mirror of
https://github.com/fsolla/teqo.git
synced 2026-11-13 15:13:07 +00:00
671af1e21f
Some checks are pending
Deploy / preflight (push) Waiting to run
Deploy / verify (push) Blocked by required conditions
Deploy / deploy staging (teqo-staging) (push) Blocked by required conditions
Deploy / requeue when main advanced (push) Blocked by required conditions
Deploy / deploy production (teqo-1313) (push) Blocked by required conditions
Collection archivePhoto ganha o grupo catalog (legenda/descrição/cena/texto visível/temas/pessoas/município/origem/catalogedAt), curatedFields (o que a assessoria edita nunca é sobrescrito), takenOn e searchText com índice GIN trgm (migration aditiva add_archive_photo_catalog); hook beforeValidate deriva o índice e marca curadoria só em edição humana; pipeline transacional baixa os bytes privados, prepara JPEG <=1024px com sharp e mescla o VLM local com o gazetteer/catálogo curado (pessoas só do TEXTO, nunca de rosto); CLI pnpm archive:catalog (plan/--apply/--verify, recibo honesto, idempotente por catalogedAt) com engine OpenAI-compatible na rede privada atrás de guarda de host (ARCHIVE_VISION_ALLOW_REMOTE é o escape); client HTTP com retry/timeout e parser zod fail-closed; resolver de município extraído para owner compartilhado com o catálogo de peças delegando; unit/int novos e runbook staging-primeiro.
55 lines
1.4 KiB
TypeScript
55 lines
1.4 KiB
TypeScript
import { describe, expect, it } from 'vitest'
|
|
|
|
import { isPrivateVisionHost } from '../../scripts/lib/cli.mjs'
|
|
|
|
// C232 — the vision-endpoint locality predicate behind the PII guardrail: only
|
|
// the private network (loopback, RFC1918, CGNAT/tailnet, link-local/ULA, local
|
|
// names) passes without the explicit remote escape.
|
|
|
|
describe('isPrivateVisionHost (C232)', () => {
|
|
it('accepts loopback, private ranges and the tailnet CGNAT block', () => {
|
|
for (const host of [
|
|
'localhost',
|
|
'127.0.0.1',
|
|
'10.0.0.7',
|
|
'172.16.0.1',
|
|
'172.31.255.254',
|
|
'192.168.15.142',
|
|
'100.94.122.26',
|
|
'100.64.0.1',
|
|
'::1',
|
|
'[::1]',
|
|
'fe80::1',
|
|
'fd00::1',
|
|
'gpu-box',
|
|
'ollama',
|
|
'host.docker.internal',
|
|
'workstation.local',
|
|
'engine.internal',
|
|
]) {
|
|
expect(isPrivateVisionHost(host), host).toBe(true)
|
|
}
|
|
})
|
|
|
|
it('rejects public hosts and out-of-range addresses', () => {
|
|
for (const host of [
|
|
'8.8.8.8',
|
|
'1.1.1.1',
|
|
'172.32.0.1',
|
|
'172.15.0.1',
|
|
'100.63.0.1',
|
|
'100.128.0.1',
|
|
'203.0.113.10',
|
|
'api.openai.com',
|
|
'example.com',
|
|
'256.1.1.1',
|
|
// Names that merely START with the IPv6 ULA/link-local prefixes.
|
|
'fdic.gov',
|
|
'fcc.gov',
|
|
'fd-openai.com',
|
|
'',
|
|
]) {
|
|
expect(isPrivateVisionHost(host), host).toBe(false)
|
|
}
|
|
})
|
|
})
|