i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-12 22:20:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(gateway): harden provider request execution

Browse Source 
Preserve exact request payloads and model client surface and API operation explicitly.

Add Anthropic compatibility profiles, bounded stream commitment, and scoped OAuth retry behavior across provider transports.
This commit is contained in:
elky
2026-07-27 09:36:31 +08:00
parent 79b70f7b5c
commit 531cf11025
152 changed files with 13984 additions and 2075 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/aether-data/adapters/postgres/src/candidate_selection.rs
+41 -60
View File
@@ -114,16 +114,8 @@ INNER JOIN LATERAL (
)
OR (
LOWER(BTRIM(p.provider_type)) = 'vertex_ai'
AND (
(
LOWER(BTRIM(pak.auth_type)) = 'api_key'
AND LOWER($3) IN ('gemini:generate_content', 'gemini:embedding')
)
OR (
LOWER(BTRIM(pak.auth_type)) IN ('service_account', 'vertex_ai')
AND LOWER($3) IN ('claude:messages', 'gemini:generate_content', 'gemini:embedding')
)
)
AND LOWER(BTRIM(pak.auth_type)) IN ('api_key', 'service_account', 'vertex_ai')
AND LOWER($3) IN ('gemini:generate_content', 'gemini:embedding')
)
OR (
LOWER(BTRIM(p.provider_type)) NOT IN (
@@ -207,16 +199,8 @@ WHERE p.is_active = TRUE
)
OR (
LOWER(BTRIM(p.provider_type)) = 'vertex_ai'
AND (
(
LOWER(BTRIM(pak.auth_type)) = 'api_key'
AND LOWER($3) IN ('gemini:generate_content', 'gemini:embedding')
)
OR (
LOWER(BTRIM(pak.auth_type)) IN ('service_account', 'vertex_ai')
AND LOWER($3) IN ('claude:messages', 'gemini:generate_content', 'gemini:embedding')
)
)
AND LOWER(BTRIM(pak.auth_type)) IN ('api_key', 'service_account', 'vertex_ai')
AND LOWER($3) IN ('gemini:generate_content', 'gemini:embedding')
)
OR (
LOWER(BTRIM(p.provider_type)) NOT IN (
@@ -393,16 +377,8 @@ INNER JOIN LATERAL (
)
OR (
LOWER(BTRIM(p.provider_type)) = 'vertex_ai'
AND (
(
LOWER(BTRIM(pak.auth_type)) = 'api_key'
AND LOWER($4) IN ('gemini:generate_content', 'gemini:embedding')
)
OR (
LOWER(BTRIM(pak.auth_type)) IN ('service_account', 'vertex_ai')
AND LOWER($4) IN ('claude:messages', 'gemini:generate_content', 'gemini:embedding')
)
)
AND LOWER(BTRIM(pak.auth_type)) IN ('api_key', 'service_account', 'vertex_ai')
AND LOWER($4) IN ('gemini:generate_content', 'gemini:embedding')
)
OR (
LOWER(BTRIM(p.provider_type)) NOT IN (
@@ -487,16 +463,8 @@ WHERE p.is_active = TRUE
)
OR (
LOWER(BTRIM(p.provider_type)) = 'vertex_ai'
AND (
(
LOWER(BTRIM(pak.auth_type)) = 'api_key'
AND LOWER($4) IN ('gemini:generate_content', 'gemini:embedding')
)
OR (
LOWER(BTRIM(pak.auth_type)) IN ('service_account', 'vertex_ai')
AND LOWER($4) IN ('claude:messages', 'gemini:generate_content', 'gemini:embedding')
)
)
AND LOWER(BTRIM(pak.auth_type)) IN ('api_key', 'service_account', 'vertex_ai')
AND LOWER($4) IN ('gemini:generate_content', 'gemini:embedding')
)
OR (
LOWER(BTRIM(p.provider_type)) NOT IN (
@@ -681,16 +649,8 @@ WHERE p.is_active = TRUE
)
OR (
LOWER(BTRIM(p.provider_type)) = 'vertex_ai'
AND (
(
LOWER(BTRIM(pak.auth_type)) = 'api_key'
AND LOWER($6) IN ('gemini:generate_content', 'gemini:embedding')
)
OR (
LOWER(BTRIM(pak.auth_type)) IN ('service_account', 'vertex_ai')
AND LOWER($6) IN ('claude:messages', 'gemini:generate_content', 'gemini:embedding')
)
)
AND LOWER(BTRIM(pak.auth_type)) IN ('api_key', 'service_account', 'vertex_ai')
