mirror of
https://github.com/Wei-Shaw/sub2api.git
synced 2026-11-10 09:01:22 +00:00
shaw
221581400b
将账号级请求头覆写从 anthropic/openai 的 api_key 账号扩展到 Grok 的 api_key 与 oauth 账号，并放开 Grok OAuth 账号的自定义上游地址（仅作用于 转发端点，授权与 token 刷新链路不变）。 后端： - IsHeaderOverrideEligible 扩展到 Grok(api_key+oauth)，禁止名单新增 x-grok-conv-id（逐请求会话路由头）。 - 所有 Grok 上游请求路径接线 ApplyHeaderOverrides（Responses/Chat 桥/ 媒体/配额探测/billing 探测/连通性测试），统一置于内置默认头之后。 - GetGrokBaseURL/GetGrokMediaBaseURL 放开 OAuth 自定义地址：官方地址 视同未定制回落官方网关，仅显式第三方 host 改发转发流量。 - 非官方 host 允许任意 path 前缀，官方 host 仍强制 /v1。 - OAuth base_url 校验按 host 判定官方/自定义，自定义 host 恒受运营方 URL 策略约束，不受 XAI_ALLOW_UNSAFE_URL_OVERRIDES 调试开关放宽。 - 给 GrokQuotaService 注入 config，使配额/billing 探测与转发共用同一 URL 策略。 前端： - Edit 模态为 Grok OAuth 账号新增「自定义上游地址」开关。 - 请求头表单新增 JSON 快速导入与按 JSON 一键复制（复用 useClipboard， 兼容非安全上下文 HTTP 页面）。 - 门控改为平台×类型判定，Bulk 批量 base_url 增加格式校验，zh/en 文案同步。
342 lines
12 KiB
Go
342 lines
12 KiB
Go
//go:build unit
|
|
|
|
package xai
|
|
|
|
import (
|
|
"net/url"
|
|
"testing"
|
|
|
|
"github.com/Wei-Shaw/sub2api/internal/util/urlvalidator"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestParseAuthorizationInput(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
tests := []struct {
|
|
name string
|
|
raw string
|
|
wantCode string
|
|
wantState string
|
|
wantRequiresState bool
|
|
}{
|
|
{
|
|
name: "full callback url",
|
|
raw: "http://127.0.0.1:56121/callback?code=abc123&state=state456",
|
|
wantCode: "abc123",
|
|
wantState: "state456",
|
|
wantRequiresState: true,
|
|
},
|
|
{
|
|
name: "query string",
|
|
raw: "?code=abc123&state=state456",
|
|
wantCode: "abc123",
|
|
wantState: "state456",
|
|
wantRequiresState: true,
|
|
},
|
|
{
|
|
name: "full callback url missing state",
|
|
raw: "http://127.0.0.1:56121/callback?code=abc123",
|
|
wantCode: "abc123",
|
|
wantRequiresState: true,
|
|
},
|
|
{
|
|
name: "query string missing state",
|
|
raw: "code=abc123",
|
|
wantCode: "abc123",
|
|
wantRequiresState: true,
|
|
},
|
|
{
|
|
name: "bare code",
|
|
raw: "abc123",
|
|
wantCode: "abc123",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
got := ParseAuthorizationInput(tt.raw)
|
|
require.Equal(t, tt.wantCode, got.Code)
|
|
require.Equal(t, tt.wantState, got.State)
|
|
require.Equal(t, tt.wantRequiresState, got.RequiresState)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestBuildAuthorizationURLIncludesHermesCompatibleParameters(t *testing.T) {
|
|
t.Setenv(EnvAuthorizeURL, "https://auth.example.test/oauth2/authorize")
|
|
t.Setenv(EnvClientID, "client-id")
|
|
t.Setenv(EnvScope, "openid profile offline_access api:access")
|
|
t.Setenv(EnvAllowUnsafeURLOverrides, "true")
|
|
|
|
authURL, err := BuildAuthorizationURL("state", "challenge", "http://127.0.0.1:56121/callback", "nonce")
|
|
require.NoError(t, err)
|
|
parsed, err := url.Parse(authURL)
|
|
require.NoError(t, err)
|
|
|
|
values := parsed.Query()
|
|
require.Equal(t, "https", parsed.Scheme)
|
|
require.Equal(t, "auth.example.test", parsed.Host)
|
|
require.Equal(t, "/oauth2/authorize", parsed.Path)
|
|
require.Equal(t, "code", values.Get("response_type"))
|
|
require.Equal(t, "client-id", values.Get("client_id"))
|
|
require.Equal(t, "http://127.0.0.1:56121/callback", values.Get("redirect_uri"))
|
|
require.Equal(t, "openid profile offline_access api:access", values.Get("scope"))
|
|
require.Equal(t, "state", values.Get("state"))
|
|
