-
+
{webhookUrl}
diff --git a/frontend/src/preferences/preferenceSlice.ts b/frontend/src/preferences/preferenceSlice.ts
index e12a144b..f53a8b9b 100644
--- a/frontend/src/preferences/preferenceSlice.ts
+++ b/frontend/src/preferences/preferenceSlice.ts
@@ -44,6 +44,10 @@ export interface Preference {
// not act before the first /me response (avoids a first-paint admin bounce).
roles: string[];
rolesResolved: boolean;
+ // Speech features the server has switched on (/api/config). True until the
+ // config loads, so a backend without these flags keeps showing the controls.
+ ttsAvailable: boolean;
+ sttAvailable: boolean;
}
const initialState: Preference = {
@@ -74,6 +78,8 @@ const initialState: Preference = {
agentFolders: null,
roles: [],
rolesResolved: false,
+ ttsAvailable: true,
+ sttAvailable: true,
};
export const prefSlice = createSlice({
@@ -142,6 +148,13 @@ export const prefSlice = createSlice({
state.roles = [];
state.rolesResolved = false;
},
+ setSpeechAvailability: (
+ state,
+ action: PayloadAction<{ tts: boolean; stt: boolean }>,
+ ) => {
+ state.ttsAvailable = action.payload.tts;
+ state.sttAvailable = action.payload.stt;
+ },
},
});
@@ -166,6 +179,7 @@ export const {
setAgentFolders,
setRoles,
clearRoles,
+ setSpeechAvailability,
} = prefSlice.actions;
export default prefSlice.reducer;
@@ -314,3 +328,7 @@ export const selectRolesResolved = (state: RootState) =>
state.preference.rolesResolved;
export const selectIsAdmin = (state: RootState) =>
state.preference.roles.includes('admin');
+export const selectTtsAvailable = (state: RootState) =>
+ state.preference.ttsAvailable;
+export const selectSttAvailable = (state: RootState) =>
+ state.preference.sttAvailable;
diff --git a/frontend/src/store.ts b/frontend/src/store.ts
index ff3330af..c9a72491 100644
--- a/frontend/src/store.ts
+++ b/frontend/src/store.ts
@@ -56,6 +56,8 @@ const preloadedState: { preference: Preference } = {
agentFolders: null,
roles: [],
rolesResolved: false,
+ ttsAvailable: true,
+ sttAvailable: true,
},
};
const store = configureStore({
diff --git a/frontend/src/utils/connectorAuthUtils.test.ts b/frontend/src/utils/connectorAuthUtils.test.ts
new file mode 100644
index 00000000..f36aa39d
--- /dev/null
+++ b/frontend/src/utils/connectorAuthUtils.test.ts
@@ -0,0 +1,58 @@
+import { describe, expect, it } from 'vitest';
+
+import { isTrustedConnectorMessage } from './connectorAuthUtils';
+
+const popup = {} as Window;
+const otherWindow = {} as Window;
+
+describe('isTrustedConnectorMessage', () => {
+ it('rejects messages when no auth popup is open', () => {
+ expect(
+ isTrustedConnectorMessage(
+ { source: popup, origin: 'https://api.example.com' },
+ null,
+ 'https://api.example.com',
+ ),
+ ).toBe(false);
+ });
+
+ it('rejects messages that do not come from the auth popup', () => {
+ expect(
+ isTrustedConnectorMessage(
+ { source: otherWindow, origin: 'https://api.example.com' },
+ popup,
+ 'https://api.example.com',
+ ),
+ ).toBe(false);
+ });
+
+ it('rejects messages from the popup when its origin is unexpected', () => {
+ expect(
+ isTrustedConnectorMessage(
+ { source: popup, origin: 'https://evil.example.com' },
+ popup,
+ 'https://api.example.com',
+ ),
+ ).toBe(false);
+ });
+
+ it('accepts messages from the popup on the callback origin', () => {
+ expect(
+ isTrustedConnectorMessage(
+ { source: popup, origin: 'https://api.example.com' },
+ popup,
+ 'https://api.example.com',
+ ),
+ ).toBe(true);
+ });
+
+ it('falls back to the popup identity check when no origin is known', () => {
+ expect(
+ isTrustedConnectorMessage(
+ { source: popup, origin: 'https://api.example.com' },
+ popup,
+ null,
+ ),
+ ).toBe(true);
+ });
+});
diff --git a/frontend/src/utils/connectorAuthUtils.ts b/frontend/src/utils/connectorAuthUtils.ts
new file mode 100644
index 00000000..7342f41d
--- /dev/null
+++ b/frontend/src/utils/connectorAuthUtils.ts
@@ -0,0 +1,12 @@
+/**
+ * Whether a window message is the OAuth result posted by the connector popup we opened.
+ * `expectedOrigin` is the callback origin reported by the backend, when known.
+ */
+export const isTrustedConnectorMessage = (
+ event: Pick,
+ authWindow: Window | null,
+ expectedOrigin?: string | null,
+): boolean => {
+ if (!authWindow || event.source !== authWindow) return false;
+ return !expectedOrigin || event.origin === expectedOrigin;
+};
diff --git a/tests/api/test_connector_oauth_security.py b/tests/api/test_connector_oauth_security.py
new file mode 100644
index 00000000..f8b2e521
--- /dev/null
+++ b/tests/api/test_connector_oauth_security.py
@@ -0,0 +1,482 @@
+"""Connector OAuth hardening: popup message origin, token exposure, session ownership."""
