auth

package
v7.2.87 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 41 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	AuthKindAPIKey = "apikey"
	AuthKindOAuth  = "oauth"

	AuthSourceConfig      = "config"
	AuthSourceFile        = "file"
	AuthSourceGit         = "git"
	AuthSourceMemory      = "memory"
	AuthSourceObjectStore = "objectstore"
	AuthSourcePostgres    = "postgres"

	AttributeAPIKey        = "api_key"
	AttributeAuthKind      = "auth_kind"
	AttributePath          = "path"
	AttributeRuntimeOnly   = "runtime_only"
	AttributeSource        = "source"
	AttributeSourceBackend = "source_backend"
)
View Source 
const (
	AttributeAuthIndexSeed = "auth_index_seed"
	AttributePluginVirtual = "plugin_virtual"
	AttributeVirtualSource = "virtual_source"
)
View Source 
const (

	// CloseAllExecutionSessionsID asks an executor to release all active execution sessions.
	// Executors that do not support this marker may ignore it.
	CloseAllExecutionSessionsID = "__all_execution_sessions__"
)

Variables

This section is empty.

Functions

func AntigravityCreditsRequested added in v7.2.49 

func AntigravityCreditsRequested(ctx context.Context) bool

AntigravityCreditsRequested reports whether the context carries the credits flag.

func ApplyCustomHeadersFromMetadata 

func ApplyCustomHeadersFromMetadata(auth *Auth)

func DefaultRuntimeSnapshotPath 

func DefaultRuntimeSnapshotPath(configFilePath string) string

func ExtractCustomHeadersFromMetadata 

func ExtractCustomHeadersFromMetadata(metadata map[string]any) map[string]string

func ExtractSessionID 

func ExtractSessionID(headers http.Header, payload []byte, metadata map[string]any) string

ExtractSessionID extracts a stable session identifier from request metadata, headers, or body.

func HasKnownAntigravityCreditsHint added in v7.2.49 

func HasKnownAntigravityCreditsHint(authID string) bool

HasKnownAntigravityCreditsHint reports whether credits state has been discovered for an auth.

func IsConfigAPIKeyAuth 

func IsConfigAPIKeyAuth(auth *Auth) bool

IsConfigAPIKeyAuth reports whether the auth entry is synthesized from config *-api-key lists. 仅识别“配置里显式配置的 API Key 账号”，排除 oauth/runtime 注入出来却碰巧带 api_key 字段的条目。

func IsPluginVirtualAuth added in v7.2.49 

func IsPluginVirtualAuth(auth *Auth) bool

IsPluginVirtualAuth reports whether an auth was expanded from a plugin-owned source file.

func IsRequestInterruptedError 

func IsRequestInterruptedError(err error) bool

IsRequestInterruptedError reports whether err represents a user/request cancellation rather than provider health.

func MarkPluginVirtualAuth added in v7.2.49 

func MarkPluginVirtualAuth(auth *Auth, sourcePath string, ordinal int)

MarkPluginVirtualAuth marks an auth that was expanded from a plugin-owned source file.

func OAuthModelAliasChannel 

func OAuthModelAliasChannel(provider, authKind string) string

OAuthModelAliasChannel returns the OAuth model alias channel name for a given provider and auth kind. Returns empty string if the provider/authKind combination doesn't support OAuth model alias (e.g., API key authentication).

Built-in channels: vertex, aistudio, antigravity, claude, codex, kimi. Plugin OAuth providers use their normalized provider key as the channel.

func OAuthModelAliasesFromAttributes added in v7.2.49 

func OAuthModelAliasesFromAttributes(attributes map[string]string) []internalconfig.OAuthModelAlias

OAuthModelAliasesFromAttributes returns sanitized per-auth OAuth model aliases from auth attributes.

func ProviderRefreshLead 

func ProviderRefreshLead(provider string, runtime any) *time.Duration

func RegisterRefreshLeadProvider 

func RegisterRefreshLeadProvider(provider string, factory func() *time.Duration)

func SaveRuntimeSnapshotToFile 

func SaveRuntimeSnapshotToFile(path string, snapshot RuntimeSnapshot) error

func SetAntigravityCreditsHint added in v7.2.49 

func SetAntigravityCreditsHint(authID string, hint AntigravityCreditsHint)

SetAntigravityCreditsHint updates the latest known AI credits state for an auth.

func SetOAuthModelAliasesAttribute added in v7.2.49 

func SetOAuthModelAliasesAttribute(auth *Auth, aliases []internalconfig.OAuthModelAlias)

SetOAuthModelAliasesAttribute stores sanitized per-auth OAuth model aliases on an auth entry.

