101 lines
3.3 KiB
Python
101 lines
3.3 KiB
Python
import pytest
|
|
from pydantic import SecretStr, ValidationError
|
|
|
|
from ai_platform.infrastructure.config.settings import Settings
|
|
|
|
_TEST_DATABASE_URL = "postgresql+asyncpg://test:test@localhost/ai_platform_test"
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"base_url",
|
|
["http://remote.example/v1", "http://localhost:8317/path", "https://user:pass@example.com"],
|
|
)
|
|
def test_openai_base_url_rejects_unsafe_url(base_url: str):
|
|
with pytest.raises(ValidationError):
|
|
Settings(database_url=_TEST_DATABASE_URL, openai_base_url=base_url)
|
|
|
|
|
|
def test_openai_local_http_allows_no_key_only_in_development():
|
|
settings = Settings(
|
|
database_url=_TEST_DATABASE_URL,
|
|
environment="development",
|
|
openai_base_url="http://127.0.0.1:8317",
|
|
)
|
|
assert settings.openai_api_key is None
|
|
with pytest.raises(ValidationError):
|
|
Settings(
|
|
database_url=_TEST_DATABASE_URL,
|
|
environment="production",
|
|
tenant_provisioning_secret=SecretStr("provisioner"),
|
|
openai_base_url="http://127.0.0.1:8317",
|
|
openai_api_key=SecretStr("proxy-key"),
|
|
)
|
|
|
|
|
|
def test_openai_production_requires_https_and_key():
|
|
with pytest.raises(ValidationError):
|
|
Settings(
|
|
database_url=_TEST_DATABASE_URL,
|
|
environment="production",
|
|
tenant_provisioning_secret=SecretStr("provisioner"),
|
|
openai_base_url="https://proxy.example",
|
|
)
|
|
settings = Settings(
|
|
database_url=_TEST_DATABASE_URL,
|
|
environment="production",
|
|
tenant_provisioning_secret=SecretStr("provisioner"),
|
|
openai_base_url="https://proxy.example",
|
|
openai_api_key=SecretStr("proxy-key"),
|
|
)
|
|
assert settings.openai_base_url == "https://proxy.example"
|
|
assert "proxy-key" not in repr(settings)
|
|
|
|
|
|
def test_openai_rejects_key_without_url_and_header_injection():
|
|
with pytest.raises(ValidationError):
|
|
Settings(database_url=_TEST_DATABASE_URL, openai_api_key=SecretStr("key"))
|
|
with pytest.raises(ValidationError):
|
|
Settings(
|
|
database_url=_TEST_DATABASE_URL,
|
|
environment="development",
|
|
openai_base_url="http://localhost:8317",
|
|
openai_api_key=SecretStr("key\r\nX-Evil: test"),
|
|
)
|
|
|
|
|
|
def test_aihub_base_url_accepts_local_http():
|
|
settings = Settings(
|
|
database_url=_TEST_DATABASE_URL,
|
|
environment="development",
|
|
aihub_base_url="http://localhost:8080",
|
|
)
|
|
assert settings.aihub_base_url == "http://localhost:8080"
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"base_url",
|
|
[
|
|
"ftp://localhost:8080",
|
|
"http://user:password@localhost:8080",
|
|
"http://localhost:8080?token=secret",
|
|
"http://aihub:8080",
|
|
],
|
|
)
|
|
def test_aihub_base_url_rejects_invalid_or_nonlocal_http(base_url: str):
|
|
with pytest.raises(ValidationError):
|
|
Settings(
|
|
database_url=_TEST_DATABASE_URL,
|
|
environment="development",
|
|
aihub_base_url=base_url,
|
|
)
|
|
|
|
|
|
def test_aihub_base_url_requires_https_outside_development():
|
|
with pytest.raises(ValidationError):
|
|
Settings(
|
|
database_url=_TEST_DATABASE_URL,
|
|
environment="production",
|
|
tenant_provisioning_secret=SecretStr("a-provisioner-secret"),
|
|
aihub_base_url="http://localhost:8080",
|
|
)
|