+
+import base64
+import json
+import logging
+from contextlib import contextmanager
+from unittest.mock import MagicMock, patch
+
+import pytest
+from flask import Flask
+
+
+@pytest.fixture
+def app():
+ return Flask(__name__)
+
+
+@contextmanager
+def _patch_db(conn, module="docsgpt.api.connector.routes"):
+ @contextmanager
+ def _yield():
+ yield conn
+
+ with patch(f"{module}.db_session", _yield), patch(f"{module}.db_readonly", _yield):
+ yield
+
+
+def _encode_state(payload):
+ return base64.urlsafe_b64encode(json.dumps(payload).encode()).decode()
+
+
+def _seed_session(pg_conn, user, token, provider="google_drive", token_info=None):
+ from docsgpt.storage.db.repositories.connector_sessions import ConnectorSessionsRepository
+
+ repo = ConnectorSessionsRepository(pg_conn)
+ row = repo.upsert(user, provider, status="authorized")
+ patch_fields = {"session_token": token}
+ if token_info:
+ patch_fields["token_info"] = token_info
+ repo.update(str(row["id"]), patch_fields)
+ return repo
+
+
+class TestConnectorAllowedOrigins:
+ def test_collects_configured_origins(self):
+ from docsgpt.api.connector.routes import connector_allowed_origins
+ from docsgpt.core.settings import settings
+
+ with patch.object(settings, "CONNECTOR_ALLOWED_ORIGINS", "https://app.example.com/, https://b.example.com/x"), \
+ patch.object(settings, "OIDC_FRONTEND_URL", "https://sso.example.com/home"), \
+ patch.object(settings, "CONNECTOR_REDIRECT_BASE_URI", "https://api.example.com/api/connectors/callback"):
+ origins = connector_allowed_origins("https://api.example.com/")
+
+ assert set(origins) == {
+ "https://app.example.com",
+ "https://b.example.com",
+ "https://sso.example.com",
+ "https://api.example.com",
+ }
+
+ def test_rejects_wildcards_and_non_http_values(self):
+ from docsgpt.api.connector.routes import connector_allowed_origins
+ from docsgpt.core.settings import settings
+
+ with patch.object(settings, "CONNECTOR_ALLOWED_ORIGINS", "*, javascript:alert(1), null, not a url"), \
+ patch.object(settings, "OIDC_FRONTEND_URL", None), \
+ patch.object(settings, "CONNECTOR_REDIRECT_BASE_URI", "https://api.example.com/api/connectors/callback"):
+ origins = connector_allowed_origins("https://api.example.com/")
+
+ assert origins == ["https://api.example.com"]
+
+ def test_loopback_dev_frontend_allowed_only_for_loopback_callback(self):
+ from docsgpt.api.connector.routes import connector_allowed_origins
+ from docsgpt.core.settings import settings
+
+ with patch.object(settings, "CONNECTOR_ALLOWED_ORIGINS", None), \
+ patch.object(settings, "OIDC_FRONTEND_URL", None), \
+ patch.object(settings, "CONNECTOR_REDIRECT_BASE_URI", "http://127.0.0.1:7091/api/connectors/callback"):
+ local = connector_allowed_origins("http://127.0.0.1:7091/")
+ with patch.object(settings, "CONNECTOR_ALLOWED_ORIGINS", None), \
+ patch.object(settings, "OIDC_FRONTEND_URL", None), \
+ patch.object(settings, "CONNECTOR_REDIRECT_BASE_URI", "https://api.example.com/api/connectors/callback"):
+ public = connector_allowed_origins("http://localhost:7091/")
+
+ assert "http://localhost:5173" in local
+ assert "http://127.0.0.1:5173" in local
+ assert "http://localhost:5173" not in public
+
+ def test_loopback_aliases_keep_callback_scheme_and_port(self):
+ from docsgpt.api.connector.routes import connector_allowed_origins
+ from docsgpt.core.settings import settings
+
+ with patch.object(settings, "CONNECTOR_ALLOWED_ORIGINS", None), \
+ patch.object(settings, "OIDC_FRONTEND_URL", None), \
+ patch.object(settings, "CONNECTOR_REDIRECT_BASE_URI", "https://localhost/api/connectors/callback"):
+ origins = connector_allowed_origins("https://localhost/")
+
+ assert "https://127.0.0.1" in origins
+ assert "http://localhost" not in origins
+ assert "http://127.0.0.1" not in origins
+
+
+class TestCallbackStatusPage:
+ def test_never_posts_to_wildcard_origin(self, app):
+ from docsgpt.api.connector.routes import ConnectorCallbackStatus
+
+ with app.test_request_context(
+ "/api/connectors/callback-status?status=success&provider=google_drive"
+ ):
+ r = ConnectorCallbackStatus().get()
+ body = r.get_data(as_text=True)
+ assert r.status_code == 200
+ assert "'*'" not in body
+ assert '"*"' not in body
+
+ def test_ignores_session_token_query_param(self, app):
+ from docsgpt.api.connector.routes import ConnectorCallbackStatus
+
+ with app.test_request_context(
+ "/api/connectors/callback-status?status=success&provider=google_drive"
+ "&session_token=attacker-supplied&user_email=evil@example.com"
+ ):
+ r = ConnectorCallbackStatus().get()
+ body = r.get_data(as_text=True)
+ assert "attacker-supplied" not in body
+ assert "evil@example.com" not in body
+
+ def test_tokenless_success_posts_to_no_origin(self, app):
+ from docsgpt.api.connector.routes import ConnectorCallbackStatus
+
+ with app.test_request_context(
+ "/api/connectors/callback-status?status=success&provider=google_drive"
+ ):
+ r = ConnectorCallbackStatus().get()
+ assert "const targetOrigins = [];" in r.get_data(as_text=True)
+
+ def test_request_provider_never_reaches_inline_script(self, app):
+ from docsgpt.api.connector.routes import ConnectorCallbackStatus
+
+ with app.test_request_context(
+ "/api/connectors/callback-status?status=error&provider=zz-injected-provider"
+ ):
+ r = ConnectorCallbackStatus().get()
+ body = r.get_data(as_text=True)
+ script = body[body.index("")]
+ assert "zz-injected-provider" not in script
+
+ def test_error_posts_fixed_auth_error_to_allowed_origins(self, app):