func SetQuotaCooldownDisabled 

func SetQuotaCooldownDisabled(disable bool)

SetQuotaCooldownDisabled toggles quota cooldown scheduling globally.

func SetTransientErrorCooldownSeconds added in v7.2.49 

func SetTransientErrorCooldownSeconds(seconds int)

SetTransientErrorCooldownSeconds configures cooldowns for 408/500/502/503/504. 0 keeps the legacy default; negative values disable transient error cooldowns.

func WithAntigravityCredits added in v7.2.49 

func WithAntigravityCredits(ctx context.Context) context.Context

WithAntigravityCredits returns a child context that signals the executor to inject enabledCreditTypes into the request payload.

func WithDeferredAPIKeyModelAliasRebuild added in v7.2.49 

func WithDeferredAPIKeyModelAliasRebuild(ctx context.Context) context.Context

WithDeferredAPIKeyModelAliasRebuild returns a derived context that defers API-key model alias table rebuilds. Callers that use this for a batch of Register/Update/Remove operations must call RefreshAPIKeyModelAlias once.

func WithRequestInfo 

func WithRequestInfo(ctx context.Context, info *RequestInfo) context.Context

WithRequestInfo returns a new context with the given RequestInfo attached.

func WithSkipPersist 

func WithSkipPersist(ctx context.Context) context.Context

WithSkipPersist returns a derived context that disables persistence for Manager Update/Register calls. It is intended for code paths that are reacting to file watcher events, where the file on disk is already the source of truth and persisting again would create a write-back loop.

Types

type APIKeyConfigEntry 

type APIKeyConfigEntry interface {
	GetAPIKey() string
	GetBaseURL() string
}

APIKeyConfigEntry is a generic interface for API key configurations.

type AntigravityCreditsHint added in v7.2.49 

type AntigravityCreditsHint struct {
	Known           bool
	Available       bool
	CreditAmount    float64
	MinCreditAmount float64
	PaidTierID      string
	UpdatedAt       time.Time
}

AntigravityCreditsHint stores the latest known AI credits state for one auth.

func GetAntigravityCreditsHint added in v7.2.49 

func GetAntigravityCreditsHint(authID string) (AntigravityCreditsHint, bool)

GetAntigravityCreditsHint returns the latest known AI credits state for an auth.

func GetAntigravityCreditsHintRequired added in v7.2.49 

func GetAntigravityCreditsHintRequired(ctx context.Context, authID string) (AntigravityCreditsHint, bool, error)

GetAntigravityCreditsHintRequired returns the latest known AI credits state for request-time paths.

type Auth 

type Auth struct {
	// ID uniquely identifies the auth record across restarts.
	ID string `json:"id"`
	// Index is a stable runtime identifier derived from auth metadata (not persisted).
	Index string `json:"-"`
	// Provider is the upstream provider key (e.g. "gemini", "claude").
	Provider string `json:"provider"`
	// Prefix optionally namespaces models for routing (e.g., "teamA/gemini-3-pro-preview").
	Prefix string `json:"prefix,omitempty"`
	// FileName stores the relative or absolute path of the backing auth file.
	FileName string `json:"-"`
	// Storage holds the token persistence implementation used during login flows.
	Storage baseauth.TokenStorage `json:"-"`
	// Label is an optional human readable label for logging.
	Label string `json:"label,omitempty"`
	// Status is the lifecycle status managed by the AuthManager.
	Status Status `json:"status"`
	// StatusMessage holds a short description for the current status.
	StatusMessage string `json:"status_message,omitempty"`
	// Disabled indicates the auth is intentionally disabled by operator.
	Disabled bool `json:"disabled"`
	// Unavailable flags transient provider unavailability (e.g. quota exceeded).
	Unavailable bool `json:"unavailable"`
	// ProxyURL overrides the global proxy setting for this auth if provided.
	ProxyURL string `json:"proxy_url,omitempty"`
	// Attributes stores provider specific metadata needed by executors (immutable configuration).
	Attributes map[string]string `json:"attributes,omitempty"`
	// Metadata stores runtime mutable provider state (e.g. tokens, cookies).
	Metadata map[string]any `json:"metadata,omitempty"`
	// Quota captures recent quota information for load balancers.
	Quota QuotaState `json:"quota"`
	// LastError stores the last failure encountered while executing or refreshing.
	LastError *Error `json:"last_error,omitempty"`
	// CreatedAt is the creation timestamp in UTC.
	CreatedAt time.Time `json:"created_at"`
	// UpdatedAt is the last modification timestamp in UTC.
	UpdatedAt time.Time `json:"updated_at"`
	// LastRefreshedAt records the last successful refresh time in UTC.
	LastRefreshedAt time.Time `json:"last_refreshed_at"`
	// NextRefreshAfter is the earliest time a refresh should retrigger.
	NextRefreshAfter time.Time `json:"next_refresh_after"`
	// NextRetryAfter is the earliest time a retry should retrigger.
	NextRetryAfter time.Time `json:"next_retry_after"`
	// ModelStates tracks per-model runtime availability data.
	ModelStates map[string]*ModelState `json:"model_states,omitempty"`

