peptide-repo/pr-vision
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

P2 pre-merge fixes: io_captured column, reconcile copy, harden security test

Browse Source 
Fix 1: Add io_captured TINYINT(1) NOT NULL DEFAULT 0 to prv_call_meta
CREATE (baked into initial schema — table is new in v0.3.0, no separate
migration needed). PRV_Capture_Writer::write_io() sets io_captured=1 via
set_io_captured() on success; error rows and legacy rows keep 0.
Drawer state now driven by io_captured instead of config_version heuristic:
  0         → Legacy/not-captured
  1 + io    → Normal
  1 + no io → Pruned
ARCHITECTURE.md schema section updated.

Fix 2: Soften reconciliation copy in PRV_Costs_Renderer (~line 75):
'matches the Dashboard MTD total' → 'approximately reconciles to the
Dashboard MTD total' — error calls write prv_call_meta (cost 0) but not
prv_ai_visibility, so exact equality is not guaranteed.

Fix 3: Harden security test (test-capture-writer Test 4): inject sentinel
sk-or-TEST-LEAK-CANARY as PRV_OPENROUTER_API_KEY constant; queue a mocked
401 wp_remote_post response; drive PRV_Probe_Runner → PRV_Probe_Run_Executor
→ probe_one() 401 error path end-to-end; assert the sentinel, Bearer, and
Authorization appear in NO stored row (prv_call_meta or prv_call_io).
Original direct-writer security test retained as Test 3.
This commit is contained in:
peptiderepo
2026-06-15 09:56:11 +00:00
parent 94bef937c7
commit 09dc6db9ce
7 changed files with 116 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
tests/unit/test-capture-writer.php
View File