+ from docsgpt.api.connector.routes import ConnectorCallbackStatus
+ from docsgpt.core.settings import settings
+
+ with patch.object(settings, "CONNECTOR_ALLOWED_ORIGINS", "https://app.example.com"), app.test_request_context(
+ "/api/connectors/callback-status?status=error&provider=google_drive&message=zz-request-message"
+ ):
+ r = ConnectorCallbackStatus().get()
+ body = r.get_data(as_text=True)
+ script = body[body.index("")]
+ assert '{"type": "google_drive_auth_error"}' in script
+ assert '"https://app.example.com"' in script
+ assert "zz-request-message" not in script
+
+ def test_cancelled_posts_nothing(self, app):
+ from docsgpt.api.connector.routes import ConnectorCallbackStatus
+
+ with app.test_request_context(
+ "/api/connectors/callback-status?status=cancelled&provider=google_drive"
+ ):
+ r = ConnectorCallbackStatus().get()
+ body = r.get_data(as_text=True)
+ assert "const payload = null;" in body
+ assert "const targetOrigins = [];" in body
+
+
+class TestCallbackDeliversTokenSafely:
+ def test_success_renders_page_without_redirecting_token(self, app, pg_conn):
+ from docsgpt.api.connector.routes import ConnectorsCallback
+ from docsgpt.core.settings import settings
+ from docsgpt.storage.db.repositories.connector_sessions import ConnectorSessionsRepository
+
+ user = "u-cb-origin"
+ repo = ConnectorSessionsRepository(pg_conn)
+ pending = repo.upsert(user, "google_drive", status="pending")
+ state = _encode_state({"provider": "google_drive", "object_id": str(pending["id"])})
+
+ fake_auth = MagicMock()
+ fake_auth.exchange_code_for_tokens.return_value = {"access_token": "at"}
+ fake_auth.sanitize_token_info.return_value = {"access_token": "at"}
+ fake_auth.create_credentials_from_token_info.side_effect = RuntimeError("no creds")
+
+ with _patch_db(pg_conn), patch(
+ "docsgpt.api.connector.routes.ConnectorCreator.is_supported", return_value=True,
+ ), patch(
+ "docsgpt.api.connector.routes.ConnectorCreator.create_auth", return_value=fake_auth,
+ ), patch.object(
+ settings, "CONNECTOR_ALLOWED_ORIGINS", "https://app.example.com",
+ ), app.test_request_context(
+ f"/api/connectors/callback?state={state}&code=auth-code",
+ base_url="https://api.example.com",
+ ):
+ r = ConnectorsCallback().get()
+
+ token = repo.get_by_user_provider(user, "google_drive")["session_token"]
+ body = r.get_data(as_text=True)
+ assert token
+ assert r.status_code == 200
+ assert "Location" not in r.headers
+ assert token in body
+ assert '"type": "google_drive_auth_success"' in body
+ assert '"https://app.example.com"' in body
+ assert "'*'" not in body
+ assert r.headers["Cache-Control"] == "no-store"
+ assert r.headers["Referrer-Policy"] == "no-referrer"
+
+
+class TestAuthUrlReportsCallbackOrigin:
+ def test_includes_callback_origin(self, app, pg_conn):
+ from docsgpt.api.connector.routes import ConnectorAuth
+ from docsgpt.core.settings import settings
+
+ fake_auth = MagicMock()
+ fake_auth.get_authorization_url.return_value = "https://ex/auth?state=x"
+
+ with _patch_db(pg_conn), patch(
+ "docsgpt.api.connector.routes.ConnectorCreator.is_supported", return_value=True,
+ ), patch(
+ "docsgpt.api.connector.routes.ConnectorCreator.create_auth", return_value=fake_auth,
+ ), patch.object(
+ settings, "CONNECTOR_REDIRECT_BASE_URI", "https://api.example.com/api/connectors/callback",
+ ), app.test_request_context("/api/connectors/auth?provider=google_drive"):
+ from flask import request
+ request.decoded_token = {"sub": "u-auth-origin"}
+ r = ConnectorAuth().get()
+
+ assert r.status_code == 200
+ assert r.json["callback_origin"] == "https://api.example.com"
+
+ @pytest.mark.parametrize(
+ "origin, warns",
+ [("https://app.example.com", True), ("https://api.example.com", False), (None, False)],
+ )
+ def test_warns_when_requesting_origin_cannot_receive_result(self, app, pg_conn, caplog, origin, warns):
+ from docsgpt.api.connector.routes import ConnectorAuth
+ from docsgpt.core.settings import settings
+
+ fake_auth = MagicMock()
+ fake_auth.get_authorization_url.return_value = "https://ex/auth?state=x"
+ headers = {"Origin": origin} if origin else {}
+
+ with _patch_db(pg_conn), patch(
+ "docsgpt.api.connector.routes.ConnectorCreator.is_supported", return_value=True,
+ ), patch(
+ "docsgpt.api.connector.routes.ConnectorCreator.create_auth", return_value=fake_auth,
+ ), patch.object(settings, "CONNECTOR_ALLOWED_ORIGINS", None), patch.object(
+ settings, "OIDC_FRONTEND_URL", None,
+ ), patch.object(
+ settings, "CONNECTOR_REDIRECT_BASE_URI", "https://api.example.com/api/connectors/callback",
+ ), app.test_request_context(
+ "/api/connectors/auth?provider=google_drive", headers=headers, base_url="https://api.example.com",
+ ), caplog.at_level(logging.WARNING):
+ from flask import request
+ request.decoded_token = {"sub": "u-auth-warn"}
+ r = ConnectorAuth().get()
+
+ assert r.status_code == 200
+ warned = any("CONNECTOR_ALLOWED_ORIGINS" in rec.getMessage() for rec in caplog.records)
+ assert warned is warns
+
+
+class TestDisconnectOwnership:
+ def test_requires_authentication(self, app, pg_conn):
+ from docsgpt.api.connector.routes import ConnectorDisconnect
+
+ repo = _seed_session(pg_conn, "u-owner", "st-noauth")
+ with _patch_db(pg_conn), app.test_request_context(
+ "/api/connectors/disconnect", method="POST",
+ json={"provider": "google_drive", "session_token": "st-noauth"},
+ ):
+ from flask import request
+ request.decoded_token = None
+ r = ConnectorDisconnect().post()
+
