mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
a86b8ab6f8
### Changes **coder/coder:** - `coderd/aibridge/aibridge.go` — Added `HeaderCoderBYOKToken` constant, `IsBYOK()` helper, and updated `ExtractAuthToken` to check the BYOK header first. - `enterprise/aibridged/http.go` — BYOK-aware header stripping: in BYOK mode only the BYOK header is stripped (user's LLM credentials preserved); in centralized mode all auth headers are stripped. <hr/> **NOTE**: `X-Coder-Token` was removed! As of now `ExtractAuthToken` retrieves token either from `X-Coder-AI-Governance-BYOK-Token` or from `Authorization`/`X-Api-Key`. --------- Co-authored-by: Susana Ferreira <susana@coder.com> Co-authored-by: Danny Kopping <danny@coder.com>
44 lines
1.6 KiB
Go
44 lines
1.6 KiB
Go
// Package aibridge provides utilities for the AI Bridge feature.
|
|
package aibridge
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
// HeaderCoderToken is a header set by clients opting into BYOK
|
|
// (Bring Your Own Key) mode. It carries the Coder token so
|
|
// that Authorization and X-Api-Key can carry the user's own LLM
|
|
// credentials. When present, AI Bridge forwards the user's LLM
|
|
// headers unchanged instead of injecting the centralized key.
|
|
//
|
|
// The AI Bridge proxy also sets this header automatically for clients
|
|
// that use per-user LLM credentials but cannot set custom headers.
|
|
const HeaderCoderToken = "X-Coder-AI-Governance-Token" //nolint:gosec // This is a header name, not a credential.
|
|
|
|
// IsBYOK reports whether the request is using BYOK mode, determined
|
|
// by the presence of the X-Coder-AI-Governance-Token header.
|
|
func IsBYOK(header http.Header) bool {
|
|
return strings.TrimSpace(header.Get(HeaderCoderToken)) != ""
|
|
}
|
|
|
|
// ExtractAuthToken extracts a token from HTTP headers.
|
|
// It checks the BYOK header first (set by clients opting into BYOK),
|
|
// then falls back to Authorization: Bearer and X-Api-Key for direct
|
|
// centralized mode. If none are present, an empty string is returned.
|
|
func ExtractAuthToken(header http.Header) string {
|
|
if token := strings.TrimSpace(header.Get(HeaderCoderToken)); token != "" {
|
|
return token
|
|
}
|
|
if auth := strings.TrimSpace(header.Get("Authorization")); auth != "" {
|
|
fields := strings.Fields(auth)
|
|
if len(fields) == 2 && strings.EqualFold(fields[0], "Bearer") {
|
|
return fields[1]
|
|
}
|
|
}
|
|
if apiKey := strings.TrimSpace(header.Get("X-Api-Key")); apiKey != "" {
|
|
return apiKey
|
|
}
|
|
return ""
|
|
}
|