From 07f628b9287b4ea80e7506d9ff8be1023154c2c3 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Thu, 6 Aug 2026 17:53:51 -0400
Subject: [PATCH] add the pangolin header information

---
 server/routers/aiGateway/pipeline.ts      | 30 ++++++++++++++++++++++-
 server/routers/aiGateway/targetRouting.ts |  8 +++++-
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/server/routers/aiGateway/pipeline.ts b/server/routers/aiGateway/pipeline.ts
index 08ea6d1bc..04d318004 100644
--- a/server/routers/aiGateway/pipeline.ts
+++ b/server/routers/aiGateway/pipeline.ts
@@ -119,6 +119,28 @@ export type RequestUser = {
     role: string | null;
 };
 
+// Identity headers forwarded to the upstream inference endpoint when the
+// requesting user is known. Omitted entirely (not sent empty) when we
+// couldn't resolve a user for the request.
+export function applyRequestUserHeaders(
+    headers: Record<string, string>,
+    requestUser: RequestUser | null
+): void {
+    if (!requestUser) {
+        return;
+    }
+    headers["Remote-User"] = requestUser.username;
+    if (requestUser.email) {
+        headers["Remote-Email"] = requestUser.email;
+    }
+    if (requestUser.name) {
+        headers["Remote-Name"] = requestUser.name;
+    }
+    if (requestUser.role) {
+        headers["Remote-Role"] = requestUser.role;
+    }
+}
+
 async function buildRequestUser(
     userId: string,
     orgId: string | null
@@ -519,7 +541,12 @@ export async function handleAiGatewayProxy(
         const { provider } = selection;
 
         if (provider.type === "custom" && provider.routingMode === "target") {
-            return await proxyAiGatewayToSiteTarget(req, res, provider);
+            return await proxyAiGatewayToSiteTarget(
+                req,
+                res,
+                provider,
+                requestUser
+            );
         }
 
         const upstreamUrl = provider.upstreamUrl;
@@ -580,6 +607,7 @@ export async function handleAiGatewayProxy(
             config.getRawConfig().server.secret!
         );
         applyAiProviderAuthHeaders(headers, authType, apiKey);
+        applyRequestUserHeaders(headers, requestUser);
 
         const body = JSON.stringify(req.body);
 
diff --git a/server/routers/aiGateway/targetRouting.ts b/server/routers/aiGateway/targetRouting.ts
index b0b2456d4..b091bf8f5 100644
--- a/server/routers/aiGateway/targetRouting.ts
+++ b/server/routers/aiGateway/targetRouting.ts
@@ -12,6 +12,10 @@ import {
 } from "@server/lib/aiProviderDefaults";
 import logger from "@server/logger";
 import HttpCode from "@server/types/HttpCode";
+import {
+    applyRequestUserHeaders,
+    type RequestUser
+} from "@server/routers/aiGateway/pipeline";
 
 // Short TTL: long enough to spare the DB on a burst of requests, short
 // enough that target/site changes (added, removed, exit node moved) show up
@@ -147,7 +151,8 @@ function pathFromRequest(req: Request): string {
 export async function proxyAiGatewayToSiteTarget(
     req: Request,
     res: Response,
-    provider: AiProvider
+    provider: AiProvider,
+    requestUser: RequestUser | null
 ): Promise<void> {
     const providerTargets = await getProviderTargets(provider.providerId);
     if (providerTargets.length === 0) {
@@ -191,6 +196,7 @@ export async function proxyAiGatewayToSiteTarget(
         config.getRawConfig().server.secret!
     );
     applyAiProviderAuthHeaders(headers, authType, apiKey);
+    applyRequestUserHeaders(headers, requestUser);
 
     headers[PANGOLIN_DEST_HEADER] = target.destination;
     headers[PANGOLIN_HOST_HEADER] = target.hostHeader;