feat(web): add optional LLM user email header #1455
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,103 @@ | ||
| import { beforeEach, describe, expect, test, vi } from 'vitest'; | ||
|
|
||
| const mocks = vi.hoisted(() => ({ | ||
| env: { | ||
| SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED: 'false', | ||
| }, | ||
| getTokenFromConfig: vi.fn(), | ||
| getAuthContext: vi.fn(), | ||
| isServiceError: vi.fn(), | ||
| })); | ||
|
|
||
| vi.mock('@sourcebot/shared', () => mocks); | ||
| vi.mock('server-only', () => ({})); | ||
| vi.mock('@/lib/posthog', () => ({ | ||
| createPostHogClient: vi.fn(), | ||
| tryGetPostHogDistinctId: vi.fn(), | ||
| })); | ||
| vi.mock('./logger', () => ({ | ||
| logger: { | ||
| error: vi.fn(), | ||
| warn: vi.fn(), | ||
| }, | ||
| })); | ||
| vi.mock('@/middleware/withAuth', () => ({ | ||
| getAuthContext: mocks.getAuthContext, | ||
| })); | ||
| vi.mock('@/lib/utils', () => ({ | ||
| isServiceError: mocks.isServiceError, | ||
| })); | ||
|
|
||
| import { | ||
| resolveLanguageModelHeaders, | ||
| SOURCEBOT_USER_EMAIL_HEADER, | ||
| } from './llm.server'; | ||
|
|
||
| const resolveHeadersForUser = ( | ||
| email: string, | ||
| configuredHeaders?: Parameters<typeof resolveLanguageModelHeaders>[0], | ||
| ) => { | ||
| mocks.getAuthContext.mockResolvedValue({ user: { email } }); | ||
| return resolveLanguageModelHeaders(configuredHeaders); | ||
| }; | ||
|
|
||
| describe('resolveLanguageModelHeaders', () => { | ||
| beforeEach(() => { | ||
| mocks.env.SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED = 'false'; | ||
| mocks.getTokenFromConfig.mockReset(); | ||
| mocks.getAuthContext.mockReset(); | ||
| mocks.getAuthContext.mockResolvedValue({ user: undefined }); | ||
| mocks.isServiceError.mockReset(); | ||
| mocks.isServiceError.mockReturnValue(false); | ||
| }); | ||
|
|
||
| test('does not add the user email header by default', async () => { | ||
| await expect(resolveHeadersForUser('User@Example.com')).resolves.toBeUndefined(); | ||
| expect(mocks.getAuthContext).not.toHaveBeenCalled(); | ||
| }); | ||
|
|
||
| test('adds the current user email in lower case when enabled', async () => { | ||
| mocks.env.SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED = 'true'; | ||
|
|
||
| await expect(resolveHeadersForUser('User@Example.COM')).resolves.toEqual({ | ||
| [SOURCEBOT_USER_EMAIL_HEADER]: 'user@example.com', | ||
| }); | ||
| }); | ||
|
|
||
| test('omits the user email header for anonymous requests', async () => { | ||
| mocks.env.SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED = 'true'; | ||
|
|
||
| await expect(resolveLanguageModelHeaders(undefined)).resolves.toBeUndefined(); | ||
| }); | ||
|
|
||
| test('omits the user email header when auth context resolution fails', async () => { | ||
| const authError = { statusCode: 401 }; | ||
| mocks.env.SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED = 'true'; | ||
| mocks.getAuthContext.mockResolvedValue(authError); | ||
| mocks.isServiceError.mockReturnValue(true); | ||
|
|
||
| await expect(resolveLanguageModelHeaders(undefined)).resolves.toBeUndefined(); | ||
| expect(mocks.isServiceError).toHaveBeenCalledWith(authError); | ||
| }); | ||
|
|
||
| test('preserves configured headers when adding the user email header', async () => { | ||
| mocks.env.SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED = 'true'; | ||
|
|
||
| await expect(resolveHeadersForUser('Authenticated@Example.com', { | ||
| 'X-Custom-Header': 'custom-value', | ||
| })).resolves.toEqual({ | ||
| 'X-Custom-Header': 'custom-value', | ||
| [SOURCEBOT_USER_EMAIL_HEADER]: 'authenticated@example.com', | ||
| }); | ||
| }); | ||
|
|
||
| test('resolves token-backed configured headers', async () => { | ||
