self = <test_api_keys.TestAPIKeyModelInference object at 0x7f4231a349a0> model_completions_url = 'https://maas.apps.f2870b7c-a9d8-4ac1-a7a6-e5c9692c1c9c.prod.konfluxeaas.com/llm/facebook-opt-125m-simulated/v1/completions' api_key_headers = {'Authorization': 'Bearer sk-oai-or1M1nNM589QW7KL_kADdk9Uz77hjzE0CxHEeBHPDyXHdjgIqNo4DOg8ohm1', 'Content-Type': 'application/json'} inference_model_name = 'facebook/opt-125m' def test_api_key_model_access_success( self, model_completions_url: str, api_key_headers: dict, inference_model_name: str, ): """Test 11: Valid API key can access model endpoint - verify 200 response. Subscription is bound on the key at mint (see conftest ``api_key`` fixture). """ r = requests.post( model_completions_url, headers=api_key_headers, json={ "model": inference_model_name, "prompt": "Hello world", "max_tokens": 10, }, timeout=60, verify=TLS_VERIFY, ) > assert r.status_code == 200, f"Expected 200, got {r.status_code}: {r.text}" E AssertionError: Expected 200, got 500: E assert 500 == 200 E + where 500 = <Response [500]>.status_code test/e2e/tests/test_api_keys.py:548: AssertionError/workspace/source/test/e2e/tests/test_api_keys.py:700: Chat completions returned 500self = <urllib3.connectionpool.HTTPSConnectionPool object at 0x7f42314d3430> conn = <HTTPSConnection(host='maas.apps.f2870b7c-a9d8-4ac1-a7a6-e5c9692c1c9c.prod.konfluxeaas.com', port=443) at 0x7f42314e1c40> method = 'POST', url = '/llm/facebook-opt-125m-simulated/v1/completions' body = b'{"model": "facebook/opt-125m", "prompt": "Test", "max_tokens": 5}' headers = {'User-Agent': 'python-requests/2.32.5', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-aliv...Q3mXTFWzLzn9S_9y9jdVeYozhClntzds07qy8kRSvmWXbLozdKtzOOSv1', 'Content-Type': 'application/json', 'Content-Length': '65'} retries = Retry(total=0, connect=None, read=False, redirect=None, status=None) timeout = Timeout(connect=10, read=10, total=None), chunked = False response_conn = <HTTPSConnection(host='maas.apps.f2870b7c-a9d8-4ac1-a7a6-e5c9692c1c9c.prod.konfluxeaas.com', port=443) at 0x7f42314e1c40> preload_content = False, decode_content = False, enforce_content_length = True def _make_request( self, conn: BaseHTTPConnection, method: str, url: str, body: _TYPE_BODY | None = None, headers: typing.Mapping[str, str] | None = None, retries: Retry | None = None, timeout: _TYPE_TIMEOUT = _DEFAULT_TIMEOUT, chunked: bool = False, response_conn: BaseHTTPConnection | None = None, preload_content: bool = True, decode_content: bool = True, enforce_content_length: bool = True, ) -> BaseHTTPResponse: """ Perform a request on a given urllib connection object taken from our pool. :param conn: a connection from one of our connection pools :param method: HTTP request method (such as GET, POST, PUT, etc.) :param url: The URL to perform the request on. :param body: Data to send in the request body, either :class:`str`, :class:`bytes`, an iterable of :class:`str`/:class:`bytes`, or a file-like object. :param headers: Dictionary of custom headers to send, such as User-Agent, If-None-Match, etc. If None, pool headers are used. If provided, these headers completely replace any pool-specific headers. :param retries: Configure the number of retries to allow before raising a :class:`~urllib3.exceptions.MaxRetryError` exception. Pass ``None`` to retry until you receive a response. Pass a :class:`~urllib3.util.retry.Retry` object for fine-grained control over different types of retries. Pass an integer number to retry connection errors that many times, but no other types of errors. Pass zero to never retry. If ``False``, then retries are disabled and any exception is raised immediately. Also, instead of raising a MaxRetryError on redirects, the redirect response will be returned. :type retries: :class:`~urllib3.util.retry.Retry`, False, or an int. :param timeout: If specified, overrides the default timeout for this one request. It may be a float (in seconds) or an instance of :class:`urllib3.util.Timeout`. :param chunked: If True, urllib3 will send the body