	// Runtime carries non-serialisable data used during execution (in-memory only).
	Runtime any `json:"-"`

	// Success / Failed are lifetime success/failure counters used by the plugin
	// host when surfacing credential health to plugins. They are maintained
	// opportunistically and are not persisted to disk.
	Success int64 `json:"-"`
	Failed  int64 `json:"-"`
	// contains filtered or unexported fields
}

Auth encapsulates the runtime state and metadata associated with a single credential.

func (*Auth) AccountInfo 

func (a *Auth) AccountInfo() (string, string)

func (*Auth) AuthKind added in v7.2.49 

func (a *Auth) AuthKind() string

AuthKind returns the credential kind using explicit metadata first and legacy field-shape fallbacks second.

func (*Auth) AuthSourceKind added in v7.2.49 

func (a *Auth) AuthSourceKind() string

AuthSourceKind returns where the Auth entry came from at runtime.

func (*Auth) Clone 

func (a *Auth) Clone() *Auth

Clone shallow copies the Auth structure, duplicating maps to avoid accidental mutation.

func (*Auth) DisableCoolingOverride 

func (a *Auth) DisableCoolingOverride() (bool, bool)

DisableCoolingOverride returns the auth-file scoped disable_cooling override when present. The value is read from metadata key "disable_cooling" (or legacy "disable-cooling").

func (*Auth) EnsureIndex 

func (a *Auth) EnsureIndex() string

EnsureIndex returns a stable index derived from the auth file name or credential identity.

func (*Auth) ExpirationTime 

func (a *Auth) ExpirationTime() (time.Time, bool)

ExpirationTime attempts to extract the credential expiration timestamp from metadata. It inspects common keys such as "expired", "expire", "expires_at", and also nested "token" objects to remain compatible with legacy auth file formats.

func (*Auth) ProxyInfo 

func (a *Auth) ProxyInfo() string

func (*Auth) RecentRequestsSnapshot 

func (a *Auth) RecentRequestsSnapshot(now time.Time) []RecentRequestBucket

RecentRequestsSnapshot returns the most recent bucket window ending at now. Buckets that have no recorded activity for their interval are returned with zero counters so callers always receive a fixed-length series.

func (*Auth) RequestRetryOverride 

func (a *Auth) RequestRetryOverride() (int, bool)

RequestRetryOverride returns the auth-file scoped request_retry override when present. The value is read from metadata key "request_retry" (or legacy "request-retry").

func (*Auth) ToolPrefixDisabled 

func (a *Auth) ToolPrefixDisabled() bool

ToolPrefixDisabled returns whether the proxy_ tool name prefix should be skipped for this auth. When true, tool names are sent to Anthropic unchanged. The value is read from metadata key "tool_prefix_disabled" (or "tool-prefix-disabled").

type AuthRuntimeState 

type AuthRuntimeState struct {
	Status         Status                 `json:"status"`
	StatusMessage  string                 `json:"status_message,omitempty"`
	Unavailable    bool                   `json:"unavailable"`
	Quota          QuotaState             `json:"quota"`
	LastError      *Error                 `json:"last_error,omitempty"`
	UpdatedAt      time.Time              `json:"updated_at"`
	NextRetryAfter time.Time              `json:"next_retry_after"`
	ModelStates    map[string]*ModelState `json:"model_states,omitempty"`
}

func (*AuthRuntimeState) Clone 

func (r *AuthRuntimeState) Clone() *AuthRuntimeState

type CooldownStateRecord added in v7.2.49 

type CooldownStateRecord struct {
	Provider       string     `json:"provider,omitempty"`
	AuthID         string     `json:"auth_id"`
	AuthFile       string     `json:"-"`
	Model          string     `json:"model,omitempty"`
	Status         string     `json:"status,omitempty"`
	NextRetryAfter time.Time  `json:"next_retry_after"`
	Reason         string     `json:"reason,omitempty"`
	Quota          QuotaState `json:"quota,omitempty"`
	LastError      *Error     `json:"last_error,omitempty"`
	UpdatedAt      time.Time  `json:"updated_at"`
}

