Repository navigation
refactor(config): relocate cloud-provider operations - #472
Merged
Merged
Conversation
Moved cloud provider credential parsing and primary-cloud resolution out of the inference settings handler into dedicated config ops modules. This centralizes the logic so it can be reused and keeps the RPC handler focused on orchestration. Auto-committed-on: dragonfly
Primary cloud selection and legacy inference slug resolution now live in config/ops instead of the inference provider factory, so the factory depends on config rather than owning config-derived helpers. Endpoint redaction in ephemeral routes now uses the shared sanitize helper. Auto-committed-on: dragonfly
The primary_cloud module's provider resolution helpers are no longer needed, so the file is deleted. Any remaining callers should rely on the shared factory logic instead. Auto-committed-on: dragonfly
Moved the `crate::config::ops` imports in the provider factory modules to the top of each file alongside the other use statements. This keeps import placement consistent and avoids a trailing use declaration at the end of credentials.rs. Auto-committed-on: dragonfly
Dropped an unused import of resolve_primary_cloud_provider_string from the chat model factory, which is no longer referenced after the provider resolution logic moved elsewhere. Auto-committed-on: dragonfly
Relocated the resolve_primary_cloud_provider_string import from the bottom of chat_model.rs to the top with the other use statements. This is a cosmetic cleanup with no behaviour change. Auto-committed-on: dragonfly
Dropped a redundant import of resolve_primary_cloud_provider_string from the cloud slug and routing factory modules, as it was no longer referenced. Auto-committed-on: dragonfly
Adds a unit test asserting that AuthStyle::parse accepts the various spellings for bearer, anthropic, openhuman_jwt and none while returning the expected error for unknown values. Also registers the primary cloud test module so its tests are compiled and run. Auto-committed-on: dragonfly
Extend the ephemeral route debug test to use an endpoint containing userinfo, query, and fragment secrets, and assert that none of them appear in the debug output. This guards against future regressions where only the API key and headers are redacted. Auto-committed-on: dragonfly
The debug logs in primary_cloud now label the redacted URL as endpoint instead of host, matching what the value actually is. The module doc in cloud_providers also points at config::ops::primary_cloud rather than the old inference factory path. Auto-committed-on: dragonfly
The primary cloud helper functions are only used within their own module, so their visibility was reduced from crate-wide to private and the now-unnecessary re-exports were dropped. New tests cover verbatim preservation of non-blank id, label, and default model values along with padded auth style errors. Auto-committed-on: dragonfly
Extend the ephemeral route debug test to include a secret in the URL path and assert it is not disclosed. This guards against redaction logic that handles credentials, query, and fragment but leaks path segments. Auto-committed-on: dragonfly
Route and BYOK diagnostics now log only the URL origin, so endpoint paths, credentials and query values no longer leak into logs. A shared helper in each module parses the endpoint and falls back to TinyInference's sanitizer for malformed input, with a test covering the redaction. Auto-committed-on: dragonfly
This was referenced Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Move primary cloud selection into config operations and move cloud-provider update conversion there as well. The inference settings handler now keeps the RPC boundary and delegates credential construction; AuthStyle parsing is centralized in config schema. Direct callers use config ops, with no factory forwarding shim.
Preserve managed-versus-BYOK selection, legacy provider matching and fallback behavior, reserved-slug handling, blank and whitespace field semantics, auth aliases/errors, CA collection, and config patch application. Diagnostic rendering now sanitizes only the URL origin, keeping endpoint paths, credentials, and query values out of logs and Debug while leaving the configured routing endpoint unchanged.
Validation:
pnpm debug rust inference(without--lib): 630 passed, 0 failed across the selected product-feature test inventory.cargo check,pnpm rust:layout(including the 28-owner storage schema),pnpm docs:check,cargo fmt --all --check, andgit diff --checkpassed.Refs #267
Part of tinyhumansai#8092.