require.Equal(t, "nonce", values.Get("nonce"))
|
|
require.Equal(t, "challenge", values.Get("code_challenge"))
|
|
require.Equal(t, "S256", values.Get("code_challenge_method"))
|
|
require.Equal(t, "generic", values.Get("plan"))
|
|
require.Equal(t, "sub2api", values.Get("referrer"))
|
|
}
|
|
|
|
func TestValidateXAIURLsAllowOfficialOAuthAndGatewayHosts(t *testing.T) {
|
|
authorizeURL, err := ValidateOAuthEndpointURL(DefaultAuthorizeURL)
|
|
require.NoError(t, err)
|
|
require.Equal(t, DefaultAuthorizeURL, authorizeURL)
|
|
|
|
tokenURL, err := ValidateOAuthEndpointURL(DefaultTokenURL)
|
|
require.NoError(t, err)
|
|
require.Equal(t, DefaultTokenURL, tokenURL)
|
|
|
|
baseURL, err := ValidateBaseURL(DefaultBaseURL)
|
|
require.NoError(t, err)
|
|
require.Equal(t, DefaultBaseURL, baseURL)
|
|
|
|
cliBaseURL, err := ValidateBaseURL(DefaultCLIBaseURL)
|
|
require.NoError(t, err)
|
|
require.Equal(t, DefaultCLIBaseURL, cliBaseURL)
|
|
|
|
baseURLNoPath, err := ValidateBaseURL("https://api.x.ai")
|
|
require.NoError(t, err)
|
|
require.Equal(t, DefaultBaseURL, baseURLNoPath)
|
|
|
|
chatURL, err := BuildChatCompletionsURL(DefaultCLIBaseURL + "/")
|
|
require.NoError(t, err)
|
|
require.Equal(t, DefaultCLIBaseURL+"/chat/completions", chatURL)
|
|
}
|
|
|
|
func TestBuildGrokMediaURLs(t *testing.T) {
|
|
imagesURL, err := BuildImagesGenerationsURL(DefaultBaseURL + "/")
|
|
require.NoError(t, err)
|
|
require.Equal(t, DefaultBaseURL+"/images/generations", imagesURL)
|
|
|
|
editsURL, err := BuildImagesEditsURL(DefaultBaseURL)
|
|
require.NoError(t, err)
|
|
require.Equal(t, DefaultBaseURL+"/images/edits", editsURL)
|
|
|
|
videosURL, err := BuildVideosGenerationsURL(DefaultBaseURL)
|
|
require.NoError(t, err)
|
|
require.Equal(t, DefaultBaseURL+"/videos/generations", videosURL)
|
|
|
|
videoEditsURL, err := BuildVideosEditsURL(DefaultBaseURL)
|
|
require.NoError(t, err)
|
|
require.Equal(t, DefaultBaseURL+"/videos/edits", videoEditsURL)
|
|
|
|
videoExtensionsURL, err := BuildVideosExtensionsURL(DefaultBaseURL)
|
|
require.NoError(t, err)
|
|
require.Equal(t, DefaultBaseURL+"/videos/extensions", videoExtensionsURL)
|
|
|
|
videoURL, err := BuildVideoURL(DefaultBaseURL, "req 123")
|
|
require.NoError(t, err)
|
|
require.Equal(t, DefaultBaseURL+"/videos/req%20123", videoURL)
|
|
|
|
_, err = BuildVideoURL(DefaultBaseURL, " ")
|
|
require.Error(t, err)
|
|
}
|
|
|
|
func TestValidateXAIURLsRejectUntrustedOAuthAndUnsafeBaseURLsByDefault(t *testing.T) {
|
|
_, err := ValidateOAuthEndpointURL("https://auth.example.test/oauth2/token")
|
|
require.Error(t, err)
|
|
|
|
_, err = ValidateBaseURL("http://127.0.0.1:8080/v1")
|
|
require.Error(t, err)
|
|
|
|
_, err = ValidateBaseURL("https://api.x.ai/custom")
|
|
require.Error(t, err)
|
|
}
|
|
|
|
func TestValidateBaseURLAllowsPublicThirdPartyGrokAPI(t *testing.T) {
|
|
baseURL, err := ValidateBaseURL("https://grok.example.test/v1/")
|
|
require.NoError(t, err)
|
|
require.Equal(t, "https://grok.example.test/v1", baseURL)
|
|
|
|
_, err = ValidateTrustedBaseURL("https://grok.example.test/v1")
|
|
require.Error(t, err)
|
|
}
|
|
|
|
func TestValidateBaseURLPathPrefixPolicy(t *testing.T) {
|
|
// 非官方主机保留管理员配置的任意 path 前缀。
|
|
prefixed, err := ValidateBaseURL("https://relay.example.test/xai/v1/")
|
|
require.NoError(t, err)
|
|
require.Equal(t, "https://relay.example.test/xai/v1", prefixed)
|
|
|
|
