92 lines
3.0 KiB
TypeScript
92 lines
3.0 KiB
TypeScript
import { strict as assert } from 'node:assert';
|
|
import { randomBytes } from 'node:crypto';
|
|
import { describe, it } from 'node:test';
|
|
import type { Config } from '../src/lib/config';
|
|
import {
|
|
inviteMetadata,
|
|
isInferenceEndpoint,
|
|
memberAccessSchema,
|
|
platformSettingsResponse,
|
|
platformSettingsSchema,
|
|
} from '../src/routes/admin-settings';
|
|
import { decryptSecret, encryptSecret, SecretConfigurationError } from '../src/lib/secrets';
|
|
|
|
describe('admin settings decisions', () => {
|
|
it('keeps inference separate from the Prime compute API host', () => {
|
|
assert.equal(isInferenceEndpoint('https://api.pinference.ai/api/v1'), true);
|
|
assert.equal(isInferenceEndpoint('https://api.primeintellect.ai'), false);
|
|
assert.equal(
|
|
platformSettingsSchema.safeParse({
|
|
piggyInferenceBase: 'https://api.primeintellect.ai/v1',
|
|
}).success,
|
|
false,
|
|
);
|
|
});
|
|
|
|
it('encrypts credentials with authenticated random envelopes and requires an external key', () => {
|
|
const key = randomBytes(32).toString('base64');
|
|
const first = encryptSecret('prime-secret', key);
|
|
const second = encryptSecret('prime-secret', key);
|
|
assert.notEqual(first, second);
|
|
assert.equal(decryptSecret(first, key), 'prime-secret');
|
|
assert.throws(
|
|
() => encryptSecret('prime-secret', undefined),
|
|
(error: unknown) => error instanceof SecretConfigurationError,
|
|
);
|
|
});
|
|
|
|
it('never returns a stored key, ciphertext, or invite hash in metadata', () => {
|
|
const now = new Date('2026-08-12T12:00:00.000Z');
|
|
const settings = platformSettingsResponse(
|
|
{
|
|
id: 'default',
|
|
piggyModel: 'nvidia/nemotron-3-nano-30b-a3b',
|
|
piggyInferenceBase: 'https://api.pinference.ai/api/v1',
|
|
piggyEnabled: true,
|
|
primeApiKeyEncrypted: 'v1.iv.tag.ciphertext',
|
|
primeApiKeyUpdatedAt: now,
|
|
primeSyncEnabled: true,
|
|
primeSyncIntervalMinutes: 30,
|
|
updatedByUserId: null,
|
|
updatedAt: now,
|
|
},
|
|
{
|
|
PRIME_API_KEY: 'environment-secret',
|
|
PRIME_API_BASE: 'https://api.primeintellect.ai',
|
|
} as Config,
|
|
);
|
|
assert.equal(JSON.stringify(settings).includes('ciphertext'), false);
|
|
assert.equal(JSON.stringify(settings).includes('environment-secret'), false);
|
|
|
|
const invite = inviteMetadata({
|
|
id: '00000000-0000-0000-0000-000000000001',
|
|
codeHash: 'never-return-this',
|
|
email: null,
|
|
team: null,
|
|
role: 'member',
|
|
createdByUserId: null,
|
|
expiresAt: null,
|
|
usesRemaining: 1,
|
|
scopeNote: null,
|
|
redeemedByUserId: null,
|
|
redeemedAt: null,
|
|
revokedAt: null,
|
|
createdAt: now,
|
|
});
|
|
assert.equal('codeHash' in invite, false);
|
|
});
|
|
|
|
it('rejects duplicate team assignments rather than depending on a database conflict', () => {
|
|
assert.equal(
|
|
memberAccessSchema.safeParse({
|
|
isPlatformAdmin: false,
|
|
memberships: [
|
|
{ team: 'supply', role: 'member' },
|
|
{ team: 'supply', role: 'admin' },
|
|
],
|
|
}).success,
|
|
false,
|
|
);
|
|
});
|
|
});
|