using chunked transfer encoding. Otherwise, urllib3 will send the body using the standard content-length form. Defaults to False. :param response_conn: Set this to ``None`` if you will handle releasing the connection or set the connection to have the response release it. :param preload_content: If True, the response's body will be preloaded during construction. :param decode_content: If True, will attempt to decode the body based on the 'content-encoding' header. :param enforce_content_length: Enforce content length checking. Body returned by server must match value of Content-Length header, if present. Otherwise, raise error. """ self.num_requests += 1 timeout_obj = self._get_timeout(timeout) timeout_obj.start_connect() conn.timeout = Timeout.resolve_default_timeout(timeout_obj.connect_timeout) try: # Trigger any extra validation we need to do. try: self._validate_conn(conn) except (SocketTimeout, BaseSSLError) as e: self._raise_timeout(err=e, url=url, timeout_value=conn.timeout) raise # _validate_conn() starts the connection to an HTTPS proxy # so we need to wrap errors with 'ProxyError' here too. except ( OSError, NewConnectionError, TimeoutError, BaseSSLError, CertificateError, SSLError, ) as e: new_e: Exception = e if isinstance(e, (BaseSSLError, CertificateError)): new_e = SSLError(e) # If the connection didn't successfully connect to it's proxy # then there if isinstance( new_e, (OSError, NewConnectionError, TimeoutError, SSLError) ) and (conn and conn.proxy and not conn.has_connected_to_proxy): new_e = _wrap_proxy_error(new_e, conn.proxy.scheme) raise new_e # conn.request() calls http.client.*.request, not the method in # urllib3.request. It also calls makefile (recv) on the socket. try: conn.request( method, url, body=body, headers=headers, chunked=chunked, preload_content=preload_content, decode_content=decode_content, enforce_content_length=enforce_content_length, ) # We are swallowing BrokenPipeError (errno.EPIPE) since the server is # legitimately able to close the connection after sending a valid response. # With this behaviour, the received response is still readable. except BrokenPipeError: pass except OSError as e: # MacOS/Linux # EPROTOTYPE and ECONNRESET are needed on macOS # https://erickt.github.io/blog/2014/11/19/adventures-in-debugging-a-potential-osx-kernel-bug/ # Condition changed later to emit ECONNRESET instead of only EPROTOTYPE. if e.errno != errno.EPROTOTYPE and e.errno != errno.ECONNRESET: raise # Reset the timeout for the recv() on the socket read_timeout = timeout_obj.read_timeout if not conn.is_closed: # In Python 3 socket.py will catch EAGAIN and return None when you # try and read into the file pointer created by http.client, which # instead raises a BadStatusLine exception. Instead of catching # the exception and assuming all BadStatusLine exceptions are read # timeouts, check for a zero timeout before making the request. if read_timeout == 0: raise ReadTimeoutError( self, url, f"Read timed out. (read timeout={read_timeout})" ) conn.timeout = read_timeout # Receive the response from the server try: > response = conn.getresponse() test/e2e/.venv/lib64/python3.9/site-packages/urllib3/connectionpool.py:534: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ test/e2e/.venv/lib64/python3.9/site-packages/urllib3/connection.py:571: in getresponse httplib_response = super().getresponse() /usr/lib64/python3.9/http/client.py:1377: in getresponse response.begin() /usr/lib64/python3.9/http/client.py:320: in begin version, status, reason = self._read_status() /usr/lib64/python3.9/http/client.py:281: in _read_status line = str(self.fp.readline(_MAXLINE + 1), "iso-8859-1") /usr/lib64/python3.9/socket.py:716: in readinto return self._sock.recv_into(b) /usr/lib64/python3.9/ssl.py:1277: in recv_into return self.read(nbytes, buffer) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = <ssl.SSLSocket [closed] fd=-1, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=6> len = 8192, buffer = <memory at 0x7f4231586ac0> def read(self, len=1024, buffer=None): """Read