mirror of
https://github.com/Wei-Shaw/sub2api.git
synced 2026-11-05 16:47:26 +00:00
shaw
fce41e318f
Default codex_fingerprint_mode to off. v0.1.175 treated a missing key as "session", so upgrading silently rewrote installation/session/thread/turn/ window identifiers for every existing OAuth account that had never configured this field. The quota regressions in #5555, #5556 and #5582 line up with that version boundary, with A/B reports that rolling back to v0.1.173 restores quota. Convergence is now explicit opt-in (#5610). Only accounts that never set the field change behaviour; explicit off / device / session / full keep working exactly as configured. That required flipping the persistence condition in all three account modals from "!== 'session'" to "!== 'off'": the old rule deleted the key when it equalled the default, which after the flip would have silently discarded an administrator's explicit opt-in to session. Also extend convergence to the passthrough path, which previously left client identifiers untouched: - resolve the ids once in forwardOpenAIPassthrough and rewrite client_metadata on the raw bytes (gjson extract + sjson splice) because passthrough is a hot path that must not fully unmarshal multi-MB bodies; a shared core keeps the raw and map variants from drifting - both request builders apply the staged ids at the same relative position (after session isolation, before identity enforcement) so headers and body share one id set and turn_id stays consistent - stage the ids unconditionally, including nil: a failover from a converged account to an off account must not leave the previous account's ids behind
662 lines
26 KiB
Go
662 lines
26 KiB
Go
package service
|
||
|
||
import (
|
||
"context"
|
||
"encoding/json"
|
||
"net/http"
|
||
"net/http/httptest"
|
||
"testing"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
"github.com/google/uuid"
|
||
"github.com/stretchr/testify/assert"
|
||
"github.com/stretchr/testify/require"
|
||
)
|
||
|
||
func newTestOAuthAccount(id int64, extra map[string]any) *Account {
|
||
return &Account{
|
||
ID: id,
|
||
Platform: PlatformOpenAI,
|
||
Type: AccountTypeOAuth,
|
||
Extra: extra,
|
||
}
|
||
}
|
||
|
||
// --- deriveStableUUIDv4 ---
|
||
|
||
func TestDeriveStableUUIDv4_Deterministic(t *testing.T) {
|
||
a := deriveStableUUIDv4("test-seed-1")
|
||
b := deriveStableUUIDv4("test-seed-1")
|
||
assert.Equal(t, a, b, "同一种子应返回相同结果")
|
||
}
|
||
|
||
func TestDeriveStableUUIDv4_DifferentSeeds(t *testing.T) {
|
||
a := deriveStableUUIDv4("seed-a")
|
||
b := deriveStableUUIDv4("seed-b")
|
||
assert.NotEqual(t, a, b, "不同种子应返回不同结果")
|
||
}
|
||
|
||
func TestDeriveStableUUIDv4_ValidFormat(t *testing.T) {
|
||
result := deriveStableUUIDv4("test-seed")
|
||
parsed, err := uuid.Parse(result)
|
||
require.NoError(t, err, "应返回合法 UUID 格式")
|
||
assert.Equal(t, uuid.Version(4), parsed.Version(), "应为 UUIDv4")
|
||
assert.Equal(t, uuid.RFC4122, parsed.Variant(), "应为 RFC4122 变体")
|
||
}
|
||
|
||
// --- GetCodexFingerprintMode ---
|
||
|
||
func TestGetCodexFingerprintMode(t *testing.T) {
|
||
tests := []struct {
|
||
name string
|
||
account *Account
|
||
expected codexFingerprintMode
|
||
}{
|
||
{"nil 账号", nil, codexFingerprintOff},
|
||
{"非 OAuth 账号", &Account{Platform: PlatformOpenAI, Type: "api_key"}, codexFingerprintOff},
|
||
// 收敛是显式 opt-in：缺省/空/非法一律 off（#5610）。存量账号普遍没有这个
|
||
// extra 键，升级不得把它们静默切进收敛。
|
||
{"无 extra 默认 off", newTestOAuthAccount(1, nil), codexFingerprintOff},
|
||
{"空值默认 off", newTestOAuthAccount(1, map[string]any{codexFingerprintModeExtraKey: ""}), codexFingerprintOff},
|
||
{"非法值默认 off", newTestOAuthAccount(1, map[string]any{codexFingerprintModeExtraKey: "invalid"}), codexFingerprintOff},
|
||
