chore: import upstream snapshot with attribution

tests/unit/cli-mitm-schema.test.ts

@@ -0,0 +1,85 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { cliMitmStartSchema } from "../../src/shared/validation/schemas.ts";
+import { validateBody } from "../../src/shared/validation/helpers.ts";
+import { resolveApiKey } from "../../src/shared/services/apiKeyResolver.ts";
+
+test("cliMitmStartSchema accepts a non-empty string apiKey", () => {
+  const result = validateBody(cliMitmStartSchema, {
+    apiKey: "sk-test-key-value",
+    sudoPassword: "password123",
+  });
+  assert.equal(result.success, true);
+  if (result.success) {
+    assert.equal(result.data.apiKey, "sk-test-key-value");
+    assert.equal(result.data.sudoPassword, "password123");
+  }
+});
+
+test("cliMitmStartSchema accepts a null apiKey", () => {
+  const result = validateBody(cliMitmStartSchema, {
+    apiKey: null,
+    sudoPassword: "",
+  });
+  assert.equal(result.success, true);
+  if (result.success) {
+    assert.equal(result.data.apiKey, null);
+    assert.equal(result.data.sudoPassword, "");
+  }
+});
+
+test("cliMitmStartSchema accepts an omitted apiKey", () => {
+  const result = validateBody(cliMitmStartSchema, {
+    sudoPassword: "",
+  });
+  assert.equal(result.success, true);
+  if (result.success) {
+    assert.equal(result.data.apiKey, undefined);
+  }
+});
+
+test("cliMitmStartSchema accepts and parses keyId correctly", () => {
+  const result = validateBody(cliMitmStartSchema, {
+    keyId: "api-key-id-123",
+    sudoPassword: "password",
+  });
+  assert.equal(result.success, true);
+  if (result.success) {
+    assert.equal(result.data.keyId, "api-key-id-123");
+    assert.equal(result.data.apiKey, undefined);
+  }
+});
+
+test("cliMitmStartSchema accepts null keyId", () => {
+  const result = validateBody(cliMitmStartSchema, {
+    keyId: null,
+    sudoPassword: "",
+  });
+  assert.equal(result.success, true);
+  if (result.success) {
+    assert.equal(result.data.keyId, null);
+  }
+});
+
+// Regression test: null apiKey + unresolvable keyId must yield the sentinel 'sk_omniroute',
+// which the route guard must reject with a 400 rather than letting it pass to startMitm.
+test("resolveApiKey returns sentinel when apiKey is null and keyId is null", async () => {
+  const result = await resolveApiKey(null, null);
+  assert.equal(
+    result,
+    "sk_omniroute",
+    "resolveApiKey should return the sentinel when no real key is available"
+  );
+});
+
+test("sentinel guard condition catches sk_omniroute and null", () => {
+  const SENTINEL = "sk_omniroute";
+  // Simulate what the route guard checks: (!apiKey || apiKey === 'sk_omniroute')
+  const shouldReject = (apiKey: string | null | undefined): boolean =>
+    !apiKey || apiKey === SENTINEL;
+
+  assert.equal(shouldReject(null), true, "null apiKey must be rejected");
+  assert.equal(shouldReject(undefined), true, "undefined apiKey must be rejected");
+  assert.equal(shouldReject("sk_omniroute"), true, "sentinel must be rejected");
+  assert.equal(shouldReject("sk-real-key-abc"), false, "real key must be allowed");
+});