+ assert r.status_code == 401
+ assert repo.get_by_session_token("st-noauth") is not None
+
+ def test_cannot_delete_another_users_session(self, app, pg_conn):
+ from docsgpt.api.connector.routes import ConnectorDisconnect
+
+ repo = _seed_session(pg_conn, "u-victim", "st-victim")
+ with _patch_db(pg_conn), app.test_request_context(
+ "/api/connectors/disconnect", method="POST",
+ json={"provider": "google_drive", "session_token": "st-victim"},
+ ):
+ from flask import request
+ request.decoded_token = {"sub": "u-attacker"}
+ ConnectorDisconnect().post()
+
+ assert repo.get_by_session_token("st-victim") is not None
+
+ def test_owner_can_delete_own_session(self, app, pg_conn):
+ from docsgpt.api.connector.routes import ConnectorDisconnect
+
+ repo = _seed_session(pg_conn, "u-self", "st-self")
+ with _patch_db(pg_conn), app.test_request_context(
+ "/api/connectors/disconnect", method="POST",
+ json={"provider": "google_drive", "session_token": "st-self"},
+ ):
+ from flask import request
+ request.decoded_token = {"sub": "u-self"}
+ r = ConnectorDisconnect().post()
+
+ assert r.status_code == 200
+ assert repo.get_by_session_token("st-self") is None
+
+
+class TestSyncSessionOwnership:
+ def test_rejects_foreign_session_token(self, app, pg_conn):
+ from docsgpt.api.connector.routes import ConnectorSync
+ from docsgpt.storage.db.repositories.sources import SourcesRepository
+
+ _seed_session(pg_conn, "u-victim-sync", "st-victim-sync")
+ attacker = "u-attacker-sync"
+ src = SourcesRepository(pg_conn).create(
+ "drive-src", user_id=attacker,
+ remote_data={"provider": "google_drive", "file_ids": ["f"], "folder_ids": []},
+ )
+
+ delay = MagicMock()
+ with _patch_db(pg_conn), patch(
+ "docsgpt.api.connector.routes.ingest_connector_task.delay", delay,
+ ), app.test_request_context(
+ "/api/connectors/sync", method="POST",
+ json={"source_id": str(src["id"]), "session_token": "st-victim-sync"},
+ ):
+ from flask import request
+ request.decoded_token = {"sub": attacker}
+ r = ConnectorSync().post()
+
+ assert r.status_code == 401
+ delay.assert_not_called()
+
+
+class TestRemoteUploadSessionOwnership:
+ def _post(self, app, pg_conn, user, token, apply_mock):
+ from docsgpt.api.user.sources.upload import UploadRemote
+
+ with _patch_db(pg_conn, "docsgpt.api.user.sources.upload"), patch(
+ "docsgpt.api.user.sources.upload.ingest_connector_task.apply_async", apply_mock,
+ ), app.test_request_context(
+ "/api/remote", method="POST",
+ data={
+ "user": user, "source": "google_drive", "name": "g",
+ "data": json.dumps({"session_token": token, "file_ids": ["f1"]}),
+ },
+ content_type="multipart/form-data",
+ ):
+ from flask import request
+ request.decoded_token = {"sub": user}
+ return UploadRemote().post()
+
+ def test_rejects_foreign_session_token(self, app, pg_conn):
+ _seed_session(pg_conn, "u-victim-up", "st-victim-up")
+ apply_mock = MagicMock(return_value=MagicMock(id="t"))
+
+ r = self._post(app, pg_conn, "u-attacker-up", "st-victim-up", apply_mock)
+
+ assert r.status_code == 401
+ apply_mock.assert_not_called()
+
+ def test_accepts_own_session_token(self, app, pg_conn):
+ _seed_session(pg_conn, "u-owner-up", "st-owner-up")
+ apply_mock = MagicMock(return_value=MagicMock(id="t"))
+
+ r = self._post(app, pg_conn, "u-owner-up", "st-owner-up", apply_mock)
+
+ assert r.status_code == 200
+ apply_mock.assert_called_once()
+
+ def test_rejects_session_issued_for_another_provider(self, app, pg_conn):
+ _seed_session(pg_conn, "u-prov-up", "st-prov-up", provider="share_point")
+ apply_mock = MagicMock(return_value=MagicMock(id="t"))
+
+ r = self._post(app, pg_conn, "u-prov-up", "st-prov-up", apply_mock)
+
+ assert r.status_code == 401
+ apply_mock.assert_not_called()
+
+
+class TestValidateSessionOwnership:
+ def test_rejects_foreign_session_token(self, app, pg_conn):
+ from docsgpt.api.connector.routes import ConnectorValidateSession
+
+ _seed_session(pg_conn, "u-victim-val", "st-victim-val", token_info={"access_token": "victim-at"})
+ create_auth = MagicMock()
+ with _patch_db(pg_conn), patch(
+ "docsgpt.api.connector.routes.ConnectorCreator.create_auth", create_auth,
+ ), app.test_request_context(
+ "/api/connectors/validate-session", method="POST",
+ json={"provider": "google_drive", "session_token": "st-victim-val"},
+ ):
+ from flask import request
+ request.decoded_token = {"sub": "u-attacker-val"}
+ r = ConnectorValidateSession().post()
+
+ assert r.status_code == 401
+ assert "victim-at" not in r.get_data(as_text=True)
+ create_auth.assert_not_called()
+
+
+class TestSessionProviderBinding:
+ def _files(self, app, pg_conn, user, provider, token, create_connector):
+ from docsgpt.api.connector.routes import ConnectorFiles
+
+ with _patch_db(pg_conn), patch(
+ "docsgpt.api.connector.routes.ConnectorCreator.create_connector", create_connector,
+ ), app.test_request_context(
+ "/api/connectors/files", method="POST", json={"provider": provider, "session_token": token},
+ ):
+ from flask import request
+ request.decoded_token = {"sub": user}
+ return ConnectorFiles().post()
+
+ def test_files_rejects_session_issued_for_another_provider(self, app, pg_conn):
+ _seed_session(pg_conn, "u-files-prov", "st-files-prov", provider="google_drive")
+ create_connector = MagicMock()
+
+ r = self._files(app, pg_conn, "u-files-prov", "share_point", "st-files-prov", create_connector)
+
+ assert r.status_code == 401
+ create_connector.assert_not_called()
+
+ def test_files_matches_provider_case_insensitively(self, app, pg_conn):