up to LEN bytes and return them. Return zero-length string on EOF.""" self._checkClosed() if self._sslobj is None: raise ValueError("Read on closed or unwrapped SSL socket.") try: if buffer is not None: > return self._sslobj.read(len, buffer) E socket.timeout: The read operation timed out /usr/lib64/python3.9/ssl.py:1135: timeout The above exception was the direct cause of the following exception: self = <requests.adapters.HTTPAdapter object at 0x7f4231270f40> request = <PreparedRequest [POST]>, stream = False timeout = Timeout(connect=10, read=10, total=None), verify = False, cert = None proxies = OrderedDict() def send( self, request, stream=False, timeout=None, verify=True, cert=None, proxies=None ): """Sends PreparedRequest object. Returns Response object. :param request: The :class:`PreparedRequest <PreparedRequest>` being sent. :param stream: (optional) Whether to stream the request content. :param timeout: (optional) How long to wait for the server to send data before giving up, as a float, or a :ref:`(connect timeout, read timeout) <timeouts>` tuple. :type timeout: float or tuple or urllib3 Timeout object :param verify: (optional) Either a boolean, in which case it controls whether we verify the server's TLS certificate, or a string, in which case it must be a path to a CA bundle to use :param cert: (optional) Any user-provided SSL certificate to be trusted. :param proxies: (optional) The proxies dictionary to apply to the request. :rtype: requests.Response """ try: conn = self.get_connection_with_tls_context( request, verify, proxies=proxies, cert=cert ) except LocationValueError as e: raise InvalidURL(e, request=request) self.cert_verify(conn, request.url, verify, cert) url = self.request_url(request, proxies) self.add_headers( request, stream=stream, timeout=timeout, verify=verify, cert=cert, proxies=proxies, ) chunked = not (request.body is None or "Content-Length" in request.headers) if isinstance(timeout, tuple): try: connect, read = timeout timeout = TimeoutSauce(connect=connect, read=read) except ValueError: raise ValueError( f"Invalid timeout {timeout}. Pass a (connect, read) timeout tuple, " f"or a single float to set both timeouts to the same value." ) elif isinstance(timeout, TimeoutSauce): pass else: timeout = TimeoutSauce(connect=timeout, read=timeout) try: > resp = conn.urlopen( method=request.method, url=url, body=request.body, headers=request.headers, redirect=False, assert_same_host=False, preload_content=False, decode_content=False, retries=self.max_retries, timeout=timeout, chunked=chunked, ) test/e2e/.venv/lib64/python3.9/site-packages/requests/adapters.py:644: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ test/e2e/.venv/lib64/python3.9/site-packages/urllib3/connectionpool.py:841: in urlopen retries = retries.increment( test/e2e/.venv/lib64/python3.9/site-packages/urllib3/util/retry.py:490: in increment raise reraise(type(error), error, _stacktrace) test/e2e/.venv/lib64/python3.9/site-packages/urllib3/util/util.py:39: in reraise raise value test/e2e/.venv/lib64/python3.9/site-packages/urllib3/connectionpool.py:787: in urlopen response = self._make_request( test/e2e/.venv/lib64/python3.9/site-packages/urllib3/connectionpool.py:536: in _make_request self._raise_timeout(err=e, url=url, timeout_value=read_timeout) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = <urllib3.connectionpool.HTTPSConnectionPool object at 0x7f42314d3430> err = timeout('The read operation timed out') url = '/llm/facebook-opt-125m-simulated/v1/completions', timeout_value = 10 def _raise_timeout( self, err: BaseSSLError | OSError | SocketTimeout, url: str, timeout_value: _TYPE_TIMEOUT | None, ) -> None: """Is the error actually a timeout? Will raise a ReadTimeout or pass""" if isinstance(err, SocketTimeout): > raise ReadTimeoutError( self, url, f"Read timed out. (read timeout={timeout_value})" ) from err E urllib3.exceptions.ReadTimeoutError: HTTPSConnectionPool(host='maas.apps.f2870b7c-a9d8-4ac1-a7a6-e5c9692c1c9c.prod.konfluxeaas.com', port=443): Read