CooldownStateRecord is a persisted runtime cooldown snapshot for one auth/model pair.

type CooldownStateStore added in v7.2.49 

type CooldownStateStore interface {
	Load(context.Context) ([]CooldownStateRecord, error)
	Save(context.Context, []CooldownStateRecord) error
}

CooldownStateStore persists runtime cooldown state independently from auth tokens.

type Error 

type Error struct {
	// Code is a short machine readable identifier.
	Code string `json:"code,omitempty"`
	// Message is a human readable description of the failure.
	Message string `json:"message"`
	// Retryable indicates whether a retry might fix the issue automatically.
	Retryable bool `json:"retryable"`
	// HTTPStatus optionally records an HTTP-like status code for the error.
	HTTPStatus int `json:"http_status,omitempty"`
}

Error describes an authentication related failure in a provider agnostic format.

func (*Error) Error 

func (e *Error) Error() string

Error implements the error interface.

func (*Error) IsRequestScoped added in v7.2.59 

func (e *Error) IsRequestScoped() bool

IsRequestScoped reports whether the failure is tied to the current request rather than the selected credential.

func (*Error) StatusCode 

func (e *Error) StatusCode() int

StatusCode implements optional status accessor for manager decision making.

type ExecutionSessionCloser 

type ExecutionSessionCloser interface {
	CloseExecutionSession(sessionID string)
}

ExecutionSessionCloser allows executors to release per-session runtime resources.

type FileCooldownStateStore added in v7.2.49 

type FileCooldownStateStore struct {
	// contains filtered or unexported fields
}

FileCooldownStateStore stores cooldown state as one .cds file per auth.

func NewFileCooldownStateStore added in v7.2.49 

func NewFileCooldownStateStore(dir string) *FileCooldownStateStore

NewFileCooldownStateStore creates a file-backed cooldown state store rooted at dir.

func NewFileCooldownStateStoreWithAuthDir added in v7.2.49 

func NewFileCooldownStateStoreWithAuthDir(dir, authDir string) *FileCooldownStateStore

NewFileCooldownStateStoreWithAuthDir creates a store and derives per-auth .cds paths from auth files relative to authDir when possible.

func (*FileCooldownStateStore) Load added in v7.2.49 

func (s *FileCooldownStateStore) Load(ctx context.Context) ([]CooldownStateRecord, error)

Load reads all cooldown state files. A missing directory is treated as empty state.

func (*FileCooldownStateStore) Save added in v7.2.49 

func (s *FileCooldownStateStore) Save(ctx context.Context, records []CooldownStateRecord) error

Save atomically writes one cooldown state file per auth and removes stale files.

type FillFirstSelector 

type FillFirstSelector struct{}

FillFirstSelector selects the first available credential (deterministic ordering). This "burns" one account before moving to the next, which can help stagger rolling-window subscription caps (e.g. chat message limits).

func (*FillFirstSelector) Pick 

func (s *FillFirstSelector) Pick(ctx context.Context, provider, model string, opts cliproxyexecutor.Options, auths []*Auth) (*Auth, error)

Pick selects the first available auth for the provider in a deterministic manner.

type Hook 

type Hook interface {
	// OnAuthRegistered fires when a new auth is registered.
	OnAuthRegistered(ctx context.Context, auth *Auth)
	// OnAuthUpdated fires when an existing auth changes state.
	OnAuthUpdated(ctx context.Context, auth *Auth)
	// OnResult fires when execution result is recorded.
	OnResult(ctx context.Context, result Result)
}

Hook captures lifecycle callbacks for observing auth changes.

type Manager 

type Manager struct {
	// contains filtered or unexported fields
}

Manager orchestrates auth lifecycle, selection, execution, and persistence.

func NewManager 

func NewManager(store Store, selector Selector, hook Hook) *Manager

NewManager constructs a manager with optional custom selector and hook.

func (*Manager) ApplyRuntimeSnapshot 

func (m *Manager) ApplyRuntimeSnapshot(snapshot RuntimeSnapshot, now time.Time) []string

func (*Manager) AvailableProviders added in v7.2.49 

func (m *Manager) AvailableProviders() []string

AvailableProviders returns the set of provider keys that currently have at least one registered auth record that is not disabled. It is a best-effort snapshot for routing decisions and does not account for per-model cooldowns or transient runtime availability. Disabled auths (Disabled flag or StatusDisabled) are excluded so routing does not target providers that auth selection would refuse to use, which would otherwise cause execution failures instead of falling back to lower-priority routers.

func (*Manager) CloseExecutionSession 

func (m *Manager) CloseExecutionSession(sessionID string)