@@ -37,6 +37,7 @@ prv_assert( count( $meta_rows ) === 1, 'write_meta inserts exactly one call_meta
prv_assert_equals( 'bpc-157', $meta_rows[0]['peptide_slug'], 'write_meta stores peptide_slug' );
prv_assert_equals( 100, $meta_rows[0]['tokens_in'], 'write_meta stores tokens_in' );
prv_assert_equals( 250, $meta_rows[0]['tokens_out'], 'write_meta stores tokens_out' );
prv_assert_equals( 0, $meta_rows[0]['io_captured'], 'write_meta sets io_captured=0 initially' );
// ── Test 2: write_io writes a row to prv_call_io ─────────────────────────
$ok = $writer->write_io( $call_id, 'what is BPC-157?', 'BPC-157 is a peptide...' );
@@ -46,9 +47,8 @@ prv_assert( count( $io_rows ) === 1, 'write_io inserts exactly one call_io row'
prv_assert_equals( 'what is BPC-157?', $io_rows[0]['prompt_text'], 'write_io stores prompt_text' );
prv_assert_equals( 'BPC-157 is a peptide...', $io_rows[0]['response_text'], 'write_io stores response_text' );
// ── Test 3 (P0 SECURITY): 401 error record does NOT store key/Bearer ──────
// Simulate the probe-runner error path: write_meta called with http_status=401
// and write_io called with the rendered query only (no auth).
// ── Test 3 (P0 SECURITY — direct writer): 401 error record does NOT store key/Bearer ──
// Direct-writer path: simulate the probe-runner error path parameters.
prv_test_reset();
$writer2 = new PRV_Capture_Writer();
$writer2->write_meta(
@@ -72,10 +72,8 @@ $writer2->write_io( 1, 'what is TB-500?', '' );
$err_meta = $GLOBALS['prv_test_state']['wpdb_call_meta_rows'][0];
$err_io = $GLOBALS['prv_test_state']['wpdb_call_io_rows'][0];
// The error metadata must contain http_status=401.
prv_assert_equals( 401, $err_meta['http_status'], 'Error record stores http_status 401' );
// The stored data must NOT contain any key-like strings.
$all_stored = wp_json_encode( $err_meta ) . wp_json_encode( $err_io );
prv_assert( false === strpos( $all_stored, 'Bearer' ), 'Stored data does not contain "Bearer"' );
prv_assert( false === strpos( $all_stored, 'sk-or-' ), 'Stored data does not contain "sk-or-"' );
@@ -83,9 +81,59 @@ prv_assert( false === strpos( $all_stored, 'Authorization' ), 'Stored data does
prv_assert( null === $err_meta['cited'], 'Error record has cited=null' );
prv_assert_equals( 'what is TB-500?', $err_io['prompt_text'], 'Error record stores rendered query as prompt_text' );
// ── Test 4: update_meta_cost writes back the cost ────────────────────────
// No direct state to assert in the stub (update is a no-op returning 1), but
// confirm the method returns true.
// ── Test 4 (P0 SECURITY — full executor path): sentinel key must not leak ─
// Inject a known sentinel as the resolved API key; drive a mocked 401 error
// path end-to-end through PRV_Probe_Run_Executor (via PRV_Probe_Runner).
// Assert the sentinel, "Bearer", and "Authorization" appear in NO stored row.
prv_test_reset();
if ( ! defined( 'PRV_OPENROUTER_API_KEY' ) ) {
define( 'PRV_OPENROUTER_API_KEY', 'sk-or-TEST-LEAK-CANARY' );
}
$GLOBALS['prv_test_state']['options']['prv_monthly_budget_usd'] = 5.0;
$GLOBALS['prv_test_state']['options']['prv_peptides'] = array( array( 'slug' => 'bpc-157', 'label' => 'BPC-157' ) );
$GLOBALS['prv_test_state']['options']['prv_prompt_intents'] = array( 'what is {peptide}' );
$GLOBALS['prv_test_state']['options']['prv_models_v2'] = array(
array( 'slug' => 'openai/gpt-4o', 'enabled' => true ),
);
$GLOBALS['prv_test_state']['options']['prv_active_config_version'] = 3;
$GLOBALS['prv_test_state']['wpdb_var'] = '0.0'; // No prior spend.
// Queue a 401 response for wp_remote_post.
$GLOBALS['prv_test_state']['remote_posts'][] = array(
'response' => array( 'code' => 401 ),
'body' => '{"error":{"message":"Invalid API key","code":401}}',
);
$sentinel_capture = new PRV_Capture_Writer();
$sentinel_ledger = new PRV_Cost_Ledger();
$sentinel_runner = new PRV_Probe_Runner( $sentinel_ledger, $sentinel_capture );
try {
$sentinel_counts = $sentinel_runner->run();
} catch ( \Throwable $ex ) {
$sentinel_counts = array( 'skipped_error' => -99 );
}
// The executor must have recorded the 401 error call (skipped_error >= 1).
prv_assert( isset( $sentinel_counts['skipped_error'] ) && $sentinel_counts['skipped_error'] >= 1, 'Executor recorded a skipped_error for the 401 path' );
// Now verify NO stored row (meta or io) contains the sentinel key or auth material.
$all_meta = $GLOBALS['prv_test_state']['wpdb_call_meta_rows'];
$all_io = $GLOBALS['prv_test_state']['wpdb_call_io_rows'];
$all_json = wp_json_encode( $all_meta ) . wp_json_encode( $all_io );
prv_assert( false === strpos( $all_json, 'sk-or-TEST-LEAK-CANARY' ), 'Sentinel key does not appear in any stored row (executor path)' );
prv_assert( false === strpos( $all_json, 'Bearer' ), 'Bearer does not appear in any stored row (executor path)' );
prv_assert( false === strpos( $all_json, 'Authorization' ), 'Authorization does not appear in any stored row (executor path)' );
prv_assert( count( $all_meta ) >= 1, 'Executor path wrote at least one call_meta row on 401' );
if ( ! empty( $all_meta ) ) {
prv_assert_equals( 401, $all_meta[0]['http_status'], 'Executor 401 path stores http_status=401 in call_meta' );
}
// ── Test 5: update_meta_cost writes back the cost ────────────────────────
prv_test_reset();
$writer3 = new PRV_Capture_Writer();
$result = $writer3->update_meta_cost( 5, 0.004567 );