timed out. (read timeout=10) test/e2e/.venv/lib64/python3.9/site-packages/urllib3/connectionpool.py:367: ReadTimeoutError During handling of the above exception, another exception occurred: self = <test_api_keys.TestAPIKeyRevocationE2E object at 0x7f4231822040> api_keys_base_url = 'https://maas.apps.f2870b7c-a9d8-4ac1-a7a6-e5c9692c1c9c.prod.konfluxeaas.com/maas-api/v1/api-keys' model_completions_url = 'https://maas.apps.f2870b7c-a9d8-4ac1-a7a6-e5c9692c1c9c.prod.konfluxeaas.com/llm/facebook-opt-125m-simulated/v1/completions' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6ImtGdEVpY3pvaW9NRzMyUDh0STVuM3lFeWFrdzJsNkw2dWp2MXpEWXJvWWsifQ.e...BP6MA9Ia0TouXG9bf-zc36iNvAYl9sR5tMAlNgsJLkb0Sgxj07HqU7cBpNrTvBuriUaOozYDnJPW2Nwbg', 'Content-Type': 'application/json'} inference_model_name = 'facebook/opt-125m' def test_revoke_then_create_new_key_works( self, api_keys_base_url: str, model_completions_url: str, headers: dict, inference_model_name: str, ): """After revoking a key, a newly created key should still work for inference.""" designated = SIMULATOR_SUBSCRIPTION # Create key A r_a = requests.post( api_keys_base_url, headers=headers, json={"name": "test-revoke-remint-a", "subscription": designated}, timeout=30, verify=TLS_VERIFY, ) assert r_a.status_code in (200, 201), f"Failed to create key A: {r_a.text}" key_a = r_a.json()["key"] key_a_id = r_a.json()["id"] # Revoke key A r_revoke = requests.delete(f"{api_keys_base_url}/{key_a_id}", headers=headers, timeout=30, verify=TLS_VERIFY) assert r_revoke.status_code == 200 # Create key B (new key after revocation) r_b = requests.post( api_keys_base_url, headers=headers, json={"name": "test-revoke-remint-b", "subscription": designated}, timeout=30, verify=TLS_VERIFY, ) assert r_b.status_code in (200, 201), f"Failed to create key B: {r_b.text}" key_b = r_b.json()["key"] # Poll until revoked key A is rejected (revocation may take time to propagate) max_wait = 30 poll_interval = 0.5 deadline = time.monotonic() + max_wait while True: remaining = deadline - time.monotonic() if remaining <= 0: break > r_a_inf = requests.post( model_completions_url, headers={"Authorization": f"Bearer {key_a}", "Content-Type": "application/json"}, json={"model": inference_model_name, "prompt": "Test", "max_tokens": 5}, timeout=min(remaining, 10), verify=TLS_VERIFY, ) test/e2e/tests/test_api_keys.py:778: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ test/e2e/.venv/lib64/python3.9/site-packages/requests/api.py:115: in post return request("post", url, data=data, json=json, **kwargs) test/e2e/.venv/lib64/python3.9/site-packages/requests/api.py:59: in request return session.request(method=method, url=url, **kwargs) test/e2e/.venv/lib64/python3.9/site-packages/requests/sessions.py:589: in request resp = self.send(prep, **send_kwargs) test/e2e/.venv/lib64/python3.9/site-packages/requests/sessions.py:703: in send r = adapter.send(request, **kwargs) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = <requests.adapters.HTTPAdapter object at 0x7f4231270f40> request = <PreparedRequest [POST]>, stream = False timeout = Timeout(connect=10, read=10, total=None), verify = False, cert = None proxies = OrderedDict() def send( self, request, stream=False, timeout=None, verify=True, cert=None, proxies=None ): """Sends PreparedRequest object. Returns Response object. :param request: The :class:`PreparedRequest <PreparedRequest>` being sent. :param stream: (optional) Whether to stream the request content. :param timeout: (optional) How long to wait for the server to send data before giving up, as a float, or a :ref:`(connect timeout, read timeout) <timeouts>` tuple. :type timeout: float or tuple or urllib3 Timeout object :param verify: (optional) Either a boolean, in which case it controls whether we verify the server's TLS certificate, or a string, in which case it must be a path to a CA bundle to use :param cert: (optional) Any user-provided SSL certificate to be trusted. :param proxies: (optional) The proxies dictionary to apply to the request. :rtype: