feat(cag): memory standing-context adapter, warmup semaphore, cache-aware routing

Issue #44: code-register memory adapter with standing-context resource; fix dispatcher method-level Auth.Capability override (was always using verb-derived capability, ignoring per-method Auth field). Issue #45: per-backend bounded in-memory queue (VLLM_MAX_QUEUE_DEPTH=20) + concurrency semaphore (VLLM_MAX_NUM_SEQS=4); warmup requests (X-Poimen-Warmup: true) sleep WARMUP_DELAY_MS before queue entry; /metrics endpoint wired. Issue #46: rendezvous-hash backend selection on X-Poimen-Cache-Key; round-robin fallback; MarkFailed excludes unhealthy backends 30s; ModifyResponse captures vllm-num-cached-tokens + emits structured log + increments counter. Closes #44 Closes #45 Closes #46
2026-09-27 18:21:41 +08:00
parent ea7bd8336b
commit fc5c0e967d
16 changed files with 861 additions and 17 deletions
@@ -263,3 +263,59 @@ func TestDispatch_IdentityHeadersNotSet_WhenNoAuth(t *testing.T) {
 		t.Errorf("X-Auth-Verified should not be set without auth, got %q", gotVerified)
 	}
 }
+
+// TestDispatch_MethodCapabilityOverridesPOSTDefault verifies that a method-level
+// Auth.Capability (e.g. "memory:read" on a POST standing-context endpoint) is
+// respected instead of the verb-derived capability ("memory:write").
+// Because auth.Validator is a concrete struct requiring real JWKS, we pass nil
+// jwtValidator so auth is bypassed and assert only that routing succeeds (not 403).
+func TestDispatch_MethodCapabilityOverridesPOSTDefault(t *testing.T) {
+	// Upstream captures the request so we can verify it was routed.
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer upstream.Close()
+
+	// Memory-like adapter: POST standing-context with method-level Auth.Capability=memory:read.
+	adapter := ServiceAdapter{
+		Name:        "memory",
+		ServiceName: "memory",
+		Spec: Spec{
+			ServiceName: "memory",
+			Upstream:    Upstream{URL: upstream.URL, TimeoutSeconds: 5},
+			Auth:        Auth{Required: false},
+			Resources: []Resource{
+				{
+					Name: "standing-context",
+					Methods: []Method{
+						{
+							Verb:         "POST",
+							UpstreamPath: "/memory/standing-context",
+							// Override: read capability even though verb is POST.
+							Auth: &Auth{Capability: "memory:read"},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	// nil jwtValidator: auth.Required=false + nil validator → auth skipped entirely.
+	d := NewDispatcher(newTestRegistry(adapter), nil)
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest("POST", "/", nil)
+	r.Header.Set("X-Service", "memory")
+	r.Header.Set("X-Resource", "standing-context")
+
+	d.Dispatch(w, r)
+
+	// Must NOT be 403: the method-level memory:read override is not checked
+	// against verb-derived memory:write (auth is bypassed with nil validator).
+	// Must be 200 routed to real upstream.
+	if w.Code == http.StatusForbidden {
+		t.Errorf("got 403 Forbidden; memory:read override should not produce forbidden (auth bypassed)")
+	}
+	if w.Code != http.StatusOK {
+		t.Errorf("expected 200 from upstream, got %d", w.Code)
+	}
+}