescriptor, "requiredCredentials" | "externalInput">;
|
|
const env = { CODEX_AUTH_JSON: "profile-login", OPENAI_API_KEY: "wizard-value", ANTHROPIC_API_KEY: "other-value", PAPERCLIP_CHAT_EVAL_UNUSED: "unrelated-value" };
|
|
const staged = stageChatPrivateInputs({ execution, descriptor, privateDir: root, env, secrets });
|
|
expect(statSync(staged.filename).mode & 0o077).toBe(0);
|
|
const privateEnv = { [CHAT_PRIVATE_INPUTS_ENV]: staged.filename, PAPERCLIP_RUNNER_E2E_TEMP_ROOT: root };
|
|
const inputs = readChatPrivateInputs("selected", secrets, privateEnv);
|
|
expect(inputs.credentials.OPENAI_API_KEY).toBe("wizard-value"); expect(inputs.read("ANTHROPIC_API_KEY")).toBeUndefined();
|
|
expect(secrets).toContain("wizard-value");
|
|
expect(() => readChatPrivateInputs("other", [], privateEnv)).toThrow("another execution");
|
|
const child = scrubChatPrivateEnvironment({ ...env, ...privateEnv }, [execution]);
|
|
expect(child.CODEX_AUTH_JSON).toBe("profile-login"); expect(child.OPENAI_API_KEY).toBeUndefined(); expect(child.PAPERCLIP_CHAT_EVAL_UNUSED).toBeUndefined();
|
|
expect(scrubChatPrivateEnvironment(child, [], true)[CHAT_PRIVATE_INPUTS_ENV]).toBeUndefined();
|
|
expect(JSON.stringify(chatPrivateInputNameIdentity("selected", privateEnv))).not.toContain("wizard-value");
|
|
chmodSync(staged.filename, 0o644); expect(() => readChatPrivateInputs("selected", [], privateEnv)).toThrow("private0600");
|
|
});
|
|
it("resolves only the selected provider references and fingerprints names rather than credential values", () => {
|
|
const root = fixture(), configFile = path.join(root, "external.json"), secrets: string[] = [];
|
|
writeFileSync(configFile, JSON.stringify({ schemaVersion: 1, providers: {
|
|
notion: { disposable: true, resourceIds: ["test-page"], credentialEnv: ["PAPERCLIP_CHAT_EVAL_NOTION_AUTH"], prerequisites: { workspaceId: "test-space", tokenEnv: "PAPERCLIP_CHAT_EVAL_NOTION_AUTH", unrelated: "not-selected" } },
|
|
slack: { disposable: true, resourceIds: ["unrelated"], credentialEnv: ["PAPERCLIP_CHAT_EVAL_SLACK_AUTH"], prerequisites: {} },
|
|
} }), { mode: 0o600 });
|
|
const descriptor = { externalInput: { provider: "notion", fields: ["workspaceId", "tokenEnv"] } } satisfies Pick<ChatCatalogDescriptor, "requiredCredentials" | "externalInput">;
|
|
const staged = stageChatPrivateInputs({ execution, descriptor, privateDir: root, secrets, env: { PAPERCLIP_CHAT_CATALOG_EXTERNAL_CONFIG: configFile, PAPERCLIP_CHAT_EVAL_NOTION_AUTH: "notion-private", PAPERCLIP_CHAT_EVAL_SLACK_AUTH: "slack-private" } });
|
|
const env = { [CHAT_PRIVATE_INPUTS_ENV]: staged.filename, PAPERCLIP_RUNNER_E2E_TEMP_ROOT: root };
|
|
const inputs = readChatPrivateInputs("selected", secrets, env);
|
|
expect(inputs.read("PAPERCLIP_CHAT_EVAL_NOTION_AUTH")).toBe("notion-private"); expect(inputs.read("PAPERCLIP_CHAT_EVAL_SLACK_AUTH")).toBeUndefined();
|
|
expect(JSON.stringify(inputs.configuration("external-provider"))).not.toContain("slack");
|
|
expect(JSON.stringify(inputs.configuration("external-provider"))).not.toContain("not-selected");
|
|
const identity = JSON.stringify(chatPrivateInputNameIdentity("selected", env));
|
|
expect(identity).toContain("PAPERCLIP_CHAT_EVAL_NOTION_AUTH"); expect(identity).not.toContain("notion-private"); expect(identity).not.toContain("test-space");
|
|
});
|