+ _seed_session(pg_conn, "u-files-case", "st-files-case", provider="google_drive")
+ create_connector = MagicMock(return_value=MagicMock(load_data=MagicMock(return_value=[]), next_page_token=None))
+
+ r = self._files(app, pg_conn, "u-files-case", "Google_Drive", "st-files-case", create_connector)
+
+ assert r.status_code == 200
+ create_connector.assert_called_once()
+
+ def test_validate_session_rejects_session_issued_for_another_provider(self, app, pg_conn):
+ from docsgpt.api.connector.routes import ConnectorValidateSession
+
+ _seed_session(
+ pg_conn, "u-val-prov", "st-val-prov", provider="google_drive", token_info={"access_token": "at"},
+ )
+ create_auth = MagicMock()
+ with _patch_db(pg_conn), patch(
+ "docsgpt.api.connector.routes.ConnectorCreator.create_auth", create_auth,
+ ), app.test_request_context(
+ "/api/connectors/validate-session", method="POST",
+ json={"provider": "share_point", "session_token": "st-val-prov"},
+ ):
+ from flask import request
+ request.decoded_token = {"sub": "u-val-prov"}
+ r = ConnectorValidateSession().post()
+
+ assert r.status_code == 401
+ create_auth.assert_not_called()
+
+ def test_sync_rejects_session_issued_for_another_provider(self, app, pg_conn):
+ from docsgpt.api.connector.routes import ConnectorSync
+ from docsgpt.storage.db.repositories.sources import SourcesRepository
+
+ user = "u-sync-prov"
+ _seed_session(pg_conn, user, "st-sync-prov", provider="share_point")
+ src = SourcesRepository(pg_conn).create(
+ "drive-src", user_id=user,
+ remote_data={"provider": "google_drive", "file_ids": ["f"], "folder_ids": []},
+ )
+ delay = MagicMock()
+ with _patch_db(pg_conn), patch(
+ "docsgpt.api.connector.routes.ingest_connector_task.delay", delay,
+ ), app.test_request_context(
+ "/api/connectors/sync", method="POST",
+ json={"source_id": str(src["id"]), "session_token": "st-sync-prov"},
+ ):
+ from flask import request
+ request.decoded_token = {"sub": user}
+ r = ConnectorSync().post()
+
+ assert r.status_code == 401
+ delay.assert_not_called()
diff --git a/tests/api/test_connector_routes_happy.py b/tests/api/test_connector_routes_happy.py
index 4fb5493d..141f87b0 100644
--- a/tests/api/test_connector_routes_happy.py
+++ b/tests/api/test_connector_routes_happy.py
@@ -199,8 +199,11 @@ class TestConnectorsCallback:
f"/api/connectors/callback?state={state}&code=auth-code"
):
r = ConnectorsCallback().get()
- assert r.status_code == 302
- assert "status=success" in r.location
+ token = ConnectorSessionsRepository(pg_conn).get_by_user_provider(
+ "u-callback", "google_drive",
+ )["session_token"]
+ assert r.status_code == 200
+ assert token and token in r.get_data(as_text=True)
def test_token_exchange_failure_redirects_error(self, app, pg_conn):
from docsgpt.api.connector.routes import ConnectorsCallback
@@ -425,6 +428,8 @@ class TestConnectorDisconnect:
with app.test_request_context(
"/api/connectors/disconnect", method="POST", json={}
):
+ from flask import request
+ request.decoded_token = {"sub": "u"}
r = ConnectorDisconnect().post()
assert r.status_code == 400
@@ -444,9 +449,12 @@ class TestConnectorDisconnect:
method="POST",
json={"provider": "google_drive", "session_token": "st-disc"},
):
+ from flask import request
+ request.decoded_token = {"sub": user}
r = ConnectorDisconnect().post()
assert r.status_code == 200
assert r.json["success"] is True
+ assert repo.get_by_session_token("st-disc") is None
def test_disconnect_without_session_token_succeeds(self, app):
from docsgpt.api.connector.routes import ConnectorDisconnect
@@ -456,6 +464,8 @@ class TestConnectorDisconnect:
method="POST",
json={"provider": "google_drive"},
):
+ from flask import request
+ request.decoded_token = {"sub": "u"}
r = ConnectorDisconnect().post()
assert r.status_code == 200
@@ -530,6 +540,14 @@ class TestConnectorSync:
remote_data={"provider": "github", "file_ids": [], "folder_ids": []},
)
+ from docsgpt.storage.db.repositories.connector_sessions import (
+ ConnectorSessionsRepository,
+ )
+
+ repo = ConnectorSessionsRepository(pg_conn)
+ session = repo.upsert(user, "github", status="authorized")
+ repo.update(str(session["id"]), {"session_token": "st"})
+
fake_task = MagicMock(id="task-abc")
with _patch_db(pg_conn), patch(
"docsgpt.api.connector.routes.ingest_connector_task.delay",
diff --git a/tests/api/user/attachments/test_routes.py b/tests/api/user/attachments/test_routes.py
index 0165c4d0..e7979a6d 100644
--- a/tests/api/user/attachments/test_routes.py
+++ b/tests/api/user/attachments/test_routes.py
@@ -1854,6 +1854,96 @@ class TestTextToSpeech:
assert _get_response_status(response) == 400
assert _get_response_json(response)["success"] is False
+ @patch("docsgpt.api.user.attachments.routes.TTSCreator.create_tts")
+ def test_tts_disabled_returns_404_without_a_provider(self, mock_create_tts, flask_app):
+ from docsgpt.api.user.attachments import routes
+
+ app = Flask(__name__)
+ with patch.object(routes.settings, "TTS_PROVIDER", "none"), app.test_request_context(
+ "/api/tts",
+ method="POST",
+ json={"text": "Hello world"},
+ ):
+ response = routes.TextToSpeech().post()
+ assert _get_response_status(response) == 404
+ assert _get_response_json(response) == {
+ "success": False,
+ "message": "Text-to-speech is disabled on this server.",
+ }
+ mock_create_tts.assert_not_called()
+
+
+@pytest.mark.unit
+class TestSpeechToTextDisabled:
+ """STT_PROVIDER=none turns every transcription endpoint off before any provider is built."""
