netbird/management/internals/modules/agentnetwork/credentialcheck_test.go

package agentnetwork

import (
	"context"
	"crypto/tls"
	"errors"
	"fmt"
	"net"
	"os"
	"syscall"
	"testing"

	"github.com/stretchr/testify/require"

	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/modeldiscovery"
	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
	"github.com/netbirdio/netbird/management/server/permissions/modules"
	"github.com/netbirdio/netbird/management/server/permissions/operations"
	"github.com/netbirdio/netbird/management/server/store"
	"github.com/netbirdio/netbird/shared/management/status"
)

// stubLister stands in for the vendor on the write path. It records what it
// was asked so a test can assert not only that the check ran, but that it ran
// against the right upstream and the right credential — and, for an edit that
// touches neither, that it did not run at all.
type stubLister struct {
	err      error
	requests []modeldiscovery.Request
}

func (s *stubLister) Fetch(_ context.Context, req modeldiscovery.Request) ([]modeldiscovery.Model, error) {
	s.requests = append(s.requests, req)
	if s.err != nil {
		return nil, s.err
	}
	return []modeldiscovery.Model{{ID: "a-model", PricingKnown: true}}, nil
}

func (s *stubLister) calls() int { return len(s.requests) }

func (s *stubLister) only(t *testing.T) modeldiscovery.Request {
	t.Helper()
	require.Len(t, s.requests, 1, "the vendor must be asked exactly once")
	return s.requests[0]
}

// TestCredentialCheckFailure_SeparatesTheUrlFromTheCredential is the contract
// the provider form is written against: an operator gets told which of the two
// fields they have to look at, and the message says so without a status code
// and without echoing the URL back at them.
func TestCredentialCheckFailure_SeparatesTheUrlFromTheCredential(t *testing.T) {
	cases := []struct {
		name string
		err  error
		want string
	}{
		{
			name: "401 is the credential",
			err:  &modeldiscovery.VendorStatusError{Provider: "OpenAI", Status: 401},
			want: "the provider rejected the credential",
		},
		{
			name: "403 is the credential",
			err:  &modeldiscovery.VendorStatusError{Provider: "Bedrock", Status: 403},
			want: "the provider rejected the credential",
		},
		{
			// The host authenticated us fine and then said it has no such
			// endpoint, which is the URL being wrong rather than the key.
			name: "404 is the url",
			err:  &modeldiscovery.VendorStatusError{Provider: "OpenAI", Status: 404},
			want: "the upstream url did not answer a model listing",
		},
		{
			name: "405 is the url",
			err:  &modeldiscovery.VendorStatusError{Provider: "OpenAI", Status: 405},
			want: "the upstream url did not answer a model listing",
		},
		{
			name: "500 is the vendor",
			err:  &modeldiscovery.VendorStatusError{Provider: "Anthropic", Status: 500},
			want: "the provider returned an error",
		},
		{
			name: "503 is the vendor",
			err:  &modeldiscovery.VendorStatusError{Provider: "Anthropic", Status: 503},
			want: "the provider returned an error",
		},
		{
			name: "429 is the vendor",
			err:  &modeldiscovery.VendorStatusError{Provider: "Anthropic", Status: 429},
			want: "the provider returned an error",
		},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			got, blocking := credentialCheckFailure(tc.err)
			require.True(t, blocking, "a vendor refusal must block the write")
			require.Equal(t, tc.want, got)
		})
	}
}

// TestCredentialCheckFailure_NamesTheTransportFault covers the failures that
// never reached the vendor. The distinction inside them is worth keeping: a
// refused connection is a wrong port and an unknown host is a wrong hostname,
// and an operator staring at a URL they believe in needs to be told which.
func TestCredentialCheckFailure_NamesTheTransportFault(t *testing.T) {
	cases := []struct {
		name string
		err  error
		want string
	}{
		{
			name: "unknown host",
			err:  &net.DNSError{Err: "no such host", Name: "api.exmaple.com", IsNotFound: true},
			want: "the upstream url could not be reached: no such host",
		},
		{
			name: "dns failure that is not a missing name",
			err:  &net.DNSError{Err: "server misbehaving", Name: "api.example.com"},
			want: "the upstream url could not be reached: dns lookup failed",
		},
		{
			name: "connection refused",
			err:  &net.OpError{Op: "dial", Net: "tcp", Err: syscall.ECONNREFUSED},
			want: "the upstream url could not be reached: connection refused",
		},
		{
			name: "host unreachable",
			err:  &net.OpError{Op: "dial", Net: "tcp", Err: syscall.EHOSTUNREACH},
			want: "the upstream url could not be reached: host unreachable",
		},
		{
			name: "timeout",
			err:  fmt.Errorf("dial: %w", os.ErrDeadlineExceeded),
			want: "the upstream url could not be reached: connection timed out",
		},
		{
			name: "context deadline",
			err:  fmt.Errorf("dial: %w", context.DeadlineExceeded),
			want: "the upstream url could not be reached: connection timed out",
		},
		{
			name: "untrusted certificate",
			err:  &tls.CertificateVerificationError{},
			want: "the upstream url could not be reached: tls certificate not trusted",
		},
		{
			name: "plaintext service on an https url",
			err:  tls.RecordHeaderError{Msg: "first record does not look like a TLS handshake"},
			want: "the upstream url could not be reached: not a tls endpoint",
		},
		{
			// Nothing we recognise. Better to say only that it could not be
			// reached than to paste a Go error into the provider form.
			name: "cause we do not recognise",
			err:  errors.New("something went sideways"),
			want: "the upstream url could not be reached",
		},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			wrapped := &modeldiscovery.UnreachableError{Provider: "OpenAI", Err: tc.err}
			got, blocking := credentialCheckFailure(wrapped)
			require.True(t, blocking, "an unreachable upstream must block the write")
			require.Equal(t, tc.want, got)
		})
	}
}

