Add secure Gemini, Anthropic, and OpenAI API gateways#71
Add secure Gemini, Anthropic, and OpenAI API gateways#71lawrencecchen wants to merge 31 commits into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds authenticated Anthropic, OpenAI, and Gemini API gateways with provider-key rewriting, configurable upstreams, protected systemd credential persistence, comprehensive proxy tests, and deployment documentation. ChangesTeam API gateways
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant Gateway
participant ProviderUpstream
Client->>Gateway: Send request with client-facing token
Gateway->>Gateway: Authenticate and rewrite credentials
Gateway->>ProviderUpstream: Forward request with provider key
ProviderUpstream-->>Gateway: Return provider response
Gateway-->>Client: Return proxied response
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 129429a5f8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bc9e4d558d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2a96902f41
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aa9191b051
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
internal/proxy/proxy.go (1)
924-930: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider conditionally registering Gemini routes like Bedrock.
Gemini routes are always registered, even when the gateway is unconfigured. This is inconsistent with Bedrock's conditional pattern at lines 921-923. When Gemini is not configured, requests to
/v1beta/and/upload/v1beta/get 503 instead of falling through to the catch-all proxy. The impact is low since these are Google-specific paths, but conditional registration would be cleaner and match the existing pattern.♻️ Optional refactor: conditional Gemini route registration
- mux.Handle("/gemini", s.geminiHandler()) - mux.Handle("/gemini/", s.geminiHandler()) - // The Google GenAI SDK rewrites resumable upload URLs to the configured - // base host without retaining a path prefix, so native paths must also be - // available at the listener root. - mux.Handle("/upload/v1beta/", s.geminiHandler()) - mux.Handle("/v1beta/", s.geminiHandler()) + if s.Gemini != nil && s.Gemini.configured() { + mux.Handle("/gemini", s.geminiHandler()) + mux.Handle("/gemini/", s.geminiHandler()) + // The Google GenAI SDK rewrites resumable upload URLs to the configured + // base host without retaining a path prefix, so native paths must also be + // available at the listener root. + mux.Handle("/upload/v1beta/", s.geminiHandler()) + mux.Handle("/v1beta/", s.geminiHandler()) + }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/proxy/proxy.go` around lines 924 - 930, Conditionally register Gemini routes only when Gemini is configured, matching the existing Bedrock pattern near the route setup. Move the /gemini, /gemini/, /upload/v1beta/, and /v1beta/ registrations into the appropriate Gemini configuration guard so unconfigured requests fall through to the catch-all proxy.internal/proxy/gemini_test.go (1)
13-231: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd a test for the
Authorization: Bearergateway token path.
authorizeGeminiGatewayaccepts the gateway token via eitherX-Goog-Api-KeyorAuthorization: Bearer, but all tests useX-Goog-Api-Key. The Bearer path (gemini.go lines 124-128) is untested.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/proxy/gemini_test.go` around lines 13 - 231, Add a test covering gateway authorization through the Authorization header. Reuse the setup pattern from TestGeminiGatewayRejectsWrongGatewayToken or TestGeminiGatewayReplacesClientCredentialAndPreservesAPIPaths, omit X-Goog-Api-Key, set Authorization to Bearer team-token, and assert the request succeeds and reaches the upstream.cmd/subrouter/main.go (1)
335-340: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd a startup log when the Gemini gateway is enabled.
Bedrock logs at line 307 (
slog.Info("bedrock gateway enabled", ...)), but there's no equivalent for Gemini. Operators can't tell from logs whether the Gemini gateway is active. Consider logging after the server struct is built.♻️ Optional: add Gemini startup log
} + if server.Gemini != nil && server.Gemini.configured() { + slog.Info("gemini gateway enabled", "upstream", geminiUpstream.String(), "auth", server.Gemini.GatewayToken != "") + } + initialAccounts := append([]accounts.Account(nil), codexAccounts...)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/subrouter/main.go` around lines 335 - 340, Add a startup informational log for the Gemini gateway, matching the existing Bedrock gateway log style, after the server configuration is constructed and Gemini is enabled. Use a unique message such as “gemini gateway enabled” and include relevant configuration context through the existing logging mechanism.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/proxy/gemini.go`:
- Around line 108-111: Update rewriteGeminiUploadURL to determine the scheme
from X-Forwarded-Proto when request.TLS is nil, while retaining https for direct
TLS requests and http as the fallback. Use the first forwarded protocol value,
normalize it as needed, and only accept https to avoid generating incorrect
upload URLs.
---
Nitpick comments:
In `@cmd/subrouter/main.go`:
- Around line 335-340: Add a startup informational log for the Gemini gateway,
matching the existing Bedrock gateway log style, after the server configuration
is constructed and Gemini is enabled. Use a unique message such as “gemini
gateway enabled” and include relevant configuration context through the existing
logging mechanism.