+
+ DISABLED = {"success": False, "message": "Speech-to-text is disabled on this server."}
+
+ @patch("docsgpt.api.user.attachments.routes.STTCreator.create_stt")
+ def test_stt_returns_404(self, mock_create_stt, flask_app):
+ from docsgpt.api.user.attachments import routes
+
+ app = Flask(__name__)
+ with patch.object(routes.settings, "STT_PROVIDER", "none"), app.test_request_context(
+ "/api/stt",
+ method="POST",
+ data={"file": (io.BytesIO(b"audio-bytes"), "clip.wav")},
+ content_type="multipart/form-data",
+ ):
+ request.decoded_token = {"sub": "test_user"}
+ response = routes.SpeechToText().post()
+ assert _get_response_status(response) == 404
+ assert _get_response_json(response) == self.DISABLED
+ mock_create_stt.assert_not_called()
+
+ def test_live_stt_start_returns_404(self, flask_app):
+ from docsgpt.api.user.attachments import routes
+
+ app = Flask(__name__)
+ with patch.object(routes.settings, "STT_PROVIDER", "none"), app.test_request_context(
+ "/api/stt/live/start", method="POST", json={}
+ ):
+ request.decoded_token = {"sub": "test_user"}
+ response = routes.LiveSpeechToTextStart().post()
+ assert _get_response_status(response) == 404
+ assert _get_response_json(response) == self.DISABLED
+
+ @patch("docsgpt.api.user.attachments.routes.STTCreator.create_stt")
+ def test_live_stt_chunk_returns_404(self, mock_create_stt, flask_app):
+ from docsgpt.api.user.attachments import routes
+
+ app = Flask(__name__)
+ with patch.object(routes.settings, "STT_PROVIDER", "none"), app.test_request_context(
+ "/api/stt/live/chunk",
+ method="POST",
+ data={
+ "session_id": "abc",
+ "chunk_index": "0",
+ "file": (io.BytesIO(b"audio-bytes"), "chunk.wav"),
+ },
+ content_type="multipart/form-data",
+ ):
+ request.decoded_token = {"sub": "test_user"}
+ response = routes.LiveSpeechToTextChunk().post()
+ assert _get_response_status(response) == 404
+ assert _get_response_json(response) == self.DISABLED
+ mock_create_stt.assert_not_called()
+
+ def test_live_stt_finish_returns_404_without_touching_redis(self, flask_app):
+ from docsgpt.api.user.attachments import routes
+
+ app = Flask(__name__)
+ with patch.object(routes.settings, "STT_PROVIDER", "none"), patch.object(
+ routes, "_require_live_stt_redis"
+ ) as require_redis, app.test_request_context(
+ "/api/stt/live/finish", method="POST", json={"session_id": "abc"}
+ ):
+ request.decoded_token = {"sub": "test_user"}
+ response = routes.LiveSpeechToTextFinish().post()
+ assert _get_response_status(response) == 404
+ assert _get_response_json(response) == self.DISABLED
+ require_redis.assert_not_called()
+
# =====================================================================
# Coverage gap tests (lines 136, 256, 330, 337, 443, 457, 560, 590)
diff --git a/tests/api/user/sources/test_upload_idempotency.py b/tests/api/user/sources/test_upload_idempotency.py
index a3b842af..f5b069bc 100644
--- a/tests/api/user/sources/test_upload_idempotency.py
+++ b/tests/api/user/sources/test_upload_idempotency.py
@@ -597,6 +597,13 @@ class TestRemoteIdempotency:
pytest.skip("no connectors registered in this build")
connector_source = next(iter(supported))
+ from docsgpt.storage.db.repositories.connector_sessions import (
+ ConnectorSessionsRepository,
+ )
+ repo = ConnectorSessionsRepository(pg_conn)
+ session = repo.upsert("u", connector_source, status="authorized")
+ repo.update(str(session["id"]), {"session_token": "tok"})
+
with _patch_db(pg_conn), patch(
"docsgpt.api.user.sources.upload.ingest_connector_task.apply_async",
apply_mock,
diff --git a/tests/core/test_paths.py b/tests/core/test_paths.py
index e625626b..a1c80acd 100644
--- a/tests/core/test_paths.py
+++ b/tests/core/test_paths.py
@@ -57,12 +57,23 @@ class TestSettingsFollowTheHome:
assert fresh.MILVUS_URI == str(tmp_path.resolve() / "milvus_local.db")
assert fresh.LANCEDB_PATH == str(tmp_path.resolve() / "data" / "lancedb")
+ def test_model_cache_defaults_under_the_home(self, monkeypatch, tmp_path):
+ """FastEmbed's own default is the temp dir, which a reboot wipes."""
+ from docsgpt.core.settings import Settings
+
+ monkeypatch.setenv(paths.HOME_ENV, str(tmp_path))
+ monkeypatch.delenv("EMBEDDINGS_CACHE_DIR", raising=False)
+ assert Settings(_env_file=None).EMBEDDINGS_CACHE_DIR == str(tmp_path.resolve() / "models")
+
def test_env_overrides_still_win(self, monkeypatch, tmp_path):
from docsgpt.core.settings import Settings
monkeypatch.setenv(paths.HOME_ENV, str(tmp_path))
monkeypatch.setenv("LANCEDB_PATH", "/srv/lancedb")
- assert Settings(_env_file=None).LANCEDB_PATH == "/srv/lancedb"
+ monkeypatch.setenv("EMBEDDINGS_CACHE_DIR", "/srv/models")
+ fresh = Settings(_env_file=None)
+ assert fresh.LANCEDB_PATH == "/srv/lancedb"
+ assert fresh.EMBEDDINGS_CACHE_DIR == "/srv/models"
class TestPackageDir:
diff --git a/tests/parser/file/test_audio_parser.py b/tests/parser/file/test_audio_parser.py
index 6109c74d..5933b1d2 100644
--- a/tests/parser/file/test_audio_parser.py
+++ b/tests/parser/file/test_audio_parser.py
@@ -1,6 +1,9 @@
from unittest.mock import MagicMock, patch
+import pytest
+
from docsgpt.parser.file.audio_parser import AudioParser
+from docsgpt.parser.file.base_parser import DocumentParseError
from docsgpt.parser.file.bulk import get_default_file_extractor
from docsgpt.stt.upload_limits import AudioFileTooLargeError
@@ -44,6 +47,20 @@ def test_audio_parser_transcribes_file(
)
+@patch("docsgpt.parser.file.audio_parser.STTCreator.create_stt")
+@patch("docsgpt.parser.file.audio_parser.settings")
+def test_audio_parser_refuses_when_speech_to_text_is_disabled(
+ mock_settings, mock_create_stt, tmp_path
+):
+ mock_settings.STT_PROVIDER = "none"
+ audio_file = tmp_path / "meeting.wav"
+ audio_file.write_bytes(b"audio-bytes")
+
+ with pytest.raises(DocumentParseError, match="STT_PROVIDER"):
+ AudioParser().parse_file(audio_file)
+ mock_create_stt.assert_not_called()
+
+
@patch("docsgpt.stt.upload_limits.settings")
def test_audio_parser_rejects_oversized_files(mock_limit_settings, tmp_path):
mock_limit_settings.STT_MAX_FILE_SIZE_MB = 1
diff --git a/tests/parser/test_tokenization.py b/tests/parser/test_tokenization.py
index 9a254e31..be751f1a 100644
--- a/tests/parser/test_tokenization.py
+++ b/tests/parser/test_tokenization.py
@@ -309,7 +309,7 @@ class TestTokenizerFile:
def test_cache_hit_makes_no_online_call(self, monkeypatch):
calls = []
- def fake_download(repo, filename, local_files_only=False):
+ def fake_download(repo, filename, local_files_only=False, cache_dir=None):
calls.append(local_files_only)
return "/cache/tokenizer.json"
@@ -322,7 +322,7 @@ class TestTokenizerFile:
def test_cache_miss_falls_back_to_online(self, monkeypatch):
calls = []
- def fake_download(repo, filename, local_files_only=False):
+ def fake_download(repo, filename, local_files_only=False, cache_dir=None):
calls.append(local_files_only)
if local_files_only:
raise FileNotFoundError("not cached")
@@ -333,3 +333,20 @@ class TestTokenizerFile:
monkeypatch.setitem(sys.modules, "huggingface_hub", fake_hub)
assert tokenization._tokenizer_file("org/model") == "/downloaded/tokenizer.json"
assert calls == [True, False]
+
+ def test_reads_the_embedding_model_cache(self, monkeypatch):
+ """FastEmbed's snapshot already holds tokenizer.json; a second cache downloads it again."""
