mirror of
https://github.com/headroomlabs-ai/headroom.git
synced 2026-08-27 14:17:10 -04:00
5a7265daa8
## Description Extract auth-mode and client-harness classification rules into `headroom.proxy.auth_policy`, leaving `auth_mode` as the header-reading/logging adapter. This gives the proxy a pure `AuthSignals` value object and deterministic policy functions for auth mode, client classification, and Codex Responses stamping. Closes # ## Type of Change - [ ] Bug fix (non-breaking change that fixes an issue) - [ ] New feature (non-breaking change that adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update - [ ] Performance improvement - [x] Code refactoring (no functional changes) ## Changes Made - Added `AuthSignals` as the normalized input model for pure auth/client policy. - Moved `AuthMode`, subscription UA prefixes, client UA map, Codex Responses path, auth-mode classification, client classification, and Codex stamping rules into `headroom.proxy.auth_policy`. - Kept `headroom.proxy.auth_mode` public API stable by adapting headers into `AuthSignals` and delegating to policy functions. - Added direct pure-policy tests for subscription precedence, OAuth/PAYG token shapes, explicit client override, and Codex Responses stamping. - Included the LiteLLM callback hook compatibility shim needed for repo-wide mypy on branches based on `main`. ## Testing - [x] Unit tests pass (`pytest`) - [x] Linting passes (`ruff check .`) - [x] Type checking passes (`mypy headroom`) - [x] New tests added for new functionality - [ ] Manual testing performed ### Test Output ```text python -m pytest tests/test_auth_policy.py tests/test_auth_mode.py tests/test_codex_client_stamp.py tests/test_litellm_callback.py tests/test_compress_api.py::TestLiteLLMCallback -q 48 passed in 6.63s python -m ruff check . All checks passed! python -m ruff format --check . 1095 files already formatted python -m mypy headroom --ignore-missing-imports Success: no issues found in 409 source files ``` ## Real Behavior Proof - Environment: Windows, Python 3.13.13, local worktree `C:\git\headroom-pr-slice9`. - Exact command / steps: Ran the focused pytest suite plus repo-wide Ruff, format check, and mypy commands listed above. - Observed result: Existing adapter behavior remains covered by `tests/test_auth_mode.py` and `tests/test_codex_client_stamp.py`, while the extracted pure policy is covered by `tests/test_auth_policy.py`. - Not tested: Full test suite locally; CI will run the full matrix. ## Review Readiness - [x] I have performed a self-review - [x] This PR is ready for human review ## Checklist - [x] My code follows the project's style guidelines - [x] I have performed a self-review of my code - [x] I have commented my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [ ] I have updated the CHANGELOG.md if applicable ## Screenshots (if applicable) N/A ## Additional Notes Documentation and changelog updates are not applicable for this internal refactor. The LiteLLM shim is repeated here because this branch is intentionally independent from the other open architecture slices and must stay green against current `main`.
55 lines
1.8 KiB
Python
55 lines
1.8 KiB
Python
"""Tests for pure auth and client classification policy."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from headroom.proxy.auth_policy import (
|
|
AuthMode,
|
|
AuthSignals,
|
|
classify_auth_signals,
|
|
classify_client_signals,
|
|
should_stamp_codex_client_signals,
|
|
)
|
|
|
|
|
|
def test_subscription_user_agent_wins_over_oauth_token() -> None:
|
|
signals = AuthSignals(
|
|
user_agent="claude-code/1.5.0 (linux; x86_64)",
|
|
authorization="Bearer sk-ant-oat01-abc123",
|
|
)
|
|
|
|
assert classify_auth_signals(signals) is AuthMode.SUBSCRIPTION
|
|
|
|
|
|
def test_oauth_bearer_token_shapes_are_oauth() -> None:
|
|
jwt = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.signature"
|
|
|
|
assert classify_auth_signals(AuthSignals(authorization="Bearer sk-ant-oat01-abc")) is (
|
|
AuthMode.OAUTH
|
|
)
|
|
assert classify_auth_signals(AuthSignals(authorization=f"Bearer {jwt}")) is AuthMode.OAUTH
|
|
|
|
|
|
def test_payg_key_shapes_are_payg() -> None:
|
|
assert classify_auth_signals(AuthSignals(authorization="Bearer sk-ant-api03-abc")) is (
|
|
AuthMode.PAYG
|
|
)
|
|
assert classify_auth_signals(AuthSignals(x_api_key="sk-ant-api03-abc")) is AuthMode.PAYG
|
|
assert classify_auth_signals(AuthSignals(x_goog_api_key="AIzaSyDUMMY")) is AuthMode.PAYG
|
|
|
|
|
|
def test_client_explicit_override_wins_over_user_agent() -> None:
|
|
signals = AuthSignals(user_agent="claude-code/1.2.3", x_client=" AIDER ")
|
|
|
|
assert classify_client_signals(signals) == "aider"
|
|
|
|
|
|
def test_codex_stamp_only_for_unidentified_responses_callers() -> None:
|
|
assert should_stamp_codex_client_signals("/v1/responses", AuthSignals()) is True
|
|
assert (
|
|
should_stamp_codex_client_signals(
|
|
"/v1/responses/foo",
|
|
AuthSignals(user_agent="codex-cli/0.5"),
|
|
)
|
|
is False
|
|
)
|
|
assert should_stamp_codex_client_signals("/v1/chat/completions", AuthSignals()) is False
|