i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-02 01:10:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

refactor: separate request auth channel from route kind

Browse Source 
Extract request_auth_channel as a distinct routing dimension to distinguish
between api_key and bearer_like authentication methods. This improves routing
clarity by decoupling authentication mechanism from route classification.
This commit is contained in:
fawney19
2026-05-02 21:23:33 +08:00
parent 47ee8b9c13
commit 3a770306cc
16 changed files with 337 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
apps/aether-gateway/src/ai_serving/api.rs
View File

@@ -66,6 +66,7 @@ pub(crate) fn resolve_execution_runtime_stream_plan_kind(
decision.route_class.as_deref(),
decision.route_family.as_deref(),
decision.route_kind.as_deref(),
decision.request_auth_channel.as_deref(),
&parts.method,
parts.uri.path(),
)
@@ -79,6 +80,7 @@ pub(crate) fn resolve_execution_runtime_sync_plan_kind(
decision.route_class.as_deref(),
decision.route_family.as_deref(),
decision.route_kind.as_deref(),
decision.request_auth_channel.as_deref(),
&parts.method,
parts.uri.path(),
)

3
apps/aether-gateway/src/ai_serving/finalize/tests_sync.rs
View File

@@ -25,6 +25,7 @@ fn test_decision() -> GatewayControlDecision {
route_class: Some("ai_public".to_string()),
route_family: Some("openai".to_string()),
route_kind: Some("compact".to_string()),
request_auth_channel: None,
auth_endpoint_signature: Some("openai:responses:compact".to_string()),
execution_runtime_candidate: true,
auth_context: None,
@@ -1747,6 +1748,7 @@ fn local_finalize_handles_claude_chat_cross_format_sync_response_from_openai_cha
route_class: Some("ai_public".to_string()),
route_family: Some("claude".to_string()),
route_kind: Some("chat".to_string()),
request_auth_channel: None,
auth_endpoint_signature: Some("claude:messages".to_string()),
execution_runtime_candidate: true,
auth_context: None,
@@ -1813,6 +1815,7 @@ fn local_finalize_handles_gemini_cli_cross_format_sync_response_from_claude_cli(
route_class: Some("ai_public".to_string()),
route_family: Some("gemini".to_string()),
route_kind: Some("cli".to_string()),
request_auth_channel: None,
auth_endpoint_signature: Some("gemini:generate_content".to_string()),
execution_runtime_candidate: true,
auth_context: None,

54
apps/aether-gateway/src/ai_serving/planner/route.rs
View File

@@ -15,6 +15,7 @@ pub(crate) fn resolve_execution_runtime_stream_plan_kind(
decision.route_class.as_deref(),
decision.route_family.as_deref(),
decision.route_kind.as_deref(),
decision.request_auth_channel.as_deref(),
&parts.method,
parts.uri.path(),
)
@@ -28,6 +29,7 @@ pub(crate) fn resolve_execution_runtime_sync_plan_kind(
decision.route_class.as_deref(),
decision.route_family.as_deref(),
decision.route_kind.as_deref(),
decision.request_auth_channel.as_deref(),
&parts.method,
parts.uri.path(),
)
@@ -69,6 +71,7 @@ mod tests {
route_class: Some("ai_public".to_string()),
route_family: Some(route_family.to_string()),
route_kind: Some(route_kind.to_string()),
request_auth_channel: None,
auth_context: None,
admin_principal: None,
auth_endpoint_signature: None,
@@ -77,6 +80,16 @@ mod tests {
}
}
fn sample_decision_with_auth_channel(
route_family: &str,
route_kind: &str,
request_auth_channel: &str,
) -> GatewayControlDecision {
let mut decision = sample_decision(route_family, route_kind);
decision.request_auth_channel = Some(request_auth_channel.to_string());
decision
}
#[test]
fn resolves_openai_chat_plan_kinds_via_format_crate() {
let request = Request::builder()
@@ -97,6 +110,47 @@ mod tests {
);
}
#[test]
fn resolves_endpoint_route_kinds_by_request_auth_channel_via_format_crate() {
let claude_request = Request::builder()
.method(Method::POST)
.uri("/v1/messages")
.body(())
.expect("request should build");
let (claude_parts, _) = claude_request.into_parts();
let claude_api_key = sample_decision_with_auth_channel("claude", "messages", "api_key");
let claude_bearer = sample_decision_with_auth_channel("claude", "messages", "bearer_like");
assert_eq!(
resolve_execution_runtime_sync_plan_kind(&claude_parts, &claude_api_key),
Some("claude_chat_sync")
);
assert_eq!(
resolve_execution_runtime_stream_plan_kind(&claude_parts, &claude_bearer),
Some("claude_cli_stream")
);
let gemini_request = Request::builder()
.method(Method::POST)
.uri("/v1beta/models/gemini-2.5-pro:generateContent")
.body(())
.expect("request should build");
let (gemini_parts, _) = gemini_request.into_parts();
let gemini_api_key =
sample_decision_with_auth_channel("gemini", "generate_content", "api_key");
let gemini_bearer =
sample_decision_with_auth_channel("gemini", "generate_content", "bearer_like");
assert_eq!(
resolve_execution_runtime_sync_plan_kind(&gemini_parts, &gemini_api_key),
Some("gemini_chat_sync")
);
assert_eq!(
resolve_execution_runtime_sync_plan_kind(&gemini_parts, &gemini_bearer),
Some("gemini_cli_sync")
);
}
#[test]
fn stream_matching_uses_surface_route_logic() {
let request = Request::builder()

