feat: sync deployed v1.0.0-rc.38-custom.42

Sync production source including routing, billing, Astra detection and public uptime. Update custom build instructions and license packaging.

middleware/auth_test.go

@@ -255,3 +255,82 @@ func TestTryUserAuthCredentialClassification(t *testing.T) {
 	assert.Equal(t, http.StatusInternalServerError, databaseFailureResponse.Code)
 	assert.Contains(t, databaseFailureResponse.Body.String(), "AUTH_INTERNAL_ERROR")
 }
+
+func TestAPIKeyFromWebSocketSubprotocol(t *testing.T) {
+	tests := []struct {
+		name      string
+		protocols string
+		wantKey   string
+		wantOK    bool
+	}{
+		{
+			name:      "responses protocol only",
+			protocols: "responses",
+			wantOK:    false,
+		},
+		{
+			name:      "realtime protocol only",
+			protocols: "realtime",
+			wantOK:    false,
+		},
+		{
+			name:      "responses with insecure key",
+			protocols: "responses, openai-insecure-api-key.sk-test",
+			wantKey:   "sk-test",
+			wantOK:    true,
+		},
+		{
+			name:      "realtime with beta and insecure key",
+			protocols: "realtime, openai-insecure-api-key.sk-realtime, openai-beta.realtime-v1",
+			wantKey:   "sk-realtime",
+			wantOK:    true,
+		},
+		{
+			name:      "empty insecure key",
+			protocols: "responses, openai-insecure-api-key.",
+			wantOK:    false,
+		},
+		{
+			name:      "bare insecure marker is not a key",
+			protocols: "openai-insecure-api-key",
+			wantOK:    false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotKey, gotOK := apiKeyFromWebSocketSubprotocol(tt.protocols)
+			assert.Equal(t, tt.wantOK, gotOK)
+			assert.Equal(t, tt.wantKey, gotKey)
+		})
+	}
+}
+
+func TestApplyWebSocketSubprotocolAuthorizationDoesNotOverrideProtocolOnly(t *testing.T) {
+	header := http.Header{}
+	header.Set("Authorization", "Bearer sk-original")
+	header.Set("Sec-WebSocket-Protocol", "responses")
+	header.Add("Sec-WebSocket-Protocol", "openai-beta.realtime-v1")
+
+	assert.False(t, applyWebSocketSubprotocolAuthorization(header))
+	assert.Equal(t, "Bearer sk-original", header.Get("Authorization"))
+}
+
+func TestApplyWebSocketSubprotocolAuthorizationOverridesWithInsecureKey(t *testing.T) {
+	header := http.Header{}
+	header.Set("Authorization", "Bearer sk-original")
+	header.Set("Sec-WebSocket-Protocol", "responses, openai-insecure-api-key.sk-from-protocol")
+
+	assert.True(t, applyWebSocketSubprotocolAuthorization(header))
+	assert.Equal(t, "Bearer sk-from-protocol", header.Get("Authorization"))
+}
+
+func TestApplyWebSocketSubprotocolAuthorizationReadsRepeatedHeaders(t *testing.T) {
+	header := http.Header{}
+	header.Set("Authorization", "Bearer sk-original")
+	header.Add("Sec-WebSocket-Protocol", "responses")
+	header.Add("Sec-WebSocket-Protocol", "openai-insecure-api-key.sk-later-field")
+
+	assert.True(t, applyWebSocketSubprotocolAuthorization(header))
+	assert.Equal(t, "Bearer sk-later-field", header.Get("Authorization"))
+}