Files
coder/aibridge/config/config.go
T
Susana Ferreira b6dacb4a3c feat: add automatic key failover for AI Bridge OpenAI (#24847)
## Description

Adds automatic key failover for centralized OpenAI provider, covering both chat completions and responses APIs. Same shape as the Anthropic PR: each upstream call walks the configured key pool, keys are marked **temporary** on 429 (with cooldown from `Retry-After`) and **permanent** on 401/403. Each agentic-loop iteration gets its own fresh walker so a tool-call continuation can fail over independently of the initial request.

BYOK is unchanged: BYOK requests run as a single attempt with no failover.

## Changes

- `config.OpenAI` carries a `KeyPool`. `Key` remains for BYOK Authorization Bearer set per interception.
- Chat completions blocking interceptor: walks the pool via `newChatCompletionWithKeyFailover`, marks keys on key-specific failures, returns on first success or non-failover error.
- Chat completions streaming interceptor: per-iteration walker. Pre-stream failures fail over to the next key; mid-stream errors are relayed as SSE events.
- Responses blocking interceptor: extracts `newResponseWithKeyFailover` parallel to chatcompletions.
- Responses streaming interceptor: per-iteration walker, retains the existing buffer-then-forward design.

## Related Issues

Related to: https://github.com/coder/internal/issues/1446
Related to: https://linear.app/codercom/issue/AIGOV-197/aibridge-automatic-key-failover-for-bridged-and-passthrough-routes

## Follow-up PRs

- Bedrock multi-key support.
- Refactor provider vs interceptor config separation.
- Record the actually-used key in the interception credential hint after failover.

> [!NOTE]
> Initially generated by Claude Opus 4.7, modified and reviewed by @ssncferreira
2026-05-07 15:35:46 +01:00

110 lines
3.6 KiB
Go

package config
import (
"time"
"github.com/coder/coder/v2/aibridge/keypool"
)
const (
ProviderAnthropic = "anthropic"
ProviderOpenAI = "openai"
ProviderCopilot = "copilot"
)
// Anthropic carries configuration for an Anthropic provider.
//
// Authentication is mutually exclusive across these three fields,
// set per interception in the provider's CreateInterceptor:
// - KeyPool: centralized requests with automatic key failover.
// - Key: BYOK with X-Api-Key (single attempt, no failover).
// - BYOKBearerToken: BYOK with Authorization Bearer (single
// attempt, no failover).
//
// TODO(ssncferreira): consolidate the three authentication
// fields into a single abstraction per
// https://github.com/coder/aibridge/issues/266.
type Anthropic struct {
// Name is the provider instance name. If empty, defaults to "anthropic".
Name string
BaseURL string
Key string
KeyPool *keypool.Pool
APIDumpDir string
CircuitBreaker *CircuitBreaker
SendActorHeaders bool
ExtraHeaders map[string]string
// BYOKBearerToken is set in BYOK mode when the user authenticates
// with a access token. When set, the access token is used for upstream
// LLM requests instead of the API key.
BYOKBearerToken string
}
type AWSBedrock struct {
Region string
AccessKey, AccessKeySecret string
Model, SmallFastModel string
// If set, requests will be sent to this URL instead of the default AWS Bedrock endpoint
// (https://bedrock-runtime.{region}.amazonaws.com).
// This is useful for routing requests through a proxy or for testing.
BaseURL string
}
// OpenAI carries configuration for an OpenAI provider.
//
// Authentication is mutually exclusive across these two fields,
// set per interception in the provider's CreateInterceptor:
// - KeyPool: centralized requests with automatic key failover.
// - Key: BYOK with Authorization Bearer (single attempt, no
// failover).
//
// TODO(ssncferreira): consolidate the authentication fields per
// https://github.com/coder/aibridge/issues/266.
type OpenAI struct {
// Name is the provider instance name. If empty, defaults to "openai".
Name string
BaseURL string
Key string
KeyPool *keypool.Pool
APIDumpDir string
CircuitBreaker *CircuitBreaker
SendActorHeaders bool
ExtraHeaders map[string]string
}
type Copilot struct {
// Name is the provider instance name. If empty, defaults to "copilot".
Name string
BaseURL string
APIDumpDir string
CircuitBreaker *CircuitBreaker
}
// CircuitBreaker holds configuration for circuit breakers.
type CircuitBreaker struct {
// MaxRequests is the maximum number of requests allowed in half-open state.
MaxRequests uint32
// Interval is the cyclic period of the closed state for clearing internal counts.
Interval time.Duration
// Timeout is how long the circuit stays open before transitioning to half-open.
Timeout time.Duration
// FailureThreshold is the number of consecutive failures that triggers the circuit to open.
FailureThreshold uint32
// IsFailure determines if a status code should count as a failure.
// If nil, defaults to DefaultIsFailure.
IsFailure func(statusCode int) bool
// OpenErrorResponse returns the response body when the circuit is open.
// This should match the provider's error format.
OpenErrorResponse func() []byte
}
// DefaultCircuitBreaker returns sensible defaults for circuit breaker configuration.
func DefaultCircuitBreaker() CircuitBreaker {
return CircuitBreaker{
FailureThreshold: 5,
Interval: 10 * time.Second,
Timeout: 30 * time.Second,
MaxRequests: 3,
}
}