{"显式 off", newTestOAuthAccount(1, map[string]any{codexFingerprintModeExtraKey: "off"}), codexFingerprintOff},
|
||
{"device", newTestOAuthAccount(1, map[string]any{codexFingerprintModeExtraKey: "device"}), codexFingerprintDevice},
|
||
{"session", newTestOAuthAccount(1, map[string]any{codexFingerprintModeExtraKey: "session"}), codexFingerprintSession},
|
||
{"full", newTestOAuthAccount(1, map[string]any{codexFingerprintModeExtraKey: "full"}), codexFingerprintFull},
|
||
}
|
||
for _, tt := range tests {
|
||
t.Run(tt.name, func(t *testing.T) {
|
||
assert.Equal(t, tt.expected, tt.account.GetCodexFingerprintMode())
|
||
})
|
||
}
|
||
}
|
||
|
||
// --- resolveConvergedInstallationID ---
|
||
|
||
func TestResolveConvergedInstallationID_UsesDeviceID(t *testing.T) {
|
||
account := newTestOAuthAccount(1, map[string]any{"openai_device_id": "real-device-id"})
|
||
assert.Equal(t, "real-device-id", resolveConvergedInstallationID(account))
|
||
}
|
||
|
||
func TestResolveConvergedInstallationID_DerivesFromAccountID(t *testing.T) {
|
||
account := newTestOAuthAccount(42, nil)
|
||
result := resolveConvergedInstallationID(account)
|
||
_, err := uuid.Parse(result)
|
||
require.NoError(t, err, "派生值应为合法 UUID")
|
||
assert.Equal(t, result, resolveConvergedInstallationID(account), "确定性")
|
||
}
|
||
|
||
func TestResolveConvergedInstallationID_DifferentAccounts(t *testing.T) {
|
||
a := resolveConvergedInstallationID(newTestOAuthAccount(1, nil))
|
||
b := resolveConvergedInstallationID(newTestOAuthAccount(2, nil))
|
||
assert.NotEqual(t, a, b)
|
||
}
|
||
|
||
// --- resolveConvergedThreadID ---
|
||
|
||
func TestResolveConvergedThreadID_PerClientSession(t *testing.T) {
|
||
account := newTestOAuthAccount(1, nil)
|
||
a := resolveConvergedThreadID(account, "session-aaa")
|
||
b := resolveConvergedThreadID(account, "session-bbb")
|
||
assert.NotEqual(t, a, b, "不同客户端 session 应得到不同 thread_id")
|
||
}
|
||
|
||
func TestResolveConvergedThreadID_Deterministic(t *testing.T) {
|
||
account := newTestOAuthAccount(1, nil)
|
||
a := resolveConvergedThreadID(account, "session-aaa")
|
||
b := resolveConvergedThreadID(account, "session-aaa")
|
||
assert.Equal(t, a, b, "同一客户端 session 应得到相同 thread_id")
|
||
}
|
||
|
||
func TestResolveConvergedThreadID_EmptySession(t *testing.T) {
|
||
account := newTestOAuthAccount(1, nil)
|
||
assert.Equal(t, "", resolveConvergedThreadID(account, ""))
|
||
}
|
||
|
||
// --- off 模式：resolveCodexFingerprintIDsFromRequest 返回 nil ---
|
||
|
||
func TestResolveCodexFingerprintIDsFromRequest_ExplicitOff(t *testing.T) {
|
||
account := newTestOAuthAccount(1, map[string]any{codexFingerprintModeExtraKey: "off"})
|
||
ids := resolveCodexFingerprintIDsFromRequest(account, nil)
|
||
assert.Nil(t, ids, "显式 off 模式应返回 nil")
|
||
}
|
||
|
||
// 未显式配置的存量账号不得被收敛（#5610）：默认返回 nil，出站身份保持
|
||
// v0.1.175 之前的客户端原值。
|
||
func TestResolveCodexFingerprintIDsFromRequest_DefaultIsOff(t *testing.T) {
|
||
account := newTestOAuthAccount(1, nil)
|
||
assert.Nil(t, resolveCodexFingerprintIDsFromRequest(account, nil), "无 extra 应视为 off")
|
||
}
|
||
|
||
// 管理员显式 opt-in 的账号行为不变。
|
||
func TestResolveCodexFingerprintIDsFromRequest_ExplicitOptInHonored(t *testing.T) {
|
||
for _, mode := range []string{"device", "session", "full"} {
|
||
t.Run(mode, func(t *testing.T) {
|
||
account := newTestOAuthAccount(1, map[string]any{codexFingerprintModeExtraKey: mode})
|
||
ids := resolveCodexFingerprintIDsFromRequest(account, nil)
|
||
require.NotNil(t, ids, "显式配置必须生效")
|
||
assert.Equal(t, codexFingerprintMode(mode), ids.mode)
|
||
assert.NotEmpty(t, ids.installationID)
|
||
})
|
||
}
|
||
}
|
||
|
||
// --- applyCodexFingerprintHeaders: off 模式 ---
|
||
|
||
func TestApplyCodexFingerprintHeaders_OffMode(t *testing.T) {