In `@internal/proxy/gemini_test.go`:
- Around line 13-231: Add a test covering gateway authorization through the
Authorization header. Reuse the setup pattern from
TestGeminiGatewayRejectsWrongGatewayToken or
TestGeminiGatewayReplacesClientCredentialAndPreservesAPIPaths, omit
X-Goog-Api-Key, set Authorization to Bearer team-token, and assert the request
succeeds and reaches the upstream.
In `@internal/proxy/proxy.go`:
- Around line 924-930: Conditionally register Gemini routes only when Gemini is
configured, matching the existing Bedrock pattern near the route setup. Move the
/gemini, /gemini/, /upload/v1beta/, and /v1beta/ registrations into the
appropriate Gemini configuration guard so unconfigured requests fall through to
the catch-all proxy.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9d42f885-18f5-4b0d-ad0e-894c2eeee21f
📒 Files selected for processing (9)
README.mdcmd/subrouter/install_systemd.gocmd/subrouter/install_systemd_test.gocmd/subrouter/main.godeploy/gcp/README.mddocs/production.mdinternal/proxy/gemini.gointernal/proxy/gemini_test.gointernal/proxy/proxy.go
lawrencecchen
changed the title
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8f6dc0cb9e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a0e8b0f2fa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/subrouter/install_systemd.go`:
- Around line 140-146: Protect the systemd defaults file from secrets supplied
through ExtraArgs: update the mode selection in the installation logic around
writeSystemdDefaults and systemdDefaultPath to use 0600 unconditionally, or
detect and reject secret-bearing ExtraArgs such as --bedrock-gateway-token
before writing; ensure credential values cannot be persisted with 0644
permissions.
In `@cmd/subrouter/main.go`:
- Line 897: Update the serve command usage text in main to include the existing
--kimi-upstream and --zai-upstream flags alongside the other upstream options,
matching their registered flag names and formatting.
- Around line 246-253: Validate both parsed gateway URLs in the startup
configuration logic after url.Parse, requiring a non-empty host, an absolute
URL, and a scheme restricted to http or https; return a descriptive
configuration error for invalid values. Apply the same validation to
anthropicGatewayUpstream and openAIGatewayUpstream.
In `@internal/proxy/gemini_test.go`:
- Line 71: The tests in gemini_test.go assert upload continuation URLs
containing the long-lived team token. Update the upload continuation and
WebSocket request flows and their expectations to keep credentials out of URLs,
using header-based authentication where supported and a scoped short-lived
capability for continuation URLs; revise all referenced assertions to verify the
token is absent from URLs and avoid logging sensitive authentication data.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f5f0db67-ae18-4e88-9c56-89edb8872232
📒 Files selected for processing (11)
README.mdcmd/subrouter/install_systemd.gocmd/subrouter/install_systemd_test.gocmd/subrouter/main.godeploy/gcp/README.mddocs/production.mdinternal/proxy/api_key_gateway.gointernal/proxy/api_key_gateway_test.gointernal/proxy/gemini.gointernal/proxy/gemini_test.gointernal/proxy/proxy.go
✅ Files skipped from review due to trivial changes (2)
- deploy/gcp/README.md
- README.md
🚧 Files skipped from review as they are similar to previous changes (4)
- docs/production.md
- cmd/subrouter/install_systemd_test.go
- internal/proxy/gemini.go
- internal/proxy/proxy.go
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4357db80a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/proxy/gemini.go`:
- Line 160: Canonicalize the SDK root upload alias before capability
verification: in the upload request handling around geminiUploadCapability and
the affected lines 164–179, map paths beginning with /upload/v1beta/ to the
signed /gemini/upload/ path before calling geminiUploadCapability. Add a test
that generates a capability and replays it through /upload/v1beta/, then run go
test ./....
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: c467ba0d-f2b2-4353-be8e-6ed9abff9d78
📒 Files selected for processing (12)
README.mdcmd/subrouter/install_systemd.gocmd/subrouter/install_systemd_test.godeploy/gcp/README.mddocs/production.mdinternal/proxy/api_key_gateway.gointernal/proxy/api_key_gateway_test.gointernal/proxy/gemini.gointernal/proxy/gemini_test.gointernal/proxy/proxy.gointernal/session/extract.gointernal/session/extract_test.go
✅ Files skipped from review due to trivial changes (3)
- internal/session/extract.go
- deploy/gcp/README.md
- README.md
🚧 Files skipped from review as they are similar to previous changes (6)
- internal/proxy/api_key_gateway.go
- cmd/subrouter/install_systemd_test.go
- internal/proxy/api_key_gateway_test.go
- internal/proxy/proxy.go
- internal/proxy/gemini_test.go
- cmd/subrouter/install_systemd.go
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3412a5a36e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8069b87ff9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b55c307b22
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
1 participant
Summary
/anthropic/*,/api/*, and/openai/*while preserving root subscription/account routing0600systemd defaults updatesTesting
go test ./...go vet ./...Summary by CodeRabbit
serveflags for provider/gateway upstream overrides plus Gemini public URL handling.install-systemdto configure Gemini/Anthropic/OpenAI API keys and distinct gateway tokens.0600for secrets, safer quoting/decoding).