23
apps/aether-gateway/src/control/route/ai.rs
View File

@@ -1,6 +1,6 @@
use super::{
classified, is_claude_cli_request, is_gemini_cli_request, is_gemini_models_route,
is_gemini_operation_route, ClassifiedRoute,
classified, classified_with_request_auth_channel, is_claude_cli_request, is_gemini_cli_request,
is_gemini_models_route, is_gemini_operation_route, ClassifiedRoute,
};
pub(super) fn classify_ai_public_route(
@@ -58,15 +58,16 @@ pub(super) fn classify_ai_public_route(
false,
))
} else if method == http::Method::POST && normalized_path == "/v1/messages" {
let route_kind = if is_claude_cli_request(headers) {
"cli"
let request_auth_channel = if is_claude_cli_request(headers) {
"bearer_like"
} else {
"messages"
"api_key"
};
Some(classified(
Some(classified_with_request_auth_channel(
"ai_public",
"claude",
route_kind,
"messages",
request_auth_channel,
"claude:messages",
true,
))
@@ -88,18 +89,20 @@ pub(super) fn classify_ai_public_route(
true,
))
} else if is_gemini_cli_request(headers) {
Some(classified(
Some(classified_with_request_auth_channel(
"ai_public",
"gemini",
"cli",
"generate_content",
"bearer_like",
"gemini:generate_content",
true,
))
} else {
Some(classified(
Some(classified_with_request_auth_channel(
"ai_public",
"gemini",
"generate_content",
"api_key",
"gemini:generate_content",
true,
))

23
apps/aether-gateway/src/control/route/mod.rs
View File

@@ -19,6 +19,7 @@ pub(crate) struct GatewayControlDecision {
pub(crate) route_class: Option<String>,
pub(crate) route_family: Option<String>,
pub(crate) route_kind: Option<String>,
pub(crate) request_auth_channel: Option<String>,
pub(crate) auth_endpoint_signature: Option<String>,
pub(crate) execution_runtime_candidate: bool,
pub(crate) auth_context: Option<GatewayControlAuthContext>,
@@ -40,6 +41,7 @@ impl GatewayControlDecision {
route_class,
route_family,
route_kind,
request_auth_channel: None,
auth_endpoint_signature,
execution_runtime_candidate: false,
auth_context: None,
@@ -75,6 +77,7 @@ pub(super) struct ClassifiedRoute {
route_class: &'static str,
route_family: &'static str,
route_kind: &'static str,
request_auth_channel: Option<&'static str>,
auth_endpoint_signature: String,
execution_runtime_candidate: bool,
}
@@ -90,6 +93,25 @@ pub(super) fn classified(
route_class,
route_family,
route_kind,
request_auth_channel: None,
auth_endpoint_signature: auth_endpoint_signature.into(),
execution_runtime_candidate,
}
}
pub(super) fn classified_with_request_auth_channel(
route_class: &'static str,
route_family: &'static str,
route_kind: &'static str,
request_auth_channel: &'static str,
auth_endpoint_signature: impl Into<String>,
execution_runtime_candidate: bool,
) -> ClassifiedRoute {
ClassifiedRoute {
route_class,
route_family,
route_kind,
request_auth_channel: Some(request_auth_channel),
auth_endpoint_signature: auth_endpoint_signature.into(),
execution_runtime_candidate,
}
@@ -103,6 +125,7 @@ impl ClassifiedRoute {
route_class: Some(self.route_class.to_string()),
route_family: Some(self.route_family.to_string()),
route_kind: Some(self.route_kind.to_string()),
request_auth_channel: self.request_auth_channel.map(str::to_string),
auth_endpoint_signature: Some(self.auth_endpoint_signature),
execution_runtime_candidate: self.execution_runtime_candidate,
auth_context: None,