|
||
h := http.Header{}
|
||
h.Set("x-codex-installation-id", "original-install-id")
|
||
h.Set("x-codex-window-id", "original-window-id")
|
||
|
||
applyCodexFingerprintHeaders(h, nil)
|
||
|
||
assert.Equal(t, "original-install-id", h.Get("x-codex-installation-id"), "nil ids 不改写")
|
||
assert.Equal(t, "original-window-id", h.Get("x-codex-window-id"), "nil ids 不改写")
|
||
}
|
||
|
||
// --- applyCodexFingerprintHeaders: device 模式 ---
|
||
|
||
func TestApplyCodexFingerprintHeaders_DeviceMode(t *testing.T) {
|
||
account := newTestOAuthAccount(1, map[string]any{
|
||
codexFingerprintModeExtraKey: "device",
|
||
"openai_device_id": "converged-device",
|
||
})
|
||
turnMetadata := `{"installation_id":"user-install","session_id":"user-session","sandbox":"seccomp"}`
|
||
h := http.Header{}
|
||
h.Set("x-codex-installation-id", "user-install")
|
||
h.Set("x-codex-window-id", "user-window:0")
|
||
h.Set("x-codex-turn-metadata", turnMetadata)
|
||
|
||
ids := resolveCodexFingerprintIDsFromRequest(account, nil)
|
||
applyCodexFingerprintHeaders(h, ids)
|
||
|
||
assert.Equal(t, "converged-device", h.Get("x-codex-installation-id"), "installation_id 应收敛")
|
||
assert.Equal(t, "user-window:0", h.Get("x-codex-window-id"), "device 模式不改写 window_id")
|
||
|
||
var meta map[string]any
|
||
require.NoError(t, json.Unmarshal([]byte(h.Get("x-codex-turn-metadata")), &meta))
|
||
assert.Equal(t, "converged-device", meta["installation_id"])
|
||
assert.Equal(t, "user-session", meta["session_id"], "device 模式不改写 session_id")
|
||
assert.Equal(t, "seccomp", meta["sandbox"], "非指纹字段保留原样")
|
||
}
|
||
|
||
// --- applyCodexFingerprintHeaders: session 模式 ---
|
||
|
||
func TestApplyCodexFingerprintHeaders_SessionMode(t *testing.T) {
|
||
account := newTestOAuthAccount(1, map[string]any{
|
||
codexFingerprintModeExtraKey: "session",
|
||
})
|
||
clientHeaders := http.Header{}
|
||
clientHeaders.Set("session-id", "client-session-aaa")
|
||
|
||
turnMetadata := `{"installation_id":"user-install","session_id":"user-session","thread_id":"user-thread","turn_id":"user-turn","window_id":"user-thread:0","sandbox":"seccomp","thread_source":"user"}`
|
||
h := http.Header{}
|
||
h.Set("x-codex-installation-id", "user-install")
|
||
h.Set("x-codex-window-id", "user-thread:0")
|
||
h.Set("x-codex-turn-metadata", turnMetadata)
|
||
h.Set("x-client-request-id", "user-thread")
|
||
|
||
ids := resolveCodexFingerprintIDsFromRequest(account, clientHeaders)
|
||
applyCodexFingerprintHeaders(h, ids)
|
||
|
||
convergedInstall := resolveConvergedInstallationID(account)
|
||
convergedSession := resolveConvergedSessionID(account)
|
||
convergedThread := resolveConvergedThreadID(account, "client-session-aaa")
|
||
|
||
assert.Equal(t, convergedInstall, h.Get("x-codex-installation-id"))
|
||
assert.Equal(t, convergedSession, h.Get("session-id"))
|
||
assert.Equal(t, convergedSession, h.Get("session_id"), "下划线形式也应被改写")
|
||
assert.Equal(t, convergedThread, h.Get("thread-id"))
|
||
assert.Equal(t, convergedThread, h.Get("x-client-request-id"))
|
||
assert.Equal(t, convergedThread+":0", h.Get("x-codex-window-id"))
|
||
|
||
var meta map[string]any
|
||
require.NoError(t, json.Unmarshal([]byte(h.Get("x-codex-turn-metadata")), &meta))
|
||
assert.Equal(t, convergedInstall, meta["installation_id"])
|
||
assert.Equal(t, convergedSession, meta["session_id"])
|
||
assert.Equal(t, convergedThread, meta["thread_id"])
|
||
assert.NotEqual(t, "user-turn", meta["turn_id"], "turn_id 应被新生成的值替换")
|
||
assert.Equal(t, "seccomp", meta["sandbox"], "sandbox 保留原样")
|
||
assert.Equal(t, "user", meta["thread_source"], "thread_source 保留原样")
|
||
}
|
||
|
||
// --- session 模式：不同客户端得到不同 thread ---
|
||
|
||
