mirror of
https://github.com/openai/codex.git
synced 2026-10-30 19:18:49 +00:00
Dmitriy Kovalenko
a9ea49e78b
## What changed Extract executor startup into `codex-exec-server-cli`, shared by `codex exec-server` and the new standalone binary. Preserve executor arguments, authentication, configuration overrides, and sandbox helper dispatch across both entry points. Build the standalone binary with `cargo build -p codex-exec-server-cli --bin codex-exec-server` and run it with `codex-exec-server --listen stdio`. ## Testing Add standalone CLI parsing and help coverage, plus an integration test for version reporting, stdio initialization, filesystem reads, process execution, and sandbox helper re-execution when supported. GitOrigin-RevId: ab3a81c6b91b6f45e4d72d8add2e01af8372e97f
62 lines
1.7 KiB
Rust
62 lines
1.7 KiB
Rust
#![cfg(test)]
|
|
|
|
use super::*;
|
|
use pretty_assertions::assert_eq;
|
|
|
|
#[test]
|
|
fn exec_server_remote_auth_accepts_api_key_auth() {
|
|
let auth = CodexAuth::from_api_key("sk-test");
|
|
|
|
assert!(is_supported_exec_server_remote_auth(&auth));
|
|
}
|
|
|
|
#[test]
|
|
fn exec_server_remote_api_key_auth_accepts_https_openai_domains() {
|
|
for base_url in [
|
|
"https://openai.com/api",
|
|
"https://service.openai.com/api",
|
|
"https://openai.org/api",
|
|
"https://service.openai.org/api",
|
|
] {
|
|
assert!(validate_api_key_remote_host(base_url).is_ok());
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn exec_server_remote_api_key_auth_accepts_http_loopback() {
|
|
for base_url in [
|
|
"http://localhost:8098/api",
|
|
"http://127.0.0.1:8098/api",
|
|
"http://[::1]:8098/api",
|
|
] {
|
|
assert!(validate_api_key_remote_host(base_url).is_ok());
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn exec_server_remote_api_key_auth_rejects_http_openai_domain() {
|
|
for base_url in [
|
|
"http://service.openai.com/api",
|
|
"http://service.openai.org/api",
|
|
] {
|
|
let error = validate_api_key_remote_host(base_url)
|
|
.expect_err("reject plaintext OpenAI destination");
|
|
|
|
assert_eq!(
|
|
error.to_string(),
|
|
"remote exec-server API-key authentication is restricted to HTTPS openai.com and openai.org hosts and subdomains or loopback hosts"
|
|
);
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn exec_server_remote_api_key_auth_rejects_suffix_spoof() {
|
|
let error = validate_api_key_remote_host("https://service.openai.org.evil.example/api")
|
|
.expect_err("reject suffix spoof");
|
|
|
|
assert_eq!(
|
|
error.to_string(),
|
|
"remote exec-server API-key authentication is restricted to HTTPS openai.com and openai.org hosts and subdomains or loopback hosts"
|
|
);
|
|
}
|