Something went wrong. Try again.
sloproxy
Something went wrong. Try again.
52 kB · 1764 lines
Go
at main
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765package watcher
import ( "context" "crypto/sha256" "encoding/json" "fmt" "os" "path/filepath" "strings" "sync" "sync/atomic" "testing" "time"
"github.com/fsnotify/fsnotify" "github.com/router-for-me/CLIProxyAPI/v7/internal/config" "github.com/router-for-me/CLIProxyAPI/v7/internal/redisqueue" "github.com/router-for-me/CLIProxyAPI/v7/internal/watcher/diff" "github.com/router-for-me/CLIProxyAPI/v7/internal/watcher/synthesizer" sdkAuth "github.com/router-for-me/CLIProxyAPI/v7/sdk/auth" coreauth "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/auth" "gopkg.in/yaml.v3")
func TestApplyAuthExcludedModelsMeta_APIKey(t *testing.T) { auth := &coreauth.Auth{Attributes: map[string]string{}} cfg := &config.Config{} perKey := []string{" Model-1 ", "model-2"}
synthesizer.ApplyAuthExcludedModelsMeta(auth, cfg, perKey, "apikey")
expected := diff.ComputeExcludedModelsHash([]string{"model-1", "model-2"}) if got := auth.Attributes["excluded_models_hash"]; got != expected { t.Fatalf("expected hash %s, got %s", expected, got) } if got := auth.Attributes["auth_kind"]; got != "apikey" { t.Fatalf("expected auth_kind=apikey, got %s", got) }}
func TestApplyAuthExcludedModelsMeta_OAuthProvider(t *testing.T) { auth := &coreauth.Auth{ Provider: "TestProv", Attributes: map[string]string{}, } cfg := &config.Config{ OAuthExcludedModels: map[string][]string{ "testprov": {"A", "b"}, }, }
synthesizer.ApplyAuthExcludedModelsMeta(auth, cfg, nil, "oauth")
expected := diff.ComputeExcludedModelsHash([]string{"a", "b"}) if got := auth.Attributes["excluded_models_hash"]; got != expected { t.Fatalf("expected hash %s, got %s", expected, got) } if got := auth.Attributes["auth_kind"]; got != "oauth" { t.Fatalf("expected auth_kind=oauth, got %s", got) }}
func TestBuildAPIKeyClientsCounts(t *testing.T) { cfg := &config.Config{ GeminiKey: []config.GeminiKey{{APIKey: "g1"}, {APIKey: "g2"}}, InteractionsKey: []config.GeminiKey{{APIKey: "i1"}}, VertexCompatAPIKey: []config.VertexCompatKey{ {APIKey: "v1"}, }, ClaudeKey: []config.ClaudeKey{{APIKey: "c1"}}, CodexKey: []config.CodexKey{{APIKey: "c1"}, {APIKey: "c2"}}, XAIKey: []config.XAIKey{{APIKey: "x1"}}, OpenAICompatibility: []config.OpenAICompatibility{ {APIKeyEntries: []config.OpenAICompatibilityAPIKey{{APIKey: "o1"}, {APIKey: "o2"}}}, }, }
gemini, vertex, claude, codex, xai, compat := BuildAPIKeyClients(cfg) if gemini != 3 || vertex != 1 || claude != 1 || codex != 2 || xai != 1 || compat != 2 { t.Fatalf("unexpected counts: %d %d %d %d %d %d", gemini, vertex, claude, codex, xai, compat) }}
func TestNormalizeAuthStripsTemporalFields(t *testing.T) { now := time.Now() auth := &coreauth.Auth{ CreatedAt: now, UpdatedAt: now, LastRefreshedAt: now, NextRefreshAfter: now, Quota: coreauth.QuotaState{ NextRecoverAt: now, }, Runtime: map[string]any{"k": "v"}, }
normalized := normalizeAuth(auth) if !normalized.CreatedAt.IsZero() || !normalized.UpdatedAt.IsZero() || !normalized.LastRefreshedAt.IsZero() || !normalized.NextRefreshAfter.IsZero() { t.Fatal("expected time fields to be zeroed") } if normalized.Runtime != nil { t.Fatal("expected runtime to be nil") } if !normalized.Quota.NextRecoverAt.IsZero() { t.Fatal("expected quota.NextRecoverAt to be zeroed") }}
func TestMatchProvider(t *testing.T) { if _, ok := matchProvider("OpenAI", []string{"openai", "claude"}); !ok { t.Fatal("expected match to succeed ignoring case") } if _, ok := matchProvider("missing", []string{"openai"}); ok { t.Fatal("expected match to fail for unknown provider") }}
func TestSnapshotCoreAuths_ConfigAndAuthFiles(t *testing.T) { authDir := t.TempDir() metadata := map[string]any{ "type": "gemini", "email": "user@example.com", "project_id": "proj-a, proj-b", "proxy_url": "https://proxy", } authFile := filepath.Join(authDir, "gemini.json") data, err := json.Marshal(metadata) if err != nil { t.Fatalf("failed to marshal metadata: %v", err) } if err = os.WriteFile(authFile, data, 0o644); err != nil { t.Fatalf("failed to write auth file: %v", err) }
cfg := &config.Config{ AuthDir: authDir, GeminiKey: []config.GeminiKey{ { APIKey: "g-key", BaseURL: "https://gemini", ExcludedModels: []string{"Model-A", "model-b"}, Headers: map[string]string{"X-Req": "1"}, }, }, }
w := &Watcher{authDir: authDir} w.SetConfig(cfg)
auths := w.SnapshotCoreAuths() if len(auths) != 1 { t.Fatalf("expected 1 config auth entry, got %d", len(auths)) }
var geminiAPIKeyAuth *coreauth.Auth for _, a := range auths { if a.Provider == "gemini" && a.Attributes["api_key"] == "g-key" { geminiAPIKeyAuth = a } } if geminiAPIKeyAuth == nil { t.Fatal("expected synthesized Gemini API key auth") } expectedAPIKeyHash := diff.ComputeExcludedModelsHash([]string{"Model-A", "model-b"}) if geminiAPIKeyAuth.Attributes["excluded_models_hash"] != expectedAPIKeyHash { t.Fatalf("expected API key excluded hash %s, got %s", expectedAPIKeyHash, geminiAPIKeyAuth.Attributes["excluded_models_hash"]) } if geminiAPIKeyAuth.Attributes["auth_kind"] != "apikey" { t.Fatalf("expected auth_kind=apikey, got %s", geminiAPIKeyAuth.Attributes["auth_kind"]) }}
func TestReloadConfigIfChanged_TriggersOnChangeAndSkipsUnchanged(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) }
configPath := filepath.Join(tmpDir, "config.yaml") writeConfig := func(port int, allowRemote bool) { cfg := &config.Config{ Port: port, AuthDir: authDir, CredentialInFlight: config.DefaultCredentialInFlightConfig(), RemoteManagement: config.RemoteManagement{ AllowRemote: allowRemote, }, } data, err := yaml.Marshal(cfg) if err != nil { t.Fatalf("failed to marshal config: %v", err) } if err = os.WriteFile(configPath, data, 0o644); err != nil { t.Fatalf("failed to write config: %v", err) } }
writeConfig(8080, false)
reloads := 0 w := &Watcher{ configPath: configPath, authDir: authDir, reloadCallback: func(*config.Config) { reloads++ }, }
