feat(ql3): establish 3.0 incubation baseline

2026-09-23 03:18:09 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,125 @@
+const assert = require('node:assert/strict');
+const { chmod, mkdtemp, writeFile } = require('node:fs/promises');
+const { tmpdir } = require('node:os');
+const { join } = require('node:path');
+const test = require('node:test');
+
+const {
+  PROJECTED_MODEL_GATEWAY_AUTHORITY_SCHEMA,
+  ProjectedModelGatewayAuthorityUnavailableError,
+  canonicalProjectedModelGatewayAuthorityManifest,
+  loadProjectedModelGatewayProviderAuthority,
+} = require('../dist/model-gateway/projectedModelGatewayAuthority.js');
+
+function manifest(overrides = {}) {
+  return {
+    schema: PROJECTED_MODEL_GATEWAY_AUTHORITY_SCHEMA,
+    providers: [
+      {
+        type: 'openai-compatible',
+        baseUrl: 'https://models.example.test/v1/',
+        allowPlaintextLoopback: false,
+        maxResponseBytes: 1048576,
+      },
+    ],
+    projects: [
+      {
+        projectId: 'project-a',
+        policy: {
+          revision: 'policy-v1',
+          allowedProviders: ['openai-compatible'],
+          allowedModels: ['vendor/model-a'],
+          maxInputBytes: 4096,
+          maxOutputBytes: 4096,
+          maxOutputTokens: 256,
+          maxTotalTokens: 1024,
+          maxCostMicros: null,
+          priceRevision: null,
+        },
+      },
+    ],
+    ...overrides,
+  };
+}
+
+async function authorityFile(value, mode = 0o440) {
+  const root = await mkdtemp(join(tmpdir(), 'ql3-ai-authority-'));
+  const file = join(root, 'authority.json');
+  await writeFile(
+    file,
+    canonicalProjectedModelGatewayAuthorityManifest(value),
+    { mode },
+  );
+  await chmod(file, mode);
+  return file;
+}
+
+const credentials = Object.freeze({
+  async authorizationHeader() {
+    throw new Error('not invoked while loading authority');
+  },
+});
+
+test('projected authority loads one canonical provider and Project policy', async () => {
+  const configFile = await authorityFile(manifest());
+  const authority = await loadProjectedModelGatewayProviderAuthority({
+    configFile,
+    credentials,
+  });
+  assert.deepEqual(
+    authority.providers.map(({ type }) => type),
+    ['openai-compatible'],
+  );
+  assert.deepEqual(
+    await authority.policies.resolve({ projectId: 'project-a' }),
+    manifest().projects[0].policy,
+  );
+  await assert.rejects(
+    authority.policies.resolve({ projectId: 'project-b' }),
+    ProjectedModelGatewayAuthorityUnavailableError,
+  );
+});
+
+test('projected authority rejects provider/policy drift before network access', async () => {
+  assert.throws(
+    () =>
+      canonicalProjectedModelGatewayAuthorityManifest(
+        manifest({
+          projects: [
+            {
+              ...manifest().projects[0],
+              policy: {
+                ...manifest().projects[0].policy,
+                allowedProviders: ['missing-provider'],
+              },
+            },
+          ],
+        }),
+      ),
+    ProjectedModelGatewayAuthorityUnavailableError,
+  );
+});
+
+test('projected authority rejects writable or noncanonical JSON', async () => {
+  const writable = await authorityFile(manifest(), 0o640);
+  await assert.rejects(
+    loadProjectedModelGatewayProviderAuthority({
+      configFile: writable,
+      credentials,
+    }),
+    ProjectedModelGatewayAuthorityUnavailableError,
+  );
+  const root = await mkdtemp(join(tmpdir(), 'ql3-ai-authority-'));
+  const noncanonical = join(root, 'authority.json');
+  await writeFile(noncanonical, JSON.stringify(manifest(), null, 2), {
+    mode: 0o440,
+  });
+  await chmod(noncanonical, 0o440);
+  await assert.rejects(
+    loadProjectedModelGatewayProviderAuthority({
+      configFile: noncanonical,
+      credentials,
+    }),
+    ProjectedModelGatewayAuthorityUnavailableError,
+  );
+});