func TestApplyCodexFingerprintHeaders_SessionMode_DifferentClients(t *testing.T) {
|
||
account := newTestOAuthAccount(1, map[string]any{
|
||
codexFingerprintModeExtraKey: "session",
|
||
})
|
||
|
||
makeTurnMeta := func() string {
|
||
return `{"installation_id":"x","session_id":"x","thread_id":"x","turn_id":"x","window_id":"x:0"}`
|
||
}
|
||
|
||
clientA := http.Header{}
|
||
clientA.Set("session-id", "client-A")
|
||
idsA := resolveCodexFingerprintIDsFromRequest(account, clientA)
|
||
hA := http.Header{}
|
||
hA.Set("x-codex-turn-metadata", makeTurnMeta())
|
||
applyCodexFingerprintHeaders(hA, idsA)
|
||
|
||
clientB := http.Header{}
|
||
clientB.Set("session-id", "client-B")
|
||
idsB := resolveCodexFingerprintIDsFromRequest(account, clientB)
|
||
hB := http.Header{}
|
||
hB.Set("x-codex-turn-metadata", makeTurnMeta())
|
||
applyCodexFingerprintHeaders(hB, idsB)
|
||
|
||
assert.Equal(t, hA.Get("session-id"), hB.Get("session-id"), "session_id 应相同")
|
||
assert.NotEqual(t, hA.Get("thread-id"), hB.Get("thread-id"), "不同客户端 thread_id 应不同")
|
||
assert.NotEqual(t, hA.Get("x-codex-window-id"), hB.Get("x-codex-window-id"), "不同客户端 window_id 应不同")
|
||
assert.Equal(t, hA.Get("x-codex-installation-id"), hB.Get("x-codex-installation-id"))
|
||
}
|
||
|
||
// --- full 模式 ---
|
||
|
||
func TestApplyCodexFingerprintHeaders_FullMode(t *testing.T) {
|
||
account := newTestOAuthAccount(1, map[string]any{
|
||
codexFingerprintModeExtraKey: "full",
|
||
})
|
||
convergedSession := resolveConvergedSessionID(account)
|
||
|
||
clientA := http.Header{}
|
||
clientA.Set("session-id", "client-A")
|
||
idsA := resolveCodexFingerprintIDsFromRequest(account, clientA)
|
||
hA := http.Header{}
|
||
hA.Set("x-codex-turn-metadata", `{"installation_id":"x","session_id":"x","thread_id":"x","turn_id":"x","window_id":"x:0"}`)
|
||
applyCodexFingerprintHeaders(hA, idsA)
|
||
|
||
clientB := http.Header{}
|
||
clientB.Set("session-id", "client-B")
|
||
idsB := resolveCodexFingerprintIDsFromRequest(account, clientB)
|
||
hB := http.Header{}
|
||
hB.Set("x-codex-turn-metadata", `{"installation_id":"x","session_id":"x","thread_id":"x","turn_id":"x","window_id":"x:0"}`)
|
||
applyCodexFingerprintHeaders(hB, idsB)
|
||
|
||
assert.Equal(t, hA.Get("thread-id"), hB.Get("thread-id"), "full 模式 thread_id 应相同")
|
||
assert.Equal(t, convergedSession, hA.Get("thread-id"), "full 模式 thread_id 应等于 session_id")
|
||
assert.Equal(t, hA.Get("x-codex-window-id"), hB.Get("x-codex-window-id"), "full 模式 window_id 应相同")
|
||
}
|
||
|
||
// --- H1 修复验证：头和体的 turn_id 一致性 ---
|
||
|
||
func TestFingerprintIDs_HeaderAndBody_TurnID_Consistent(t *testing.T) {
|
||
account := newTestOAuthAccount(1, map[string]any{
|
||
codexFingerprintModeExtraKey: "session",
|
||
})
|
||
clientHeaders := http.Header{}
|
||
clientHeaders.Set("session-id", "client-session-xyz")
|
||
|
||
ids := resolveCodexFingerprintIDsFromRequest(account, clientHeaders)
|
||
require.NotNil(t, ids)
|
||
|
||
// 头改写
|
||
h := http.Header{}
|
||
h.Set("x-codex-turn-metadata", `{"installation_id":"x","session_id":"x","thread_id":"x","turn_id":"x","window_id":"x:0"}`)
|
||
applyCodexFingerprintHeaders(h, ids)
|
||
|
||
// 体改写（使用同一份 ids）
|
||
reqBody := map[string]any{
|
||
"client_metadata": map[string]any{
|
||
"x-codex-installation-id": "x",
|
||
"session_id": "x",
|
||
"turn_id": "x",
|
||
"x-codex-turn-metadata": `{"installation_id":"x","session_id":"x","thread_id":"x","turn_id":"x","window_id":"x:0"}`,
|
||
},
|
||
}
|
||
applyCodexFingerprintClientMetadata(reqBody, ids)
|
||
|
||
// 从头 turn-metadata JSON 提取 turn_id
|
||
var headerMeta map[string]any
|
||
require.NoError(t, json.Unmarshal([]byte(h.Get("x-codex-turn-metadata")), &headerMeta))
|
||
headerTurnID, ok := headerMeta["turn_id"].(string)
|
||