CloseExecutionSession asks all registered executors to release the supplied execution session.

func (*Manager) Execute 

func (m *Manager) Execute(ctx context.Context, providers []string, req cliproxyexecutor.Request, opts cliproxyexecutor.Options) (cliproxyexecutor.Response, error)

Execute performs a non-streaming execution using the configured selector and executor. It supports multiple providers for the same model and round-robins the starting provider per model.

func (*Manager) ExecuteCount 

func (m *Manager) ExecuteCount(ctx context.Context, providers []string, req cliproxyexecutor.Request, opts cliproxyexecutor.Options) (cliproxyexecutor.Response, error)

ExecuteCount performs a non-streaming execution using the configured selector and executor. It supports multiple providers for the same model and round-robins the starting provider per model.

func (*Manager) ExecuteStream 

func (m *Manager) ExecuteStream(ctx context.Context, providers []string, req cliproxyexecutor.Request, opts cliproxyexecutor.Options) (*cliproxyexecutor.StreamResult, error)

ExecuteStream performs a streaming execution using the configured selector and executor. It supports multiple providers for the same model and round-robins the starting provider per model.

func (*Manager) Executor 

func (m *Manager) Executor(provider string) (ProviderExecutor, bool)

Executor returns the registered provider executor for a provider key.

func (*Manager) ExportRuntimeSnapshot 

func (m *Manager) ExportRuntimeSnapshot(now time.Time) RuntimeSnapshot

func (*Manager) GetByID 

func (m *Manager) GetByID(id string) (*Auth, bool)

func (*Manager) GetExecutionSessionAuthByID 

func (m *Manager) GetExecutionSessionAuthByID(sessionID string, authID string) (*Auth, bool)

GetExecutionSessionAuthByID retrieves a Home runtime auth scoped to an execution session.

func (*Manager) HasProviderAuth added in v7.2.49 

func (m *Manager) HasProviderAuth(provider string) bool

HasProviderAuth reports whether at least one non-disabled auth record is registered for the provider. Disabled auths (Disabled flag or StatusDisabled) are excluded to match the behavior of auth selection, which refuses to pick disabled credentials.

func (*Manager) HomeEnabled 

func (m *Manager) HomeEnabled() bool

HomeEnabled reports whether the Home control plane integration is enabled in the runtime config.

func (*Manager) HttpRequest 

func (m *Manager) HttpRequest(ctx context.Context, auth *Auth, req *http.Request) (*http.Response, error)

HttpRequest injects provider credentials into the supplied HTTP request and executes it.

func (*Manager) InjectCredentials 

func (m *Manager) InjectCredentials(req *http.Request, authID string) error

InjectCredentials delegates per-provider HTTP request preparation when supported. If the registered executor for the auth provider implements RequestPreparer, it will be invoked to modify the request (e.g., add headers).

func (*Manager) List 

func (m *Manager) List() []*Auth

List returns all auth entries currently known by the manager.

func (*Manager) Load 

func (m *Manager) Load(ctx context.Context) error

Load resets manager state from the backing store.

func (*Manager) MarkResult 

func (m *Manager) MarkResult(ctx context.Context, result Result)

MarkResult records an execution result and notifies hooks.

func (*Manager) NewHttpRequest 

func (m *Manager) NewHttpRequest(ctx context.Context, auth *Auth, method, targetURL string, body []byte, headers http.Header) (*http.Request, error)

NewHttpRequest constructs a new HTTP request and injects provider credentials into it.

func (*Manager) PrepareHttpRequest 

func (m *Manager) PrepareHttpRequest(ctx context.Context, auth *Auth, req *http.Request) error

PrepareHttpRequest injects provider credentials into the supplied HTTP request.

func (*Manager) ReconcileRegistryModelStates 

func (m *Manager) ReconcileRegistryModelStates(ctx context.Context, authID string)

ReconcileRegistryModelStates aligns per-model runtime state with the current registry snapshot for one auth.

Supported models are reset to a clean state because re-registration already cleared the registry-side cooldown/suspension snapshot. ModelStates for models that are no longer present in the registry are pruned entirely so renamed/removed models cannot keep auth-level status stale.

func (*Manager) RefreshAPIKeyModelAlias added in v7.2.49 

func (m *Manager) RefreshAPIKeyModelAlias()

RefreshAPIKeyModelAlias rebuilds the API-key model alias table from the current runtime config.

func (*Manager) RefreshSchedulerAll added in v7.2.49 

func (m *Manager) RefreshSchedulerAll()

RefreshSchedulerAll rebuilds scheduler entries for every known auth.

