a9518cc5be
新增 codex_cli_only 开关并默认关闭，关闭时完全绕过限制逻辑。 在 OpenAI 网关引入统一检测入口，集中判定账号类型、开关与客户端族。 开启后仅放行 codex_cli_rs、codex_vscode、codex_app 客户端家族。 补充后端判定与网关分支测试，并在前端创建/编辑页增加开关配置与回显。 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
108 lines
3.5 KiB
Go
108 lines
3.5 KiB
Go
package service
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/Wei-Shaw/sub2api/internal/config"
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func newCodexDetectorTestContext(ua string) *gin.Context {
|
|
rec := httptest.NewRecorder()
|
|
c, _ := gin.CreateTestContext(rec)
|
|
c.Request = httptest.NewRequest(http.MethodPost, "/v1/responses", nil)
|
|
if ua != "" {
|
|
c.Request.Header.Set("User-Agent", ua)
|
|
}
|
|
return c
|
|
}
|
|
|
|
func TestOpenAICodexClientRestrictionDetector_Detect(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
t.Run("未开启开关时绕过", func(t *testing.T) {
|
|
detector := NewOpenAICodexClientRestrictionDetector(nil)
|
|
account := &Account{Platform: PlatformOpenAI, Type: AccountTypeOAuth, Extra: map[string]any{}}
|
|
|
|
result := detector.Detect(newCodexDetectorTestContext("curl/8.0"), account)
|
|
require.False(t, result.Enabled)
|
|
require.False(t, result.Matched)
|
|
require.Equal(t, CodexClientRestrictionReasonDisabled, result.Reason)
|
|
})
|
|
|
|
t.Run("开启后 codex_cli_rs 命中", func(t *testing.T) {
|
|
detector := NewOpenAICodexClientRestrictionDetector(nil)
|
|
account := &Account{
|
|
Platform: PlatformOpenAI,
|
|
Type: AccountTypeOAuth,
|
|
Extra: map[string]any{"codex_cli_only": true},
|
|
}
|
|
|
|
result := detector.Detect(newCodexDetectorTestContext("codex_cli_rs/0.99.0"), account)
|
|
require.True(t, result.Enabled)
|
|
require.True(t, result.Matched)
|
|
require.Equal(t, CodexClientRestrictionReasonMatchedUA, result.Reason)
|
|
})
|
|
|
|
t.Run("开启后 codex_vscode 命中", func(t *testing.T) {
|
|
detector := NewOpenAICodexClientRestrictionDetector(nil)
|
|
account := &Account{
|
|
Platform: PlatformOpenAI,
|
|
Type: AccountTypeOAuth,
|
|
Extra: map[string]any{"codex_cli_only": true},
|
|
}
|
|
|
|
result := detector.Detect(newCodexDetectorTestContext("codex_vscode/1.0.0"), account)
|
|
require.True(t, result.Enabled)
|
|
require.True(t, result.Matched)
|
|
require.Equal(t, CodexClientRestrictionReasonMatchedUA, result.Reason)
|
|
})
|
|
|
|
t.Run("开启后 codex_app 命中", func(t *testing.T) {
|
|
detector := NewOpenAICodexClientRestrictionDetector(nil)
|
|
account := &Account{
|
|
Platform: PlatformOpenAI,
|
|
Type: AccountTypeOAuth,
|
|
Extra: map[string]any{"codex_cli_only": true},
|
|
}
|
|
|
|
result := detector.Detect(newCodexDetectorTestContext("codex_app/2.1.0"), account)
|
|
require.True(t, result.Enabled)
|
|
require.True(t, result.Matched)
|
|
require.Equal(t, CodexClientRestrictionReasonMatchedUA, result.Reason)
|
|
})
|
|
|
|
t.Run("开启后非官方客户端拒绝", func(t *testing.T) {
|
|
detector := NewOpenAICodexClientRestrictionDetector(nil)
|
|
account := &Account{
|
|
Platform: PlatformOpenAI,
|
|
Type: AccountTypeOAuth,
|
|
Extra: map[string]any{"codex_cli_only": true},
|
|
}
|
|
|
|
result := detector.Detect(newCodexDetectorTestContext("curl/8.0"), account)
|
|
require.True(t, result.Enabled)
|
|
require.False(t, result.Matched)
|
|
require.Equal(t, CodexClientRestrictionReasonNotMatchedUA, result.Reason)
|
|
})
|
|
|
|
t.Run("开启 ForceCodexCLI 时允许通过", func(t *testing.T) {
|
|
detector := NewOpenAICodexClientRestrictionDetector(&config.Config{
|
|
Gateway: config.GatewayConfig{ForceCodexCLI: true},
|
|
})
|
|
account := &Account{
|
|
Platform: PlatformOpenAI,
|
|
Type: AccountTypeOAuth,
|
|
Extra: map[string]any{"codex_cli_only": true},
|
|
}
|
|
|
|
result := detector.Detect(newCodexDetectorTestContext("curl/8.0"), account)
|
|
require.True(t, result.Enabled)
|
|
require.True(t, result.Matched)
|
|
require.Equal(t, CodexClientRestrictionReasonForceCodexCLI, result.Reason)
|
|
})
|
|
}
|