require.True(t, ok, "头 turn-metadata 应包含 string 类型的 turn_id")
|
||
|
||
// 从体 client_metadata 提取 turn_id
|
||
cm, ok := reqBody["client_metadata"].(map[string]any)
|
||
require.True(t, ok, "请求体应包含 client_metadata")
|
||
bodyTurnID, ok := cm["turn_id"].(string)
|
||
require.True(t, ok, "体 client_metadata 应包含 string 类型的 turn_id")
|
||
|
||
// 从体内嵌 turn-metadata JSON 提取 turn_id
|
||
embeddedRaw, ok := cm["x-codex-turn-metadata"].(string)
|
||
require.True(t, ok, "体 client_metadata 应包含 x-codex-turn-metadata 字符串")
|
||
var bodyMeta map[string]any
|
||
require.NoError(t, json.Unmarshal([]byte(embeddedRaw), &bodyMeta))
|
||
bodyEmbeddedTurnID, ok := bodyMeta["turn_id"].(string)
|
||
require.True(t, ok, "体内嵌 turn-metadata 应包含 string 类型的 turn_id")
|
||
|
||
assert.Equal(t, headerTurnID, bodyTurnID, "头和体的 turn_id 必须一致")
|
||
assert.Equal(t, headerTurnID, bodyEmbeddedTurnID, "头和体内嵌 turn-metadata 的 turn_id 必须一致")
|
||
assert.Equal(t, ids.turnID, headerTurnID, "所有 turn_id 都应来自同一份 ids")
|
||
}
|
||
|
||
// --- applyCodexFingerprintClientMetadata ---
|
||
|
||
func TestApplyCodexFingerprintClientMetadata_OffMode(t *testing.T) {
|
||
reqBody := map[string]any{
|
||
"client_metadata": map[string]any{
|
||
"x-codex-installation-id": "original",
|
||
},
|
||
}
|
||
modified := applyCodexFingerprintClientMetadata(reqBody, nil)
|
||
assert.False(t, modified, "nil ids 不改写")
|
||
}
|
||
|
||
func TestApplyCodexFingerprintClientMetadata_DeviceMode(t *testing.T) {
|
||
account := newTestOAuthAccount(1, map[string]any{
|
||
codexFingerprintModeExtraKey: "device",
|
||
"openai_device_id": "converged-device",
|
||
})
|
||
ids := resolveCodexFingerprintIDsFromRequest(account, nil)
|
||
require.NotNil(t, ids)
|
||
|
||
embeddedMeta := `{"installation_id":"x","session_id":"user-session","sandbox":"seccomp"}`
|
||
reqBody := map[string]any{
|
||
"client_metadata": map[string]any{
|
||
"x-codex-installation-id": "original-install",
|
||
"session_id": "user-session",
|
||
"x-codex-turn-metadata": embeddedMeta,
|
||
},
|
||
}
|
||
|
||
modified := applyCodexFingerprintClientMetadata(reqBody, ids)
|
||
require.True(t, modified)
|
||
|
||
cm, ok := reqBody["client_metadata"].(map[string]any)
|
||
require.True(t, ok)
|
||
assert.Equal(t, "converged-device", cm["x-codex-installation-id"])
|
||
assert.Equal(t, "user-session", cm["session_id"], "device 模式不改 session_id")
|
||
|
||
turnMetaStr, ok := cm["x-codex-turn-metadata"].(string)
|
||
require.True(t, ok)
|
||
var meta map[string]any
|
||
require.NoError(t, json.Unmarshal([]byte(turnMetaStr), &meta))
|
||
assert.Equal(t, "converged-device", meta["installation_id"])
|
||
assert.Equal(t, "seccomp", meta["sandbox"], "非指纹字段保留原样")
|
||
}
|
||
|
||
func TestApplyCodexFingerprintClientMetadata_SessionMode(t *testing.T) {
|
||
account := newTestOAuthAccount(1, map[string]any{
|
||
codexFingerprintModeExtraKey: "session",
|
||
})
|
||
clientHeaders := http.Header{}
|
||
clientHeaders.Set("session-id", "client-session-aaa")
|
||
|
||
ids := resolveCodexFingerprintIDsFromRequest(account, clientHeaders)
|
||
require.NotNil(t, ids)
|
||
|
||
embeddedMeta := `{"installation_id":"x","session_id":"x","thread_id":"x","turn_id":"x","window_id":"x:0","sandbox":"seccomp"}`
|
||
reqBody := map[string]any{
|
||
"client_metadata": map[string]any{
|
||
"x-codex-installation-id": "original-install",
|
||
"session_id": "original-session",
|
||
"x-codex-turn-metadata": embeddedMeta,
|
||
},
|
||
}
|
||
|
||
modified := applyCodexFingerprintClientMetadata(reqBody, ids)
|
||
require.True(t, modified)
|
||
|
||
cm, ok := reqBody["client_metadata"].(map[string]any)
|
||
require.True(t, ok)
|
||
convergedInstall := resolveConvergedInstallationID(account)
|
||
convergedSession := resolveConvergedSessionID(account)
