Nvidia/BossAI
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix Gemini OAuth refresh and failure coverage

Browse Source
This commit is contained in:
Cita
2026-03-21 18:38:00 +08:00
parent 6a19d809f0
commit dd48550ffa
5 changed files with 634 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/server/routes/api/oauth.test.ts
+162
View File
@@ -789,6 +789,168 @@ describe('oauth routes', { timeout: 15_000 }, () => {
expect(String(fetchMock.mock.calls[7]?.[0] || '')).toContain('/projects/gen-lang-client-0123456789/services/cloudaicompanion.googleapis.com');
});
it('surfaces Cloud AI API enable failures during Gemini CLI oauth setup and keeps the account rolled back', async () => {
fetchMock
.mockResolvedValueOnce({
ok: true,
status: 200,
json: async () => ({
access_token: 'gemini-access-token',
refresh_token: 'gemini-refresh-token',
expires_in: 3600,
token_type: 'Bearer',
scope: 'cloud-platform',
}),
text: async () => JSON.stringify({ ok: true }),
})
.mockResolvedValueOnce({
ok: true,
status: 200,
json: async () => ({
projects: [
{ projectId: 'project-enable-failure' },
],
}),
text: async () => JSON.stringify({ ok: true }),
})
.mockResolvedValueOnce({
ok: true,
status: 200,
json: async () => ({
cloudaicompanionProject: {
id: 'project-enable-failure',
},
allowedTiers: [
{ id: 'legacy-tier', isDefault: true },
],
}),
text: async () => JSON.stringify({ ok: true }),
})
.mockResolvedValueOnce({
ok: true,
status: 200,
json: async () => ({
done: true,
response: {
cloudaicompanionProject: {
id: 'project-enable-failure',
},
},
}),
text: async () => JSON.stringify({ done: true }),
})
.mockResolvedValueOnce({
ok: true,
status: 200,
json: async () => ({ state: 'DISABLED' }),
text: async () => JSON.stringify({ state: 'DISABLED' }),
})
.mockResolvedValueOnce({
ok: false,
status: 403,
json: async () => ({ error: { message: 'Permission denied for project-enable-failure' } }),
text: async () => JSON.stringify({ error: { message: 'Permission denied for project-enable-failure' } }),
});
const startResponse = await app.inject({
method: 'POST',
url: '/api/oauth/providers/gemini-cli/start',
headers: {
host: 'metapi.example',
'x-forwarded-proto': 'https',
},
});
expect(startResponse.statusCode).toBe(200);
const startBody = startResponse.json() as { state: string };
const callbackResponse = await app.inject({
method: 'POST',
url: `/api/oauth/sessions/${encodeURIComponent(startBody.state)}/manual-callback`,
payload: {
callbackUrl: `http://localhost:8085/oauth2callback?state=${encodeURIComponent(startBody.state)}&code=gemini-oauth-code-enable-failure`,
},
});
expect(callbackResponse.statusCode).toBe(500);
expect(callbackResponse.json()).toMatchObject({
message: expect.stringContaining('project activation required'),
});
const sessionResponse = await app.inject({
method: 'GET',
url: `/api/oauth/sessions/${startBody.state}`,
});
expect(sessionResponse.statusCode).toBe(200);
expect(sessionResponse.json()).toMatchObject({
provider: 'gemini-cli',
status: 'error',
error: expect.stringContaining('Permission denied for project-enable-failure'),
});
const accounts = await db.select().from(schema.accounts).all();
expect(accounts).toEqual([]);
});
it('fails Gemini CLI oauth setup when the Google account has no available Cloud projects', async () => {
fetchMock
.mockResolvedValueOnce({
ok: true,
status: 200,
json: async () => ({
access_token: 'gemini-access-token',
refresh_token: 'gemini-refresh-token',
expires_in: 3600,
token_type: 'Bearer',
scope: 'cloud-platform',
}),
text: async () => JSON.stringify({ ok: true }),