38
apps/aether-gateway/src/control/tests/ai.rs
View File

@@ -44,7 +44,11 @@ fn classifies_claude_messages_cli_when_bearer_without_api_key() {
classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
assert_eq!(decision.route_family.as_deref(), Some("claude"));
assert_eq!(decision.route_kind.as_deref(), Some("cli"));
assert_eq!(decision.route_kind.as_deref(), Some("messages"));
assert_eq!(
decision.request_auth_channel.as_deref(),
Some("bearer_like")
);
assert_eq!(
decision.auth_endpoint_signature.as_deref(),
Some("claude:messages")
@@ -63,7 +67,11 @@ fn classifies_claude_messages_cli_when_bearer_is_present_even_with_api_key() {
classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
assert_eq!(decision.route_family.as_deref(), Some("claude"));
assert_eq!(decision.route_kind.as_deref(), Some("cli"));
assert_eq!(decision.route_kind.as_deref(), Some("messages"));
assert_eq!(
decision.request_auth_channel.as_deref(),
Some("bearer_like")
);
assert_eq!(
decision.auth_endpoint_signature.as_deref(),
Some("claude:messages")
@@ -80,6 +88,7 @@ fn classifies_claude_messages_when_api_key_without_bearer() {
assert_eq!(decision.route_family.as_deref(), Some("claude"));
assert_eq!(decision.route_kind.as_deref(), Some("messages"));
assert_eq!(decision.request_auth_channel.as_deref(), Some("api_key"));
assert_eq!(
decision.auth_endpoint_signature.as_deref(),
Some("claude:messages")
@@ -97,7 +106,30 @@ fn classifies_gemini_cli_generate_content_when_x_app_contains_cli() {
classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
assert_eq!(decision.route_family.as_deref(), Some("gemini"));
assert_eq!(decision.route_kind.as_deref(), Some("cli"));
assert_eq!(decision.route_kind.as_deref(), Some("generate_content"));
assert_eq!(
decision.request_auth_channel.as_deref(),
Some("bearer_like")
);
assert_eq!(
decision.auth_endpoint_signature.as_deref(),
Some("gemini:generate_content")
);
assert!(decision.is_execution_runtime_candidate());
}
#[test]
fn classifies_gemini_generate_content_api_key_without_cli_marker() {
let headers = headers(&[("x-goog-api-key", "gemini-key")]);
let uri: Uri = "/v1beta/models/gemini-2.5-pro:generateContent"
.parse()
.expect("uri should parse");
let decision =
classify_control_route(&http::Method::POST, &uri, &headers).expect("route should classify");
assert_eq!(decision.route_family.as_deref(), Some("gemini"));
assert_eq!(decision.route_kind.as_deref(), Some("generate_content"));
assert_eq!(decision.request_auth_channel.as_deref(), Some("api_key"));
assert_eq!(
decision.auth_endpoint_signature.as_deref(),
Some("gemini:generate_content")

9
apps/aether-gateway/src/control/tests/mod.rs
View File

@@ -61,7 +61,14 @@ fn builds_public_request_context_from_request_parts() {
.control_decision
.as_ref()
.and_then(|value| value.route_kind.as_deref()),
Some("cli")
Some("generate_content")
);
assert_eq!(
context
.control_decision
.as_ref()
.and_then(|value| value.request_auth_channel.as_deref()),
Some("bearer_like")
);
}

1
apps/aether-gateway/src/fallback_metrics.rs
View File

@@ -173,6 +173,7 @@ mod tests {
route_class: Some("ai_public".to_string()),
route_family: Some("openai".to_string()),
route_kind: Some("chat".to_string()),
request_auth_channel: None,
auth_endpoint_signature: None,
execution_runtime_candidate: true,
auth_context: None,