|
||
convergedThread := resolveConvergedThreadID(account, "client-session-aaa")
|
||
|
||
assert.Equal(t, convergedInstall, cm["x-codex-installation-id"])
|
||
assert.Equal(t, convergedSession, cm["session_id"])
|
||
assert.Equal(t, convergedThread, cm["thread_id"])
|
||
assert.Equal(t, convergedThread+":0", cm["x-codex-window-id"])
|
||
|
||
turnMetaStr, ok := cm["x-codex-turn-metadata"].(string)
|
||
require.True(t, ok)
|
||
var meta map[string]any
|
||
require.NoError(t, json.Unmarshal([]byte(turnMetaStr), &meta))
|
||
assert.Equal(t, convergedInstall, meta["installation_id"])
|
||
assert.Equal(t, convergedSession, meta["session_id"])
|
||
assert.Equal(t, "seccomp", meta["sandbox"], "非指纹字段保留原样")
|
||
}
|
||
|
||
func TestApplyCodexFingerprintClientMetadata_FullMode(t *testing.T) {
|
||
account := newTestOAuthAccount(1, map[string]any{
|
||
codexFingerprintModeExtraKey: "full",
|
||
})
|
||
clientHeaders := http.Header{}
|
||
clientHeaders.Set("session-id", "any-client")
|
||
|
||
ids := resolveCodexFingerprintIDsFromRequest(account, clientHeaders)
|
||
require.NotNil(t, ids)
|
||
|
||
reqBody := map[string]any{
|
||
"client_metadata": map[string]any{
|
||
"session_id": "x",
|
||
"thread_id": "x",
|
||
"x-codex-turn-metadata": `{"installation_id":"x","session_id":"x","thread_id":"x","turn_id":"x","window_id":"x:0"}`,
|
||
},
|
||
}
|
||
|
||
modified := applyCodexFingerprintClientMetadata(reqBody, ids)
|
||
require.True(t, modified)
|
||
|
||
cm, ok := reqBody["client_metadata"].(map[string]any)
|
||
require.True(t, ok)
|
||
convergedSession := resolveConvergedSessionID(account)
|
||
|
||
assert.Equal(t, convergedSession, cm["session_id"])
|
||
assert.Equal(t, convergedSession, cm["thread_id"], "full 模式 thread_id 应等于 session_id")
|
||
}
|
||
|
||
// --- extractClientSessionID ---
|
||
|
||
func TestExtractClientSessionID(t *testing.T) {
|
||
tests := []struct {
|
||
name string
|
||
headers http.Header
|
||
expected string
|
||
}{
|
||
{"连字符形式优先", func() http.Header {
|
||
h := http.Header{}
|
||
h.Set("session-id", "hyphen-form")
|
||
h.Set("session_id", "underscore-form")
|
||
return h
|
||
}(), "hyphen-form"},
|
||
{"回退到下划线形式", func() http.Header {
|
||
h := http.Header{}
|
||
h.Set("session_id", "underscore-form")
|
||
return h
|
||
}(), "underscore-form"},
|
||
{"都没有", http.Header{}, ""},
|
||
}
|
||
for _, tt := range tests {
|
||
t.Run(tt.name, func(t *testing.T) {
|
||
assert.Equal(t, tt.expected, extractClientSessionID(tt.headers))
|
||
})
|
||
}
|
||
}
|
||
|
||
// --- 透传路径：raw 字节版 client_metadata 改写 ---
|
||
|
||
// rawVsMapClientMetadata 用同一份 ids 分别跑 map 版与 raw 字节版，
|
||
// 返回两侧最终的 client_metadata 解码结果。
|
||
func rawVsMapClientMetadata(t *testing.T, body []byte, ids *codexFingerprintIDs) (map[string]any, map[string]any) {
|
||
t.Helper()
|
||
|
||
var decoded map[string]any
|
||
require.NoError(t, json.Unmarshal(body, &decoded))
|
||
applyCodexFingerprintClientMetadata(decoded, ids)
|
||
mapCM, _ := decoded["client_metadata"].(map[string]any)
|
||
|
||
rawBody, changed, err := applyCodexFingerprintClientMetadataRaw(body, ids)
|
||
require.NoError(t, err)
|
||
require.True(t, changed)
|
||
var rawDecoded map[string]any
|
||
require.NoError(t, json.Unmarshal(rawBody, &rawDecoded))
|
||
rawCM, _ := rawDecoded["client_metadata"].(map[string]any)
|
||
return mapCM, rawCM
|
||
}
|
||
|
||
func TestApplyCodexFingerprintClientMetadataRaw_MatchesMapVariant(t *testing.T) {
|
||
embedded := `{\"installation_id\":\"real-install\",\"session_id\":\"real-session\",\"sandbox\":\"seatbelt\"}`
|
||
bodies := map[string]string{
|
||
"no_client_metadata": `{"model":"gpt-5.6-sol","input":[],"stream":true}`,
|
||