func (*Manager) RefreshSchedulerEntry 

func (m *Manager) RefreshSchedulerEntry(authID string)

RefreshSchedulerEntry re-upserts a single auth into the scheduler so that its supportedModelSet is rebuilt from the current global model registry state. This must be called after models have been registered for a newly added auth, because the initial scheduler.upsertAuth during Register/Update runs before registerModelsForAuth and therefore snapshots an empty model set.

func (*Manager) Register 

func (m *Manager) Register(ctx context.Context, auth *Auth) (*Auth, error)

Register inserts a new auth entry into the manager.

func (*Manager) RegisterExecutor 

func (m *Manager) RegisterExecutor(executor ProviderExecutor)

RegisterExecutor registers a provider executor with the manager.

func (*Manager) Remove added in v7.2.49 

func (m *Manager) Remove(ctx context.Context, id string)

Remove deletes an auth from runtime state without persisting. Disk and token-store deletion must be handled by the caller.

func (*Manager) ResetQuota added in v7.2.49 

func (m *Manager) ResetQuota(ctx context.Context, authID string) (*Auth, []string, error)

ResetQuota clears quota/cooldown state for an auth and resumes registry routing.

func (*Manager) RestoreCooldownStates added in v7.2.49 

func (m *Manager) RestoreCooldownStates(ctx context.Context) error

RestoreCooldownStates restores unexpired persisted cooldown records into registered auths.

func (*Manager) SetConfig 

func (m *Manager) SetConfig(cfg *internalconfig.Config)

SetConfig updates the runtime config snapshot used by request-time helpers. Callers should provide the latest config on reload so per-credential alias mapping stays in sync.

func (*Manager) SetCooldownStateStore added in v7.2.49 

func (m *Manager) SetCooldownStateStore(store CooldownStateStore)

SetCooldownStateStore swaps the independent runtime cooldown state store.

func (*Manager) SetOAuthModelAlias 

func (m *Manager) SetOAuthModelAlias(aliases map[string][]internalconfig.OAuthModelAlias)

SetOAuthModelAlias updates the OAuth model name alias table used during execution. The alias is applied per-auth channel to resolve the upstream model name while keeping the client-visible model name unchanged for translation/response formatting.

func (*Manager) SetPluginScheduler 

func (m *Manager) SetPluginScheduler(scheduler PluginScheduler)

SetPluginScheduler installs the dynamic plugin scheduler used for plugin-owned providers.

func (*Manager) SetRetryConfig 

func (m *Manager) SetRetryConfig(retry int, maxRetryInterval time.Duration, maxRetryCredentials int)

SetRetryConfig updates retry attempts, credential retry limit and cooldown wait interval.

func (*Manager) SetRoundTripperProvider 

func (m *Manager) SetRoundTripperProvider(p RoundTripperProvider)

SetRoundTripperProvider register a provider that returns a per-auth RoundTripper.

func (*Manager) SetSelector 

func (m *Manager) SetSelector(selector Selector)

func (*Manager) SetStore 

func (m *Manager) SetStore(store Store)

SetStore swaps the underlying persistence store.

func (*Manager) StartAutoRefresh 

func (m *Manager) StartAutoRefresh(parent context.Context, interval time.Duration)

StartAutoRefresh launches a background loop that evaluates auth freshness every few seconds and triggers refresh operations when required. Only one loop is kept alive; starting a new one cancels the previous run.

func (*Manager) StopAutoRefresh 

func (m *Manager) StopAutoRefresh()

StopAutoRefresh cancels the background refresh loop, if running.

func (*Manager) UnregisterExecutor 

func (m *Manager) UnregisterExecutor(provider string)

UnregisterExecutor removes the executor associated with the provider key.

func (*Manager) Update 

func (m *Manager) Update(ctx context.Context, auth *Auth) (*Auth, error)

Update replaces an existing auth entry and notifies hooks.

type ModelState 

type ModelState struct {
	// Status reflects the lifecycle status for this model.
	Status Status `json:"status"`
	// StatusMessage provides an optional short description of the status.
	StatusMessage string `json:"status_message,omitempty"`
	// Unavailable mirrors whether the model is temporarily blocked for retries.
	Unavailable bool `json:"unavailable"`
	// NextRetryAfter defines the per-model retry time.
	NextRetryAfter time.Time `json:"next_retry_after"`
	// LastError records the latest error observed for this model.
	LastError *Error `json:"last_error,omitempty"`
	// Quota retains quota information if this model hit rate limits.
	Quota QuotaState `json:"quota"`
	// UpdatedAt tracks the last update timestamp for this model state.
	UpdatedAt time.Time `json:"updated_at"`
}