})
.mockResolvedValueOnce({
ok: true,
status: 200,
json: async () => ({
projects: [],
}),
text: async () => JSON.stringify({ ok: true }),
});
const startResponse = await app.inject({
method: 'POST',
url: '/api/oauth/providers/gemini-cli/start',
headers: {
host: 'metapi.example',
'x-forwarded-proto': 'https',
},
});
expect(startResponse.statusCode).toBe(200);
const startBody = startResponse.json() as { state: string };
const callbackResponse = await app.inject({
method: 'POST',
url: `/api/oauth/sessions/${encodeURIComponent(startBody.state)}/manual-callback`,
payload: {
callbackUrl: `http://localhost:8085/oauth2callback?state=${encodeURIComponent(startBody.state)}&code=gemini-oauth-code-no-projects`,
},
});
expect(callbackResponse.statusCode).toBe(500);
expect(callbackResponse.json()).toMatchObject({
message: 'no Google Cloud projects available for this account',
});
const sessionResponse = await app.inject({
method: 'GET',
url: `/api/oauth/sessions/${startBody.state}`,
});
expect(sessionResponse.statusCode).toBe(200);
expect(sessionResponse.json()).toMatchObject({
provider: 'gemini-cli',
status: 'error',
error: 'no Google Cloud projects available for this account',
});
const accounts = await db.select().from(schema.accounts).all();
expect(accounts).toEqual([]);
});
it('lists oauth connection health metadata and supports deleting the connection', async () => {
const site = await db.insert(schema.sites).values({
name: 'ChatGPT Codex OAuth',
src/server/routes/proxy/gemini.test.ts
+175
View File
@@ -7,6 +7,7 @@ import { resetUpstreamEndpointRuntimeState } from './upstreamEndpoint.js';
const fetchMock = vi.fn();
const fetchModelPricingCatalogMock = vi.fn();
const refreshModelsAndRebuildRoutesMock = vi.fn();
const refreshOauthAccessTokenSingleflightMock = vi.fn();
const selectChannelMock = vi.fn();
const selectNextChannelMock = vi.fn();
const recordSuccessMock = vi.fn();
@@ -43,6 +44,7 @@ function createDbSelectChain() {
vi.mock('undici', () => ({
fetch: (...args: unknown[]) => fetchMock(...args),
Response: globalThis.Response,
}));
vi.mock('../../services/modelPricingService.js', () => ({
@@ -53,6 +55,10 @@ vi.mock('../../services/modelService.js', () => ({
refreshModelsAndRebuildRoutes: (...args: unknown[]) => refreshModelsAndRebuildRoutesMock(...args),
}));
vi.mock('../../services/oauth/refreshSingleflight.js', () => ({
refreshOauthAccessTokenSingleflight: (...args: unknown[]) => refreshOauthAccessTokenSingleflightMock(...args),
}));
vi.mock('../../services/tokenRouter.js', () => ({
tokenRouter: {
selectChannel: (...args: unknown[]) => selectChannelMock(...args),
@@ -154,6 +160,7 @@ describe('gemini native proxy routes', () => {
fetchMock.mockReset();
fetchModelPricingCatalogMock.mockReset();
refreshModelsAndRebuildRoutesMock.mockReset();
refreshOauthAccessTokenSingleflightMock.mockReset();
selectChannelMock.mockReset();
selectNextChannelMock.mockReset();
recordSuccessMock.mockReset();
@@ -514,6 +521,174 @@ describe('gemini native proxy routes', () => {
});
});
it('refreshes gemini-cli oauth token and retries the same internal request on 401', async () => {
selectChannelMock.mockReturnValue({
channel: { id: 31, routeId: 22 },
site: { id: 66, name: 'gemini-cli-site', url: 'https://cloudcode-pa.googleapis.com', platform: 'gemini-cli' },
account: {
id: 36,
username: 'gemini-cli-user@example.com',
accessToken: 'oauth-access-token',
extraConfig: JSON.stringify({
credentialMode: 'session',
oauth: {
provider: 'gemini-cli',
email: 'gemini-cli-user@example.com',
projectId: 'project-before-refresh',