requests.Response """ try: conn = self.get_connection_with_tls_context( request, verify, proxies=proxies, cert=cert ) except LocationValueError as e: raise InvalidURL(e, request=request) self.cert_verify(conn, request.url, verify, cert) url = self.request_url(request, proxies) self.add_headers( request, stream=stream, timeout=timeout, verify=verify, cert=cert, proxies=proxies, ) chunked = not (request.body is None or "Content-Length" in request.headers) if isinstance(timeout, tuple): try: connect, read = timeout timeout = TimeoutSauce(connect=connect, read=read) except ValueError: raise ValueError( f"Invalid timeout {timeout}. Pass a (connect, read) timeout tuple, " f"or a single float to set both timeouts to the same value." ) elif isinstance(timeout, TimeoutSauce): pass else: timeout = TimeoutSauce(connect=timeout, read=timeout) try: resp = conn.urlopen( method=request.method, url=url, body=request.body, headers=request.headers, redirect=False, assert_same_host=False, preload_content=False, decode_content=False, retries=self.max_retries, timeout=timeout, chunked=chunked, ) except (ProtocolError, OSError) as err: raise ConnectionError(err, request=request) except MaxRetryError as e: if isinstance(e.reason, ConnectTimeoutError): # TODO: Remove this in 3.0.0: see #2811 if not isinstance(e.reason, NewConnectionError): raise ConnectTimeout(e, request=request) if isinstance(e.reason, ResponseError): raise RetryError(e, request=request) if isinstance(e.reason, _ProxyError): raise ProxyError(e, request=request) if isinstance(e.reason, _SSLError): # This branch is for urllib3 v1.22 and later. raise SSLError(e, request=request) raise ConnectionError(e, request=request) except ClosedPoolError as e: raise ConnectionError(e, request=request) except _ProxyError as e: raise ProxyError(e) except (_SSLError, _HTTPError) as e: if isinstance(e, _SSLError): # This branch is for urllib3 versions earlier than v1.22 raise SSLError(e, request=request) elif isinstance(e, ReadTimeoutError): > raise ReadTimeout(e, request=request) E requests.exceptions.ReadTimeout: HTTPSConnectionPool(host='maas.apps.f2870b7c-a9d8-4ac1-a7a6-e5c9692c1c9c.prod.konfluxeaas.com', port=443): Read timed out. (read timeout=10) test/e2e/.venv/lib64/python3.9/site-packages/requests/adapters.py:690: ReadTimeoutself = <test_api_keys.TestAPIKeyRevocationE2E object at 0x7f4231822850> api_keys_base_url = 'https://maas.apps.f2870b7c-a9d8-4ac1-a7a6-e5c9692c1c9c.prod.konfluxeaas.com/maas-api/v1/api-keys' model_completions_url = 'https://maas.apps.f2870b7c-a9d8-4ac1-a7a6-e5c9692c1c9c.prod.konfluxeaas.com/llm/facebook-opt-125m-simulated/v1/completions' headers = {'Authorization': 'Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6ImtGdEVpY3pvaW9NRzMyUDh0STVuM3lFeWFrdzJsNkw2dWp2MXpEWXJvWWsifQ.e...BP6MA9Ia0TouXG9bf-zc36iNvAYl9sR5tMAlNgsJLkb0Sgxj07HqU7cBpNrTvBuriUaOozYDnJPW2Nwbg', 'Content-Type': 'application/json'} inference_model_name = 'facebook/opt-125m' def test_revoke_keys_rejected_at_gateway( self, api_keys_base_url: str, model_completions_url: str, headers: dict, inference_model_name: str, ): """After individually revoking keys, they should be rejected at the gateway.""" designated = SIMULATOR_SUBSCRIPTION # Create 3 keys, capturing plaintext and IDs keys = [] for i in range(3): r = requests.post( api_keys_base_url, headers=headers, json={"name": f"test-revoke-gw-{i}", "subscription": designated}, timeout=30, verify=TLS_VERIFY, ) assert r.status_code in (200, 201), f"Failed to create key {i}: {r.text}" keys.append({"id": r.json()["id"], "key": r.json()["key"]}) # Smoke-test: verify at least one key works before revocation r_smoke = requests.post( model_completions_url, headers={"Authorization": f"Bearer {keys[0]['key']}", "Content-Type": "application/json"}, json={"model": inference_model_name, "prompt": "Test", "max_tokens": 5}, timeout=60, verify=TLS_VERIFY, ) > assert r_smoke.status_code == 200, ( f"Key should work before revoke, got {r_smoke.status_code}: {r_smoke.text}" ) E AssertionError: Key should work before