Method handleRequest

enterprise/aibridgeproxyd/aibridgeproxyd.go:904–1016

handleRequest intercepts HTTP requests after MITM decryption. - Requests to known AI providers are rewritten to point at aibridged. In centralized mode the Coder token is already in the Authorization header. For BYOK clients that cannot set custom headers, the proxy injects the BYOK header. - Unknow

(req *http.Request, ctx *goproxy.ProxyCtx)

//     headers, the proxy injects the BYOK header.
//   - Unknown hosts are passed through to the original upstream.
func (s *Server) handleRequest(req *http.Request, ctx *goproxy.ProxyCtx) (*http.Request, *http.Response) {
	originalPath := req.URL.Path

	// Get the request context stored during CONNECT.
	reqCtx, _ := ctx.UserData.(*requestContext)
	if reqCtx == nil {
		s.logger.Warn(s.ctx, "rejecting request with missing context",
			slog.F("host", req.Host),
			slog.F("method", req.Method),
			slog.F("path", originalPath),
		)

		resp := goproxy.NewResponse(req, goproxy.ContentTypeText, http.StatusProxyAuthRequired, "Proxy authentication required")
		resp.Header.Set("Proxy-Authenticate", `Basic realm="Coder AI Bridge Proxy"`)
		return req, resp
	}

	// Re-validate the CONNECT-time provider against the live router.
	// A long-lived CONNECT tunnel can outlive a provider being disabled,
	// removed, or renamed: the captured reqCtx.Provider is stale, but
	// subsequent decrypted requests would still route to aibridged if we
	// trusted it. Look up the provider for the current request's host
	// and pass through if the mapping is gone or has changed.
	host := req.URL.Hostname()
	if host == "" {
		host = req.Host
		if h, _, splitErr := net.SplitHostPort(host); splitErr == nil {
			host = h
		}
	}
	liveProvider := s.loadProviderRouter().providerFromHost(host)
	if liveProvider == "" || liveProvider != reqCtx.Provider {
		s.logger.Warn(s.ctx, "provider mapping changed or removed since CONNECT, passing through",
			slog.F("connect_id", reqCtx.ConnectSessionID.String()),
			slog.F("host", req.Host),
			slog.F("method", req.Method),
			slog.F("path", originalPath),
			slog.F("connect_provider", reqCtx.Provider),
			slog.F("live_provider", liveProvider),
		)
		return req, nil
	}

	// Generate a unique request ID for this request.
	// This ID is sent to aibridged for cross-service log correlation.
	reqCtx.RequestID = uuid.New()

	logger := s.logger.With(
		slog.F("connect_id", reqCtx.ConnectSessionID.String()),
		slog.F("request_id", reqCtx.RequestID.String()),
		slog.F("host", req.Host),
		slog.F("method", req.Method),
		slog.F("path", originalPath),
		slog.F("provider", reqCtx.Provider),
	)

	// Reject unauthenticated requests to AI providers.
	if reqCtx.CoderToken == "" {