"object_with_extras": `{"model":"gpt-5.6-sol","client_metadata":{"session_id":"client-session","traceparent":"00-abc-def-01","x-codex-turn-metadata":"` + embedded + `"},"stream":true}`,
|
||
"non_object_value": `{"model":"gpt-5.6-sol","client_metadata":"bogus","stream":true}`,
|
||
}
|
||
for _, mode := range []codexFingerprintMode{codexFingerprintDevice, codexFingerprintSession, codexFingerprintFull} {
|
||
account := newTestOAuthAccount(4242, nil)
|
||
ids := resolveCodexFingerprintIDs(account, "client-sess-raw", mode)
|
||
require.NotNil(t, ids)
|
||
for name, body := range bodies {
|
||
t.Run(string(mode)+"/"+name, func(t *testing.T) {
|
||
mapCM, rawCM := rawVsMapClientMetadata(t, []byte(body), ids)
|
||
assert.Equal(t, mapCM, rawCM, "raw 字节版与 map 版的 client_metadata 结果必须逐点一致")
|
||
})
|
||
}
|
||
}
|
||
}
|
||
|
||
func TestApplyCodexFingerprintClientMetadataRaw_PreservesUnrelatedFields(t *testing.T) {
|
||
account := newTestOAuthAccount(4243, nil)
|
||
ids := resolveCodexFingerprintIDs(account, "client-sess-preserve", codexFingerprintSession)
|
||
require.NotNil(t, ids)
|
||
|
||
body := []byte(`{"model":"gpt-5.6-sol","input":[{"type":"message","role":"user","content":"hi"}],"stream":true,"prompt_cache_key":"pck-1"}`)
|
||
out, changed, err := applyCodexFingerprintClientMetadataRaw(body, ids)
|
||
require.NoError(t, err)
|
||
require.True(t, changed)
|
||
|
||
var decoded map[string]any
|
||
require.NoError(t, json.Unmarshal(out, &decoded))
|
||
assert.Equal(t, "gpt-5.6-sol", decoded["model"])
|
||
assert.Equal(t, "pck-1", decoded["prompt_cache_key"])
|
||
assert.Equal(t, true, decoded["stream"])
|
||
cm, _ := decoded["client_metadata"].(map[string]any)
|
||
require.NotNil(t, cm)
|
||
assert.Equal(t, ids.sessionID, cm["session_id"])
|
||
assert.Equal(t, ids.turnID, cm["turn_id"])
|
||
}
|
||
|
||
func TestApplyCodexFingerprintClientMetadataRaw_Noop(t *testing.T) {
|
||
body := []byte(`{"model":"gpt-5.6-sol"}`)
|
||
out, changed, err := applyCodexFingerprintClientMetadataRaw(body, nil)
|
||
require.NoError(t, err)
|
||
assert.False(t, changed)
|
||
assert.Equal(t, body, out)
|
||
|
||
out, changed, err = applyCodexFingerprintClientMetadataRaw(nil, &codexFingerprintIDs{mode: codexFingerprintSession, installationID: "x"})
|
||
require.NoError(t, err)
|
||
assert.False(t, changed)
|
||
assert.Nil(t, out)
|
||
}
|
||
|
||
// --- context 暂存与出站头应用（透传/非透传共用 seam）---
|
||
|
||
func newFingerprintStageTestContext(t *testing.T) *gin.Context {
|
||
t.Helper()
|
||
gin.SetMode(gin.TestMode)
|
||
c, _ := gin.CreateTestContext(httptest.NewRecorder())
|
||
c.Request = httptest.NewRequest(http.MethodPost, "/v1/responses", nil)
|
||
return c
|
||
}
|
||
|
||
func TestStageCodexFingerprintIDs_NilOverwritesPreviousAccount(t *testing.T) {
|
||
c := newFingerprintStageTestContext(t)
|
||
accountA := newTestOAuthAccount(1001, nil)
|
||
idsA := resolveCodexFingerprintIDs(accountA, "sess-x", codexFingerprintSession)
|
||
require.NotNil(t, idsA)
|
||
stageCodexFingerprintIDs(c, idsA)
|
||
|
||
// failover 切到 off 模式账号：无条件覆写为 nil，上一账号 IDs 不得残留
|
||
stageCodexFingerprintIDs(c, nil)
|
||
|
||
h := http.Header{}
|
||
h.Set("session_id", "isolated-session")
|
||
accountB := newTestOAuthAccount(1002, map[string]any{"codex_fingerprint_mode": "off"})
|
||
applyStagedCodexFingerprintHeaders(c, accountB, h)
|
||
assert.Equal(t, "isolated-session", h.Get("session_id"), "off 账号不得应用上一账号的收敛 ID")
|
||
assert.Empty(t, h.Get("x-codex-installation-id"))
|
||
}
|
||
|
||
func TestApplyStagedCodexFingerprintHeaders_SkipsNonOAuthAccount(t *testing.T) {
|
||
c := newFingerprintStageTestContext(t)
|
||
oauthIDs := resolveCodexFingerprintIDs(newTestOAuthAccount(1003, nil), "sess-y", codexFingerprintSession)
|
||
require.NotNil(t, oauthIDs)
|
||
