chore: import upstream snapshot with attribution

backend/test/unit/server/test_cors_config.py

@@ -0,0 +1,70 @@
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.testclient import TestClient
+
+from server.main import _build_cors_options, _parse_cors_origins
+
+
+def _client_for_origins(origins: list[str]) -> TestClient:
+    app = FastAPI()
+    app.add_middleware(CORSMiddleware, **_build_cors_options(origins))
+
+    @app.get("/ping")
+    async def ping():
+        return {"ok": True}
+
+    return TestClient(app)
+
+
+def _preflight(client: TestClient, origin: str):
+    return client.options(
+        "/ping",
+        headers={
+            "Origin": origin,
+            "Access-Control-Request-Method": "POST",
+            "Access-Control-Request-Headers": "authorization,last-event-id",
+        },
+    )
+
+
+def test_default_development_cors_origins(monkeypatch):
+    monkeypatch.delenv("YUXI_CORS_ORIGINS", raising=False)
+    monkeypatch.setenv("YUXI_ENV", "development")
+
+    assert _parse_cors_origins() == ["http://localhost:5173", "http://127.0.0.1:5173"]
+
+
+def test_production_does_not_default_to_wildcard(monkeypatch):
+    monkeypatch.delenv("YUXI_CORS_ORIGINS", raising=False)
+    monkeypatch.setenv("YUXI_ENV", "production")
+
+    assert _parse_cors_origins() == []
+
+
+def test_cors_allows_configured_origin_with_credentials():
+    client = _client_for_origins(["http://localhost:5173"])
+
+    response = _preflight(client, "http://localhost:5173")
+
+    assert response.status_code == 200
+    assert response.headers["access-control-allow-origin"] == "http://localhost:5173"
+    assert response.headers["access-control-allow-credentials"] == "true"
+
+
+def test_cors_rejects_unconfigured_origin():
+    client = _client_for_origins(["http://localhost:5173"])
+
+    response = _preflight(client, "https://evil.example")
+
+    assert response.status_code == 400
+    assert "access-control-allow-origin" not in response.headers
+
+
+def test_wildcard_cors_disables_credentials():
+    client = _client_for_origins(["*"])
+
+    response = _preflight(client, "https://any.example")
+
+    assert response.status_code == 200
+    assert response.headers["access-control-allow-origin"] == "*"
+    assert "access-control-allow-credentials" not in response.headers

backend/test/unit/server/test_model_provider_router.py

@@ -0,0 +1,56 @@
+import pytest
+
+from server.routers import model_provider_router
+from server.routers.model_provider_router import ModelProviderPayload
+
+
+def test_model_provider_payload_accepts_embedding_and_rerank_urls():
+    payload = ModelProviderPayload(
+        provider_id="mixed-provider",
+        display_name="Mixed Provider",
+        base_url="https://api.example.com/v1",
+        embedding_base_url="https://api.example.com/v1/embeddings",
+        rerank_base_url="https://api.example.com/v1/rerank",
+        capabilities=["chat", "embedding", "rerank"],
+    )
+
+    data = payload.model_dump(exclude_none=True)
+
+    assert data["embedding_base_url"] == "https://api.example.com/v1/embeddings"
+    assert data["rerank_base_url"] == "https://api.example.com/v1/rerank"
+
+
+@pytest.mark.asyncio
+async def test_update_provider_commits_before_refreshing_cache(monkeypatch):
+    calls = []
+
+    class Db:
+        async def commit(self):
+            calls.append("commit")
+
+    class User:
+        username = "admin"
+
+    class Provider:
+        def to_dict(self):
+            return {"provider_id": "alibaba"}
+
+    async def fake_update_provider_config(db, provider_id, data, username):
+        calls.append("update")
+        return Provider()
+
+    async def fake_refresh_model_cache():
+        calls.append("refresh")
+
+    monkeypatch.setattr(model_provider_router, "update_provider_config", fake_update_provider_config)
+    monkeypatch.setattr(model_provider_router, "_refresh_model_cache", fake_refresh_model_cache)
+
+    result = await model_provider_router.update_provider(
+        "alibaba",
+        ModelProviderPayload(enabled_models=[]),
+        current_user=User(),
+        db=Db(),
+    )
+
+    assert result == {"success": True, "data": {"provider_id": "alibaba"}}
+    assert calls == ["update", "commit", "refresh"]