mirror of
https://github.com/whit3rabbit/anyllm-proxy.git
synced 2026-09-22 16:00:51 +00:00
whit3rabbitandClaude Sonnet 5
a87cae6ca4
Adds opt-in client-credential forwarding for Anthropic passthrough (single-key/BYOK deployments), plus fixes found in review: - Startup safeguard now shares one check (server/middleware/auth.rs) with the live admin PUT /admin/api/config path, closing a bypass where PROXY_OPEN_RELAY=true alongside 2+ PROXY_API_KEYS entries slipped past the old startup-only check. - x-goog-api-key is now recognized as a forwardable credential (renamed to x-api-key upstream, since Anthropic doesn't understand that header name), matching validate_auth's precedence. - Managed (admin-API) backends no longer carry a dead forward_client_auth field that could never take effect. - ClientAuthPath forwarding decisions are now double-checked against live VirtualKeyContext/JwtClaims presence, not just the enum, to fail closed if the two ever desync. - Moved from a per-backend BackendConfig field to a global RuntimeConfig field (like anthropic_thinking_repair), making it live-toggleable from the admin UI with no restart, and uniform across every Anthropic-kind backend in a multi-backend deployment. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>