ModelState captures the execution state for a specific model under an auth entry.

func (*ModelState) Clone 

func (m *ModelState) Clone() *ModelState

Clone duplicates a model state including nested error details.

type NoopHook 

type NoopHook struct{}

NoopHook provides optional hook defaults.

func (NoopHook) OnAuthRegistered 

func (NoopHook) OnAuthRegistered(context.Context, *Auth)

OnAuthRegistered implements Hook.

func (NoopHook) OnAuthUpdated 

func (NoopHook) OnAuthUpdated(context.Context, *Auth)

OnAuthUpdated implements Hook.

func (NoopHook) OnResult 

func (NoopHook) OnResult(context.Context, Result)

OnResult implements Hook.

type OAuthModelAliasResult added in v7.2.49 

type OAuthModelAliasResult struct {
	UpstreamModel string // resolved upstream model name (empty if no mapping found)
	ForceMapping  bool   // whether to rewrite model name in responses
	OriginalAlias string // client-visible model for response rewrite; only applied when ForceMapping is true (see rewriteForceMappedResponse / wrapStreamResult)
}

OAuthModelAliasResult contains the resolved upstream model and mapping metadata.

type PluginScheduler 

type PluginScheduler interface {
	PickAuth(context.Context, pluginapi.SchedulerPickRequest) (pluginapi.SchedulerPickResponse, bool, error)
}

PluginScheduler lets dynamic plugins override auth selection for their providers.

type PostAuthHook 

type PostAuthHook func(context.Context, *Auth) error

PostAuthHook defines a function that is called after an Auth record is created but before it is persisted to storage. This allows for modification of the Auth record (e.g., injecting metadata) based on external context.

type ProviderExecutor 

type ProviderExecutor interface {
	// Identifier returns the provider key handled by this executor.
	Identifier() string
	// Execute handles non-streaming execution and returns the provider response payload.
	Execute(ctx context.Context, auth *Auth, req cliproxyexecutor.Request, opts cliproxyexecutor.Options) (cliproxyexecutor.Response, error)
	// ExecuteStream handles streaming execution and returns a StreamResult containing
	// upstream headers and a channel of provider chunks.
	ExecuteStream(ctx context.Context, auth *Auth, req cliproxyexecutor.Request, opts cliproxyexecutor.Options) (*cliproxyexecutor.StreamResult, error)
	// Refresh attempts to refresh provider credentials and returns the updated auth state.
	Refresh(ctx context.Context, auth *Auth) (*Auth, error)
	// CountTokens returns the token count for the given request.
	CountTokens(ctx context.Context, auth *Auth, req cliproxyexecutor.Request, opts cliproxyexecutor.Options) (cliproxyexecutor.Response, error)
	// HttpRequest injects provider credentials into the supplied HTTP request and executes it.
	// Callers must close the response body when non-nil.
	HttpRequest(ctx context.Context, auth *Auth, req *http.Request) (*http.Response, error)
}

ProviderExecutor defines the contract required by Manager to execute provider calls.

type QuotaState 

type QuotaState struct {
	// Exceeded indicates the credential recently hit a quota error.
	Exceeded bool `json:"exceeded"`
	// Reason provides an optional provider specific human readable description.
	Reason string `json:"reason,omitempty"`
	// NextRecoverAt is when the credential may become available again.
	NextRecoverAt time.Time `json:"next_recover_at"`
	// BackoffLevel stores the progressive cooldown exponent used for rate limits.
	BackoffLevel int `json:"backoff_level,omitempty"`
}

QuotaState contains limiter tracking data for a credential.

type RecentRequestBucket 

type RecentRequestBucket struct {
	Time    string `json:"time"`
	Success int64  `json:"success"`
	Failed  int64  `json:"failed"`
}

RecentRequestBucket is the exported snapshot entry returned by RecentRequestsSnapshot. Time is a human-readable local-clock label so the value can be displayed directly in management UIs.

type RefreshEvaluator 

type RefreshEvaluator interface {
	ShouldRefresh(now time.Time, auth *Auth) bool
}

RefreshEvaluator allows runtime state to override refresh decisions.

type RequestAuthPreparer 

type RequestAuthPreparer interface {
	ShouldPrepareRequestAuth(auth *Auth) bool
	PrepareRequestAuth(ctx context.Context, auth *Auth) (*Auth, error)
}

RequestAuthPreparer lets an executor update missing auth metadata immediately before a request.

type RequestInfo 

type RequestInfo struct {
	Query   url.Values
	Headers http.Header
}

RequestInfo holds information extracted from the HTTP request. It is injected into the context passed to PostAuthHook.