w.reloadConfigIfChanged() if reloads != 1 { t.Fatalf("expected first reload to trigger callback once, got %d", reloads) }
// Same content should be skipped by hash check. w.reloadConfigIfChanged() if reloads != 1 { t.Fatalf("expected unchanged config to be skipped, callback count %d", reloads) }
writeConfig(9090, true) w.reloadConfigIfChanged() if reloads != 2 { t.Fatalf("expected changed config to trigger reload, callback count %d", reloads) } w.clientsMutex.RLock() defer w.clientsMutex.RUnlock() if w.config == nil || w.config.Port != 9090 || !w.config.RemoteManagement.AllowRemote { t.Fatalf("expected config to be updated after reload, got %+v", w.config) }}
func TestStartAndStopSuccess(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) } configPath := filepath.Join(tmpDir, "config.yaml") if err := os.WriteFile(configPath, []byte("auth_dir: "+authDir), 0o644); err != nil { t.Fatalf("failed to create config file: %v", err) }
var reloads int32 w, err := NewWatcher(configPath, authDir, func(*config.Config) { atomic.AddInt32(&reloads, 1) }) if err != nil { t.Fatalf("failed to create watcher: %v", err) } w.SetConfig(&config.Config{AuthDir: authDir})
ctx, cancel := context.WithCancel(context.Background()) defer cancel()
if err := w.Start(ctx); err != nil { t.Fatalf("expected Start to succeed: %v", err) } cancel() if err := w.Stop(); err != nil { t.Fatalf("expected Stop to succeed: %v", err) } if got := atomic.LoadInt32(&reloads); got != 1 { t.Fatalf("expected one reload callback, got %d", got) }}
func TestStartFailsWhenConfigMissing(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) } configPath := filepath.Join(tmpDir, "missing-config.yaml")
w, err := NewWatcher(configPath, authDir, nil) if err != nil { t.Fatalf("failed to create watcher: %v", err) } defer w.Stop()
ctx, cancel := context.WithCancel(context.Background()) defer cancel()
if err := w.Start(ctx); err == nil { t.Fatal("expected Start to fail for missing config file") }}
func TestDispatchRuntimeAuthUpdateEnqueuesAndUpdatesState(t *testing.T) { queue := make(chan AuthUpdate, 4) w := &Watcher{} w.SetAuthUpdateQueue(queue) defer w.stopDispatch()
auth := &coreauth.Auth{ID: "auth-1", Provider: "test"} if ok := w.DispatchRuntimeAuthUpdate(AuthUpdate{Action: AuthUpdateActionAdd, Auth: auth}); !ok { t.Fatal("expected DispatchRuntimeAuthUpdate to enqueue") }
select { case update := <-queue: if update.Action != AuthUpdateActionAdd || update.Auth.ID != "auth-1" { t.Fatalf("unexpected update: %+v", update) } case <-time.After(2 * time.Second): t.Fatal("timed out waiting for auth update") }
if ok := w.DispatchRuntimeAuthUpdate(AuthUpdate{Action: AuthUpdateActionDelete, ID: "auth-1"}); !ok { t.Fatal("expected delete update to enqueue") } select { case update := <-queue: if update.Action != AuthUpdateActionDelete || update.ID != "auth-1" { t.Fatalf("unexpected delete update: %+v", update) } case <-time.After(2 * time.Second): t.Fatal("timed out waiting for delete update") } w.clientsMutex.RLock() if _, exists := w.runtimeAuths["auth-1"]; exists { w.clientsMutex.RUnlock() t.Fatal("expected runtime auth to be cleared after delete") } w.clientsMutex.RUnlock()}
func TestAddOrUpdateClientSkipsUnchanged(t *testing.T) { tmpDir := t.TempDir() authFile := filepath.Join(tmpDir, "sample.json") if err := os.WriteFile(authFile, []byte(`{"type":"demo"}`), 0o644); err != nil { t.Fatalf("failed to create auth file: %v", err) } data, _ := os.ReadFile(authFile) sum := sha256.Sum256(data)
var reloads int32 w := &Watcher{ authDir: tmpDir, lastAuthHashes: make(map[string]string), reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, } w.SetConfig(&config.Config{AuthDir: tmpDir}) // Use normalizeAuthPath to match how addOrUpdateClient stores the key w.lastAuthHashes[w.normalizeAuthPath(authFile)] = hexString(sum[:])
w.addOrUpdateClient(authFile) if got := atomic.LoadInt32(&reloads); got != 0 { t.Fatalf("expected no reload for unchanged file, got %d", got) }}
func TestAddOrUpdateClientTriggersReloadAndHash(t *testing.T) { tmpDir := t.TempDir() authFile := filepath.Join(tmpDir, "sample.json") if err := os.WriteFile(authFile, []byte(`{"type":"demo","api_key":"k"}`), 0o644); err != nil { t.Fatalf("failed to create auth file: %v", err) }
var reloads int32 w := &Watcher{ authDir: tmpDir, lastAuthHashes: make(map[string]string), reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, } w.SetConfig(&config.Config{AuthDir: tmpDir})
w.addOrUpdateClient(authFile)
if got := atomic.LoadInt32(&reloads); got != 0 { t.Fatalf("expected no reload callback for auth update, got %d", got) } // Use normalizeAuthPath to match how addOrUpdateClient stores the key normalized := w.normalizeAuthPath(authFile) if _, ok := w.lastAuthHashes[normalized]; !ok { t.Fatalf("expected hash to be stored for %s", normalized) }}
func TestRemoveClientRemovesHash(t *testing.T) { tmpDir := t.TempDir() authFile := filepath.Join(tmpDir, "sample.json") var reloads int32
w := &Watcher{ authDir: tmpDir, lastAuthHashes: make(map[string]string), reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, } w.SetConfig(&config.Config{AuthDir: tmpDir}) // Use normalizeAuthPath to set up the hash with the correct key format w.lastAuthHashes[w.normalizeAuthPath(authFile)] = "hash"
w.removeClient(authFile) if _, ok := w.lastAuthHashes[w.normalizeAuthPath(authFile)]; ok { t.Fatal("expected hash to be removed after deletion") } if got := atomic.LoadInt32(&reloads); got != 0 { t.Fatalf("expected no reload callback for auth removal, got %d", got) }}
func TestAuthFileClientChangesNotifyUsageSubscribersToRefresh(t *testing.T) { tmpDir := t.TempDir() authFile := filepath.Join(tmpDir, "sample.json") if err := os.WriteFile(authFile, []byte(`{"type":"demo","api_key":"k"}`), 0o644); err != nil { t.Fatalf("failed to create auth file: %v", err) }
redisqueue.SetEnabled(false) redisqueue.SetEnabled(true) t.Cleanup(func() { redisqueue.SetEnabled(false) })
