car-inference 0.63.0

//! Which hosts a reserved provider credential may be sent to (car#3072).
//!
//! A model row names a credential (`api_key_env`, or `auth.env_var` on a
//! proprietary row) and an endpoint, and inference sends the first to the
//! second. Nothing about the row says the two belong together, so a row that
//! pairs `OPENAI_API_KEY` with `https://evil.example` sends the user's OpenAI
//! key to that host.
//!
//! This module answers the question the daemon's `models.register` asks before
//! it persists a row from a client that is not the operator: does this row send
//! a reserved credential to a host outside its provider? Both halves come from
//! existing sources rather than a table kept here:
//!
//! - **Reserved credentials** are the names CAR's built-in catalog reads
//!   ([`crate::registry::builtin_credential_env_names`]), the provider keys
//!   `car keys` stores ([`car_secrets::KEY_PROVIDERS`]), the credentials CAR
//!   stores for itself ([`car_secrets::CAR_OWNED_SECRET_KEYS`] and every name
//!   under [`car_secrets::CAR_OWNED_SECRET_PREFIXES`]: `connector:`, `CAR_`,
//!   `PARSLEE_`), the daemon-private connection credentials
//!   ([`car_secrets::is_daemon_private_secret`]), and any non-ASCII name.
//!   Keychain items are stored under those same names, so one name check covers
//!   the process environment and the secret store.
//! - **A provider's hosts** are the endpoint hosts of the built-in rows that
//!   send that credential. A reserved name no built-in row sends (a GitHub
//!   token, the AWS keys Bedrock signs with rather than sends) has no provider
//!   host, so no non-operator row may send it anywhere.
//!
//! Credential names compare without regard to ASCII case on every platform:
//! Windows reads environment variables and Credential Manager items that way,
//! so `openai_api_key` reaches the same secret as `OPENAI_API_KEY` there.
//! Hosts compare exactly (the URL parser lowercases them). Ports and paths do
//! not matter: the question is who receives the key, not how it is addressed.

use std::collections::{BTreeMap, BTreeSet};

use crate::schema::{ApiProtocol, ModelSchema, ModelSource, ProprietaryAuth};

/// A reserved credential that a model row would send to a host that does not
/// belong to the credential's provider.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ForeignReservedCredential {
    /// The reserved credential name (env var and Keychain item).
    pub credential: String,
    /// The host the row would send it to. `None` when the endpoint is not an
    /// absolute URL with a host, which no provider host can match.
    pub host: Option<String>,
    /// The hosts that do belong to the credential's provider. Empty when no
    /// built-in row sends this credential at all.
    pub provider_hosts: Vec<String>,
}

/// Whether `name` is a reserved credential (see the module docs), in any
/// ASCII case. A name with any non-ASCII character is reserved outright: no
/// reserved name has one, and a platform's case folding beyond ASCII is not
/// something this check can mirror, so it fails closed.
pub fn is_reserved_credential(name: &str) -> bool {
    if !name.is_ascii() {
        return true;
    }
    let name = name.to_ascii_uppercase();
    car_secrets::CAR_OWNED_SECRET_KEYS
        .iter()
        .any(|owned| owned.eq_ignore_ascii_case(&name))
        || car_secrets::CAR_OWNED_SECRET_PREFIXES
            .iter()
            .any(|prefix| name.starts_with(&prefix.to_ascii_uppercase()))
        || crate::registry::builtin_credential_env_names()
            .iter()
            .any(|reserved| reserved.eq_ignore_ascii_case(&name))
        || car_secrets::KEY_PROVIDERS.iter().any(|provider| {
            provider
                .keys
                .iter()
                .any(|key| key.eq_ignore_ascii_case(&name))
        })
        || car_secrets::is_daemon_private_secret(car_secrets::DEFAULT_SERVICE, &name)
}

/// The first reserved credential `schema` would send to a host outside that
/// credential's provider, or `None` when every credential it sends is either
/// not reserved or sent to one of its provider's hosts.
pub fn foreign_reserved_credential(schema: &ModelSchema) -> Option<ForeignReservedCredential> {
    let (credentials, host) = credential_destination(schema)?;
    let reserved: Vec<String> = credentials
        .into_iter()
        .filter(|name| is_reserved_credential(name))
        .collect();
    if reserved.is_empty() {
        return None;
    }
    let owned = provider_hosts();
    reserved.into_iter().find_map(|credential| {
        let hosts = owned
            .get(&credential.to_ascii_uppercase())
            .cloned()
            .unwrap_or_default();
        let at_home = host.as_ref().is_some_and(|host| hosts.contains(host));
        (!at_home).then(|| ForeignReservedCredential {
            credential,
            host: host.clone(),
            provider_hosts: hosts.into_iter().collect(),
        })
    })
}

/// Credential names (ASCII uppercase) → the hosts the built-in catalog sends
/// each one to.
fn provider_hosts() -> BTreeMap<String, BTreeSet<String>> {
    let mut owned: BTreeMap<String, BTreeSet<String>> = BTreeMap::new();
    for schema in crate::registry::builtin_catalog() {
        let Some((credentials, Some(host))) = credential_destination(&schema) else {
            continue;
        };
        for credential in credentials {
            owned
                .entry(credential.to_ascii_uppercase())
                .or_default()
                .insert(host.clone());
        }
    }
    owned
        .entry("TYPESAFE_API_KEY".into())
        .or_default()
        .insert("api.typesafe.ai".into());
    owned
}