revoke, got 500: E assert 500 == 200 E + where 500 = <Response [500]>.status_code test/e2e/tests/test_api_keys.py:858: AssertionError/workspace/source/test/e2e/tests/test_namespace_scoping.py:212: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:245: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:283: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:320: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:377: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=true/workspace/source/test/e2e/tests/test_namespace_scoping.py:453: test_namespace_scoping validates single-tenant dormant mode; skipped when ENABLE_TENANT_NAMESPACE_DISCOVERY=trueself = <test_negative_security.TestHeaderSpoofing object at 0x7f4231a32430> def test_injected_identity_headers_ignored(self): """Client injects X-MaaS-Username/Group/Key-Id — platform ignores them. Validates that Authorino strips attacker-controlled identity headers. The request should succeed (200) using the real key-derived identity, proving the spoofed headers had no effect on authorization. """ api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) spoofed_headers = { "X-MaaS-Username": "cluster-admin", "X-MaaS-Group": "system:cluster-admins,system:masters", "X-MaaS-Key-Id": "fake-key-id-00000", } r = _inference(api_key, extra_headers=spoofed_headers) # Request succeeds with the REAL identity (API key owner), not the spoofed one. # If spoofed headers were honored, the test user would gain cluster-admin access. log.info("Spoofed identity headers -> %s", r.status_code) > assert r.status_code == 200, ( f"Expected 200 (spoofed headers stripped, real identity used), " f"got {r.status_code}: {r.text[:500]}" ) E AssertionError: Expected 200 (spoofed headers stripped, real identity used), got 500: E assert 500 == 200 E + where 500 = <Response [500]>.status_code test/e2e/tests/test_negative_security.py:96: AssertionErrorself = <test_negative_security.TestHeaderSpoofing object at 0x7f4231a320a0> def test_duplicate_subscription_headers_ignored(self): """Client sends multiple X-MaaS-Subscription headers — API key binding wins. For API key requests, the subscription is fixed at mint time. Duplicate or conflicting X-MaaS-Subscription headers must not override the key-derived subscription. """ api_key = _create_api_key(_get_cluster_token(), subscription=SIMULATOR_SUBSCRIPTION) # Use http.client to send genuinely duplicate X-MaaS-Subscription headers. # The requests library uses a dict for headers, so it cannot send two # headers with the same name — the second value overwrites the first. gateway = _gateway_url() parsed = urlparse(gateway) path = f"{MODEL_PATH}/v1/completions" body = json.dumps({"model": MODEL_NAME, "prompt": "Hello", "max_tokens": 3}) if parsed.scheme == "https": ctx = ssl.create_default_context() if not TLS_VERIFY: ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE conn = http.client.HTTPSConnection( parsed.hostname, parsed.port or 443, timeout=TIMEOUT, context=ctx, ) else: conn = http.client.HTTPConnection( parsed.hostname, parsed.port or 80, timeout=TIMEOUT, ) # Two separate X-MaaS-Subscription header lines headers = [ ("Authorization", f"Bearer {api_key}"), ("Content-Type", "application/json"), ("X-MaaS-Subscription", SIMULATOR_SUBSCRIPTION), ("X-MaaS-Subscription", "nonexistent-fake-sub"), ] conn.putrequest("POST", path) for key, value in headers: conn.putheader(key, value) conn.putheader("Content-Length", str(len(body))) conn.endheaders(body.encode()) resp = conn.getresponse() status = resp.status resp_body = resp.read().decode(errors="replace") conn.close() # API key binding wins — request succeeds with key-derived subscription. log.info("Duplicate X-MaaS-Subscription headers -> %s", status) > assert status == 200, ( f"Expected 200 (API key subscription binding wins over duplicate headers), " f"got {status}: {resp_body[:500]}" ) E AssertionError: Expected 200 (API key subscription binding wins over duplicate headers), got 500: E assert 500 == 200 test/e2e/tests/test_negative_security.py:152: AssertionError