vvzvlad/gitmost
1
0
Fork 0
Code Issues 14 Pull Requests 12 Packages Projects Releases Activity

test(ai-chat): cover safety-critical code paths (review follow-ups P1) #3

Closed
Ghost wants to merge 1 commits from test/ai-chat-safety-critical-coverage into develop
pull from: test/ai-chat-safety-critical-coverage
merge into: vvzvlad:develop
Conversation 1 Commits 1 Files Changed 6 +460 -3

1 Commits

Author SHA1 Message Date
glm5.2 agent 180
b24fc12e2b test(ai-chat): cover safety-critical code paths (review follow-ups P1) 
Adds unit tests for five pieces of security-critical code that previously
had zero coverage, closing the warning-level findings of the ai-chat
multi-aspect review (docs/backlog/ai-chat-review-followups.md, priority 1).

- crypto/secret-box.spec.ts (NEW): AES-256-GCM round-trip; non-determinism
  (two encrypts of the same input yield different blobs, both decrypt);
  tampered authTag / ciphertext bytes throw with the 'APP_SECRET may have
  changed' message; wrong APP_SECRET throws the same. Guards the only
  at-rest protection of provider API keys.
- ai-chat/external-mcp/ssrf-guard.spec.ts (NEW): isIpAllowed blocks every
  forbidden class (loopback, link-local incl. metadata 169.254.169.254,
  private, CGNAT, ULA, unspecified, IPv4-mapped IPv6, unparseable) and
  allows a public IP; isUrlAllowed rejects bad scheme / invalid URL,
  blocks IP-literal private, and (with a mocked dns.lookup) blocks
  DNS-rebinding to a private address and an unresolvable host.
- ai-chat/ai-chat.service.spec.ts (extended): assistantParts now covered
  - paired tool call -> output-available (compacted), unpaired call ->
  output-error with 'Tool call did not complete.' (regression guard for
  the MissingToolResultsError fix), broken calls skipped, step text and
  fallback text paths. Requires exporting assistantParts + StepLike (the
  only production change here, two export keywords).
- ai-chat/tools/ai-chat-tools.service.spec.ts (extended): JSON-string
  coercion in patchNode / insertNode / updatePageJson - string parsed to
  object, invalid JSON throws the specific message, updatePageJson
  distinguishes undefined (title-only) / object / string. Guards the
  OpenAI tool-call compatibility fix.
- database/repos/ai-chat/page-embedding.repo.spec.ts (NEW):
  searchByEmbedding with empty spaceIds returns [] without touching the
  DB (Proxy stub throws on any access). Guards the access-scoping
  early-return.

54 new tests, all green. No functional behaviour changed.
 2026-06-20 04:45:22 +03:00