+ cache_dirs = []
+
+ def fake_download(repo, filename, local_files_only=False, cache_dir=None):
+ cache_dirs.append(cache_dir)
+ if local_files_only:
+ raise FileNotFoundError("not cached")
+ return "/models/tokenizer.json"
+
+ fake_hub = types.ModuleType("huggingface_hub")
+ fake_hub.hf_hub_download = fake_download
+ monkeypatch.setitem(sys.modules, "huggingface_hub", fake_hub)
+ monkeypatch.setattr(tokenization.settings, "EMBEDDINGS_CACHE_DIR", "/models")
+ tokenization._tokenizer_file("org/model")
+ assert cache_dirs == ["/models", "/models"]
diff --git a/tests/scripts/test_prefetch_models.py b/tests/scripts/test_prefetch_models.py
index 3deda43b..a0417835 100644
--- a/tests/scripts/test_prefetch_models.py
+++ b/tests/scripts/test_prefetch_models.py
@@ -95,17 +95,12 @@ class TestMain:
prefetch_models.main(["granite-97m"])
assert spy.call_args.args[1] == "/app/models"
+ def test_cache_dir_defaults_to_the_one_the_app_reads(self, fake_fastembed, monkeypatch):
+ """Without the variable, models must land where the running app looks for them."""
+ from docsgpt.core.settings import settings
-class TestPrefetchTiktoken:
- def test_warms_every_listed_encoding(self):
- """The image sets TIKTOKEN_CACHE_DIR; warming fills it at build time."""
- fake = MagicMock()
- module = types.ModuleType("tiktoken")
- module.get_encoding = fake
- with patch.dict(sys.modules, {"tiktoken": module}):
- fetched = prefetch_models.prefetch_tiktoken()
- assert fetched == list(prefetch_models.TIKTOKEN_ENCODINGS)
- assert [c.args[0] for c in fake.call_args_list] == list(prefetch_models.TIKTOKEN_ENCODINGS)
-
- def test_cl100k_is_the_encoding_token_counting_uses(self):
- assert "cl100k_base" in prefetch_models.TIKTOKEN_ENCODINGS
+ monkeypatch.delenv("EMBEDDINGS_CACHE_DIR", raising=False)
+ monkeypatch.setattr(settings, "EMBEDDINGS_CACHE_DIR", "/home/docsgpt/models")
+ with patch.object(prefetch_models, "prefetch", return_value=[]) as spy:
+ prefetch_models.main(["granite-97m"])
+ assert spy.call_args.args[1] == "/home/docsgpt/models"
diff --git a/tests/scripts/test_verify_offline.py b/tests/scripts/test_verify_offline.py
index 11f6114b..e1f95b78 100644
--- a/tests/scripts/test_verify_offline.py
+++ b/tests/scripts/test_verify_offline.py
@@ -8,8 +8,11 @@ from docsgpt.scripts import verify_offline
def _fake_tiktoken(monkeypatch):
+ """The check must exercise the app's own loader, which reads the packaged encoding."""
+ encoding = types.SimpleNamespace(name="cl100k_base", encode=lambda text: [1, 2])
+ monkeypatch.setattr("docsgpt.utils.get_encoding", lambda: encoding)
module = types.ModuleType("tiktoken")
- module.get_encoding = lambda name: types.SimpleNamespace(encode=lambda text: [1, 2])
+ module.get_encoding = lambda name: (_ for _ in ()).throw(AssertionError("downloaded via tiktoken"))
monkeypatch.setitem(sys.modules, "tiktoken", module)
diff --git a/tests/stt/test_stt_creator.py b/tests/stt/test_stt_creator.py
index e7de3aee..a1624d50 100644
--- a/tests/stt/test_stt_creator.py
+++ b/tests/stt/test_stt_creator.py
@@ -51,6 +51,16 @@ def test_stt_type_case_insensitivity(stt_creator):
assert result == instance
+@pytest.mark.parametrize("value", ["none", "NONE", " none ", "", None])
+def test_is_enabled_false_when_switched_off(value):
+ assert STTCreator.is_enabled(value) is False
+
+
+@pytest.mark.parametrize("value", ["openai", "faster_whisper"])
+def test_is_enabled_for_a_provider(value):
+ assert STTCreator.is_enabled(value) is True
+
+
def test_stt_providers_integrity(stt_creator):
providers = stt_creator.stt_providers
assert "openai" in providers
diff --git a/tests/test_app_routes.py b/tests/test_app_routes.py
index c4790060..552c1272 100644
--- a/tests/test_app_routes.py
+++ b/tests/test_app_routes.py
@@ -95,6 +95,28 @@ class TestConfigRoute:
data = json.loads(response.data)
assert data["hybrid_available"] is False
+ @pytest.mark.unit
+ def test_speech_features_available_by_default(self, client):
+ with patch("docsgpt.app.settings") as mock_settings:
+ mock_settings.AUTH_TYPE = None
+ mock_settings.TTS_PROVIDER = "google_tts"
+ mock_settings.STT_PROVIDER = "openai"
+ response = client.get("/api/config")
+ data = json.loads(response.data)
+ assert data["tts_available"] is True
+ assert data["stt_available"] is True
+
+ @pytest.mark.unit
+ def test_speech_features_unavailable_when_disabled(self, client):
+ with patch("docsgpt.app.settings") as mock_settings:
+ mock_settings.AUTH_TYPE = None
+ mock_settings.TTS_PROVIDER = "none"
+ mock_settings.STT_PROVIDER = "none"
+ response = client.get("/api/config")
+ data = json.loads(response.data)
+ assert data["tts_available"] is False
+ assert data["stt_available"] is False
+
@pytest.mark.unit
def test_oidc_config_exposes_login_paths(self, client):
with patch("docsgpt.app.settings") as mock_settings:
diff --git a/tests/test_extra_coverage.py b/tests/test_extra_coverage.py
index 58a6822e..fcb3333f 100644
--- a/tests/test_extra_coverage.py
+++ b/tests/test_extra_coverage.py
@@ -158,12 +158,17 @@ class TestSourcesUploadExtra:
response = UploadRemote().post()
assert response.status_code == 400
- def test_remote_connector_triggers_task(self, app):
+ def test_remote_connector_triggers_task(self, app, pg_conn):
from docsgpt.api.user.sources.upload import UploadRemote
+ from docsgpt.storage.db.repositories.connector_sessions import ConnectorSessionsRepository
import json as _json
+ repo = ConnectorSessionsRepository(pg_conn)
+ session = repo.upsert("u", "google_drive", status="authorized")
+ repo.update(str(session["id"]), {"session_token": "st"})
+
fake_task = MagicMock(id="conn-t")
- with patch(
+ with _patch_upload_db(pg_conn), patch(
"docsgpt.parser.connectors.connector_creator.ConnectorCreator"
".get_supported_connectors",
return_value={"google_drive"},
@@ -210,6 +215,8 @@ class TestConnectorExtra:
"/api/connectors/disconnect", method="POST",
json={"provider": "x", "session_token": "y"},
):
+ from flask import request
+ request.decoded_token = {"sub": "u"}
response = ConnectorDisconnect().post()
assert response.status_code == 500
diff --git a/tests/test_utils.py b/tests/test_utils.py
index 6c1f3911..2bdcf9a6 100644
--- a/tests/test_utils.py
+++ b/tests/test_utils.py
@@ -40,6 +40,47 @@ class TestGetEncoding:
enc2 = get_encoding()
assert enc1 is enc2
+ @pytest.mark.unit
+ def test_loads_the_packaged_encoding_without_network(self, monkeypatch):
+ """Token counting runs on every chat; it must never download the encoding."""
