From 0c568623d7f769e7bb3cc812a3c8c51daf919125 Mon Sep 17 00:00:00 2001 From: GareArc Date: Thu, 7 May 2026 01:35:53 -0700 Subject: [PATCH] test(openapi): pin invoke_from + user-strip invariants on /run Restores two assertions lost when the legacy per-mode unit tests were deleted in api-3 Task 4: - invoke_from == InvokeFrom.OPENAPI on the unified runner - body-side user field is stripped before reaching the generator (Model 2: bearer is identity, body cannot spoof user) Both run as part of test_run_chat_dispatches_to_chat_handler; no new tests added. --- .../integration_tests/controllers/openapi/test_app_run.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/api/tests/integration_tests/controllers/openapi/test_app_run.py b/api/tests/integration_tests/controllers/openapi/test_app_run.py index cc9be94681..7d4708cfa8 100644 --- a/api/tests/integration_tests/controllers/openapi/test_app_run.py +++ b/api/tests/integration_tests/controllers/openapi/test_app_run.py @@ -8,6 +8,7 @@ from collections.abc import Generator import pytest from flask import Flask +from core.app.entities.app_invoke_entities import InvokeFrom from extensions.ext_database import db from models import App @@ -18,6 +19,7 @@ def test_run_chat_dispatches_to_chat_handler(flask_app, account_token, app_in_wo def _fake_generate(*, app_model, user, args, invoke_from, streaming): captured["mode"] = app_model.mode captured["args"] = args + captured["invoke_from"] = invoke_from return { "event": "message", "task_id": "t", @@ -35,12 +37,14 @@ def test_run_chat_dispatches_to_chat_handler(flask_app, account_token, app_in_wo client = flask_app.test_client() res = client.post( f"/openapi/v1/apps/{app_in_workspace.id}/run", - json={"inputs": {}, "query": "hi", "response_mode": "blocking"}, + json={"inputs": {}, "query": "hi", "response_mode": "blocking", "user": "spoof@x.com"}, headers={"Authorization": f"Bearer {account_token}"}, ) assert res.status_code == 200 assert res.get_json()["mode"] == "chat" assert captured["mode"] == "chat" + assert captured["invoke_from"] == InvokeFrom.OPENAPI + assert "user" not in captured["args"], "server must strip body.user; identity comes from bearer" @pytest.fixture