mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-27 18:11:29 +02:00
5720c33be9
Four defects and two pieces of wording, from cubic's pass over the branch. A provider that asks the proxy to skip TLS verification was checked with a client that verifies it, so a self-hosted endpoint behind a self-signed certificate was refused for the one reason its operator had already declared they accept. Those records now save unchecked, alongside the other cases this cannot speak for. Sending the credential over a connection management declines to verify was the other way out, and a worse one. A key pasted with surrounding whitespace passed its check and then failed every request: the vendor call trims before building the auth header, the synthesiser substitutes the stored value verbatim. The key is now stored in the form it will be sent, so what was checked is what runs. The proxy-guard test resolved api.openai.com for real before reaching its own transport, and on a runner with no egress that lookup failed as an UnreachableError too — so it passed while never exercising the socket guard it is named for. A DNS timeout said only that the lookup failed. It now says so as a timeout, without borrowing the wording of a connection that was never attempted. The create description promised more than the check delivers: for Bedrock the runtime host is resolved but never contacted, so a public host that does not answer is still stored. It says that now, and names the TLS exemption above. The invalid-upstream message no longer quotes the URL back, which was the one path in this feature that echoed what the operator typed. The live suite's single-vendor scope and its dependence on vendor availability are now stated where the tests are, rather than left to be rediscovered.