Function TestEnvironmentDoNotLeak

internal/integrationtest/bridge_test.go:1938–1999

(t *testing.T)

}

func TestEnvironmentDoNotLeak(t *testing.T) {
	// NOTE: Cannot use t.Parallel() here because subtests use t.Setenv which requires sequential execution.

	// Test that environment variables containing API keys/tokens are not leaked to upstream requests.
	// See https://github.com/coder/aibridge/issues/60.
	testCases := []struct {
		name       string
		fixture    []byte
		path       string
		envVars    map[string]string
		headerName string
	}{
		{
			name:    config.ProviderAnthropic,
			fixture: fixtures.AntSimple,
			path:    pathAnthropicMessages,
			envVars: map[string]string{
				"ANTHROPIC_AUTH_TOKEN": "should-not-leak",
			},
			headerName: "Authorization", // We only send through the X-Api-Key, so this one should not be present.
		},
		{
			name:    config.ProviderOpenAI,
			fixture: fixtures.OaiChatSimple,
			path:    pathOpenAIChatCompletions,
			envVars: map[string]string{
				"OPENAI_ORG_ID": "should-not-leak",
			},
			headerName: "OpenAI-Organization",
		},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			// NOTE: Cannot use t.Parallel() here because t.Setenv requires sequential execution.

			ctx, cancel := context.WithTimeout(t.Context(), testutil.WaitLong)
			t.Cleanup(cancel)

			fix := fixtures.Parse(t, tc.fixture)
			upstream := newMockUpstream(ctx, t, newFixtureResponse(fix))

			// Set environment variables that the SDK would automatically read.
			// These should NOT leak into upstream requests.
			for key, val := range tc.envVars {
				t.Setenv(key, val)
			}

			bridgeServer := newBridgeTestServer(ctx, t, upstream.URL)

			resp, err := bridgeServer.makeRequest(t, http.MethodPost, tc.path, fix.Request())
			require.NoError(t, err)
			defer resp.Body.Close()
			require.Equal(t, http.StatusOK, resp.StatusCode)

			// Verify that environment values did not leak.
			received := upstream.receivedRequests()
			require.Len(t, received, 1)