llama.cpp/tools/ui/tests/unit/sanitize-headers.test.ts

import { CORS_PROXY } from '$lib/constants';
import { sanitizeHeaders } from '$lib/utils/api-headers';
import { describe, expect, it } from 'vitest';

describe('sanitizeHeaders', () => {
	it('returns empty object for undefined input', () => {
		expect(sanitizeHeaders()).toEqual({});
	});

	it('passes through non-sensitive headers', () => {
		const headers = new Headers({ accept: 'text/html', 'content-type': 'application/json' });

		expect(sanitizeHeaders(headers)).toEqual({
			accept: 'text/html',
			'content-type': 'application/json'
		});
	});

	it('redacts known sensitive headers', () => {
		const headers = new Headers({
			authorization: 'Bearer secret',
			'content-type': 'application/json',
			'x-api-key': 'key-123'
		});
		const result = sanitizeHeaders(headers);

		expect(result.authorization).toBe('[redacted]');
		expect(result['x-api-key']).toBe('[redacted]');
		expect(result['content-type']).toBe('application/json');
	});

	it('partially redacts headers specified in partialRedactHeaders', () => {
		const headers = new Headers({ 'mcp-session-id': 'session-12345' });
		const partial = new Map([['mcp-session-id', 5]]);

		expect(sanitizeHeaders(headers, undefined, partial)['mcp-session-id']).toBe('....12345');
	});

	it('fully redacts mcp-session-id when no partialRedactHeaders is given', () => {
		const headers = new Headers({ 'mcp-session-id': 'session-12345' });

		expect(sanitizeHeaders(headers)['mcp-session-id']).toBe('[redacted]');
	});

	it('redacts extra headers provided by the caller', () => {
		const headers = new Headers({
			'content-type': 'application/json',
			'x-vendor-key': 'vendor-secret'
		});
		const result = sanitizeHeaders(headers, ['x-vendor-key']);

		expect(result['x-vendor-key']).toBe('[redacted]');
		expect(result['content-type']).toBe('application/json');
	});

	it('handles case-insensitive extra header names', () => {
		const headers = new Headers({ 'X-Custom-Token': 'token-value' });
		const result = sanitizeHeaders(headers, ['X-CUSTOM-TOKEN']);

		expect(result['x-custom-token']).toBe('[redacted]');
	});

	it('redacts proxied sensitive and custom target headers', () => {
		const proxiedAuthorization = `${CORS_PROXY.HEADER_PREFIX}authorization`;
		const proxiedSessionId = `${CORS_PROXY.HEADER_PREFIX}mcp-session-id`;
		const proxiedVendorKey = `${CORS_PROXY.HEADER_PREFIX}x-vendor-key`;
		const headers = new Headers({
			[proxiedAuthorization]: 'Bearer secret',
			[proxiedSessionId]: 'session-12345',
			[proxiedVendorKey]: 'vendor-secret'
		});
		const partial = new Map([['mcp-session-id', 5]]);
		const result = sanitizeHeaders(headers, ['x-vendor-key'], partial);

		expect(result[proxiedAuthorization]).toBe('[redacted]');
		expect(result[proxiedSessionId]).toBe('....12345');
		expect(result[proxiedVendorKey]).toBe('[redacted]');
	});
});