6
apps/aether-gateway/src/handlers/internal/gateway_helpers.rs
View File

@@ -74,6 +74,12 @@ pub(crate) fn build_internal_gateway_resolve_payload(
if let Some(route_kind) = decision.route_kind {
payload.insert("route_kind".to_string(), json!(route_kind));
}
if let Some(request_auth_channel) = decision.request_auth_channel {
payload.insert(
"request_auth_channel".to_string(),
json!(request_auth_channel),
);
}
if let Some(signature) = decision.auth_endpoint_signature {
payload.insert("auth_endpoint_signature".to_string(), json!(signature));
}

1
apps/aether-gateway/src/rate_limit.rs
View File

@@ -536,6 +536,7 @@ mod tests {
route_class: Some("ai_public".to_string()),
route_family: Some("openai".to_string()),
route_kind: Some("chat".to_string()),
request_auth_channel: None,
auth_endpoint_signature: Some("openai:chat".to_string()),
execution_runtime_candidate: true,
auth_context: Some(auth_context),

3
apps/aether-gateway/src/tests/ai_execute/stream_provider.rs
View File

@@ -269,7 +269,8 @@ async fn gateway_executes_kiro_claude_cli_stream_via_local_provider_catalog_cand
"action": "proxy_public",
"route_class": "ai_public",
"route_family": "claude",
"route_kind": "cli",
"route_kind": "messages",
"request_auth_channel": "bearer_like",
"auth_endpoint_signature": "claude:messages",
"execution_runtime_candidate": true,
"auth_context": {

6
apps/aether-gateway/src/tests/ai_execute/sync/claude/kiro.rs
View File

@@ -288,7 +288,8 @@ async fn gateway_executes_kiro_claude_cli_sync_via_local_provider_catalog_candid
"action": "proxy_public",
"route_class": "ai_public",
"route_family": "claude",
"route_kind": "cli",
"route_kind": "messages",
"request_auth_channel": "bearer_like",
"auth_endpoint_signature": "claude:messages",
"execution_runtime_candidate": true,
"auth_context": {
@@ -872,7 +873,8 @@ async fn gateway_executes_kiro_claude_cli_sync_via_local_provider_catalog_candid
"action": "proxy_public",
"route_class": "ai_public",
"route_family": "claude",
"route_kind": "cli",
"route_kind": "messages",
"request_auth_channel": "bearer_like",
"auth_endpoint_signature": "claude:messages",
"execution_runtime_candidate": true,
"auth_context": {

1
apps/aether-gateway/src/tests/concurrency.rs
View File

@@ -27,6 +27,7 @@ fn sample_decision() -> crate::control::GatewayControlDecision {
route_class: Some("ai_public".to_string()),
route_family: Some("openai".to_string()),
route_kind: Some("chat".to_string()),
request_auth_channel: None,
auth_endpoint_signature: None,
execution_runtime_candidate: true,
auth_context: None,

22
apps/aether-gateway/src/tests/frontdoor/internal.rs
View File

@@ -50,6 +50,28 @@ async fn gateway_handles_internal_gateway_resolve_without_proxying_upstream() {
assert_eq!(payload["route_kind"], "chat");
assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
let response = reqwest::Client::new()
.post(format!("{gateway_url}/api/internal/gateway/resolve"))
.json(&json!({
"method": "POST",
"path": "/v1/messages",
"headers": {
"authorization": "Bearer local-token",
},
}))
.send()
.await
.expect("request should succeed");
assert_eq!(response.status(), StatusCode::OK);
let payload: serde_json::Value = response.json().await.expect("json body should parse");
assert_eq!(payload["route_class"], "ai_public");
assert_eq!(payload["route_family"], "claude");
assert_eq!(payload["route_kind"], "messages");
assert_eq!(payload["request_auth_channel"], "bearer_like");
assert_eq!(payload["auth_endpoint_signature"], "claude:messages");
assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
gateway_handle.abort();
upstream_handle.abort();
}

2
apps/aether-gateway/src/tests/usage/local.rs
View File

@@ -1645,7 +1645,7 @@ async fn gateway_records_failed_usage_when_all_local_claude_cli_candidates_are_s
assert_eq!(stored_usage.routing_key_name(), None);
assert_eq!(stored_usage.routing_planner_kind(), Some("claude_cli_sync"));
assert_eq!(stored_usage.routing_route_family(), Some("claude"));
assert_eq!(stored_usage.routing_route_kind(), Some("cli"));
assert_eq!(stored_usage.routing_route_kind(), Some("messages"));
assert_eq!(
stored_usage.routing_execution_path(),
Some("local_execution_runtime_miss")