chore: import upstream snapshot with attribution

apps/sim/app/api/providers/together/models/route.test.ts

@@ -0,0 +1,259 @@
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockFilterBlacklistedModels,
+  mockIsProviderBlacklisted,
+  mockGetBYOKKey,
+  mockGetSession,
+  mockGetUserEntityPermissions,
+  mockFetch,
+  mutableEnv,
+} = vi.hoisted(() => ({
+  mockFilterBlacklistedModels: vi.fn(),
+  mockIsProviderBlacklisted: vi.fn(),
+  mockGetBYOKKey: vi.fn(),
+  mockGetSession: vi.fn(),
+  mockGetUserEntityPermissions: vi.fn(),
+  mockFetch: vi.fn(),
+  mutableEnv: { TOGETHER_API_KEY: undefined as string | undefined },
+}))
+
+vi.mock('@/providers/utils', () => ({
+  filterBlacklistedModels: mockFilterBlacklistedModels,
+  isProviderBlacklisted: mockIsProviderBlacklisted,
+}))
+
+vi.mock('@/lib/api-key/byok', () => ({
+  getBYOKKey: mockGetBYOKKey,
+}))
+
+vi.mock('@/lib/auth', () => ({
+  getSession: mockGetSession,
+}))
+
+vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  getUserEntityPermissions: mockGetUserEntityPermissions,
+}))
+
+vi.mock('@/lib/core/config/env', () => ({
+  env: mutableEnv,
+}))
+
+import { GET } from '@/app/api/providers/together/models/route'
+
+const TOGETHER_MODELS_URL = 'https://api.together.ai/v1/models'
+
+const okResponse = (body: unknown) => ({
+  ok: true,
+  status: 200,
+  statusText: 'OK',
+  json: vi.fn().mockResolvedValue(body),
+})
+
+const errorResponse = (status: number, statusText = 'Unauthorized') => ({
+  ok: false,
+  status,
+  statusText,
+  json: vi.fn().mockResolvedValue({}),
+})
+
+/**
+ * Builds a request whose query string carries the given workspaceId. Passing
+ * `undefined` omits the param entirely; passing `''` produces `?workspaceId=`.
+ */
+const requestWithWorkspace = (workspaceId?: string) => {
+  const url = new URL('http://localhost:3000/api/providers/together/models')
+  if (workspaceId !== undefined) {
+    url.searchParams.set('workspaceId', workspaceId)
+  }
+  return createMockRequest('GET', undefined, {}, url.toString())
+}
+
+const fetchAuthHeader = () => {
+  const init = mockFetch.mock.calls[0]?.[1] as RequestInit | undefined
+  const headers = init?.headers as Record<string, string> | undefined
+  return headers?.Authorization
+}
+
+describe('GET /api/providers/together/models', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.stubGlobal('fetch', mockFetch)
+
+    mutableEnv.TOGETHER_API_KEY = undefined
+    mockIsProviderBlacklisted.mockReturnValue(false)
+    mockFilterBlacklistedModels.mockImplementation((models: string[]) => models)
+    mockGetBYOKKey.mockResolvedValue(null)
+    mockGetSession.mockResolvedValue(null)
+    mockGetUserEntityPermissions.mockResolvedValue(null)
+  })
+
+  it('returns empty models without calling fetch when the provider is blacklisted', async () => {
+    mockIsProviderBlacklisted.mockReturnValue(true)
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('returns empty models when there is no workspaceId and no env key', async () => {
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('fetches with the env key and prefixes each model id with together/', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockResolvedValue(
+      okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }, { id: 'Qwen/Qwen2.5-72B-Instruct-Turbo' }])
+    )
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({
+      models: ['together/moonshotai/Kimi-K2-Instruct', 'together/Qwen/Qwen2.5-72B-Instruct-Turbo'],
+    })
+
+    expect(mockFetch).toHaveBeenCalledTimes(1)
+    expect(mockFetch.mock.calls[0][0]).toBe(TOGETHER_MODELS_URL)
+    expect(fetchAuthHeader()).toBe('Bearer env-together-key')
+  })
+
+  it('uses the BYOK key when a workspace, session, and permission are present', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockGetUserEntityPermissions.mockResolvedValue('admin')
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'byok-together-key' })
+    mockFetch.mockResolvedValue(okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }]))
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['together/moonshotai/Kimi-K2-Instruct'] })
+
+    expect(mockGetBYOKKey).toHaveBeenCalledWith('ws-1', 'together')
+    expect(fetchAuthHeader()).toBe('Bearer byok-together-key')
+  })
+
+  it('falls back to the env key when a workspaceId is given but there is no session', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockGetSession.mockResolvedValue(null)
+    mockFetch.mockResolvedValue(okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }]))
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['together/moonshotai/Kimi-K2-Instruct'] })
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+    expect(fetchAuthHeader()).toBe('Bearer env-together-key')
+  })
+
+  it('falls back to the env key when the session user lacks workspace permission', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockGetUserEntityPermissions.mockResolvedValue(null)
+    mockFetch.mockResolvedValue(okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }]))
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['together/moonshotai/Kimi-K2-Instruct'] })
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+    expect(fetchAuthHeader()).toBe('Bearer env-together-key')
+  })
+
+  it('returns empty models when the upstream fetch responds non-ok', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockResolvedValue(errorResponse(401, 'Unauthorized'))
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('returns empty models when the upstream fetch throws', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockRejectedValue(new Error('network down'))
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('returns a validation error for an empty workspaceId query param', async () => {
+    const res = await GET(requestWithWorkspace(''))
+
+    expect(res.status).toBe(400)
+    const body = (await res.json()) as { error: string }
+    expect(body.error).toBe('Validation error')
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('dedupes duplicate model ids from the upstream array', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockResolvedValue(
+      okResponse([
+        { id: 'moonshotai/Kimi-K2-Instruct' },
+        { id: 'moonshotai/Kimi-K2-Instruct' },
+        { id: 'Qwen/Qwen2.5-72B-Instruct-Turbo' },
+      ])
+    )
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({
+      models: ['together/moonshotai/Kimi-K2-Instruct', 'together/Qwen/Qwen2.5-72B-Instruct-Turbo'],
+    })
+  })
+
+  it('applies the blacklist filter to the deduped model list', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFilterBlacklistedModels.mockImplementation((models: string[]) =>
+      models.filter((m) => !m.includes('Qwen'))
+    )
+    mockFetch.mockResolvedValue(
+      okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }, { id: 'Qwen/Qwen2.5-72B-Instruct-Turbo' }])
+    )
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['together/moonshotai/Kimi-K2-Instruct'] })
+    expect(mockFilterBlacklistedModels).toHaveBeenCalledWith([
+      'together/moonshotai/Kimi-K2-Instruct',
+      'together/Qwen/Qwen2.5-72B-Instruct-Turbo',
+    ])
+  })
+
+  it('filters out non-chat model types (image, embedding, rerank, etc.)', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockResolvedValue(
+      okResponse([
+        { id: 'meta-llama/Llama-3.3-70B-Instruct-Turbo', type: 'chat' },
+        { id: 'black-forest-labs/FLUX.1-schnell', type: 'image' },
+        { id: 'BAAI/bge-large-en-v1.5', type: 'embedding' },
+        { id: 'Salesforce/Llama-Rank-V1', type: 'rerank' },
+        { id: 'openai/whisper-large-v3', type: 'transcribe' },
+      ])
+    )
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({
+      models: ['together/meta-llama/Llama-3.3-70B-Instruct-Turbo'],
+    })
+  })
+})