Documentation
¶
Overview ¶
Package aibridge provides utilities for the AI Bridge feature.
Index ¶
- Constants
- func DelegatedAPIKeyIDFromContext(ctx context.Context) (string, bool)
- func ExtractAuthToken(header http.Header) string
- func IsBYOK(header http.Header) bool
- func WithDelegatedAPIKeyID(ctx context.Context, id string) context.Context
- func WithSource(ctx context.Context, src Source) context.Context
- type Source
- type TransportFactory
Constants ¶
const ( ProviderCopilotBusiness = "copilot-business" HostCopilotBusiness = "api.business.githubcopilot.com" ProviderCopilotEnterprise = "copilot-enterprise" HostCopilotEnterprise = "api.enterprise.githubcopilot.com" )
Copilot provider.
const ( ProviderChatGPT = "chatgpt" HostChatGPT = "chatgpt.com" BaseURLChatGPT = "https://" + HostChatGPT + "/backend-api/codex" )
ChatGPT provider.
const HeaderCoderRequestID = "X-Coder-AI-Governance-Request-Id"
HeaderCoderRequestID is a header set by aibridgeproxyd on each request forwarded to aibridged for cross-service log correlation.
const HeaderCoderToken = "X-Coder-AI-Governance-Token" //nolint:gosec // This is a header name, not a credential.
HeaderCoderToken is a header set by clients opting into BYOK (Bring Your Own Key) mode. It carries the Coder token so that Authorization and X-Api-Key can carry the user's own LLM credentials. When present, AI Bridge forwards the user's LLM headers unchanged instead of injecting the centralized key.
The AI Bridge proxy also sets this header automatically for clients that use per-user LLM credentials but cannot set custom headers.
Variables ¶
This section is empty.
Functions ¶
func DelegatedAPIKeyIDFromContext ¶ added in v2.34.0
DelegatedAPIKeyIDFromContext returns the API key ID attached by WithDelegatedAPIKeyID and whether a non-empty value was set.
func ExtractAuthToken ¶
ExtractAuthToken extracts a token from HTTP headers. It checks the BYOK header first (set by clients opting into BYOK), then falls back to Authorization: Bearer and X-Api-Key for direct centralized mode. If none are present, an empty string is returned.
func IsBYOK ¶ added in v2.32.0
IsBYOK reports whether the request is using BYOK mode, determined by the presence of the X-Coder-AI-Governance-Token header.
func WithDelegatedAPIKeyID ¶ added in v2.34.0
WithDelegatedAPIKeyID returns a copy of ctx carrying an API key ID on whose behalf the request is being made. The in-process aibridge transport requires this on every RoundTrip and rejects calls whose context lacks it.
The caller is responsible for having established that the user owning this key authorized the request: aibridged validates only that the key exists, has not expired, and belongs to a non-deleted, non-system user. It does not verify the key secret, because the caller never has it.
func WithSource ¶ added in v2.34.0
WithSource returns a copy of ctx carrying the given Source. Use this on the request context before invoking a downstream handler so SourceFromContext can recover it for logging.
Types ¶
type Source ¶ added in v2.34.0
type Source string
Source identifies the call site that asked aibridge for a transport. It is attached to the request context so downstream handlers and logs can attribute traffic without changing behavior based on the value.
const SourceAgents Source = "agents"
SourceAgents is chatd traffic originating from a Coder agent.
func SourceFromContext ¶ added in v2.34.0
SourceFromContext returns the Source attached by WithSource, or the empty string when no Source is set.
type TransportFactory ¶ added in v2.34.0
type TransportFactory interface {
TransportFor(providerName string, source Source) (http.RoundTripper, error)
}
TransportFactory returns an http.RoundTripper that dispatches an aibridge request in-process for a given provider instance name.
Implementations live in coderd/aibridged. coderd registers an in-process factory on coderd.API.AIBridgeTransportFactory at startup so callers route traffic through the daemon without going through the gated HTTP route.
The returned RoundTripper is responsible for adapting the caller's request to the aibridge daemon's mount path: callers hand it an upstream-shaped request and the transport rewrites URL.Path to "/api/v2/aibridge/<name>/..." before dispatching. Routing keys on the provider's instance name so callers can use the same string the proxy daemon and the bridge mount use.
Source is informational: implementations must not gate on it. It is attached to the request context so handlers can include it in logs and metrics.
Source Files
Directories