subscriber, unsubscribe := redisqueue.SubscribeUsage() defer unsubscribe() requireWatcherUsagePayload(t, subscriber, `{"support_refresh":true}`)
w := &Watcher{ authDir: tmpDir, lastAuthHashes: make(map[string]string), } w.SetConfig(&config.Config{AuthDir: tmpDir})
w.addOrUpdateClient(authFile) requireWatcherUsagePayload(t, subscriber, `{"refresh":true}`)
w.removeClient(authFile) requireWatcherUsagePayload(t, subscriber, `{"refresh":true}`)}
func TestAuthFileEventsDoNotInvokeSnapshotCoreAuths(t *testing.T) { tmpDir := t.TempDir() authFile := filepath.Join(tmpDir, "sample.json") if err := os.WriteFile(authFile, []byte(`{"type":"codex","email":"u@example.com"}`), 0o644); err != nil { t.Fatalf("failed to create auth file: %v", err) }
origSnapshot := snapshotCoreAuthsFunc var snapshotCalls int32 snapshotCoreAuthsFunc = func(cfg *config.Config, authDir string, parser synthesizer.PluginAuthParser) []*coreauth.Auth { atomic.AddInt32(&snapshotCalls, 1) return origSnapshot(cfg, authDir, parser) } defer func() { snapshotCoreAuthsFunc = origSnapshot }()
w := &Watcher{ authDir: tmpDir, lastAuthHashes: make(map[string]string), lastAuthContents: make(map[string]*coreauth.Auth), fileAuthsByPath: make(map[string]map[string]*coreauth.Auth), } w.SetConfig(&config.Config{AuthDir: tmpDir})
w.addOrUpdateClient(authFile) w.removeClient(authFile)
if got := atomic.LoadInt32(&snapshotCalls); got != 0 { t.Fatalf("expected auth file events to avoid full snapshot, got %d calls", got) }}
func TestAuthSliceToMap(t *testing.T) { t.Parallel()
valid1 := &coreauth.Auth{ID: "a"} valid2 := &coreauth.Auth{ID: "b"} dupOld := &coreauth.Auth{ID: "dup", Label: "old"} dupNew := &coreauth.Auth{ID: "dup", Label: "new"} empty := &coreauth.Auth{ID: " "}
tests := []struct { name string in []*coreauth.Auth want map[string]*coreauth.Auth }{ { name: "nil input", in: nil, want: map[string]*coreauth.Auth{}, }, { name: "empty input", in: []*coreauth.Auth{}, want: map[string]*coreauth.Auth{}, }, { name: "filters invalid auths", in: []*coreauth.Auth{nil, empty}, want: map[string]*coreauth.Auth{}, }, { name: "keeps valid auths", in: []*coreauth.Auth{valid1, nil, valid2}, want: map[string]*coreauth.Auth{"a": valid1, "b": valid2}, }, { name: "last duplicate wins", in: []*coreauth.Auth{dupOld, dupNew}, want: map[string]*coreauth.Auth{"dup": dupNew}, }, }
for _, tc := range tests { tc := tc t.Run(tc.name, func(t *testing.T) { t.Parallel() got := authSliceToMap(tc.in) if len(tc.want) == 0 { if got == nil { t.Fatal("expected empty map, got nil") } if len(got) != 0 { t.Fatalf("expected empty map, got %#v", got) } return } if len(got) != len(tc.want) { t.Fatalf("unexpected map length: got %d, want %d", len(got), len(tc.want)) } for id, wantAuth := range tc.want { gotAuth, ok := got[id] if !ok { t.Fatalf("missing id %q in result map", id) } if !authEqual(gotAuth, wantAuth) { t.Fatalf("unexpected auth for id %q: got %#v, want %#v", id, gotAuth, wantAuth) } } }) }}
func TestTriggerServerUpdateCancelsPendingTimerOnImmediate(t *testing.T) { tmpDir := t.TempDir() cfg := &config.Config{AuthDir: tmpDir}
var reloads int32 w := &Watcher{ reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, } w.SetConfig(cfg)
w.serverUpdateMu.Lock() w.serverUpdateLast = time.Now().Add(-(serverUpdateDebounce - 100*time.Millisecond)) w.serverUpdateMu.Unlock() w.triggerServerUpdate(cfg)
if got := atomic.LoadInt32(&reloads); got != 0 { t.Fatalf("expected no immediate reload, got %d", got) }
w.serverUpdateMu.Lock() if !w.serverUpdatePend || w.serverUpdateTimer == nil { w.serverUpdateMu.Unlock() t.Fatal("expected a pending server update timer") } w.serverUpdateLast = time.Now().Add(-(serverUpdateDebounce + 10*time.Millisecond)) w.serverUpdateMu.Unlock()
w.triggerServerUpdate(cfg) if got := atomic.LoadInt32(&reloads); got != 1 { t.Fatalf("expected immediate reload once, got %d", got) }
time.Sleep(250 * time.Millisecond) if got := atomic.LoadInt32(&reloads); got != 1 { t.Fatalf("expected pending timer to be cancelled, got %d reloads", got) }}
func TestShouldDebounceRemove(t *testing.T) { w := &Watcher{} path := filepath.Clean("test.json")
if w.shouldDebounceRemove(path, time.Now()) { t.Fatal("first call should not debounce") } if !w.shouldDebounceRemove(path, time.Now()) { t.Fatal("second call within window should debounce") }
w.clientsMutex.Lock() w.lastRemoveTimes = map[string]time.Time{path: time.Now().Add(-2 * authRemoveDebounceWindow)} w.clientsMutex.Unlock()
if w.shouldDebounceRemove(path, time.Now()) { t.Fatal("call after window should not debounce") }}
func TestAuthFileUnchangedUsesHash(t *testing.T) { tmpDir := t.TempDir() authFile := filepath.Join(tmpDir, "sample.json") content := []byte(`{"type":"demo"}`) if err := os.WriteFile(authFile, content, 0o644); err != nil { t.Fatalf("failed to write auth file: %v", err) }
w := &Watcher{lastAuthHashes: make(map[string]string)} unchanged, err := w.authFileUnchanged(authFile) if err != nil { t.Fatalf("unexpected error: %v", err) } if unchanged { t.Fatal("expected first check to report changed") }
sum := sha256.Sum256(content) // Use normalizeAuthPath to match how authFileUnchanged looks up the key w.lastAuthHashes[w.normalizeAuthPath(authFile)] = hexString(sum[:])
unchanged, err = w.authFileUnchanged(authFile) if err != nil { t.Fatalf("unexpected error: %v", err) } if !unchanged { t.Fatal("expected hash match to report unchanged") }}
func TestAuthFileUnchangedEmptyAndMissing(t *testing.T) { tmpDir := t.TempDir() emptyFile := filepath.Join(tmpDir, "empty.json") if err := os.WriteFile(emptyFile, []byte(""), 0o644); err != nil { t.Fatalf("failed to write empty auth file: %v", err) }
w := &Watcher{lastAuthHashes: make(map[string]string)} unchanged, err := w.authFileUnchanged(emptyFile) if err != nil { t.Fatalf("unexpected error for empty file: %v", err) } if unchanged { t.Fatal("expected empty file to be treated as changed") }