refreshToken: 'gemini-refresh-token',
},
}),
},
tokenName: 'default',
tokenValue: 'oauth-access-token',
actualModel: 'gemini-2.5-pro',
});
refreshOauthAccessTokenSingleflightMock.mockResolvedValue({
accountId: 36,
accessToken: 'refreshed-access-token',
extraConfig: JSON.stringify({
credentialMode: 'session',
oauth: {
provider: 'gemini-cli',
email: 'gemini-cli-user@example.com',
projectId: 'project-after-refresh',
refreshToken: 'gemini-refresh-token',
},
}),
});
fetchMock
.mockResolvedValueOnce(new Response(JSON.stringify({
error: { message: 'token expired' },
}), {
status: 401,
headers: { 'content-type': 'application/json' },
}))
.mockResolvedValueOnce(new Response(JSON.stringify({
response: {
candidates: [
{
content: {
parts: [{ text: 'hello after refresh' }],
role: 'model',
},
finishReason: 'STOP',
},
],
},
}), {
status: 200,
headers: { 'content-type': 'application/json' },
}));
const response = await app.inject({
method: 'POST',
url: '/v1beta/models/gemini-2.5-pro:generateContent',
headers: {
authorization: 'Bearer sk-managed-gemini',
},
payload: {
contents: [
{
role: 'user',
parts: [{ text: 'hello' }],
},
],
},
});
expect(response.statusCode).toBe(200);
expect(refreshOauthAccessTokenSingleflightMock).toHaveBeenCalledWith(36);
expect(fetchMock).toHaveBeenCalledTimes(2);
expect(selectNextChannelMock).not.toHaveBeenCalled();
const [, firstRequestInit] = fetchMock.mock.calls[0] as [string, RequestInit];
const [, secondRequestInit] = fetchMock.mock.calls[1] as [string, RequestInit];
expect(firstRequestInit.headers).toMatchObject({
Authorization: 'Bearer oauth-access-token',
});
expect(secondRequestInit.headers).toMatchObject({
Authorization: 'Bearer refreshed-access-token',
});
expect(JSON.parse(String(secondRequestInit.body))).toEqual({
project: 'project-after-refresh',
model: 'gemini-2.5-pro',
request: {
contents: [
{
role: 'user',
parts: [{ text: 'hello' }],
},
],
},
});
expect(response.json()).toEqual({
responseId: '',
modelVersion: '',
candidates: [
{
index: 0,
content: {
parts: [{ text: 'hello after refresh' }],
role: 'model',
},
finishReason: 'STOP',
},
],
});
});
it('returns a server error when gemini-cli oauth project metadata is missing at runtime', async () => {
selectChannelMock.mockReturnValue({
channel: { id: 31, routeId: 22 },
site: { id: 66, name: 'gemini-cli-site', url: 'https://cloudcode-pa.googleapis.com', platform: 'gemini-cli' },
account: {
id: 36,
username: 'gemini-cli-user@example.com',
accessToken: 'oauth-access-token',
extraConfig: JSON.stringify({
credentialMode: 'session',
oauth: {
provider: 'gemini-cli',
email: 'gemini-cli-user@example.com',
},
}),
},
tokenName: 'default',
tokenValue: 'oauth-access-token',
actualModel: 'gemini-2.5-pro',
});
selectNextChannelMock.mockReturnValue(null);
const response = await app.inject({
method: 'POST',
url: '/v1beta/models/gemini-2.5-pro:generateContent',
headers: {
authorization: 'Bearer sk-managed-gemini',
},
payload: {
contents: [
{
role: 'user',
parts: [{ text: 'hello' }],
},
],
},
});
expect(response.statusCode).toBe(500);
expect(fetchMock).not.toHaveBeenCalled();
expect(recordFailureMock).toHaveBeenCalledWith(31, {
status: 500,
errorText: 'Gemini CLI OAuth project is missing',
});
expect(JSON.parse(response.body)).toEqual({
error: {
message: 'Gemini CLI OAuth project is missing',
type: 'server_error',
},
});
});
it('routes Gemini native generateContent requests to openai upstreams and serializes the response back to Gemini shape', async () => {
selectChannelMock.mockReturnValue({
channel: { id: 41, routeId: 22 },