stageCodexFingerprintIDs(c, oauthIDs)
|
||
|
||
h := http.Header{}
|
||
apiKeyAccount := &Account{ID: 1004, Platform: PlatformOpenAI, Type: AccountTypeAPIKey}
|
||
applyStagedCodexFingerprintHeaders(c, apiKeyAccount, h)
|
||
assert.Empty(t, h.Get("x-codex-installation-id"), "stale 收敛 ID 不得应用到非 OAuth 账号")
|
||
}
|
||
|
||
func TestBuildUpstreamRequestOpenAIPassthrough_AppliesStagedFingerprint(t *testing.T) {
|
||
svc := &OpenAIGatewayService{}
|
||
// 收敛是显式 opt-in（#5610）：显式开启后验证透传路径的出站头收敛。
|
||
account := newTestOAuthAccount(2001, map[string]any{
|
||
"openai_oauth_passthrough": true,
|
||
"codex_fingerprint_mode": "session",
|
||
})
|
||
|
||
c := newFingerprintStageTestContext(t)
|
||
c.Request.Header.Set("session_id", "real-client-session")
|
||
c.Request.Header.Set("User-Agent", "codex_cli_rs/0.144.1 (Ubuntu 22.4.0; x86_64) xterm-256color")
|
||
c.Request.Header.Set("originator", "codex_cli_rs")
|
||
c.Request.Header.Set("x-codex-turn-metadata", `{"installation_id":"real-install","session_id":"real-session","sandbox":"seatbelt"}`)
|
||
|
||
// 复刻 forwardOpenAIPassthrough 的解析+暂存 seam（默认 session 模式）
|
||
ids := resolveCodexFingerprintIDsFromRequest(account, c.Request.Header)
|
||
require.NotNil(t, ids)
|
||
stageCodexFingerprintIDs(c, ids)
|
||
|
||
body := []byte(`{"model":"gpt-5.6-sol","input":[],"stream":true}`)
|
||
req, err := svc.buildUpstreamRequestOpenAIPassthrough(context.Background(), c, account, body, "test-token")
|
||
require.NoError(t, err)
|
||
|
||
assert.Equal(t, ids.sessionID, req.Header.Get("session_id"), "session 模式下出站 session_id 应为账号级收敛值")
|
||
assert.Equal(t, ids.installationID, req.Header.Get("x-codex-installation-id"))
|
||
assert.Equal(t, ids.windowID, req.Header.Get("x-codex-window-id"))
|
||
assert.Equal(t, ids.threadID, req.Header.Get("x-client-request-id"))
|
||
turnMetadata := req.Header.Get("x-codex-turn-metadata")
|
||
require.NotEmpty(t, turnMetadata)
|
||
assert.Contains(t, turnMetadata, ids.sessionID, "turn-metadata JSON 中的 session_id 应被收敛")
|
||
assert.Contains(t, turnMetadata, `"sandbox":"seatbelt"`, "turn-metadata 未指定字段应原样保留")
|
||
}
|
||
|
||
func TestBuildUpstreamRequestOpenAIPassthrough_OffModeKeepsIsolatedSession(t *testing.T) {
|
||
svc := &OpenAIGatewayService{}
|
||
account := newTestOAuthAccount(2002, map[string]any{
|
||
"openai_oauth_passthrough": true,
|
||
"codex_fingerprint_mode": "off",
|
||
})
|
||
|
||
c := newFingerprintStageTestContext(t)
|
||
c.Request.Header.Set("session_id", "real-client-session")
|
||
c.Request.Header.Set("originator", "codex_cli_rs")
|
||
|
||
ids := resolveCodexFingerprintIDsFromRequest(account, c.Request.Header)
|
||
require.Nil(t, ids)
|
||
stageCodexFingerprintIDs(c, ids)
|
||
|
||
body := []byte(`{"model":"gpt-5.6-sol","input":[],"stream":true}`)
|
||
req, err := svc.buildUpstreamRequestOpenAIPassthrough(context.Background(), c, account, body, "test-token")
|
||
require.NoError(t, err)
|
||
|
||
assert.NotEmpty(t, req.Header.Get("session_id"))
|
||
assert.NotEqual(t, resolveConvergedSessionID(account), req.Header.Get("session_id"), "off 模式不得收敛 session_id")
|
||
assert.Empty(t, req.Header.Get("x-codex-window-id"))
|
||
}
|
||
|
||
func TestApplyCodexFingerprintClientMetadataRaw_NonObjectBodyUntouched(t *testing.T) {
|
||
account := newTestOAuthAccount(4244, nil)
|
||
ids := resolveCodexFingerprintIDs(account, "client-sess-nonobj", codexFingerprintSession)
|
||
require.NotNil(t, ids)
|
||
|
||
for _, body := range []string{`[1,2,3]`, `"plain string"`, `not json at all`} {
|
||
out, changed, err := applyCodexFingerprintClientMetadataRaw([]byte(body), ids)
|
||
require.NoError(t, err)
|
||
assert.False(t, changed, "非 JSON 对象 body 不应被改写: %s", body)
|
||
assert.Equal(t, []byte(body), out)
|
||
}
|
||
}
|