_, err = w.authFileUnchanged(filepath.Join(tmpDir, "missing.json")) if err == nil { t.Fatal("expected error for missing auth file") }}
func TestReloadClientsCachesAuthHashes(t *testing.T) { tmpDir := t.TempDir() authFile := filepath.Join(tmpDir, "one.json") if err := os.WriteFile(authFile, []byte(`{"type":"demo"}`), 0o644); err != nil { t.Fatalf("failed to write auth file: %v", err) } w := &Watcher{ authDir: tmpDir, config: &config.Config{AuthDir: tmpDir}, }
w.reloadClients(true, nil, false)
w.clientsMutex.RLock() defer w.clientsMutex.RUnlock() if len(w.lastAuthHashes) != 1 { t.Fatalf("expected hash cache for one auth file, got %d", len(w.lastAuthHashes)) }}
func TestReloadClientsLogsConfigDiffs(t *testing.T) { tmpDir := t.TempDir() oldCfg := &config.Config{AuthDir: tmpDir, Port: 1, Debug: false} newCfg := &config.Config{AuthDir: tmpDir, Port: 2, Debug: true}
w := &Watcher{ authDir: tmpDir, config: oldCfg, } w.SetConfig(oldCfg) w.oldConfigYaml, _ = yaml.Marshal(oldCfg)
w.clientsMutex.Lock() w.config = newCfg w.clientsMutex.Unlock()
w.reloadClients(false, nil, false)}
func TestReloadClientsHandlesNilConfig(t *testing.T) { w := &Watcher{} w.reloadClients(true, nil, false)}
func TestReloadClientsNotifiesUsageSubscribersToRefresh(t *testing.T) { tmp := t.TempDir() redisqueue.SetEnabled(false) redisqueue.SetEnabled(true) t.Cleanup(func() { redisqueue.SetEnabled(false) })
subscriber, unsubscribe := redisqueue.SubscribeUsage() defer unsubscribe() requireWatcherUsagePayload(t, subscriber, `{"support_refresh":true}`)
w := &Watcher{ authDir: tmp, config: &config.Config{AuthDir: tmp}, } w.reloadClients(false, nil, false)
requireWatcherUsagePayload(t, subscriber, `{"refresh":true}`)}
func TestReloadClientsFiltersProvidersWithNilCurrentAuths(t *testing.T) { tmp := t.TempDir() w := &Watcher{ authDir: tmp, config: &config.Config{AuthDir: tmp}, } w.reloadClients(false, []string{"match"}, false) if w.currentAuths != nil && len(w.currentAuths) != 0 { t.Fatalf("expected currentAuths to be nil or empty, got %d", len(w.currentAuths)) }}
func requireWatcherUsagePayload(t *testing.T, subscriber <-chan []byte, want string) { t.Helper()
select { case got, ok := <-subscriber: if !ok { t.Fatalf("subscriber closed before receiving %q", want) } if string(got) != want { t.Fatalf("subscriber payload = %q, want %q", string(got), want) } case <-time.After(time.Second): t.Fatalf("timeout waiting for subscriber payload %q", want) }}
func TestSetAuthUpdateQueueNilResetsDispatch(t *testing.T) { w := &Watcher{} queue := make(chan AuthUpdate, 1) w.SetAuthUpdateQueue(queue) if w.dispatchCond == nil || w.dispatchCancel == nil { t.Fatal("expected dispatch to be initialized") } w.SetAuthUpdateQueue(nil) if w.dispatchCancel != nil { t.Fatal("expected dispatch cancel to be cleared when queue nil") }}
func TestPersistAsyncEarlyReturns(t *testing.T) { var nilWatcher *Watcher nilWatcher.persistConfigAsync() nilWatcher.persistAuthAsync("msg", "a")
w := &Watcher{} w.persistConfigAsync() w.persistAuthAsync("msg", " ", "")}
type errorPersister struct { configCalls int32 authCalls int32}
func (p *errorPersister) PersistConfig(context.Context) error { atomic.AddInt32(&p.configCalls, 1) return fmt.Errorf("persist config error")}
func (p *errorPersister) PersistAuthFiles(context.Context, string, ...string) error { atomic.AddInt32(&p.authCalls, 1) return fmt.Errorf("persist auth error")}
func TestPersistAsyncErrorPaths(t *testing.T) { p := &errorPersister{} w := &Watcher{storePersister: p} w.persistConfigAsync() w.persistAuthAsync("msg", "a") time.Sleep(30 * time.Millisecond) if atomic.LoadInt32(&p.configCalls) != 1 { t.Fatalf("expected PersistConfig to be called once, got %d", p.configCalls) } if atomic.LoadInt32(&p.authCalls) != 1 { t.Fatalf("expected PersistAuthFiles to be called once, got %d", p.authCalls) }}
func TestStopConfigReloadTimerSafeWhenNil(t *testing.T) { w := &Watcher{} w.stopConfigReloadTimer() w.configReloadMu.Lock() w.configReloadTimer = time.AfterFunc(10*time.Millisecond, func() {}) w.configReloadMu.Unlock() time.Sleep(1 * time.Millisecond) w.stopConfigReloadTimer()}
func TestHandleEventRemovesAuthFile(t *testing.T) { tmpDir := t.TempDir() authFile := filepath.Join(tmpDir, "remove.json") if err := os.WriteFile(authFile, []byte(`{"type":"demo"}`), 0o644); err != nil { t.Fatalf("failed to write auth file: %v", err) } if err := os.Remove(authFile); err != nil { t.Fatalf("failed to remove auth file pre-check: %v", err) }
var reloads int32 w := &Watcher{ authDir: tmpDir, config: &config.Config{AuthDir: tmpDir}, lastAuthHashes: make(map[string]string), reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, } // Use normalizeAuthPath to set up the hash with the correct key format w.lastAuthHashes[w.normalizeAuthPath(authFile)] = "hash"
w.handleEvent(fsnotify.Event{Name: authFile, Op: fsnotify.Remove})
if atomic.LoadInt32(&reloads) != 0 { t.Fatalf("expected no reload callback for auth removal, got %d", reloads) } if _, ok := w.lastAuthHashes[w.normalizeAuthPath(authFile)]; ok { t.Fatal("expected hash entry to be removed") }}
func TestDispatchAuthUpdatesFlushesQueue(t *testing.T) { queue := make(chan AuthUpdate, 4) w := &Watcher{} w.SetAuthUpdateQueue(queue) defer w.stopDispatch()
w.dispatchAuthUpdates([]AuthUpdate{ {Action: AuthUpdateActionAdd, ID: "a"}, {Action: AuthUpdateActionModify, ID: "b"}, })
got := make([]AuthUpdate, 0, 2) for i := 0; i < 2; i++ { select { case u := <-queue: got = append(got, u) case <-time.After(2 * time.Second): t.Fatalf("timed out waiting for update %d", i) } } if len(got) != 2 || got[0].ID != "a" || got[1].ID != "b" { t.Fatalf("unexpected updates order/content: %+v", got) }}
func TestDispatchLoopExitsOnContextDoneWhileSending(t *testing.T) { queue := make(chan AuthUpdate) // unbuffered to block sends w := &Watcher{ authQueue: queue, pendingUpdates: map[string]AuthUpdate{ "k": {Action: AuthUpdateActionAdd, ID: "k"}, }, pendingOrder: []string{"k"}, }