// TestCredentialCheckFailure_AnAnsweringUrlThatIsNotTheApi covers the case a
// status probe would wave through: the host is up, the credential was accepted
// or not required, and the body is a login page. Reusing the discovery parser
// for the check is what catches it.
func TestCredentialCheckFailure_AnAnsweringUrlThatIsNotTheApi(t *testing.T) {
	err := fmt.Errorf("%w: decode model listing: unexpected token", modeldiscovery.ErrUnparseableListing)

	got, blocking := credentialCheckFailure(err)
	require.True(t, blocking)
	require.Equal(t, "the upstream url answered, but not with a model listing", got)
}

// TestCredentialCheckFailure_WhatCannotBeCheckedIsNotAFailure pins the
// difference between "this record is wrong" and "we have no way to ask". A
// gateway with no listing endpoint, a Bedrock record pointed at a proxy, and a
// self-hosted endpoint the proxy reaches through the tunnel are all legitimate
// providers. Blocking them would make the feature a lockout.
func TestCredentialCheckFailure_WhatCannotBeCheckedIsNotAFailure(t *testing.T) {
	cases := map[string]error{
		"no listing endpoint":  modeldiscovery.ErrNoDiscovery,
		"no derivable host":    fmt.Errorf("%w: %w: bedrock", modeldiscovery.ErrInvalidRequest, modeldiscovery.ErrNoDiscoveryHost),
		"private upstream":     fmt.Errorf("%w: %w: 10.0.0.5", modeldiscovery.ErrInvalidRequest, modeldiscovery.ErrPrivateHost),
		"private at dial time": fmt.Errorf("%w: discovery refused to dial non-public address 10.0.0.5", modeldiscovery.ErrPrivateHost),
		"wrapped by unreachable": &modeldiscovery.UnreachableError{
			Provider: "vLLM",
			Err:      fmt.Errorf("%w: dial", modeldiscovery.ErrPrivateHost),
		},
	}

	for name, err := range cases {
		t.Run(name, func(t *testing.T) {
			message, blocking := credentialCheckFailure(err)
			require.False(t, blocking, "a provider we cannot check must still save")
			require.Empty(t, message)
		})
	}
}

// TestCredentialCheckFailure_AnUnrecognisedFailureStillBlocks covers a fault of
// ours rather than the vendor's — a malformed request this code built, or a
// catalog entry whose parser does not match its endpoint. The record went
// unverified either way, and silently saving what we could not check is the
// thing this feature exists to prevent.
func TestCredentialCheckFailure_AnUnrecognisedFailureStillBlocks(t *testing.T) {
	message, blocking := credentialCheckFailure(errors.New("no parser for listing shape \"\""))
	require.True(t, blocking)
	require.Equal(t, "the provider could not be checked", message)
}

// newCheckedProvider returns a record shaped the way the handler guarantees
// one: a known catalog id, a public upstream and a key.
func newCheckedProvider(accountID string) *types.Provider {
	provider := types.NewProvider(accountID)
	provider.ProviderID = "openai_api"
	provider.Name = "openai"
	provider.UpstreamURL = "https://api.openai.com"
	provider.APIKey = "sk-good"
	provider.Enabled = true
	return provider
}

// TestCreateProvider_RefusesARecordTheVendorRejects is the whole point of the
// feature: a key with a character missing used to save cleanly and surface
// minutes later as a failed request with nothing pointing back at the record.
func TestCreateProvider_RefusesARecordTheVendorRejects(t *testing.T) {
	ctx := context.Background()
	f := newBootstrapFixture(t)
	f.vendor.err = &modeldiscovery.VendorStatusError{Provider: "OpenAI", Status: 401}
	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)

	_, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))

	require.Error(t, err)
	require.Contains(t, err.Error(), "the provider rejected the credential")

	var sErr *status.Error
	require.ErrorAs(t, err, &sErr)
	require.Equal(t, status.InvalidArgument, sErr.Type(), "the refusal must reach the caller as a 422")

	stored, err := f.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "account1")
	require.NoError(t, err)
	require.Empty(t, stored, "a record that failed its check must not be written")
}

// TestCreateProvider_ChecksTheCredentialItWasGiven pins what the vendor is
// asked with, since a check run against the wrong upstream or a stale key
// would pass while proving nothing.
func TestCreateProvider_ChecksTheCredentialItWasGiven(t *testing.T) {
	ctx := context.Background()
	f := newBootstrapFixture(t)
	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)

