You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* put credits behind a waitlist
* clean up pr and fixed some edge cases
* credits empty state better
* lint
* fix build
* lint
* fix web build
* Remove unnecessary index creation in waitlist migration
Use direct unique constraint instead of index + constraint pattern.
Co-authored-by: Justin Torre <chitalian@users.noreply.github.com>
* docs: improve controllers README with clearer routing explanation
- Add comprehensive documentation of public vs private controller structure
- Clarify authentication rules based on route paths, not directory structure
- Explain that /v1/public routes bypass auth while others require API keys
- Include examples and documentation generation differences
- Address confusion about routing logic mentioned in PR review
Co-authored-by: Justin Torre <chitalian@users.noreply.github.com>
* Update README.md
Clarify README
* Update web/pages/settings/credits.tsx
Co-authored-by: Thomas Harmon <thomas.alan.harmon@gmail.com>
---------
Co-authored-by: Justin Torre <justin@helicone.ai>
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Justin Torre <chitalian@users.noreply.github.com>
Co-authored-by: Thomas Harmon <thomas.alan.harmon@gmail.com>
The private/public folders only represent was is generated for docs
5
+
6
+
-**`/private`** - Will not be in the public docs
7
+
-**`/public`** - Will be in the docs
8
+
9
+
## Authentication & Routing
10
+
11
+
### Route Authentication Rules (in `middleware/auth.ts`):
12
+
1.**Routes starting with `/v1/public`** - Bypass authentication entirely (no API key required)
13
+
2.**All other routes** - Require API key authentication by default (see middleware.ts). The `@Security("api_key")` was never implemented properly. We willimplement this properly in the future
14
+
15
+
### Documentation Generation:
16
+
-**`/private`** controllers - No auto-generated docs (internal/admin use)
17
+
-**`/public`** controllers - Full auto-generated documentation
18
+
19
+
### Examples:
20
+
21
+
**Public Controllers:**
22
+
- Can use routes like `@Route("v1/experiment")` - Requires authentication
23
+
- Can use routes like `@Route("/v1/public/model-registry")` - No authentication required
24
+
25
+
**Private Controllers:**
26
+
- Use routes like `@Route("v1/admin")` - Requires authentication + admin privileges
27
+
- Generally for internal/admin functionality
28
+
29
+
The key distinction is the **route path**, not the directory. Routes containing `/v1/public` skip authentication, while all others require it.
0 commit comments