mirror of
https://github.com/headroomlabs-ai/headroom.git
synced 2026-08-27 14:17:10 -04:00
868b88bc64
## Description Extracts the internal x-headroom request-header stripping policy from `headroom.proxy.helpers` into a focused policy module. This keeps the security-sensitive upstream filtering rule independently testable while preserving the existing helper API used by provider handlers. Closes # ## Type of Change - [ ] Bug fix (non-breaking change that fixes an issue) - [ ] New feature (non-breaking change that adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update - [ ] Performance improvement - [x] Code refactoring (no functional changes) ## Changes Made - Added `headroom.proxy.internal_header_policy` for strip mode resolution and x-headroom header filtering. - Kept `get_strip_internal_headers_mode()` and `_strip_internal_headers()` as compatibility wrappers in `helpers.py`. - Added direct unit tests for default/disabled/invalid modes, case-insensitive filtering, and copy semantics. ## Testing - [x] Unit tests pass (`pytest`) - [x] Linting passes (`ruff check .`) - [x] Type checking passes (`mypy headroom`) - [x] New tests added for new functionality - [ ] Manual testing performed ### Test Output ```text python -m pytest tests/test_internal_header_policy.py tests/test_header_isolation.py 29 passed in 4.89s python -m ruff check . All checks passed! python -m ruff format --check . 1069 files already formatted python -m mypy headroom --ignore-missing-imports Success: no issues found in 410 source files gitleaks protect --staged --no-banner --redact no leaks found ``` ## Real Behavior Proof - Environment: Windows, Python 3.13.13 - Exact command / steps: Ran focused policy/header isolation pytest coverage plus full ruff, ruff format check, mypy, and staged gitleaks scan. - Observed result: Header stripping behavior remains green end-to-end, direct policy tests cover security-sensitive parsing/filtering rules, and local quality/security gates pass. - Not tested: Full repository pytest suite locally; CI covers the broader matrix. ## Review Readiness - [x] I have performed a self-review - [x] This PR is ready for human review ## Checklist - [x] My code follows the project's style guidelines - [x] I have performed a self-review of my code - [x] I have commented my code, particularly in hard-to-understand areas - [ ] I have made corresponding changes to the documentation - [x] My changes generate no new warnings - [x] I have added tests that prove my fix is effective or that my feature works - [x] New and existing unit tests pass locally with my changes - [ ] I have updated the CHANGELOG.md if applicable ## Screenshots (if applicable) N/A ## Additional Notes Documentation and changelog updates are not applicable for this internal refactor. The default-branch Dependabot alerts reported during push are pre-existing and unrelated to this PR.
50 lines
1.6 KiB
Python
50 lines
1.6 KiB
Python
from __future__ import annotations
|
|
|
|
import pytest
|
|
|
|
from headroom.proxy.internal_header_policy import (
|
|
STRIP_INTERNAL_HEADERS_ENV,
|
|
resolve_strip_internal_headers_mode,
|
|
strip_internal_headers,
|
|
)
|
|
|
|
|
|
def test_resolve_strip_internal_headers_mode_defaults_to_enabled() -> None:
|
|
assert resolve_strip_internal_headers_mode(None) == "enabled"
|
|
assert resolve_strip_internal_headers_mode(" ") == "enabled"
|
|
|
|
|
|
def test_resolve_strip_internal_headers_mode_accepts_known_values() -> None:
|
|
assert resolve_strip_internal_headers_mode("ENABLED") == "enabled"
|
|
assert resolve_strip_internal_headers_mode(" disabled ") == "disabled"
|
|
|
|
|
|
def test_resolve_strip_internal_headers_mode_rejects_unknown_values() -> None:
|
|
with pytest.raises(ValueError, match=STRIP_INTERNAL_HEADERS_ENV):
|
|
resolve_strip_internal_headers_mode("maybe")
|
|
|
|
|
|
def test_strip_internal_headers_removes_headroom_headers_case_insensitively() -> None:
|
|
headers = {
|
|
"Authorization": "Bearer token",
|
|
"x-headroom-bypass": "true",
|
|
"X-Headroom-User-Id": "user-1",
|
|
"content-type": "application/json",
|
|
}
|
|
|
|
stripped = strip_internal_headers(headers, mode="enabled")
|
|
|
|
assert stripped == {
|
|
"Authorization": "Bearer token",
|
|
"content-type": "application/json",
|
|
}
|
|
assert "x-headroom-bypass" in headers
|
|
|
|
|
|
def test_strip_internal_headers_disabled_returns_copy_unchanged() -> None:
|
|
headers = {"x-headroom-mode": "passthrough", "content-type": "application/json"}
|
|
|
|
copied = strip_internal_headers(headers, mode="disabled")
|
|
|
|
assert copied == headers
|
|
assert copied is not headers
|