AND LOWER($6) IN ('gemini:generate_content', 'gemini:embedding')
)
OR (
LOWER(BTRIM(p.provider_type)) NOT IN (
@@ -1579,18 +1539,39 @@ mod tests {
}
#[test]
fn candidate_selection_sql_allows_vertex_embedding_auth() {
fn candidate_selection_sql_rejects_retired_vertex_claude_auth() {
let requested_model_sql = requested_model_selection_sql();
for sql in [
LIST_FOR_EXACT_API_FORMAT_SQL,
LIST_FOR_EXACT_API_FORMAT_AND_GLOBAL_MODEL_SQL,
LIST_POOL_KEYS_FOR_GROUP_SQL,
requested_model_sql.as_str(),
for (name, sql, expected_occurrences) in [
("exact", LIST_FOR_EXACT_API_FORMAT_SQL, 2),
(
"global_model",
LIST_FOR_EXACT_API_FORMAT_AND_GLOBAL_MODEL_SQL,
2,
),
("pool_keys", LIST_POOL_KEYS_FOR_GROUP_SQL, 1),
("requested_model", requested_model_sql.as_str(), 2),
] {
assert!(sql.contains("LOWER(BTRIM(p.provider_type)) = 'vertex_ai'"));
assert!(sql.contains("gemini:embedding"));
assert!(sql.contains("gemini:generate_content"));
assert!(sql.contains("claude:messages"));
let mut remaining = sql;
let mut occurrences = 0;
while let Some((_, suffix)) =
remaining.split_once("LOWER(BTRIM(p.provider_type)) = 'vertex_ai'")
{
let (vertex_clause, rest) = suffix
.split_once("LOWER(BTRIM(p.provider_type)) NOT IN")
.expect("each Vertex auth clause should have a following fallback clause");
assert!(vertex_clause.contains(
"LOWER(BTRIM(pak.auth_type)) IN ('api_key', 'service_account', 'vertex_ai')"
));
assert!(vertex_clause.contains("gemini:embedding"));
assert!(vertex_clause.contains("gemini:generate_content"));
assert!(!vertex_clause.contains("claude:messages"));
occurrences += 1;
remaining = rest;
}
assert_eq!(
occurrences, expected_occurrences,
"unexpected Vertex auth clause count in {name} SQL"
);
}
}
crates/aether-data/adapters/postgres/src/provider_catalog.rs
+46
View File
@@ -892,6 +892,15 @@ WHERE id = $1
.encrypted_api_key_update
.as_deref()
.is_some_and(|value| value.trim().is_empty())
|| update.expected_credential.as_ref().is_some_and(|expected| {
expected
.encrypted_api_key
.as_deref()
.is_some_and(|value| value.trim().is_empty())
|| expected.auth_type.trim().is_empty()
|| expected.provider_id.trim().is_empty()
|| expected.provider_type.trim().is_empty()
})
|| !update.status_snapshot_patch.is_object()
|| update
.upstream_metadata_patch
@@ -934,6 +943,18 @@ SET
END
WHERE id = $1
AND auth_config IS NOT DISTINCT FROM $12
AND ($13::boolean IS FALSE OR api_key IS NOT DISTINCT FROM $14)
AND ($15::text IS NULL OR auth_type = $15)
AND ($16::text IS NULL OR provider_id = $16)
AND (
$17::text IS NULL
OR EXISTS (
SELECT 1
FROM providers
WHERE providers.id = provider_api_keys.provider_id
AND providers.provider_type = $17
)
)
"#,
)
.bind(&update.key_id)
@@ -953,6 +974,31 @@ WHERE id = $1
.bind(update.reset_error_count)
.bind(update.updated_at_unix_secs.map(|value| value as f64))
.bind(update.expected_encrypted_auth_config.as_deref())
.bind(update.expected_credential.is_some())
.bind(
update
.expected_credential
.as_ref()
.and_then(|expected| expected.encrypted_api_key.as_deref()),
)
.bind(
update
.expected_credential
.as_ref()
.map(|expected| expected.auth_type.as_str()),
)
.bind(
update
.expected_credential
.as_ref()
.map(|expected| expected.provider_id.as_str()),
)
.bind(
update
.expected_credential
.as_ref()
.map(|expected| expected.provider_type.as_str()),
)
.execute(&self.pool)
.await
.map_postgres_err()?