Function TestAIProvidersKeyManagement

coderd/ai_providers_test.go:595–1315

(t *testing.T)

}

func TestAIProvidersKeyManagement(t *testing.T) {
	t.Parallel()

	t.Run("CreateWithKeysReturnsMasked", func(t *testing.T) {
		t.Parallel()
		client := coderdtest.New(t, nil)
		_ = coderdtest.CreateFirstUser(t, client)
		ctx := testutil.Context(t, testutil.WaitLong)

		const (
			primary   = "sk-openai-primary-fixture-aaaaaa"   //nolint:gosec // test fixture, not a real credential
			secondary = "sk-openai-secondary-fixture-bbbbbb" //nolint:gosec // test fixture, not a real credential
		)

		//nolint:gocritic // Owner role is the audience for this endpoint.
		provider, err := client.CreateAIProvider(ctx, codersdk.CreateAIProviderRequest{
			Type:    codersdk.AIProviderTypeOpenAI,
			Name:    "keys-openai",
			Enabled: true,
			BaseURL: "https://api.openai.com/v1",
			APIKeys: []string{primary, secondary},
		})
		require.NoError(t, err)
		require.Len(t, provider.APIKeys, 2)
		// Masked form preserves prefix and suffix while hiding the
		// middle, so it's enough for an operator to recognize the key
		// without recovering the plaintext.
		require.True(t, strings.HasPrefix(provider.APIKeys[0].Masked, "sk-o"))
		require.True(t, strings.HasSuffix(provider.APIKeys[0].Masked, "aaaa"))
		require.NotContains(t, provider.APIKeys[0].Masked, primary)
		require.NotContains(t, provider.APIKeys[1].Masked, secondary)
		require.NotEqual(t, uuid.Nil, provider.APIKeys[0].ID)
		require.NotEqual(t, uuid.Nil, provider.APIKeys[1].ID)
	})

	t.Run("ResponseHidesPlaintext", func(t *testing.T) {
		t.Parallel()
		client := coderdtest.New(t, nil)
		_ = coderdtest.CreateFirstUser(t, client)
		ctx := testutil.Context(t, testutil.WaitLong)

		const plaintext = "sk-openai-extra-secret-cccccccccccc" //nolint:gosec // test fixture, not a real credential

		//nolint:gocritic // Owner role is the audience for this endpoint.
		_, err := client.CreateAIProvider(ctx, codersdk.CreateAIProviderRequest{
			Type:    codersdk.AIProviderTypeOpenAI,
			Name:    "keys-secret",
			Enabled: true,
			BaseURL: "https://api.openai.com/v1",
			APIKeys: []string{plaintext},
		})
		require.NoError(t, err)

		// Inspect the raw HTTP body of the GET response. The masked
		// form must replace the plaintext entirely on the wire.
		res, err := client.Request(ctx, http.MethodGet, "/api/v2/ai/providers/keys-secret", nil)
		require.NoError(t, err)
		defer res.Body.Close()