deepPrefixed, err := ValidateBaseURL("https://relay.example.test/tenant-a/proxy")
|
|
require.NoError(t, err)
|
|
require.Equal(t, "https://relay.example.test/tenant-a/proxy", deepPrefixed)
|
|
|
|
// 空 path 仍按惯例补 /v1，保持既有配置兼容。
|
|
rootOnly, err := ValidateBaseURL("https://relay.example.test")
|
|
require.NoError(t, err)
|
|
require.Equal(t, "https://relay.example.test/v1", rootOnly)
|
|
|
|
// 官方主机固定 /v1 前缀。
|
|
_, err = ValidateBaseURL("https://api.x.ai/xai/v1")
|
|
require.Error(t, err)
|
|
_, err = ValidateBaseURL("https://cli-chat-proxy.grok.com/other")
|
|
require.Error(t, err)
|
|
}
|
|
|
|
func TestIsOfficialBaseURL(t *testing.T) {
|
|
official := []string{
|
|
"",
|
|
" ",
|
|
DefaultBaseURL,
|
|
DefaultCLIBaseURL,
|
|
"https://api.x.ai",
|
|
"HTTPS://API.X.AI:443/",
|
|
"https://api.x.ai:0443/v1",
|
|
"https://api.x.ai/%76%31",
|
|
"https://api.x.ai:8443/v1",
|
|
"HTTPS://CLI-CHAT-PROXY.GROK.COM:443/%76%31/",
|
|
"::invalid::url", // 无法解析的值按官方处理，回落默认端点
|
|
}
|
|
for _, raw := range official {
|
|
require.True(t, IsOfficialBaseURL(raw), "expected official: %q", raw)
|
|
}
|
|
|
|
custom := []string{
|
|
"https://relay.example.test/v1",
|
|
"https://relay.example.test/xai/v1",
|
|
"http://relay.example.test/v1",
|
|
"https://grok.com.evil.example.test/v1",
|
|
}
|
|
for _, raw := range custom {
|
|
require.False(t, IsOfficialBaseURL(raw), "expected custom: %q", raw)
|
|
}
|
|
}
|
|
|
|
func TestValidateBaseURLsRejectEmptyQueryDelimiter(t *testing.T) {
|
|
_, err := ValidateBaseURL("https://grok.example.test/v1?")
|
|
require.Error(t, err)
|
|
|
|
_, err = ValidateTrustedBaseURL("https://api.x.ai/v1?")
|
|
require.Error(t, err)
|
|
}
|
|
|
|
func TestBuildResponsesURLWithValidatorUsesCallerPolicy(t *testing.T) {
|
|
validator := func(raw string) (string, error) {
|
|
return urlvalidator.ValidateURLFormat(raw, true)
|
|
}
|
|
|
|
target, err := BuildResponsesURLWithValidator("http://grok.example.test/v1/", validator)
|
|
require.NoError(t, err)
|
|
require.Equal(t, "http://grok.example.test/v1/responses", target)
|
|
}
|
|
|
|
func TestBuildResponsesURLPreservesUnsafeOverrideCustomPath(t *testing.T) {
|
|
t.Setenv(EnvAllowUnsafeURLOverrides, "true")
|
|
|
|
target, err := BuildResponsesURL("http://localhost:8080/custom")
|
|
require.NoError(t, err)
|
|
require.Equal(t, "http://localhost:8080/custom/responses", target)
|
|
}
|
|
|
|
func TestBuildResponsesURLWithValidatorRejectsBaseURLComponents(t *testing.T) {
|
|
permissive := func(raw string) (string, error) { return raw, nil }
|
|
tests := []struct {
|
|
name string
|
|
raw string
|
|
}{
|
|
{name: "userinfo", raw: "https://user:secret@grok.example.test/v1"},
|
|
{name: "query", raw: "https://grok.example.test/v1?token=secret"},
|
|
{name: "empty query delimiter", raw: "https://grok.example.test/v1?"},
|
|
{name: "fragment", raw: "https://grok.example.test/v1#secret"},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
_, err := BuildResponsesURLWithValidator(tt.raw, permissive)
|
|
require.Error(t, err)
|
|
require.NotContains(t, err.Error(), "secret")
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestValidateXAIURLsAllowUnsafeDevOverride(t *testing.T) {
|
|
t.Setenv(EnvAllowUnsafeURLOverrides, "true")
|
|
|
|
tokenURL, err := ValidateOAuthEndpointURL("http://127.0.0.1:8080/oauth2/token")
|
|
require.NoError(t, err)
|
|
require.Equal(t, "http://127.0.0.1:8080/oauth2/token", tokenURL)
