mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
27dcd975e5
Twenty-five specs called the Playwright APIs with default or hardcoded timeouts. Routed over Tor those budgets are too small, so a spec fails on transport latency rather than on the behaviour it asserts. Route the waits through resolveTimeout and reach pages via gotoOnion, the helpers the tor branch introduced for exactly this. The remaining changes in the diff are import wrapping around those calls. The repository lint enforces this: a raw numeric timeout in a role spec is rejected with a pointer to resolveTimeout, which is how a hardcoded 500ms wait added during this session was caught. Merge work rather than authored here; not deployed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
38 lines
1.3 KiB
JavaScript
38 lines
1.3 KiB
JavaScript
const { test, expect } = require("@playwright/test");
|
|
const { resolveTimeout } = require("./timeouts");
|
|
|
|
const { skipUnlessServiceEnabled } = require("./service-gating");
|
|
|
|
exports.register = function (shared) {
|
|
test("mcp: the agent API holding the MCP credentials refuses an unauthenticated caller", async ({ request }) => {
|
|
skipUnlessServiceEnabled("mcp");
|
|
|
|
const anonymous = await request.get(`${shared.env.baseUrl}/v1/models`, {
|
|
timeout: resolveTimeout(30_000),
|
|
});
|
|
expect(
|
|
anonymous.status(),
|
|
"an unauthenticated /v1/models must be refused; the agent holds one bearer per MCP server",
|
|
).toBeGreaterThanOrEqual(400);
|
|
|
|
expect(
|
|
await anonymous.text(),
|
|
"a refused request must not leak the configured MCP servers",
|
|
).not.toContain("mcp");
|
|
|
|
expect(
|
|
shared.env.apiServerKey,
|
|
"HERMES_API_SERVER_KEY must be set for the authenticated leg of this test",
|
|
).toBeTruthy();
|
|
|
|
const authenticated = await request.get(`${shared.env.baseUrl}/v1/models`, {
|
|
headers: { Authorization: `Bearer ${shared.env.apiServerKey}` },
|
|
timeout: resolveTimeout(30_000),
|
|
});
|
|
expect(
|
|
authenticated.status(),
|
|
"the API server key must open the same endpoint that the anonymous call was refused on",
|
|
).toBeLessThan(400);
|
|
});
|
|
};
|