calvin.erfmann/pangolin
1
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-08-13 16:00:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Allow remote header overrides and fix display issues with log

Browse Source
This commit is contained in:
Owen
2026-08-12 15:54:22 -04:00
parent 47ae017f94
commit 653dd920ad
10 changed files with 213 additions and 133 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/lib/readConfigFile.ts
+22
View File
@@ -111,6 +111,20 @@ export const configSchema = z
})
.optional()
.prefault({}),
remote_headers: z
.object({
user_id: z.string().optional().default("Remote-User-Id"),
virtual_api_key_id: z
.string()
.optional()
.default("Remote-Virtual-Api-Key-Id"),
user: z.string().optional().default("Remote-User"),
email: z.string().optional().default("Remote-Email"),
name: z.string().optional().default("Remote-Name"),
role: z.string().optional().default("Remote-Role")
})
.optional()
.prefault({}),
resource_session_request_param: z
.string()
.optional()
@@ -154,6 +168,14 @@ export const configSchema = z
id: "P-Access-Token-Id",
token: "P-Access-Token"
},
remote_headers: {
user_id: "Remote-User-Id",
virtual_api_key_id: "Remote-Virtual-Api-Key-Id",
user: "Remote-User",
email: "Remote-Email",
name: "Remote-Name",
role: "Remote-Role"
},
resource_session_request_param:
"resource_session_request_param",
dashboard_session_length_hours: 720,
server/lib/traefik/TraefikConfigManager.ts
+25 -1
View File
@@ -605,7 +605,31 @@ export class TraefikConfigManager {
resourceSessionRequestParam:
config.getRawConfig().server
.resource_session_request_param
.resource_session_request_param,
remoteUserIdHeader:
config.getRawConfig().server.remote_headers
.user_id,
remoteVirtualApiKeyIdHeader:
config.getRawConfig().server.remote_headers
.virtual_api_key_id,
remoteUserHeader:
config.getRawConfig().server.remote_headers
.user,
remoteEmailHeader:
config.getRawConfig().server.remote_headers
.email,
remoteNameHeader:
config.getRawConfig().server.remote_headers
.name,
remoteRoleHeader:
config.getRawConfig().server.remote_headers
.role
}
}
};
server/lib/virtualApiKey.ts
+10 -9
View File
@@ -5,6 +5,7 @@ import {
import {
db,
resources,
User,
virtualApiKeyResources,
virtualApiKeys,
type Transaction,
@@ -148,12 +149,12 @@ async function selectUserVirtualApiKey(
export async function getOrCreateUserVirtualApiKey(params: {
orgId: string;
userId: string;
user: User;
createdByUserId?: string | null;
}): Promise<{ key: VirtualApiKey; secret: string }> {
const { orgId, userId, createdByUserId } = params;
const { orgId, user, createdByUserId } = params;
const existing = await selectUserVirtualApiKey(orgId, userId);
const existing = await selectUserVirtualApiKey(orgId, user.userId);
if (existing) {
return {
key: existing,
@@ -171,8 +172,8 @@ export async function getOrCreateUserVirtualApiKey(params: {
virtualApiKeyId: minted.virtualApiKeyId,
orgId,
kind: "user",
userId,
name: null,
userId: user.userId,
name: `${user.name ?? user.username}'s API Key`,
description: null,
token: encryptVirtualApiKeyToken(minted.secret),
lastChars: minted.lastChars,
@@ -186,7 +187,7 @@ export async function getOrCreateUserVirtualApiKey(params: {
return { key: created, secret: minted.secret };
} catch {
const raced = await selectUserVirtualApiKey(orgId, userId);
const raced = await selectUserVirtualApiKey(orgId, user.userId);
if (raced) {
return {
key: raced,
@@ -199,11 +200,11 @@ export async function getOrCreateUserVirtualApiKey(params: {
export async function rotateUserVirtualApiKey(params: {
orgId: string;
userId: string;
user: User;
createdByUserId?: string | null;
}): Promise<{ key: VirtualApiKey; secret: string }> {
const { orgId, userId, createdByUserId } = params;
const existing = await selectUserVirtualApiKey(orgId, userId);
const { orgId, user, createdByUserId } = params;
const existing = await selectUserVirtualApiKey(orgId, user.userId);
if (!existing) {
return getOrCreateUserVirtualApiKey(params);
server/routers/aiGateway/pipeline.ts
+20 -10
View File
@@ -180,15 +180,16 @@ export function applyRequestUserHeaders(
if (!requestUser) {
return;
}
headers["Remote-User"] = requestUser.username;
const remoteHeaders = config.getRawConfig().server.remote_headers;
headers[remoteHeaders.user] = requestUser.username;
if (requestUser.email) {
headers["Remote-Email"] = requestUser.email;
headers[remoteHeaders.email] = requestUser.email;
}
if (requestUser.name) {
headers["Remote-Name"] = requestUser.name;
headers[remoteHeaders.name] = requestUser.name;
}
if (requestUser.role) {
headers["Remote-Role"] = requestUser.role;
headers[remoteHeaders.role] = requestUser.role;
}
}
@@ -236,14 +237,20 @@ async function resolveRequestUser(
// Public inference: identity comes from Badger via Remote-* only when the
// Traefik trust header proves the request passed verify-session (VAK).
