fix: add stream close check, recover regression test assertions, and secure credentials type check

backend/test_sync_upstream_models.py

@@ -70,6 +70,8 @@ def test_sync_upstream_models_original_json_endpoint(db_session, monkeypatch):
     db_session.add(key2)
     db_session.commit()
 
+    updates_recorded = []
+
     class FakeClient:
         def __init__(self, *args, **kwargs):
             pass
@@ -79,13 +81,23 @@ def test_sync_upstream_models_original_json_endpoint(db_session, monkeypatch):
             pass
         def list_accounts(self):
             return [
-                {"id": "1", "name": "Account 1", "credentials": {"base_url": "old"}},
+                {
+                    "id": "1", 
+                    "name": "Account 1", 
+                    "credentials": {
+                        "base_url": "old",
+                        "access_token": "secret_access_token",  # Sensitive credential
+                        "api_key": "some_api_key",               # Sensitive credential
+                        "openai_capabilities": "some_capabilities",  # Non-sensitive field
+                        "compact_model_mapping": "some_mapping",    # Non-sensitive field
+                    }
+                },
                 {"id": "2", "name": "Account 2", "credentials": {"base_url": "old"}}
             ]
         def extract_id(self, val):
             return val["id"]
         def update_account(self, aid, data):
-            pass
+            updates_recorded.append((aid, data))
         def sync_account_upstream_models(self, aid):
             if aid == "1":
                 return ["gpt-4", "gpt-3.5"]
@@ -118,6 +130,29 @@ def test_sync_upstream_models_original_json_endpoint(db_session, monkeypatch):
 
         assert items_map["2"]["status"] == "failed"
         assert items_map["2"]["model_count"] == 0
+
+        # Verify update payload regression safety
+        # Account 1 should be updated twice (first to fix base_url, second to set model_mapping)
+        acc1_updates = [up for up in updates_recorded if up[0] == "1"]
+        assert len(acc1_updates) == 2
+
+        # 1. First update to fix base_url
+        payload1 = acc1_updates[0][1]["credentials"]
+        assert payload1["base_url"] == "http://up1.api"
+        assert "access_token" not in payload1
+        assert "api_key" not in payload1
+        assert payload1["openai_capabilities"] == "some_capabilities"
+        assert payload1["compact_model_mapping"] == "some_mapping"
+
+        # 2. Second update to write back model_mapping
+        payload2 = acc1_updates[1][1]["credentials"]
+        assert payload2["base_url"] == "http://up1.api"
+        assert "access_token" not in payload2
+        assert "api_key" not in payload2
+        assert payload2["openai_capabilities"] == "some_capabilities"
+        assert payload2["compact_model_mapping"] == "some_mapping"
+        assert payload2["model_mapping"] == {"gpt-3.5": "gpt-3.5", "gpt-4": "gpt-4"}
+
     finally:
         app.dependency_overrides.clear()
 
@@ -163,6 +198,8 @@ def test_sync_upstream_models_streaming_endpoint(db_session, monkeypatch):
     db_session.add(key2)
     db_session.commit()
 
+    updates_recorded = []
+
     class FakeClient:
         def __init__(self, *args, **kwargs):
             pass
@@ -172,13 +209,23 @@ def test_sync_upstream_models_streaming_endpoint(db_session, monkeypatch):
             pass
         def list_accounts(self):
             return [
-                {"id": "1", "name": "Account 1", "credentials": {"base_url": "old"}},
+                {
+                    "id": "1", 
+                    "name": "Account 1", 
+                    "credentials": {
+                        "base_url": "old",
+                        "access_token": "secret_access_token",  # Sensitive credential
+                        "api_key": "some_api_key",               # Sensitive credential
+                        "openai_capabilities": "some_capabilities",  # Non-sensitive field
+                        "compact_model_mapping": "some_mapping",    # Non-sensitive field
+                    }
+                },
                 {"id": "2", "name": "Account 2", "credentials": {"base_url": "old"}}
             ]
         def extract_id(self, val):
             return val["id"]
         def update_account(self, aid, data):
-            pass
+            updates_recorded.append((aid, data))
         def sync_account_upstream_models(self, aid):
             if aid == "1":
                 return ["gpt-4", "gpt-3.5"]
@@ -223,6 +270,26 @@ def test_sync_upstream_models_streaming_endpoint(db_session, monkeypatch):
         assert parsed_events[3]["event"] == "complete"
         assert parsed_events[3]["data"]["success"] is False
         assert len(parsed_events[3]["data"]["items"]) == 2
+
+        # Verify update payload regression safety for stream
+        acc1_updates = [up for up in updates_recorded if up[0] == "1"]
+        assert len(acc1_updates) == 2
+
+        # First update to fix base_url
+        payload1 = acc1_updates[0][1]["credentials"]
+        assert payload1["base_url"] == "http://up1.api"
+        assert "access_token" not in payload1
+        assert "api_key" not in payload1
+        assert payload1["openai_capabilities"] == "some_capabilities"
+
+        # Second update to write back model_mapping
+        payload2 = acc1_updates[1][1]["credentials"]
+        assert payload2["base_url"] == "http://up1.api"
+        assert "access_token" not in payload2
+        assert "api_key" not in payload2
+        assert payload2["openai_capabilities"] == "some_capabilities"
+        assert payload2["model_mapping"] == {"gpt-3.5": "gpt-3.5", "gpt-4": "gpt-4"}
+
     finally:
         app.dependency_overrides.clear()