fix(vertex): add API Key auth for Vertex Raw Express Mode and fix tok… (#3695)

plugins/wasm-go/extensions/ai-proxy/provider/vertex_test.go

@@ -8,6 +8,42 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestAppendOrReplaceAPIKey(t *testing.T) {
+	t.Run("empty apiKey returns path unchanged", func(t *testing.T) {
+		path := "/v1/publishers/google/models/gemini:generateContent"
+		assert.Equal(t, path, appendOrReplaceAPIKey(path, ""))
+	})
+
+	t.Run("path without query appends ?key=", func(t *testing.T) {
+		result := appendOrReplaceAPIKey("/v1/models/gemini:generateContent", "my-key")
+		assert.Equal(t, "/v1/models/gemini:generateContent?key=my-key", result)
+	})
+
+	t.Run("path with existing query appends &key=", func(t *testing.T) {
+		result := appendOrReplaceAPIKey("/v1/models/gemini:streamGenerateContent?alt=sse", "my-key")
+		assert.Contains(t, result, "alt=sse")
+		assert.Contains(t, result, "key=my-key")
+	})
+
+	t.Run("existing key parameter is replaced", func(t *testing.T) {
+		result := appendOrReplaceAPIKey("/v1/models/gemini:generateContent?key=old-key&trace=1", "new-key")
+		assert.Contains(t, result, "key=new-key")
+		assert.NotContains(t, result, "old-key")
+		assert.Contains(t, result, "trace=1")
+	})
+
+	t.Run("unparseable path without query falls back to ?key= append", func(t *testing.T) {
+		// A bare string with no leading slash is not a valid RequestURI
+		result := appendOrReplaceAPIKey("not-a-valid-uri", "my-key")
+		assert.Equal(t, "not-a-valid-uri?key=my-key", result)
+	})
+
+	t.Run("unparseable path with query falls back to &key= append", func(t *testing.T) {
+		result := appendOrReplaceAPIKey("not-a-valid-uri?foo=bar", "my-key")
+		assert.Equal(t, "not-a-valid-uri?foo=bar&key=my-key", result)
+	})
+}
+
 func TestVertexProviderBuildChatRequestStructuredOutputMapping(t *testing.T) {
 	t.Run("json_object response format", func(t *testing.T) {
 		v := &vertexProvider{}