ctx, cancel := context.WithCancel(context.Background()) done := make(chan struct{}) go func() { w.dispatchLoop(ctx) close(done) }()
time.Sleep(30 * time.Millisecond) cancel()
select { case <-done: case <-time.After(2 * time.Second): t.Fatal("expected dispatchLoop to exit after ctx canceled while blocked on send") }}
func TestProcessEventsHandlesEventErrorAndChannelClose(t *testing.T) { w := &Watcher{ watcher: &fsnotify.Watcher{ Events: make(chan fsnotify.Event, 2), Errors: make(chan error, 2), }, configPath: "config.yaml", authDir: "auth", }
ctx, cancel := context.WithCancel(context.Background()) defer cancel()
done := make(chan struct{}) go func() { w.processEvents(ctx) close(done) }()
w.watcher.Events <- fsnotify.Event{Name: "unrelated.txt", Op: fsnotify.Write} w.watcher.Errors <- fmt.Errorf("watcher error")
time.Sleep(20 * time.Millisecond) close(w.watcher.Events) close(w.watcher.Errors)
select { case <-done: case <-time.After(500 * time.Millisecond): t.Fatal("processEvents did not exit after channels closed") }}
func TestProcessEventsReturnsWhenErrorsChannelClosed(t *testing.T) { w := &Watcher{ watcher: &fsnotify.Watcher{ Events: nil, Errors: make(chan error), }, }
close(w.watcher.Errors)
ctx, cancel := context.WithCancel(context.Background()) defer cancel()
done := make(chan struct{}) go func() { w.processEvents(ctx) close(done) }()
select { case <-done: case <-time.After(500 * time.Millisecond): t.Fatal("processEvents did not exit after errors channel closed") }}
func TestHandleEventIgnoresUnrelatedFiles(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) } configPath := filepath.Join(tmpDir, "config.yaml") if err := os.WriteFile(configPath, []byte("auth_dir: "+authDir+"\n"), 0o644); err != nil { t.Fatalf("failed to write config file: %v", err) }
var reloads int32 w := &Watcher{ authDir: authDir, configPath: configPath, lastAuthHashes: make(map[string]string), reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, } w.SetConfig(&config.Config{AuthDir: authDir})
w.handleEvent(fsnotify.Event{Name: filepath.Join(tmpDir, "note.txt"), Op: fsnotify.Write}) if atomic.LoadInt32(&reloads) != 0 { t.Fatalf("expected no reloads for unrelated file, got %d", reloads) }}
func TestHandleEventConfigChangeSchedulesReload(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) } configPath := filepath.Join(tmpDir, "config.yaml") if err := os.WriteFile(configPath, []byte("auth_dir: "+authDir+"\n"), 0o644); err != nil { t.Fatalf("failed to write config file: %v", err) }
var reloads int32 w := &Watcher{ authDir: authDir, configPath: configPath, lastAuthHashes: make(map[string]string), reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, } w.SetConfig(&config.Config{AuthDir: authDir})
w.handleEvent(fsnotify.Event{Name: configPath, Op: fsnotify.Write})
time.Sleep(400 * time.Millisecond) if atomic.LoadInt32(&reloads) != 1 { t.Fatalf("expected config change to trigger reload once, got %d", reloads) }}
func TestHandleEventAuthWriteTriggersUpdate(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) } configPath := filepath.Join(tmpDir, "config.yaml") if err := os.WriteFile(configPath, []byte("auth_dir: "+authDir+"\n"), 0o644); err != nil { t.Fatalf("failed to write config file: %v", err) } authFile := filepath.Join(authDir, "a.json") if err := os.WriteFile(authFile, []byte(`{"type":"demo"}`), 0o644); err != nil { t.Fatalf("failed to write auth file: %v", err) }
var reloads int32 w := &Watcher{ authDir: authDir, configPath: configPath, lastAuthHashes: make(map[string]string), reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, } w.SetConfig(&config.Config{AuthDir: authDir})
w.handleEvent(fsnotify.Event{Name: authFile, Op: fsnotify.Write}) if atomic.LoadInt32(&reloads) != 0 { t.Fatalf("expected auth write to avoid global reload callback, got %d", reloads) }}
func TestHandleEventRemoveDebounceSkips(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) } configPath := filepath.Join(tmpDir, "config.yaml") if err := os.WriteFile(configPath, []byte("auth_dir: "+authDir+"\n"), 0o644); err != nil { t.Fatalf("failed to write config file: %v", err) } authFile := filepath.Join(authDir, "remove.json")
var reloads int32 w := &Watcher{ authDir: authDir, configPath: configPath, lastAuthHashes: make(map[string]string), lastRemoveTimes: map[string]time.Time{ filepath.Clean(authFile): time.Now(), }, reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, } w.SetConfig(&config.Config{AuthDir: authDir})
w.handleEvent(fsnotify.Event{Name: authFile, Op: fsnotify.Remove}) if atomic.LoadInt32(&reloads) != 0 { t.Fatalf("expected remove to be debounced, got %d", reloads) }}
func TestHandleEventAtomicReplaceUnchangedSkips(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) } configPath := filepath.Join(tmpDir, "config.yaml") if err := os.WriteFile(configPath, []byte("auth_dir: "+authDir+"\n"), 0o644); err != nil { t.Fatalf("failed to write config file: %v", err) } authFile := filepath.Join(authDir, "same.json") content := []byte(`{"type":"demo"}`) if err := os.WriteFile(authFile, content, 0o644); err != nil { t.Fatalf("failed to write auth file: %v", err) } sum := sha256.Sum256(content)
var reloads int32 w := &Watcher{ authDir: authDir, configPath: configPath, lastAuthHashes: make(map[string]string), reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, } w.SetConfig(&config.Config{AuthDir: authDir}) w.lastAuthHashes[w.normalizeAuthPath(authFile)] = hexString(sum[:])
w.handleEvent(fsnotify.Event{Name: authFile, Op: fsnotify.Rename}) if atomic.LoadInt32(&reloads) != 0 { t.Fatalf("expected unchanged atomic replace to be skipped, got %d", reloads) }}
func TestHandleEventAtomicReplaceChangedTriggersUpdate(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) } configPath := filepath.Join(tmpDir, "config.yaml") if err := os.WriteFile(configPath, []byte("auth_dir: "+authDir+"\n"), 0o644); err != nil { t.Fatalf("failed to write config file: %v", err) } authFile := filepath.Join(authDir, "change.json") oldContent := []byte(`{"type":"demo","v":1}`) newContent := []byte(`{"type":"demo","v":2}`) if err := os.WriteFile(authFile, newContent, 0o644); err != nil { t.Fatalf("failed to write auth file: %v", err) } oldSum := sha256.Sum256(oldContent)
