|
| 1 | +/** |
| 2 | + * @vitest-environment node |
| 3 | + */ |
| 4 | +import { |
| 5 | + createMockRequest, |
| 6 | + hybridAuthMockFns, |
| 7 | + inputValidationMock, |
| 8 | + inputValidationMockFns, |
| 9 | +} from '@sim/testing' |
| 10 | +import { beforeEach, describe, expect, it, vi } from 'vitest' |
| 11 | +import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits' |
| 12 | +import { PRIVATE_MODEL_INPUT_PROVENANCE_HEADER } from '@/lib/execution/model-input-provenance' |
| 13 | +import { |
| 14 | + RESOLVED_SECRET_PROVENANCE_FIELD, |
| 15 | + RESOLVED_SECRET_PROVENANCE_METADATA_V1, |
| 16 | +} from '@/lib/execution/private-tool-metadata' |
| 17 | +import { MISTRAL_OCR_REQUEST_POLICY } from '@/lib/knowledge/documents/ocr-request-policy' |
| 18 | + |
| 19 | +const { mockDownloadServableFile, mockIsModelSafeWorkspaceFileKey } = vi.hoisted(() => ({ |
| 20 | + mockDownloadServableFile: vi.fn(), |
| 21 | + mockIsModelSafeWorkspaceFileKey: vi.fn(), |
| 22 | +})) |
| 23 | + |
| 24 | +vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock) |
| 25 | +vi.mock('@/app/api/files/authorization', () => ({ |
| 26 | + assertToolFileAccess: vi.fn().mockResolvedValue(null), |
| 27 | +})) |
| 28 | +vi.mock('@/lib/uploads/utils/file-utils.server', () => ({ |
| 29 | + downloadServableFileFromStorage: mockDownloadServableFile, |
| 30 | + resolveInternalFileUrl: vi.fn(), |
| 31 | +})) |
| 32 | +vi.mock('@/lib/uploads/contexts/workspace/workspace-file-secret-provenance', () => ({ |
| 33 | + isModelSafeWorkspaceFileKey: mockIsModelSafeWorkspaceFileKey, |
| 34 | + MODEL_UNSAFE_WORKSPACE_FILE_ERROR_MESSAGE: |
| 35 | + 'File cannot be sent to a model because its secret provenance is unavailable', |
| 36 | +})) |
| 37 | + |
| 38 | +import { POST } from '@/app/api/tools/mistral/parse/route' |
| 39 | + |
| 40 | +const PDF_FILE = { |
| 41 | + key: 'workspace/workspace-1/document.pdf', |
| 42 | + name: 'document.pdf', |
| 43 | + size: 3, |
| 44 | + type: 'application/pdf', |
| 45 | +} |
| 46 | + |
| 47 | +function createVerifiedRequest() { |
| 48 | + return createMockRequest( |
| 49 | + 'POST', |
| 50 | + { |
| 51 | + apiKey: 'mistral-key', |
| 52 | + file: PDF_FILE, |
| 53 | + [RESOLVED_SECRET_PROVENANCE_FIELD]: { |
| 54 | + version: 1, |
| 55 | + complete: true, |
| 56 | + entries: [], |
| 57 | + }, |
| 58 | + }, |
| 59 | + { [PRIVATE_MODEL_INPUT_PROVENANCE_HEADER]: RESOLVED_SECRET_PROVENANCE_METADATA_V1 } |
| 60 | + ) |
| 61 | +} |
| 62 | + |
| 63 | +describe('POST /api/tools/mistral/parse', () => { |
| 64 | + beforeEach(() => { |
| 65 | + vi.clearAllMocks() |
| 66 | + hybridAuthMockFns.mockCheckInternalAuth.mockResolvedValue({ |
| 67 | + success: true, |
| 68 | + userId: 'user-1', |
| 69 | + authType: 'internal_jwt', |
| 70 | + }) |
| 71 | + inputValidationMockFns.mockValidateUrlWithDNS.mockResolvedValue({ |
| 72 | + isValid: true, |
| 73 | + resolvedIP: '93.184.216.34', |
| 74 | + originalHostname: 'api.mistral.ai', |
| 75 | + }) |
| 76 | + mockIsModelSafeWorkspaceFileKey.mockResolvedValue(true) |
| 77 | + mockDownloadServableFile.mockResolvedValue({ |
| 78 | + buffer: Buffer.from('pdf'), |
| 79 | + contentType: 'application/pdf', |
| 80 | + }) |
| 81 | + inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue( |
| 82 | + Response.json({ pages: [], usage_info: { pages_processed: 0 } }) |
| 83 | + ) |
| 84 | + }) |
| 85 | + |
| 86 | + it('returns 413 when the input file exceeds Mistral request limits', async () => { |
| 87 | + mockDownloadServableFile.mockRejectedValueOnce( |
| 88 | + new PayloadSizeLimitError({ |
| 89 | + label: 'storage file download', |
| 90 | + maxBytes: MISTRAL_OCR_REQUEST_POLICY.maxBytes, |
| 91 | + observedBytes: MISTRAL_OCR_REQUEST_POLICY.maxBytes + 1, |
| 92 | + }) |
| 93 | + ) |
| 94 | + |
| 95 | + const response = await POST(createVerifiedRequest()) |
| 96 | + |
| 97 | + expect(response.status).toBe(413) |
| 98 | + await expect(response.json()).resolves.toEqual({ |
| 99 | + success: false, |
| 100 | + error: `File exceeds Mistral OCR's ${MISTRAL_OCR_REQUEST_POLICY.maxBytes.toLocaleString()}-byte request limit`, |
| 101 | + }) |
| 102 | + expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).not.toHaveBeenCalled() |
| 103 | + }) |
| 104 | + |
| 105 | + it('returns 502 when Mistral response bytes exceed the secure-fetch cap', async () => { |
| 106 | + const responseLimitError = new PayloadSizeLimitError({ |
| 107 | + label: 'response body', |
| 108 | + maxBytes: 100, |
| 109 | + observedBytes: 101, |
| 110 | + }) |
| 111 | + inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValueOnce({ |
| 112 | + ok: true, |
| 113 | + status: 200, |
| 114 | + statusText: 'OK', |
| 115 | + headers: new Headers(), |
| 116 | + body: null, |
| 117 | + text: async () => { |
| 118 | + throw responseLimitError |
| 119 | + }, |
| 120 | + json: async () => { |
| 121 | + throw responseLimitError |
| 122 | + }, |
| 123 | + arrayBuffer: async () => { |
| 124 | + throw responseLimitError |
| 125 | + }, |
| 126 | + }) |
| 127 | + |
| 128 | + const response = await POST(createVerifiedRequest()) |
| 129 | + |
| 130 | + expect(response.status).toBe(502) |
| 131 | + await expect(response.json()).resolves.toEqual({ |
| 132 | + success: false, |
| 133 | + error: 'Mistral API response exceeded the safe size limit', |
| 134 | + }) |
| 135 | + }) |
| 136 | +}) |
0 commit comments