+ import tiktoken
+ import tiktoken.load
+
+ from docsgpt import utils
+
+ def no_download(*args, **kwargs):
+ raise AssertionError("tiktoken tried to fetch cl100k_base")
+
+ monkeypatch.setattr(utils, "_encoding", None)
+ monkeypatch.setattr(tiktoken.load, "read_file", no_download)
+ monkeypatch.setattr(tiktoken, "get_encoding", no_download)
+ assert utils.get_encoding().encode("hello world") == [15339, 1917]
+
+ @pytest.mark.unit
+ def test_packaged_encoding_matches_the_tiktoken_definition(self, monkeypatch):
+ from tiktoken_ext import openai_public
+
+ from docsgpt import utils
+
+ monkeypatch.setattr(utils, "_encoding", None)
+ monkeypatch.setattr(openai_public, "load_tiktoken_bpe", lambda *args, **kwargs: {})
+ reference = openai_public.cl100k_base()
+ encoding = utils.get_encoding()
+ assert encoding.name == reference["name"]
+ assert encoding._pat_str == reference["pat_str"]
+ assert encoding._special_tokens == reference["special_tokens"]
+
+ @pytest.mark.unit
+ def test_corrupt_packaged_encoding_is_rejected(self, monkeypatch, tmp_path):
+ from docsgpt import utils
+
+ corrupt = tmp_path / "cl100k_base.tiktoken"
+ corrupt.write_bytes(b"IQ== 0\n")
+ monkeypatch.setattr(utils, "_encoding", None)
+ monkeypatch.setattr(utils, "_CL100K_BASE_FILE", corrupt)
+ with pytest.raises(ValueError, match="cl100k_base"):
+ utils.get_encoding()
+
class TestGetGptModel:
diff --git a/tests/tts/test_tts_creator.py b/tests/tts/test_tts_creator.py
index 62284973..fe19f3f2 100644
--- a/tests/tts/test_tts_creator.py
+++ b/tests/tts/test_tts_creator.py
@@ -53,6 +53,16 @@ def test_tts_type_case_insensitivity(tts_creator):
assert result == instance
+@pytest.mark.parametrize("value", ["none", "NONE", " none ", "", None])
+def test_is_enabled_false_when_switched_off(value):
+ assert TTSCreator.is_enabled(value) is False
+
+
+@pytest.mark.parametrize("value", ["google_tts", "elevenlabs"])
+def test_is_enabled_for_a_provider(value):
+ assert TTSCreator.is_enabled(value) is True
+
+
def test_tts_providers_integrity(tts_creator):
providers = tts_creator.tts_providers
assert "google_tts" in providers
diff --git a/tests/vectorstore/test_embeddings_local.py b/tests/vectorstore/test_embeddings_local.py
index 6f5176d5..5d61a72b 100644
--- a/tests/vectorstore/test_embeddings_local.py
+++ b/tests/vectorstore/test_embeddings_local.py
@@ -1,5 +1,7 @@
"""Local embeddings run through FastEmbed, configured from the model registry."""
+import sys
+import types
from unittest.mock import MagicMock, patch
import numpy as np
@@ -9,6 +11,9 @@ from docsgpt.vectorstore import embeddings_local
from docsgpt.vectorstore.embeddings_local import EmbeddingsWrapper
from docsgpt.vectorstore.model_registry import GRANITE_97M, MPNET
+# The autouse fixture below replaces this for every test; keep the real one.
+_READ_REPO_JSON = embeddings_local._read_repo_json
+
@pytest.fixture(autouse=True)
def _clear_registration():
@@ -142,6 +147,23 @@ class TestSettingsPassthrough:
EmbeddingsWrapper(MPNET.name)
assert text_embedding.call_args.kwargs["cache_dir"] == "/models"
+ def test_repo_metadata_reads_the_embedding_model_cache(self, monkeypatch, tmp_path):
+ """Pooling metadata lives beside the model, not in a second hub cache."""
+ config = tmp_path / "config.json"
+ config.write_text('{"pooling_mode_cls_token": true}')
+ calls = []
+
+ def fake_download(repo_id, filename, local_files_only=False, cache_dir=None):
+ calls.append((local_files_only, cache_dir))
+ return str(config)
+
+ fake_hub = types.ModuleType("huggingface_hub")
+ fake_hub.hf_hub_download = fake_download
+ monkeypatch.setitem(sys.modules, "huggingface_hub", fake_hub)
+ monkeypatch.setattr(embeddings_local.settings, "EMBEDDINGS_CACHE_DIR", "/models")
+ assert _READ_REPO_JSON("org/model", "1_Pooling/config.json") == {"pooling_mode_cls_token": True}
+ assert calls == [(True, "/models")]
+
class TestEmbedding:
def test_embed_documents_returns_plain_lists(self, fake_fastembed):