| const token = { env: 'CUSTOM_HEADER' }; | ||
| mocks.getTokenFromConfig.mockResolvedValue('resolved-value'); | ||
|
|
||
| await expect(resolveLanguageModelHeaders({ Authorization: token })).resolves.toEqual({ | ||
| Authorization: 'resolved-value', | ||
| }); | ||
| expect(mocks.getTokenFromConfig).toHaveBeenCalledWith(token); | ||
| }); | ||
| }); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -23,6 +23,8 @@ import { Token } from "@sourcebot/schemas/v3/shared.type"; | |
| import { env, getTokenFromConfig } from '@sourcebot/shared'; | ||
| import { extractReasoningMiddleware, JSONValue, wrapLanguageModel } from "ai"; | ||
| import * as Sentry from "@sentry/nextjs"; | ||
| import { getAuthContext } from '@/middleware/withAuth'; | ||
| import { isServiceError } from '@/lib/utils'; | ||
|
|
||
| // @note: This module resolves a configured language model into an AI SDK | ||
| // provider object. It is intentionally FSL (open source) provider plumbing — | ||
|
|
@@ -37,6 +39,7 @@ export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Pr | |
| temperature?: number, | ||
| }> => { | ||
| const { provider, model: modelId } = config; | ||
| const headers = await resolveLanguageModelHeaders(config.headers); | ||
|
|
||
| const { model: _model, providerOptions } = await (async (): Promise<{ | ||
| model: AISDKLanguageModelV3, | ||
|
|
@@ -56,9 +59,7 @@ export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Pr | |
| sessionToken: config.sessionToken | ||
| ? await getTokenFromConfig(config.sessionToken) | ||
| : env.AWS_SESSION_TOKEN, | ||
| headers, | ||
| // Fallback to the default Node.js credential provider chain if no credentials are provided. | ||
| // See: https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-credential-providers/#fromnodeproviderchain | ||
| credentialProvider: !config.accessKeyId && !config.accessKeySecret && !config.sessionToken | ||
|
|
@@ -77,10 +78,6 @@ export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Pr | |
| const authToken = config.authToken | ||
| ? await getTokenFromConfig(config.authToken) | ||
| : env.ANTHROPIC_AUTH_TOKEN; | ||
| const anthropic = createAnthropic({ | ||
| baseURL: config.baseUrl, | ||
| apiKey, | ||
|
|
@@ -111,9 +108,7 @@ export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Pr | |
| apiKey: config.token ? (await getTokenFromConfig(config.token)) : env.AZURE_API_KEY, | ||
| apiVersion: config.apiVersion, | ||
| resourceName: config.resourceName ?? env.AZURE_RESOURCE_NAME, | ||
| headers, | ||
| }); | ||
|
|
||
| const reasoningSummary = config.reasoningSummary ?? 'auto'; | ||
|
|
@@ -131,9 +126,7 @@ export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Pr | |
| const deepseek = createDeepSeek({ | ||
| baseURL: config.baseUrl, | ||
| apiKey: config.token ? (await getTokenFromConfig(config.token)) : env.DEEPSEEK_API_KEY, | ||
| headers, | ||
| }); | ||
|
|
||
| return { | ||
|
|
@@ -146,9 +139,7 @@ export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Pr | |
| apiKey: config.token | ||
| ? await getTokenFromConfig(config.token) | ||
| : env.GOOGLE_GENERATIVE_AI_API_KEY, | ||
| headers, | ||
| }); | ||
|
|
||
| return { | ||
|
|
@@ -173,9 +164,7 @@ export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Pr | |
| keyFilename: await getTokenFromConfig(config.credentials), | ||
| } | ||
| } : {}), | ||
| headers, | ||
| }); | ||
|
|
||
| return { | ||
|
|
@@ -202,9 +191,7 @@ export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Pr | |
| keyFilename: await getTokenFromConfig(config.credentials), | ||
| } | ||
| } : {}), | ||
| headers, | ||
| }); | ||
|
|
||
| return { | ||
|
|
@@ -217,9 +204,7 @@ export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Pr | |