func GetRequestInfo 

func GetRequestInfo(ctx context.Context) *RequestInfo

GetRequestInfo retrieves the RequestInfo from the context, if present.

type RequestPreparer 

type RequestPreparer interface {
	PrepareRequest(req *http.Request, auth *Auth) error
}

RequestPreparer is an optional interface that provider executors can implement to mutate outbound HTTP requests with provider credentials.

type Result 

type Result struct {
	// AuthID references the auth that produced this result.
	AuthID string
	// Provider is copied for convenience when emitting hooks.
	Provider string
	// Model is the upstream model identifier used for the request.
	Model string
	// Success marks whether the execution succeeded.
	Success bool
	// RetryAfter carries a provider supplied retry hint (e.g. 429 retryDelay).
	RetryAfter *time.Duration
	// Error describes the failure when Success is false.
	Error *Error
}

Result captures execution outcome used to adjust auth state.

type RoundRobinSelector 

type RoundRobinSelector struct {
	// contains filtered or unexported fields
}

RoundRobinSelector provides a simple provider scoped round-robin selection strategy.

func (*RoundRobinSelector) Pick 

func (s *RoundRobinSelector) Pick(ctx context.Context, provider, model string, opts cliproxyexecutor.Options, auths []*Auth) (*Auth, error)

Pick selects the next available auth for the provider in a round-robin manner.

type RoundTripperProvider 

type RoundTripperProvider interface {
	RoundTripperFor(auth *Auth) http.RoundTripper
}

RoundTripperProvider defines a minimal provider of per-auth HTTP transports.

type RuntimeSnapshot 

type RuntimeSnapshot struct {
	Auths map[string]*AuthRuntimeState `json:"auths,omitempty"`
}

func LoadRuntimeSnapshotFromFile 

func LoadRuntimeSnapshotFromFile(path string) (RuntimeSnapshot, error)

func (RuntimeSnapshot) Clone 

func (s RuntimeSnapshot) Clone() RuntimeSnapshot

func (RuntimeSnapshot) Len 

func (s RuntimeSnapshot) Len() int

type Selector 

type Selector interface {
	Pick(ctx context.Context, provider, model string, opts cliproxyexecutor.Options, auths []*Auth) (*Auth, error)
}

Selector chooses an auth candidate for execution.

type Status 

type Status string

Status represents the lifecycle state of an Auth entry. 

const (
	// StatusUnknown means the auth state could not be determined.
	StatusUnknown Status = "unknown"
	// StatusActive indicates the auth is valid and ready for execution.
	StatusActive Status = "active"
	// StatusPending indicates the auth is waiting for an external action, such as MFA.
	StatusPending Status = "pending"
	// StatusRefreshing indicates the auth is undergoing a refresh flow.
	StatusRefreshing Status = "refreshing"
	// StatusError indicates the auth is temporarily unavailable due to errors.
	StatusError Status = "error"
	// StatusDisabled marks the auth as intentionally disabled.
	StatusDisabled Status = "disabled"
)

type StickyRoundRobinSelector 

type StickyRoundRobinSelector struct{ RoundRobinSelector }

StickyRoundRobinSelector enables scheduler-managed sticky affinity with round-robin fallback. The concrete sticky binding behavior is implemented by the built-in auth scheduler. The embedded round-robin selector keeps this type compatible with the Selector interface.

type Store 

type Store interface {
	// List returns all auth records stored in the backend.
	List(ctx context.Context) ([]*Auth, error)
	// Save persists the provided auth record, replacing any existing one with same ID.
	Save(ctx context.Context, auth *Auth) (string, error)
	// Delete removes the auth record identified by id.
	Delete(ctx context.Context, id string) error
}

Store abstracts persistence of Auth state across restarts.

type StreamRewriteOptions added in v7.2.49 

type StreamRewriteOptions struct {
	RewriteModel string
}

StreamRewriteOptions configures the stream rewriter.

type StreamRewriter added in v7.2.49 

type StreamRewriter struct {
	// contains filtered or unexported fields
}

StreamRewriter rewrites model names in streaming SSE responses.

func NewStreamRewriter added in v7.2.49 

func NewStreamRewriter(options StreamRewriteOptions) *StreamRewriter

NewStreamRewriter creates a new stream rewriter.

func (*StreamRewriter) Finish added in v7.2.49 

func (r *StreamRewriter) Finish() []byte

Finish flushes any buffered partial SSE data at the end of a stream.

func (*StreamRewriter) RewriteChunk added in v7.2.49 

func (r *StreamRewriter) RewriteChunk(chunk []byte) []byte

RewriteChunk rewrites model names in a single SSE chunk.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.