mirror of
https://github.com/coder/coder.git
synced 2026-09-22 05:05:20 +08:00
Closes [AIGOV-455](https://linear.app/codercom/issue/AIGOV-455/extend-drpc-with-buildproviders). ## Why The AI Gateway (`aibridged`) is being split into a standalone process that must not touch the database. `coderd` stays the source of truth and seeds the `ai_providers` / `ai_provider_keys` tables from the environment. This PR adds a DRPC call so the gateway fetches provider config from `coderd` instead of reading the DB, for both the embedded and standalone daemons. ## What - **Proto:** new `ProviderConfigurator` service with a unary `GetAIProviders` RPC, plus `AIProvider` / `AIProviderBedrock` messages. `CurrentMinor` bumped to 1 (additive). - **Server (`coderd/aibridgedserver`):** `GetAIProviders` runs a read-only `InTx` under `LockIDAIProvidersEnvSeed` so it never returns a mid-seed snapshot, reads providers (incl. disabled) plus keys for enabled ones, and maps to proto under `dbauthz.AsAIBridged`. Unmappable rows are skipped and logged; plaintext keys and Bedrock secrets are never logged. - **Client:** `DRPCProviderConfiguratorClient` wired into the client union, `dialer.go`, and `CreateInMemoryAIBridgeServer`. - **cli:** `BuildProvidersFromProto` maps the response through the existing DB-neutral `buildProvider`. A shared `poolRPCReloader` does the fetch/build/replace for both daemons: the embedded daemon reloads on every `ai_providers` change and fails startup if it cannot subscribe; the standalone gateway drives the same reloader once at startup, retrying until success and staying interruptible. - **Dead code removed:** `BuildProvidersFromConfig`, `ProvidersFromConfig`, `AIProviderFromConfig`, and the DB-read `BuildProviders` path.
113 lines
4.3 KiB
Go
113 lines
4.3 KiB
Go
package coderd
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"io"
|
|
"net/http"
|
|
|
|
"storj.io/drpc/drpcmux"
|
|
"storj.io/drpc/drpcserver"
|
|
|
|
"cdr.dev/slog/v3"
|
|
agplaibridge "github.com/coder/coder/v2/coderd/aibridge"
|
|
"github.com/coder/coder/v2/coderd/aibridged"
|
|
aibridgedproto "github.com/coder/coder/v2/coderd/aibridged/proto"
|
|
"github.com/coder/coder/v2/coderd/aibridgedserver"
|
|
"github.com/coder/coder/v2/coderd/tracing"
|
|
"github.com/coder/coder/v2/codersdk/drpcsdk"
|
|
)
|
|
|
|
// AIGatewayHandler returns the in-memory AI Gateway HTTP handler
|
|
// set by [API.RegisterInMemoryAIBridgedHTTPHandler], or nil if the daemon
|
|
// has not been wired in. Callers must apply their own [http.StripPrefix]
|
|
// for the route prefix they are mounting under.
|
|
func (api *API) AIGatewayHandler() http.Handler {
|
|
return api.aiGatewayHandler
|
|
}
|
|
|
|
// RegisterInMemoryAIBridgedHTTPHandler mounts [aibridged.Server]'s HTTP router onto
|
|
// [API]'s router, so that requests to aibridged will be relayed from Coder's API server
|
|
// to the in-memory aibridged.
|
|
//
|
|
// This also registers an in-process [agplaibridge.TransportFactory] so that
|
|
// chatd can route coder-agent LLM traffic through aibridge without crossing
|
|
// the HTTP route. No license entitlement gate is applied at the factory layer:
|
|
// the entitlement check stays on the HTTP route for external callers, while
|
|
// in-process coder-agent traffic is the explicit carve-out.
|
|
func (api *API) RegisterInMemoryAIBridgedHTTPHandler(srv http.Handler) {
|
|
if srv == nil {
|
|
panic("aibridged cannot be nil")
|
|
}
|
|
|
|
api.aiGatewayHandler = srv
|
|
|
|
factory := aibridged.NewTransportFactory(http.StripPrefix(agplaibridge.AIGatewayRootPath, srv))
|
|
var asInterface agplaibridge.TransportFactory = factory
|
|
api.AIBridgeTransportFactory.Store(&asInterface)
|
|
}
|
|
|
|
// CreateInMemoryAIBridgeServer creates a [aibridged.DRPCServer] and returns a
|
|
// [aibridged.DRPCClient] to it, connected over an in-memory transport.
|
|
// This server is responsible for all the Coder-specific functionality that aibridged
|
|
// requires such as persistence and retrieving configuration.
|
|
func (api *API) CreateInMemoryAIBridgeServer(dialCtx context.Context) (client aibridged.DRPCClient, err error) {
|
|
// TODO(dannyk): implement options.
|
|
// TODO(dannyk): implement tracing.
|
|
// TODO(dannyk): implement API versioning.
|
|
|
|
clientSession, serverSession := drpcsdk.MemTransportPipe()
|
|
defer func() {
|
|
if err != nil {
|
|
_ = clientSession.Close()
|
|
_ = serverSession.Close()
|
|
}
|
|
}()
|
|
|
|
mux := drpcmux.New()
|
|
srv, err := aibridgedserver.NewServer(api.ctx, api.Database, api.Logger.Named("aibridgedserver"),
|
|
api.AccessURL.String(), api.DeploymentValues.AI.BridgeConfig, api.ExternalAuthConfigs, api.Experiments, api.AISeatTracker)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if err := aibridgedserver.Register(mux, srv); err != nil {
|
|
return nil, err
|
|
}
|
|
server := drpcserver.NewWithOptions(&tracing.DRPCHandler{Handler: mux},
|
|
drpcserver.Options{
|
|
Manager: drpcsdk.DefaultDRPCOptions(nil),
|
|
Log: func(err error) {
|
|
if errors.Is(err, io.EOF) {
|
|
return
|
|
}
|
|
api.Logger.Debug(dialCtx, "aibridged drpc server error", slog.Error(err))
|
|
},
|
|
},
|
|
)
|
|
// in-mem pipes aren't technically "websockets" but they have the same properties as far as the
|
|
// API is concerned: they are long-lived connections that we need to close before completing
|
|
// shutdown of the API.
|
|
api.WebsocketWaitMutex.Lock()
|
|
api.WebsocketWaitGroup.Add(1)
|
|
api.WebsocketWaitMutex.Unlock()
|
|
go func() {
|
|
defer api.WebsocketWaitGroup.Done()
|
|
// Here we pass the background context, since we want the server to keep serving until the
|
|
// client hangs up. The aibridged is local, in-mem, so there isn't a danger of losing contact with it and
|
|
// having a dead connection we don't know the status of.
|
|
err := server.Serve(context.Background(), serverSession)
|
|
api.Logger.Info(dialCtx, "aibridge daemon disconnected", slog.Error(err))
|
|
// Close the sessions, so we don't leak goroutines serving them.
|
|
_ = clientSession.Close()
|
|
_ = serverSession.Close()
|
|
}()
|
|
|
|
return &aibridged.Client{
|
|
Conn: clientSession,
|
|
DRPCRecorderClient: aibridgedproto.NewDRPCRecorderClient(clientSession),
|
|
DRPCMCPConfiguratorClient: aibridgedproto.NewDRPCMCPConfiguratorClient(clientSession),
|
|
DRPCAuthorizerClient: aibridgedproto.NewDRPCAuthorizerClient(clientSession),
|
|
DRPCProviderConfiguratorClient: aibridgedproto.NewDRPCProviderConfiguratorClient(clientSession),
|
|
}, nil
|
|
}
|