|
|
|
|
baseURL, err := ValidateBaseURL("http://127.0.0.1:8080/v1/")
|
|
require.NoError(t, err)
|
|
require.Equal(t, "http://127.0.0.1:8080/v1", baseURL)
|
|
}
|
|
|
|
func TestRuntimeSanityReportsSafeDefaults(t *testing.T) {
|
|
t.Setenv(EnvBaseURL, "")
|
|
t.Setenv(EnvAuthorizeURL, "")
|
|
t.Setenv(EnvTokenURL, "")
|
|
t.Setenv(EnvRedirectURI, "")
|
|
t.Setenv(EnvAllowUnsafeURLOverrides, "")
|
|
t.Setenv(EnvUnsafeAllowHighConcurrency, "")
|
|
|
|
report := RuntimeSanity()
|
|
require.True(t, report.BaseURL.Valid)
|
|
require.Equal(t, DefaultBaseURL, report.BaseURL.Value)
|
|
require.True(t, report.BaseURL.IsDefault)
|
|
require.True(t, report.OAuthAuthorizeURL.Valid)
|
|
require.True(t, report.OAuthTokenURL.Valid)
|
|
require.True(t, report.OAuthRedirectURI.Valid)
|
|
require.False(t, report.UnsafeURLOverrides)
|
|
require.False(t, report.UnsafeHighConcurrency)
|
|
require.Equal(t, "responses_only", report.PublicGatewayScope)
|
|
require.Contains(t, report.ProxyPolicy, "account_proxy_optional")
|
|
require.Contains(t, report.ProxyPolicy, "API-key base URLs require public HTTPS")
|
|
}
|
|
|
|
func TestRuntimeSanityReportsInvalidOverridesWithoutSecrets(t *testing.T) {
|
|
t.Setenv(EnvBaseURL, "http://127.0.0.1:8080/v1?access_token=secret")
|
|
t.Setenv(EnvAuthorizeURL, "https://auth.example.test/oauth2/authorize")
|
|
t.Setenv(EnvTokenURL, "https://auth.example.test/oauth2/token")
|
|
t.Setenv(EnvRedirectURI, "not a url")
|
|
t.Setenv(EnvClientID, "client-secret-like-value")
|
|
t.Setenv(EnvAllowUnsafeURLOverrides, "")
|
|
|
|
report := RuntimeSanity()
|
|
require.False(t, report.BaseURL.Valid)
|
|
require.False(t, report.BaseURL.IsDefault)
|
|
require.Contains(t, report.BaseURL.Error, "invalid url")
|
|
require.NotContains(t, report.BaseURL.Value, "secret")
|
|
require.False(t, report.OAuthAuthorizeURL.Valid)
|
|
require.False(t, report.OAuthTokenURL.Valid)
|
|
require.False(t, report.OAuthRedirectURI.Valid)
|
|
require.NotContains(t, report.ProxyPolicy, "client-secret-like-value")
|
|
}
|
|
|
|
func TestDefaultModelMappingIncludesGrokAliases(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
mapping := DefaultModelMapping()
|
|
require.Equal(t, "grok-4.5", mapping["grok"])
|
|
require.Equal(t, "grok-4.5", mapping["grok-latest"])
|
|
require.Equal(t, "grok-4.5", mapping["grok-4.5"])
|
|
require.Equal(t, "grok-4.5", mapping["grok-4.5-latest"])
|
|
require.Equal(t, "grok-build-0.1", mapping["grok-build"])
|
|
require.Equal(t, "grok-4.5", mapping["grok-build-latest"])
|
|
require.Equal(t, "grok-composer-2.5-fast", mapping["grok-composer"])
|
|
require.Equal(t, "grok-composer-2.5-fast", mapping["composer-2.5"])
|
|
require.Equal(t, "grok-4.20-0309-reasoning", mapping["grok-4.20-reasoning"])
|
|
require.Equal(t, "grok-4.20-0309-non-reasoning", mapping["grok-4.20-non-reasoning"])
|
|
require.Equal(t, "grok-4.20-multi-agent-0309", mapping["grok-4.20-multi-agent-0309"])
|
|
require.Equal(t, "grok-imagine", mapping["grok-imagine"])
|
|
require.Equal(t, "grok-imagine-image", mapping["grok-imagine-image"])
|
|
require.Equal(t, "grok-imagine-image-quality", mapping["grok-imagine-image-quality"])
|
|
require.Equal(t, "grok-imagine-edit", mapping["grok-imagine-edit"])
|
|
require.Equal(t, "grok-imagine-video", mapping["grok-imagine-video"])
|
|
require.Equal(t, "grok-imagine-video-1.5", mapping["grok-imagine-video-1.5"])
|
|
}
|