| apiKey: config.token | ||
| ? await getTokenFromConfig(config.token) | ||
| : env.MISTRAL_API_KEY, | ||
| headers, | ||
| }); | ||
|
|
||
| return { | ||
|
|
@@ -232,9 +217,7 @@ export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Pr | |
| apiKey: config.token | ||
| ? await getTokenFromConfig(config.token) | ||
| : env.OPENAI_API_KEY, | ||
| headers, | ||
| }); | ||
|
|
||
| const reasoningSummary = config.reasoningSummary ?? 'auto'; | ||
|
|
@@ -255,9 +238,7 @@ export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Pr | |
| apiKey: config.token | ||
| ? await getTokenFromConfig(config.token) | ||
| : undefined, | ||
| headers, | ||
| queryParams: config.queryParams | ||
| ? await extractLanguageModelKeyValuePairs(config.queryParams) | ||
| : undefined, | ||
|
|
@@ -282,9 +263,7 @@ export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Pr | |
| apiKey: config.token | ||
| ? await getTokenFromConfig(config.token) | ||
| : env.OPENROUTER_API_KEY, | ||
| headers, | ||
| }); | ||
|
|
||
| return { | ||
|
|
@@ -297,9 +276,7 @@ export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Pr | |
| apiKey: config.token | ||
| ? await getTokenFromConfig(config.token) | ||
| : env.XAI_API_KEY, | ||
| headers, | ||
| }); | ||
|
|
||
| return { | ||
|
|
@@ -332,7 +309,7 @@ export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Pr | |
| const extractLanguageModelKeyValuePairs = async ( | ||
| pairs: { | ||
| [k: string]: string | Token; | ||
| } | undefined | ||
| ): Promise<Record<string, string>> => { | ||
| const resolvedPairs: Record<string, string> = {}; | ||
|
|
||
|
|
@@ -353,6 +330,28 @@ const extractLanguageModelKeyValuePairs = async ( | |
| return resolvedPairs; | ||
| }; | ||
|
|
||
| export const SOURCEBOT_USER_EMAIL_HEADER = 'X-Sourcebot-User-Email'; | ||
|
|
||
| export const resolveLanguageModelHeaders = async ( | ||
| configuredHeaders: Record<string, string | Token> | undefined, | ||
| ): Promise<Record<string, string> | undefined> => { | ||
| const headers = await extractLanguageModelKeyValuePairs(configuredHeaders); | ||
|
|
||
| const userEmail = await (async () => { | ||
| if (env.SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED !== 'true') { | ||
| return undefined; | ||
| } | ||
|
|
||
| const authContext = await getAuthContext(); | ||
| return isServiceError(authContext) ? undefined : authContext.user?.email; | ||
| })(); | ||
| if (userEmail) { | ||
| headers[SOURCEBOT_USER_EMAIL_HEADER] = userEmail.toLowerCase(); | ||
| } | ||
|
brendan-kellam marked this conversation as resolved.
brendan-kellam marked this conversation as resolved.
There was a problem hiding this comment. Duplicate email header with mixed casingMedium Severity The   Reviewed by Cursor Bugbot for commit 9ad3797. Configure here. |
||
|
|
||
| return Object.keys(headers).length > 0 ? headers : undefined; | ||
| }; | ||
|
|
||
| type AnthropicThinkingConfig = NonNullable<AnthropicProviderOptions['thinking']>; | ||
| const anthropicThinkingConfigCache = new Map<string, AnthropicThinkingConfig | undefined>(); | ||
|
|
||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Auth lookup on automated review calls
Medium Severity
Enabling
SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLEDmakes everygetAISDKLanguageModelAndOptionscall rungetAuthContextinsideresolveLanguageModelHeaders, including webhook-driven review-agent LLM requests that are not user-initiated. Each diff review can repeat org and membership database work, and any incidental credentials on that request can attach that user’s email to automated provider calls.Additional Locations (1)
packages/web/src/features/chat/llm.server.ts#L339-L346Reviewed by Cursor Bugbot for commit 9ad3797. Configure here.