var reloads int32 w := &Watcher{ authDir: authDir, configPath: configPath, lastAuthHashes: make(map[string]string), reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, } w.SetConfig(&config.Config{AuthDir: authDir}) w.lastAuthHashes[w.normalizeAuthPath(authFile)] = hexString(oldSum[:])
w.handleEvent(fsnotify.Event{Name: authFile, Op: fsnotify.Rename}) if atomic.LoadInt32(&reloads) != 0 { t.Fatalf("expected changed atomic replace to avoid global reload, got %d", reloads) }}
func TestHandleEventRemoveUnknownFileIgnored(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) } configPath := filepath.Join(tmpDir, "config.yaml") if err := os.WriteFile(configPath, []byte("auth_dir: "+authDir+"\n"), 0o644); err != nil { t.Fatalf("failed to write config file: %v", err) } authFile := filepath.Join(authDir, "unknown.json")
var reloads int32 w := &Watcher{ authDir: authDir, configPath: configPath, lastAuthHashes: make(map[string]string), reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, } w.SetConfig(&config.Config{AuthDir: authDir})
w.handleEvent(fsnotify.Event{Name: authFile, Op: fsnotify.Remove}) if atomic.LoadInt32(&reloads) != 0 { t.Fatalf("expected unknown remove to be ignored, got %d", reloads) }}
func TestHandleEventRemoveKnownFileDeletes(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) } configPath := filepath.Join(tmpDir, "config.yaml") if err := os.WriteFile(configPath, []byte("auth_dir: "+authDir+"\n"), 0o644); err != nil { t.Fatalf("failed to write config file: %v", err) } authFile := filepath.Join(authDir, "known.json")
var reloads int32 w := &Watcher{ authDir: authDir, configPath: configPath, lastAuthHashes: make(map[string]string), reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, } w.SetConfig(&config.Config{AuthDir: authDir}) w.lastAuthHashes[w.normalizeAuthPath(authFile)] = "hash"
w.handleEvent(fsnotify.Event{Name: authFile, Op: fsnotify.Remove}) if atomic.LoadInt32(&reloads) != 0 { t.Fatalf("expected known remove to avoid global reload, got %d", reloads) } if _, ok := w.lastAuthHashes[w.normalizeAuthPath(authFile)]; ok { t.Fatal("expected known auth hash to be deleted") }}
func TestNormalizeAuthPathAndDebounceCleanup(t *testing.T) { w := &Watcher{} if got := w.normalizeAuthPath(" "); got != "" { t.Fatalf("expected empty normalize result, got %q", got) } if got := w.normalizeAuthPath(" a/../b "); got != filepath.Clean("a/../b") { t.Fatalf("unexpected normalize result: %q", got) }
w.clientsMutex.Lock() w.lastRemoveTimes = make(map[string]time.Time, 140) old := time.Now().Add(-3 * authRemoveDebounceWindow) for i := 0; i < 129; i++ { w.lastRemoveTimes[fmt.Sprintf("old-%d", i)] = old } w.clientsMutex.Unlock()
w.shouldDebounceRemove("new-path", time.Now())
w.clientsMutex.Lock() gotLen := len(w.lastRemoveTimes) w.clientsMutex.Unlock() if gotLen >= 129 { t.Fatalf("expected debounce cleanup to shrink map, got %d", gotLen) }}
func TestRefreshAuthStateDispatchesRuntimeAuths(t *testing.T) { queue := make(chan AuthUpdate, 8) w := &Watcher{ authDir: t.TempDir(), lastAuthHashes: make(map[string]string), } w.SetConfig(&config.Config{AuthDir: w.authDir}) w.SetAuthUpdateQueue(queue) defer w.stopDispatch()
w.clientsMutex.Lock() w.runtimeAuths = map[string]*coreauth.Auth{ "nil": nil, "r1": {ID: "r1", Provider: "runtime"}, } w.clientsMutex.Unlock()
w.refreshAuthState(false)
select { case u := <-queue: if u.Action != AuthUpdateActionAdd || u.ID != "r1" { t.Fatalf("unexpected auth update: %+v", u) } case <-time.After(2 * time.Second): t.Fatal("timed out waiting for runtime auth update") }}
func TestAddOrUpdateClientEdgeCases(t *testing.T) { tmpDir := t.TempDir() authDir := tmpDir authFile := filepath.Join(tmpDir, "edge.json") if err := os.WriteFile(authFile, []byte(`{"type":"demo"}`), 0o644); err != nil { t.Fatalf("failed to write auth file: %v", err) } emptyFile := filepath.Join(tmpDir, "empty.json") if err := os.WriteFile(emptyFile, []byte(""), 0o644); err != nil { t.Fatalf("failed to write empty auth file: %v", err) }
var reloads int32 w := &Watcher{ authDir: authDir, lastAuthHashes: make(map[string]string), reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, }
w.addOrUpdateClient(filepath.Join(tmpDir, "missing.json")) w.addOrUpdateClient(emptyFile) if atomic.LoadInt32(&reloads) != 0 { t.Fatalf("expected no reloads for missing/empty file, got %d", reloads) }
w.addOrUpdateClient(authFile) // config nil -> should not panic or update if len(w.lastAuthHashes) != 0 { t.Fatalf("expected no hash entries without config, got %d", len(w.lastAuthHashes)) }}
func TestLoadFileClientsWalkError(t *testing.T) { tmpDir := t.TempDir() noAccessDir := filepath.Join(tmpDir, "0noaccess") if err := os.MkdirAll(noAccessDir, 0o755); err != nil { t.Fatalf("failed to create noaccess dir: %v", err) } if err := os.Chmod(noAccessDir, 0); err != nil { t.Skipf("chmod not supported: %v", err) } defer func() { _ = os.Chmod(noAccessDir, 0o755) }()
cfg := &config.Config{AuthDir: tmpDir} w := &Watcher{} w.SetConfig(cfg)
count := w.loadFileClients(cfg) if count != 0 { t.Fatalf("expected count 0 due to walk error, got %d", count) }}
func TestReloadConfigIfChangedHandlesMissingAndEmpty(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) }
w := &Watcher{ configPath: filepath.Join(tmpDir, "missing.yaml"), authDir: authDir, } w.reloadConfigIfChanged() // missing file -> log + return
emptyPath := filepath.Join(tmpDir, "empty.yaml") if err := os.WriteFile(emptyPath, []byte(""), 0o644); err != nil { t.Fatalf("failed to write empty config: %v", err) } w.configPath = emptyPath w.reloadConfigIfChanged() // empty file -> early return}
func TestReloadConfigUsesMirroredAuthDir(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) }
