From 54f268c81b7ab1a879f30bc4db740b656a4e0ea2 Mon Sep 17 00:00:00 2001
From: Jeffery <h3285@evertrust.com.tw>
Date: Tue, 23 Jun 2026 13:07:27 +0800
Subject: [PATCH] =?UTF-8?q?test(ai-review=20=E4=BD=BF=E7=94=A8=E9=87=8F):?=
 =?UTF-8?q?=20=E8=A3=9C=E5=81=BD=E9=80=A0=20hostname=20=E4=B8=8D=E6=B4=A9?=
 =?UTF-8?q?=20key=20=E8=88=87=20total=20token=200=20=E6=B8=AC=E8=A9=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/usage.test.js | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/app/usage.test.js b/app/usage.test.js
index 165593b..fb5adf6 100644
--- a/app/usage.test.js
+++ b/app/usage.test.js
@@ -40,6 +40,11 @@ describe('extractUsage', () => {
     assert.deepEqual(u, { promptTokens: 7, completionTokens: 3, totalTokens: 10 });
   });
 
+  it('respects an explicit total_tokens of 0 instead of summing', () => {
+    const u = extractUsage({ usage: { prompt_tokens: 10, completion_tokens: 2, total_tokens: 0 } });
+    assert.equal(u.totalTokens, 0);
+  });
+
   it('returns null when no usage info is present', () => {
     assert.equal(extractUsage({ choices: [{ message: { content: 'hi' } }] }), null);
     assert.equal(extractUsage(null), null);
@@ -86,6 +91,22 @@ describe('fetchAccountQuota', () => {
     assert.match(q.reason, /API key 無法取得/);
   });
 
+  it('does not treat spoofed openrouter hostnames as OpenRouter (no key leak)', async () => {
+    const get = async () => { throw new Error('should not be called for spoofed host'); };
+    for (const baseURL of ['https://openrouter.ai.evil.com/api/v1', 'https://evil.com/openrouter.ai']) {
+      const q = await fetchAccountQuota('openai', { apiKeys: ['sk-secret'], baseURL }, { get });
+      assert.equal(q.available, false);
+      assert.match(q.reason, /API key 無法取得/);
+    }
+  });
+
+  it('accepts a real openrouter subdomain', async () => {
+    const get = async () => ({ data: { data: { usage: 1, limit: 10, limit_remaining: 9 } } });
+    const q = await fetchAccountQuota('openai', { apiKeys: ['k'], baseURL: 'https://api.openrouter.ai/api/v1' }, { get });
+    assert.equal(q.available, true);
+    assert.equal(q.source, 'openrouter');
+  });
+
   it('reports 不適用 for local platforms', async () => {
     assert.equal((await fetchAccountQuota('ollama', {})).available, false);
     assert.equal((await fetchAccountQuota('opencode', {})).available, false);