refactor(providers): the UI, the connection test and the routes read the record's fields

Step 5 of the provider refactor plan. Provider names gave way to the
record's credential and sdk fields in: hasCredentials (one rule per
credential kind), the connection test (an Object.hasOwn check first, then a
credential switch; EdgeOne's site endpoint and cookie forwarding follow
credential none), the chat route (the on-site function and the single-system
rule for the OpenAI SDK), the credentials form (which fields to show, the
optional-key label, the base URL hint from the record), the picker (the note
from the record), the logo (icon and logo fields), the settings dialog (test
blocker, error hints, EdgeOne origin), the admin panel (fixedCredentials),
chatRequestUrl (sdk), the model list (sdk aihubmix) and the zod schema
(Object.hasOwn instead of 'in'). The eight provider-specific dictionary
entries moved into the record as four-language objects; needAzure became a
generic needUrl.

Two intended behavior changes: the connection test answers 400 'Invalid
provider' for an unknown name whether or not a key is sent (before: 400
'API key is required' without a key, 200 with an error text with one); and
Azure has no placeholder default URL any more, so a new Azure entry starts
with an empty URL and the generic 'needs a URL' rule applies. The e2e
Azure test seeds no URL and expects the new wording. Out-of-layer
provider-name checks: 44 before, 6 after (the admin panel's fixed-variable
branches for Bedrock, Vertex AI and Ollama, kept on purpose). Behavior
snapshot unchanged.

lib/test-model-connection.ts

@@ -12,8 +12,9 @@ import {
     isQuotaEnabled,
 } from "@/lib/dynamo-quota-manager"
 import { classifyLLMError } from "@/lib/llm-errors"
+import { PROVIDERS, type ProviderName } from "@/lib/providers"
 import { allowPrivateUrls, isPrivateUrl } from "@/lib/ssrf-protection"
-import { normalizeBaseUrl, type ProviderName } from "@/lib/types/model-config"
+import { normalizeBaseUrl } from "@/lib/types/model-config"
 import { getUserIdFromRequest } from "@/lib/user-id"
 
 export interface TestModelRequest {
@@ -74,10 +75,22 @@ export async function testModelConnection(
                 { status: 400 },
             )
         }
-        // EdgeOne is this site's own function, as in the chat; the admin
-        // panel's Test sends no URL, and a relative one cannot be fetched
-        const baseUrl =
-            provider === "edgeone" ? edgeOneEndpoint(req) : body.baseUrl
+        // The body is untrusted: an unknown name has no record to read
+        if (!Object.hasOwn(PROVIDERS, provider)) {
+            return NextResponse.json(
+                {
+                    valid: false,
+                    error: `Invalid provider: ${provider}. Allowed providers: ${Object.keys(PROVIDERS).join(", ")}`,
+                },
+                { status: 400 },
+            )
+        }
+        const { credential } = PROVIDERS[provider]
+        // The site's own function (EdgeOne) is this site's, as in the chat;
+        // the admin panel's Test sends no URL, and a relative one cannot be
+        // fetched
+        const onSiteFunction = credential === "none"
+        const baseUrl = onSiteFunction ? edgeOneEndpoint(req) : body.baseUrl
 
         // SECURITY: Block SSRF attacks via custom baseUrl
         if (
@@ -92,35 +105,44 @@ export async function testModelConnection(
             )
         }
 
-        // Validate credentials based on provider
-        if (provider === "bedrock") {
-            if (
-                !(apiKey || (awsAccessKeyId && awsSecretAccessKey)) ||
-                !awsRegion
-            ) {
-                return NextResponse.json(
-                    {
-                        valid: false,
-                        error: "AWS credentials (a Bedrock API key, or an Access Key ID and Secret Access Key, and a Region) are required",
-                    },
-                    { status: 400 },
-                )
-            }
-        } else if (provider === "vertexai") {
-            if (!vertexApiKey) {
-                return NextResponse.json(
-                    {
-                        valid: false,
-                        error: "Vertex AI API key is required for Express Mode",
-                    },
-                    { status: 400 },
-                )
-            }
-        } else if (provider !== "ollama" && provider !== "edgeone" && !apiKey) {
-            return NextResponse.json(
-                { valid: false, error: "API key is required" },
-                { status: 400 },
-            )
+        // The credentials the provider's kind asks for
+        switch (credential) {
+            case "aws":
+                if (
+                    !(apiKey || (awsAccessKeyId && awsSecretAccessKey)) ||
+                    !awsRegion
+                ) {
+                    return NextResponse.json(
+                        {
+                            valid: false,
+                            error: "AWS credentials (a Bedrock API key, or an Access Key ID and Secret Access Key, and a Region) are required",
+                        },
+                        { status: 400 },
+                    )
+                }
+                break
+            case "vertexKey":
+                if (!vertexApiKey) {
+                    return NextResponse.json(
+                        {
+                            valid: false,
+                            error: "Vertex AI API key is required for Express Mode",
+                        },
+                        { status: 400 },
+                    )
+                }
+                break
+            case "apiKey":
+                if (!apiKey) {
+                    return NextResponse.json(
+                        { valid: false, error: "API key is required" },
+                        { status: 400 },
+                    )
+                }
+                break
+            case "optionalKey":
+            case "none":
+                break
         }
         // The Test button checks the user's own provider. On the server's
         // keys (Ollama Cloud without a key or URL) anyone could run any model.
@@ -180,8 +202,9 @@ export async function testModelConnection(
             // Temporary AWS credentials need it, as in the chat
             awsSessionToken,
             vertexApiKey,
-            // EdgeOne checks the Pages cookies and the access code
-            ...(provider === "edgeone" && {
+            // The site's function (EdgeOne) checks the Pages cookies and
+            // the access code
+            ...(onSiteFunction && {
                 headers: {
                     cookie: req.headers.get("cookie") || "",
                     "x-access-code": req.headers.get("x-access-code") || "",