configPath := filepath.Join(tmpDir, "config.yaml") if err := os.WriteFile(configPath, []byte("auth_dir: "+filepath.Join(tmpDir, "other")+"\n"), 0o644); err != nil { t.Fatalf("failed to write config: %v", err) }
w := &Watcher{ configPath: configPath, authDir: authDir, mirroredAuthDir: authDir, lastAuthHashes: make(map[string]string), } w.SetConfig(&config.Config{AuthDir: authDir})
if ok := w.reloadConfig(); !ok { t.Fatal("expected reloadConfig to succeed") }
w.clientsMutex.RLock() defer w.clientsMutex.RUnlock() if w.config == nil || w.config.AuthDir != authDir { t.Fatalf("expected AuthDir to be overridden by mirroredAuthDir %s, got %+v", authDir, w.config) }}
func TestReloadConfigFiltersAffectedOAuthProviders(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) } configPath := filepath.Join(tmpDir, "config.yaml")
// Ensure SnapshotCoreAuths yields a provider that is NOT affected, so we can assert it survives. if err := os.WriteFile(filepath.Join(authDir, "provider-b.json"), []byte(`{"type":"provider-b","email":"b@example.com"}`), 0o644); err != nil { t.Fatalf("failed to write auth file: %v", err) }
oldCfg := &config.Config{ AuthDir: authDir, CredentialInFlight: config.DefaultCredentialInFlightConfig(), OAuthExcludedModels: map[string][]string{ "provider-a": {"m1"}, }, } newCfg := &config.Config{ AuthDir: authDir, CredentialInFlight: config.DefaultCredentialInFlightConfig(), OAuthExcludedModels: map[string][]string{ "provider-a": {"m2"}, }, } data, err := yaml.Marshal(newCfg) if err != nil { t.Fatalf("failed to marshal config: %v", err) } if err = os.WriteFile(configPath, data, 0o644); err != nil { t.Fatalf("failed to write config: %v", err) }
w := &Watcher{ configPath: configPath, authDir: authDir, lastAuthHashes: make(map[string]string), currentAuths: map[string]*coreauth.Auth{ "a": {ID: "a", Provider: "provider-a"}, }, } w.SetConfig(oldCfg)
if ok := w.reloadConfig(); !ok { t.Fatal("expected reloadConfig to succeed") }
w.clientsMutex.RLock() defer w.clientsMutex.RUnlock() for _, auth := range w.currentAuths { if auth != nil && auth.Provider == "provider-a" { t.Fatal("expected affected provider auth to be filtered") } } foundB := false for _, auth := range w.currentAuths { if auth != nil && auth.Provider == "provider-b" { foundB = true break } } if !foundB { t.Fatal("expected unaffected provider auth to remain") }}
func TestReloadConfigTriggersCallbackForMaxRetryCredentialsChange(t *testing.T) { tmpDir := t.TempDir() authDir := filepath.Join(tmpDir, "auth") if err := os.MkdirAll(authDir, 0o755); err != nil { t.Fatalf("failed to create auth dir: %v", err) } configPath := filepath.Join(tmpDir, "config.yaml")
oldCfg := &config.Config{ AuthDir: authDir, CredentialInFlight: config.DefaultCredentialInFlightConfig(), MaxRetryCredentials: 0, RequestRetry: 1, MaxRetryInterval: 5, } newCfg := &config.Config{ AuthDir: authDir, CredentialInFlight: config.DefaultCredentialInFlightConfig(), MaxRetryCredentials: 2, RequestRetry: 1, MaxRetryInterval: 5, } data, errMarshal := yaml.Marshal(newCfg) if errMarshal != nil { t.Fatalf("failed to marshal config: %v", errMarshal) } if errWrite := os.WriteFile(configPath, data, 0o644); errWrite != nil { t.Fatalf("failed to write config: %v", errWrite) }
callbackCalls := 0 callbackMaxRetryCredentials := -1 w := &Watcher{ configPath: configPath, authDir: authDir, lastAuthHashes: make(map[string]string), reloadCallback: func(cfg *config.Config) { callbackCalls++ if cfg != nil { callbackMaxRetryCredentials = cfg.MaxRetryCredentials } }, } w.SetConfig(oldCfg)
if ok := w.reloadConfig(); !ok { t.Fatal("expected reloadConfig to succeed") }
if callbackCalls != 1 { t.Fatalf("expected reload callback to be called once, got %d", callbackCalls) } if callbackMaxRetryCredentials != 2 { t.Fatalf("expected callback MaxRetryCredentials=2, got %d", callbackMaxRetryCredentials) }
w.clientsMutex.RLock() defer w.clientsMutex.RUnlock() if w.config == nil || w.config.MaxRetryCredentials != 2 { t.Fatalf("expected watcher config MaxRetryCredentials=2, got %+v", w.config) }}
func TestStartFailsWhenAuthDirMissing(t *testing.T) { tmpDir := t.TempDir() configPath := filepath.Join(tmpDir, "config.yaml") if err := os.WriteFile(configPath, []byte("auth_dir: "+filepath.Join(tmpDir, "missing-auth")+"\n"), 0o644); err != nil { t.Fatalf("failed to write config file: %v", err) } authDir := filepath.Join(tmpDir, "missing-auth")
w, err := NewWatcher(configPath, authDir, nil) if err != nil { t.Fatalf("failed to create watcher: %v", err) } defer w.Stop() w.SetConfig(&config.Config{AuthDir: authDir})
ctx, cancel := context.WithCancel(context.Background()) defer cancel()
if err := w.Start(ctx); err == nil { t.Fatal("expected Start to fail for missing auth dir") }}
func TestDispatchRuntimeAuthUpdateReturnsFalseWithoutQueue(t *testing.T) { w := &Watcher{} if ok := w.DispatchRuntimeAuthUpdate(AuthUpdate{Action: AuthUpdateActionAdd, Auth: &coreauth.Auth{ID: "a"}}); ok { t.Fatal("expected DispatchRuntimeAuthUpdate to return false when no queue configured") } if ok := w.DispatchRuntimeAuthUpdate(AuthUpdate{Action: AuthUpdateActionDelete, Auth: &coreauth.Auth{ID: "a"}}); ok { t.Fatal("expected DispatchRuntimeAuthUpdate delete to return false when no queue configured") }}
func TestNormalizeAuthNil(t *testing.T) { if normalizeAuth(nil) != nil { t.Fatal("expected normalizeAuth(nil) to return nil") }}
// stubStore implements coreauth.Store plus watcher-specific persistence helpers.type stubStore struct { mu sync.Mutex authDir string cfgPersisted int authPersisted int lastAuthMessage string lastAuthPaths []string persisted chan struct{}}
