peptide-repo/peptide-e2e
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

test(smoke): match real key token, not the sk-or- placeholder (#25)

Browse Source 
The write-only security check in 08-pr-vision-admin.spec.ts asserted
page.content() does not contain 'sk-or-'. The password input for the
API key renders with placeholder="sk-or-…" (an ellipsis format hint
shown when the key is admin-managed). This placeholder contains the
literal string 'sk-or-' so the naive toContain assertion trips even
though value="" and no real key is in the page.

Fix: replace toContain('sk-or-') with toMatch(/sk-or-v1-[A-Za-z0-9]{20,}/).
A real OpenRouter key uses the format 'sk-or-v1-<20+ alnum chars>';
the placeholder ellipsis 'sk-or-…' never matches this pattern, so the
false-positive is eliminated. The assertion still catches any real key
accidentally rendered in server-side HTML.

The value="" assertion is unchanged and continues to guard the core
write-only invariant independently.

Agent-Session: fix-smoke-key-assertion-20260617

Co-authored-by: peptiderepo <bot@peptiderepo.com>
This commit was merged in pull request #25.
This commit is contained in:
peptiderepo
2026-06-17 13:07:56 +07:00
committed by GitHub
parent 3f63c0ce77
commit 696b4d8062
1 changed files with 16 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
tests/08-pr-vision-admin.spec.ts
View File

@@ -34,7 +34,11 @@
* The stored OpenRouter key must NEVER appear in page source.
* #prv_api_key renders with value="" on every page load regardless of
* whether a key is stored. This spec asserts the empty value and asserts
* that known API key prefixes ("sk-or-") are absent from the full body.
* that no structurally valid key token (regex /sk-or-v1-[A-Za-z0-9]{20,}/)
* appears in the full body HTML. A regex is used instead of a naive
* toContain('sk-or-') to avoid a false-positive on the password input's
* placeholder="sk-or-…" attribute (the ellipsis is a format hint, not a
* token body, and won't match the regex).
*
* @see peptiderepo/pr-vision includes/core/class-prv-admin-page.php
* @see peptiderepo/pr-vision includes/core/class-prv-settings-page.php
@@ -170,10 +174,18 @@ test.describe('WP Admin - PR Vision Settings page (API-key-manager)', () => {
const inputValue = await keyInput.getAttribute('value');
expect(inputValue ?? '').toBe('');
// Security check: known OpenRouter key prefixes must not appear anywhere in
// the page HTML -- guards against accidental server-side leakage.
// Security check: a *real* OpenRouter key (format "sk-or-v1-<20+ alnum chars>")
// must not appear anywhere in the page HTML -- guards against accidental
// server-side leakage.
//
// NOTE: We use a regex rather than the naive toContain('sk-or-') to avoid
// a false-positive: the password input carries placeholder="sk-or-…"
// (an ellipsis format-hint, not a token body) which contains the literal
// string "sk-or-" but is NOT a leaked key. A regex that requires the
// "v1-" segment and at least 20 alphanumeric characters only matches a
// structurally valid key, so the placeholder never trips it.
const html = await page.content();
expect(html).not.toContain('sk-or-');
expect(html).not.toMatch(/sk-or-v1-[A-Za-z0-9]{20,}/);
});
});