sorokin.oleg.edu/learnharness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

feat(keys): free-form model-provider keys — pi-ai provider table on /api/keys

Browse Source 
Provider-keys interlude (owner spec, 2026-09-19): any pi-compatible
provider's key is manageable, not just the curated set.

GET /api/keys now also returns providers: {id, envVar, label}[] — every
pi-ai provider that takes a plain api-key env var (33 today), derived
from pi-ai's own provider→env-var table. No-drift mechanism: the table
is generated from pi-ai (builtinProviders + findEnvKeys over a
truthy-for-every-var proxy env) and pinned by
tests/auth-provider-keys.test.ts, which re-derives the truth at test
time and asserts EXACT equality — a pi-ai upgrade fails the gate loudly.

Owner-spec exclusions: github-copilot (OAuth), amazon-bedrock (AWS),
google-vertex (ADC), azure-openai-responses (base URL), the cloudflare
pair; anthropic keeps ANTHROPIC_API_KEY only. OPENROUTER_API_KEY
graduates from the curated catalog to the provider table (dedupe — the
UI pins it always-visible); curated stays Deepgram + the Google search
pair. Statuses: curated + present vars + unknown file vars — absent
provider keys never spam rows; the dropdown is discovery.

Write side: PUT/DELETE accept provider env vars (generic truncation
guard — trim, no whitespace, ≥12; family checks stay on the curated
three). Present-in-env provider vars surface as status rows so
env-wins/shadow semantics stay honest.
This commit is contained in:
amosblomqvist
2026-09-19 22:52:40 +03:00
parent e6dfa6faa4
commit ec38f91a2b
7 changed files with 318 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/keys/route.ts
+16 -8
View File
@@ -1,17 +1,25 @@
/**
* GET /api/keys — the auth page's key list (auth-keys wave, 2026-09-19).
* GET /api/keys — the auth page's key list (auth-keys wave, 2026-09-19;
* providers added by the provider-keys interlude same wave).
*
* Every curated key (present or not) plus unknown file vars surfaced as
* generic rows. Masked only — last 4 + length; PLAINTEXT NEVER LEAVES THE
* STORE THROUGH THIS API (owner decision). `source` tells the page whether
* the live value comes from the environment (dev .env.local / launch env)
* or the file, and `shadowedByEnv` explains why a saved key is not the
* live one (env always wins).
* generic rows — ABSENT provider keys deliberately do NOT spam status
* rows; the provider dropdown is the discovery surface. `providers`
* carries it: {id, envVar, label} for every pi-ai plain-key provider,
* derived from pi-ai's own provider→env-var table (no-drift pin in
* tests/auth-provider-keys.test.ts) — the settings UI reads it optionally
* with a graceful fallback.
*
* Masked only — last 4 + length; PLAINTEXT NEVER LEAVES THE STORE THROUGH
* THIS API (owner decision). `source` tells the page whether the live
* value comes from the environment (dev .env.local / launch env) or the
* file, and `shadowedByEnv` explains why a saved key is not the live one
* (env always wins).
*/
import { keyStatuses } from "@/src/server";
import { keyStatuses, providerKeyList } from "@/src/server";
export const dynamic = "force-dynamic";
export async function GET() {
return Response.json({ keys: keyStatuses() });
return Response.json({ keys: keyStatuses(), providers: providerKeyList() });
}