	_, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))
	require.NoError(t, err)

	asked := f.vendor.only(t)
	require.Equal(t, "openai_api", asked.CatalogID)
	require.Equal(t, "https://api.openai.com", asked.UpstreamURL)
	require.Equal(t, "sk-good", asked.APIKey)
}

// TestUpdateProvider_AUrlOnlyChangeIsCheckedAgainstTheStoredKey covers the
// case that shaped where the check sits. The key never returns to the browser,
// so an operator editing only the URL has none to offer — the stored one is
// the only credential there is, and the new URL still has to be proven with
// it.
func TestUpdateProvider_AUrlOnlyChangeIsCheckedAgainstTheStoredKey(t *testing.T) {
	ctx := context.Background()
	f := newBootstrapFixture(t)
	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)

	created, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))
	require.NoError(t, err)
	f.vendor.requests = nil

	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Update, true)
	edit := newCheckedProvider("account1")
	edit.ID = created.ID
	edit.UpstreamURL = "https://gateway.example.com"
	edit.APIKey = "" // the form sends no key when it was not retyped

	_, err = f.manager.UpdateProvider(ctx, "user1", edit)
	require.NoError(t, err)

	asked := f.vendor.only(t)
	require.Equal(t, "https://gateway.example.com", asked.UpstreamURL, "the new url must be what gets tested")
	require.Equal(t, "sk-good", asked.APIKey, "and the stored key must be what tests it")
}

// TestUpdateProvider_AFailedRotationLeavesTheWorkingKeyInPlace is the
// half-applied state the check must never produce: refusing the new key while
// having already replaced the old one would take the provider down.
func TestUpdateProvider_AFailedRotationLeavesTheWorkingKeyInPlace(t *testing.T) {
	ctx := context.Background()
	f := newBootstrapFixture(t)
	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)

	created, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))
	require.NoError(t, err)

	f.vendor.err = &modeldiscovery.VendorStatusError{Provider: "OpenAI", Status: 403}
	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Update, true)
	rotation := newCheckedProvider("account1")
	rotation.ID = created.ID
	rotation.APIKey = "sk-typo"

	_, err = f.manager.UpdateProvider(ctx, "user1", rotation)
	require.Error(t, err)
	require.Contains(t, err.Error(), "the provider rejected the credential")

	stored, err := f.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, "account1", created.ID)
	require.NoError(t, err)
	require.Equal(t, "sk-good", stored.APIKey, "the rejected key must not have replaced the working one")
}

// TestUpdateProvider_AnEditTouchingNeitherFieldAsksNoVendor keeps renames,
// model rows and price edits off the vendor's doorstep. They have nothing new
// to prove, and making them wait on a vendor — or fail because one is having a
// bad day — would be a tax on edits that carry no risk.
func TestUpdateProvider_AnEditTouchingNeitherFieldAsksNoVendor(t *testing.T) {
	ctx := context.Background()
	f := newBootstrapFixture(t)
	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)

	created, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))
	require.NoError(t, err)
	f.vendor.requests = nil
	// Any call at all now would fail the update, which is what makes the
	// assertion below load-bearing rather than decorative.
	f.vendor.err = &modeldiscovery.VendorStatusError{Provider: "OpenAI", Status: 500}

	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Update, true)
	rename := newCheckedProvider("account1")
	rename.ID = created.ID
	rename.Name = "openai-renamed"
	rename.APIKey = ""

	_, err = f.manager.UpdateProvider(ctx, "user1", rename)
	require.NoError(t, err, "an edit that changes neither url nor key must not be checked")
	require.Zero(t, f.vendor.calls(), "and must not reach the vendor at all")
}

// TestCreateProvider_AProviderWeCannotCheckStillSaves covers the eleven
// catalog entries with no listing endpoint, a Bedrock record behind a proxy,
// and a self-hosted endpoint on a private network. None of those are evidence
// the record is wrong, and refusing them would make this a lockout.
func TestCreateProvider_AProviderWeCannotCheckStillSaves(t *testing.T) {
	cases := map[string]error{
		"gateway with no listing endpoint": modeldiscovery.ErrNoDiscovery,
		"bedrock behind a proxy":           fmt.Errorf("%w: %w", modeldiscovery.ErrInvalidRequest, modeldiscovery.ErrNoDiscoveryHost),
		"self-hosted on a private network": fmt.Errorf("%w: %w", modeldiscovery.ErrInvalidRequest, modeldiscovery.ErrPrivateHost),
	}

	for name, vendorErr := range cases {
		t.Run(name, func(t *testing.T) {
			ctx := context.Background()
			f := newBootstrapFixture(t)
			f.vendor.err = vendorErr
			f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)

			created, err := f.manager.CreateProvider(ctx, "user1", newCheckedProvider("account1"))
			require.NoError(t, err)
			require.NotNil(t, created)

			stored, err := f.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "account1")
			require.NoError(t, err)
			require.Len(t, stored, 1, "a provider we cannot check must still be written")
		})
	}
}