const test = require('node:test'); const assert = require('node:assert/strict'); test('Piper model and config requests use the same-origin voice mirror', async () => { const {localPiperModelUrl} = await import('../piper-model-routing.mjs'); const origin = 'https://ai-spel.k3s.k0.nu'; assert.equal( localPiperModelUrl('https://huggingface.co/diffusionstudio/piper-voices/resolve/main/sv/sv_SE/nst/medium/sv_SE-nst-medium.onnx', origin), 'https://ai-spel.k3s.k0.nu/tts/piper-wasm-v1/voices/sv/sv_SE/nst/medium/sv_SE-nst-medium.onnx', ); assert.equal( localPiperModelUrl('https://huggingface.co/diffusionstudio/piper-voices/resolve/main/sv/sv_SE/lisa/medium/sv_SE-lisa-medium.onnx.json', origin), 'https://ai-spel.k3s.k0.nu/tts/piper-wasm-v1/voices/sv/sv_SE/lisa/medium/sv_SE-lisa-medium.onnx.json', ); }); test('Piper model routing leaves unrelated URLs alone and rejects traversal paths', async () => { const {localPiperModelUrl} = await import('../piper-model-routing.mjs'); const origin = 'https://ai-spel.k3s.k0.nu'; assert.equal(localPiperModelUrl('https://example.com/model.onnx', origin), null); assert.equal(localPiperModelUrl('https://huggingface.co.evil.test/diffusionstudio/piper-voices/resolve/main/model.onnx', origin), null); assert.equal(localPiperModelUrl('https://huggingface.co/diffusionstudio/piper-voices/resolve/main/../secret', origin), null); });