feat: add generic provider discovery APIs (kaito-project#283)

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>
Co-authored-by: Robbie Cronin <robert.owen.cronin@gmail.com>

Author: sozercan

.github/workflows/e2e-dynamo-mocker.yml

@@ -80,7 +80,7 @@ jobs:
           echo "=== Dynamo Provider Logs ==="
           kubectl logs -n airunway-system -l control-plane=dynamo-provider --tail=200
           echo "=== Dynamo Operator Logs ==="
-          kubectl logs -n dynamo-system --all-containers --tail=200 --prefix
+          kubectl logs -n dynamo-system --all-containers --tail=200 --prefix 2>/dev/null || echo "No Dynamo operator logs"
           echo "=== Events ==="
           kubectl get events -A --sort-by=.lastTimestamp
           echo "=== Pods ==="

agents.md

@@ -115,9 +115,10 @@ Unified API for deploying ML models. Key fields:
 
 ### InferenceProviderConfig
 Cluster-scoped resource for provider registration:
-- `spec.capabilities.engines` - Supported inference engines
-- `spec.capabilities.servingModes` - Supported serving modes
-- `spec.capabilities.gpuSupport/cpuSupport` - Hardware support
+- `spec.capabilities.engines` - Authoritative provider capabilities used by controller selection, webhook compatibility checks, and gateway behavior
+- `spec.capabilities.engines[].servingModes` - Supported serving modes per engine
+- `spec.capabilities.engines[].gpuSupport/cpuSupport` - Hardware support per engine
+- `airunway.ai/capabilities` annotation - Optional compatibility mirror for dashboard/provider discovery clients
 - `spec.selectionRules` - CEL expressions for auto-selection
 - `status.ready` - Provider health status
 

backend/src/hono-app.test.ts

@@ -1364,6 +1364,18 @@ describe('Hono Routes', () => {
       expect(data.error.message).toBe('Authentication required');
     });
 
+    test('provider detail routes require auth when AUTH_ENABLED=true', async () => {
+      process.env.AUTH_ENABLED = 'true';
+
+      for (const path of ['/api/settings/providers/kaito', '/api/providers/kaito']) {
+        const res = await app.request(path);
+        expect(res.status).toBe(401);
+        expect(res.headers.get(AIRUNWAY_AUTH_ERROR_HEADER)).toBe('true');
+        const data = await res.json();
+        expect(data.error.message).toBe('Authentication required');
+      }
+    });
+
     test('invalid bearer token returns 401', async () => {
       process.env.AUTH_ENABLED = 'true';
 

backend/src/hono-app.ts

@@ -21,6 +21,7 @@ import {
   health,
   models,
   settings,
+  providers,
   deployments,
   installation,
   oauth,
@@ -130,19 +131,24 @@ app.use('*', async (c, next) => {
 // Auth Middleware
 // ============================================================================
 
-// Routes that don't require authentication
-// Keep this list minimal — only routes needed before login
-const PUBLIC_ROUTES = [
-  '/api/cluster/status',
-  '/api/settings',      // Settings is public (read-only auth config needed by frontend)
-  '/api/oauth',         // OAuth routes must be public for initial authentication
-];
-
-// Public routes that must match exactly (no sub-path matching)
+// Routes that don't require authentication. Keep this list minimal — only
+// routes needed before login, and avoid prefix-whitelisting provider detail
+// endpoints because they include install metadata and chart values.
 const PUBLIC_ROUTES_EXACT = [
   '/api/health',
   '/api/health/',
   '/api/health/version',
+  '/api/cluster/status',
+  '/api/settings',
+  '/api/settings/',
+  '/api/settings/providers',
+  '/api/settings/providers/',
+  '/api/providers',
+  '/api/providers/',
+];
+
+const PUBLIC_ROUTE_PREFIXES = [
+  '/api/oauth', // OAuth routes must be public for initial authentication
 ];
 
 // Auth middleware for protected API routes
@@ -158,8 +164,8 @@ app.use('/api/*', async (c, next) => {
     return next();
   }
 
-  // Skip auth for prefix-match public routes (cluster/status, settings, oauth)
-  if (PUBLIC_ROUTES.some(route => path === route || path.startsWith(route + '/'))) {
+  // Skip auth for prefix-match public routes (OAuth callback/token flow).
+  if (PUBLIC_ROUTE_PREFIXES.some(route => path === route || path.startsWith(route + '/'))) {
     return next();
   }
 
@@ -200,6 +206,7 @@ app.route('/api/health', health);
 app.route('/api/cluster', health);
 app.route('/api/models', models);
 app.route('/api/settings', settings);
+app.route('/api/providers', providers);
 app.route('/api/deployments', deployments);
 app.route('/api/installation', installation);
 app.route('/api/oauth', oauth);

backend/src/lib/providers.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from 'bun:test';
 import {
   aggregateRequiresCRDFromCapabilities,
+  extractProviderInfo,
   getProviderDisplayName,
   providerRequiresRuntimeCRD,
 } from './providers';
@@ -44,6 +45,24 @@ describe('provider metadata helpers', () => {
     expect(providerRequiresRuntimeCRD('custom-provider', true, 'Custom Provider')).toBe(true);
   });
 
+  test('derives requiresCRD from annotation capabilities when spec capabilities are empty', () => {
+    const provider = extractProviderInfo({
+      metadata: {
+        name: 'custom-native-provider',
+        annotations: {
+          'airunway.ai/provider-name': 'Custom Native Provider',
+          'airunway.ai/capabilities': JSON.stringify({
+            engines: [{ name: 'vllm', servingModes: ['aggregated'], requiresCRD: false }],
+          }),
+        },
+      },
+      spec: { capabilities: {} },
+    });
+
+    expect(provider.requiresCRD).toBe(false);
+    expect(provider.capabilities?.engines).toEqual(['vllm']);
+  });
+
   test('defaults operator-backed providers to requiring runtime CRDs', () => {
     expect(providerRequiresRuntimeCRD('dynamo')).toBe(true);
     expect(providerRequiresRuntimeCRD('kaito')).toBe(true);