if (isAiGatewayTrustHeaderValid(req.headers as Record<string, string>)) {
const remoteHeaders = config.getRawConfig().server.remote_headers;
const virtualApiKeyId =
getRequestHeader(req, "remote-virtual-api-key-id") || null;
const userId = getRequestHeader(req, "remote-user-id");
getRequestHeader(req, remoteHeaders.virtual_api_key_id) || null;
const userId = getRequestHeader(req, remoteHeaders.user_id);
logger.debug("+++++++AI gateway request identity from trust header", {
virtualApiKeyId,
userId
});
if (userId) {
const username = getRequestHeader(req, "remote-user") || userId;
const email = getRequestHeader(req, "remote-email");
const name = getRequestHeader(req, "remote-name");
const role = getRequestHeader(req, "remote-role");
const username =
getRequestHeader(req, remoteHeaders.user) || userId;
const email = getRequestHeader(req, remoteHeaders.email);
const name = getRequestHeader(req, remoteHeaders.name);
const role = getRequestHeader(req, remoteHeaders.role);
const orgRoles = orgId ? await getUserOrgRoles(userId, orgId) : [];
return {
@@ -742,6 +749,9 @@ export async function handleAiGatewayProxy(
}
logger.info(`AI gateway ${capability} request for host: ${host}`);
logger.debug("AI gateway request headers", {
headers: req.headers
});
const target = await resolveTarget(host);
if (!target) {
server/routers/traefik/traefikConfigProvider.ts
+21 -1
View File
@@ -68,7 +68,27 @@ export async function traefikConfigProvider(
resourceSessionRequestParam:
config.getRawConfig().server
.resource_session_request_param
.resource_session_request_param,
remoteUserIdHeader:
config.getRawConfig().server.remote_headers
.user_id,
remoteVirtualApiKeyIdHeader:
config.getRawConfig().server.remote_headers
.virtual_api_key_id,
remoteUserHeader:
config.getRawConfig().server.remote_headers.user,
remoteEmailHeader:
config.getRawConfig().server.remote_headers.email,
remoteNameHeader:
config.getRawConfig().server.remote_headers.name,
remoteRoleHeader:
config.getRawConfig().server.remote_headers.role
}
}
};
server/routers/virtualApiKey/listMyVirtualApiKeys.ts
+17 -1
View File
@@ -3,6 +3,7 @@ import { z } from "zod";
import {
db,
resources,
users,
virtualApiKeyResources,
virtualApiKeys,
type VirtualApiKey
@@ -152,9 +153,24 @@ export async function listMyVirtualApiKeys(
resourceName = resource.name;
}
const [user] = await db
.select()
.from(users)
.where(eq(users.userId, userId))
.limit(1);
if (!user) {
return next(
createHttpError(
HttpCode.NOT_FOUND,
`User with ID ${userId} not found`
)
);
}
const { key: userKeyRow } = await getOrCreateUserVirtualApiKey({
orgId,
userId,
user,
createdByUserId: userId
});