func (s *stubStore) List(context.Context) ([]*coreauth.Auth, error) { return nil, nil }func (s *stubStore) Save(context.Context, *coreauth.Auth) (string, error) { return "", nil}func (s *stubStore) Delete(context.Context, string) error { return nil }func (s *stubStore) PersistConfig(context.Context) error { s.mu.Lock() s.cfgPersisted++ s.mu.Unlock() s.signalPersisted() return nil}func (s *stubStore) PersistAuthFiles(_ context.Context, message string, paths ...string) error { s.mu.Lock() defer s.mu.Unlock() s.lastAuthMessage = message s.lastAuthPaths = append([]string(nil), paths...) s.authPersisted++ s.signalPersisted() return nil}func (s *stubStore) AuthDir() string { return s.authDir }
func (s *stubStore) signalPersisted() { if s.persisted == nil { return } select { case s.persisted <- struct{}{}: default: }}
func (s *stubStore) persistenceSnapshot() (cfgPersisted, authPersisted int, message string, paths []string) { s.mu.Lock() defer s.mu.Unlock() return s.cfgPersisted, s.authPersisted, s.lastAuthMessage, append([]string(nil), s.lastAuthPaths...)}
func TestNewWatcherDetectsPersisterAndAuthDir(t *testing.T) { tmp := t.TempDir() store := &stubStore{authDir: tmp} orig := sdkAuth.GetTokenStore() sdkAuth.RegisterTokenStore(store) defer sdkAuth.RegisterTokenStore(orig)
w, err := NewWatcher("config.yaml", "auth", nil) if err != nil { t.Fatalf("NewWatcher failed: %v", err) } if w.storePersister == nil { t.Fatal("expected storePersister to be set from token store") } if w.mirroredAuthDir != tmp { t.Fatalf("expected mirroredAuthDir %s, got %s", tmp, w.mirroredAuthDir) }}
func TestPersistConfigAndAuthAsyncInvokePersister(t *testing.T) { store := &stubStore{persisted: make(chan struct{}, 2)} w := &Watcher{ storePersister: store, }
w.persistConfigAsync() w.persistAuthAsync("msg", " a ", "", "b ")
for range 2 { select { case <-store.persisted: case <-time.After(time.Second): t.Fatal("timed out waiting for asynchronous persistence") } } cfgPersisted, authPersisted, message, paths := store.persistenceSnapshot() if cfgPersisted != 1 { t.Fatalf("expected PersistConfig to be called once, got %d", cfgPersisted) } if authPersisted != 1 { t.Fatalf("expected PersistAuthFiles to be called once, got %d", authPersisted) } if message != "msg" { t.Fatalf("unexpected auth message: %s", message) } if len(paths) != 2 || paths[0] != "a" || paths[1] != "b" { t.Fatalf("unexpected filtered paths: %#v", paths) }}
func TestScheduleConfigReloadDebounces(t *testing.T) { tmp := t.TempDir() authDir := tmp cfgPath := tmp + "/config.yaml" if err := os.WriteFile(cfgPath, []byte("auth_dir: "+authDir+"\n"), 0o644); err != nil { t.Fatalf("failed to write config: %v", err) }
var reloads int32 w := &Watcher{ configPath: cfgPath, authDir: authDir, reloadCallback: func(*config.Config) { atomic.AddInt32(&reloads, 1) }, } w.SetConfig(&config.Config{AuthDir: authDir})
w.scheduleConfigReload() w.scheduleConfigReload()
deadline := time.Now().Add(time.Second) for { w.clientsMutex.RLock() hashSet := w.lastConfigHash != "" w.clientsMutex.RUnlock() if hashSet { break } if time.Now().After(deadline) { t.Fatal("timed out waiting for debounced config reload") } time.Sleep(10 * time.Millisecond) } if got := atomic.LoadInt32(&reloads); got != 1 { t.Fatalf("expected single debounced reload, got %d", got) }}
func TestPrepareAuthUpdatesLockedForceAndDelete(t *testing.T) { w := &Watcher{ currentAuths: map[string]*coreauth.Auth{ "a": {ID: "a", Provider: "p1"}, }, authQueue: make(chan AuthUpdate, 4), }
updates := w.prepareAuthUpdatesLocked([]*coreauth.Auth{{ID: "a", Provider: "p2"}}, false) if len(updates) != 1 || updates[0].Action != AuthUpdateActionModify || updates[0].ID != "a" { t.Fatalf("unexpected modify updates: %+v", updates) }
updates = w.prepareAuthUpdatesLocked([]*coreauth.Auth{{ID: "a", Provider: "p2"}}, true) if len(updates) != 1 || updates[0].Action != AuthUpdateActionModify { t.Fatalf("expected force modify, got %+v", updates) }
updates = w.prepareAuthUpdatesLocked([]*coreauth.Auth{}, false) if len(updates) != 1 || updates[0].Action != AuthUpdateActionDelete || updates[0].ID != "a" { t.Fatalf("expected delete for missing auth, got %+v", updates) }}
func TestAuthEqualIgnoresTemporalFields(t *testing.T) { now := time.Now() a := &coreauth.Auth{ID: "x", CreatedAt: now} b := &coreauth.Auth{ID: "x", CreatedAt: now.Add(5 * time.Second)} if !authEqual(a, b) { t.Fatal("expected authEqual to ignore temporal differences") }}
func TestDispatchLoopExitsWhenQueueNilAndContextCanceled(t *testing.T) { w := &Watcher{ dispatchCond: nil, pendingUpdates: map[string]AuthUpdate{"k": {ID: "k"}}, pendingOrder: []string{"k"}, } w.dispatchCond = sync.NewCond(&w.dispatchMu)
ctx, cancel := context.WithCancel(context.Background()) done := make(chan struct{}) go func() { w.dispatchLoop(ctx) close(done) }()
time.Sleep(20 * time.Millisecond) cancel() w.dispatchMu.Lock() w.dispatchCond.Broadcast() w.dispatchMu.Unlock()
select { case <-done: case <-time.After(500 * time.Millisecond): t.Fatal("dispatchLoop did not exit after context cancel") }}
func TestReloadClientsFiltersOAuthProvidersWithoutRescan(t *testing.T) { tmp := t.TempDir() w := &Watcher{ authDir: tmp, config: &config.Config{AuthDir: tmp}, currentAuths: map[string]*coreauth.Auth{ "a": {ID: "a", Provider: "Match"}, "b": {ID: "b", Provider: "other"}, }, lastAuthHashes: map[string]string{"cached": "hash"}, }
w.reloadClients(false, []string{"match"}, false)
w.clientsMutex.RLock() defer w.clientsMutex.RUnlock() if _, ok := w.currentAuths["a"]; ok { t.Fatal("expected filtered provider to be removed") } if len(w.lastAuthHashes) != 1 { t.Fatalf("expected existing hash cache to be retained, got %d", len(w.lastAuthHashes)) }}
func TestScheduleProcessEventsStopsOnContextDone(t *testing.T) { w := &Watcher{ watcher: &fsnotify.Watcher{ Events: make(chan fsnotify.Event, 1), Errors: make(chan error, 1), }, configPath: "config.yaml", authDir: "auth", } ctx, cancel := context.WithCancel(context.Background()) done := make(chan struct{}) go func() { w.processEvents(ctx) close(done) }()
cancel() select { case <-done: case <-time.After(500 * time.Millisecond): t.Fatal("processEvents did not exit on context cancel") }}
func hexString(data []byte) string { return strings.ToLower(fmt.Sprintf("%x", data))}