/// The credentials a row sends with each request, and the host it sends them
/// to. `None` for rows that send no caller-named credential: local models,
/// Bedrock (SigV4-signed with the AWS keys to a host derived from the region,
/// never to the row's endpoint as a bearer), and the proprietary credentials
/// whose destination is fixed by the credential itself (Parslee OAuth, ChatGPT
/// subscription).
fn credential_destination(schema: &ModelSchema) -> Option<(Vec<String>, Option<String>)> {
    match &schema.source {
        ModelSource::RemoteApi {
            protocol: ApiProtocol::Bedrock,
            ..
        } => None,
        // An OpenRouter row sends the OpenRouter credential whatever it names
        // in `api_key_env`: the personal key, or the OAuth connection's key.
        ModelSource::RemoteApi {
            protocol: ApiProtocol::OpenRouter,
            endpoint,
            ..
        } => Some((
            vec![
                crate::openrouter::API_KEY_ENV.to_string(),
                car_secrets::OPENROUTER_OAUTH_KEY.to_string(),
            ],
            endpoint_host(endpoint),
        )),
        ModelSource::RemoteApi {
            protocol:
                ApiProtocol::OpenAiCompat
                | ApiProtocol::OpenAiResponses
                | ApiProtocol::Anthropic
                | ApiProtocol::Google
                | ApiProtocol::AzureOpenAi
                | ApiProtocol::VertexAi,
            endpoint,
            ..
        }
        | ModelSource::Proprietary {
            auth: ProprietaryAuth::ApiKeyEnv { .. } | ProprietaryAuth::BearerTokenEnv { .. },
            endpoint,
            ..
        } => Some((schema.all_api_key_envs(), endpoint_host(endpoint))),
        ModelSource::Proprietary {
            auth: ProprietaryAuth::OAuth2Pkce { .. } | ProprietaryAuth::ChatGptSubscription {},
            ..
        }
        | ModelSource::Local { .. }
        | ModelSource::CodexCli { .. }
        | ModelSource::Ollama { .. }
        | ModelSource::Mlx { .. }
        | ModelSource::WhisperCpp { .. }
        | ModelSource::WindowsSpeech {}
        | ModelSource::VllmMlx { .. }
        | ModelSource::ManagedVllmMlx { .. }
        | ModelSource::AppleFoundationModels { .. }
        | ModelSource::Delegated { .. } => None,
    }
}

fn endpoint_host(endpoint: &str) -> Option<String> {
    reqwest::Url::parse(endpoint.trim())
        .ok()
        .and_then(|url| url.host_str().map(str::to_string))
}

#[cfg(test)]
mod tests {
    use super::*;

    /// A built-in row of the given source type, so the fixtures carry every
    /// field a real row does and only the source differs.
    fn builtin_row(source_type: &str) -> ModelSchema {
        crate::registry::builtin_catalog()
            .into_iter()
            .find(|schema| schema.source.kind() == source_type)
            .unwrap_or_else(|| panic!("the built-in catalog has a {source_type} row"))
    }

    fn remote(protocol: ApiProtocol, endpoint: &str, api_key_env: &str) -> ModelSchema {
        let mut schema = builtin_row("remote_api");
        schema.source = ModelSource::RemoteApi {
            endpoint: endpoint.into(),
            api_key_env: api_key_env.into(),
            api_key_envs: vec![],
            api_version: None,
            protocol,
        };
        schema
    }

    fn proprietary(endpoint: &str, auth: ProprietaryAuth) -> ModelSchema {
        let mut schema = builtin_row("proprietary");
        let ModelSource::Proprietary {
            endpoint: row_endpoint,
            auth: row_auth,
            ..
        } = &mut schema.source
        else {
            unreachable!("builtin_row returned a proprietary row");
        };
        *row_endpoint = endpoint.into();
        *row_auth = auth;
        schema
    }

    /// Every reserved name and provider host the tests below rely on, read
    /// from the same sources the check reads, so a catalog edit that moves one
    /// fails here by name rather than inside an unrelated assertion.
    #[test]
    fn the_reserved_names_and_provider_hosts_the_tests_rely_on() {
        for name in [
            "OPENAI_API_KEY",
            "ANTHROPIC_API_KEY",
            "GOOGLE_API_KEY",
            "ELEVENLABS_API_KEY",
            "OPENROUTER_API_KEY",
            "GEMINI_API_KEY",
            "GITHUB_TOKEN",
            "AWS_ACCESS_KEY_ID",
            "AWS_SECRET_ACCESS_KEY",
            "AWS_SESSION_TOKEN",
            car_secrets::OPENROUTER_OAUTH_KEY,
            car_secrets::PARSLEE_ACCESS_TOKEN_KEY,
        ] {
            assert!(is_reserved_credential(name), "{name} must be reserved");
        }
        // Every credential CAR stores for itself, read from the constants its
        // producers use where this crate can reach them.
        for name in car_secrets::CAR_OWNED_SECRET_KEYS.iter().copied().chain([
            car_auth::codex::CODEX_CREDENTIAL_KEY,
            crate::search::TAVILY_API_KEY_ENV,
            // `hf_cache` sends it to the Hub from the daemon's environment.
            "HF_TOKEN",
            "connector:github:tokens",
            "connector:linear:client_secret",
            "connector:notion:Authorization",
            "CAR_SOME_FUTURE_TOKEN",
            "PARSLEE_SOME_FUTURE_SECRET",
        ]) {
            assert!(is_reserved_credential(name), "{name} must be reserved");
        }
        // A non-ASCII name could fold onto a reserved one somewhere.
        for name in ["ÖPENAI_API_KEY", "OPENAI_API_KEY\u{200b}", "ｏｐｅｎａｉ"] {
            assert!(is_reserved_credential(name), "{name:?} fails closed");
        }
        // Windows reads names without regard to case, so every case is reserved.
        for name in [
            "openai_api_key",
            "Anthropic_Api_Key",
            "aws_secret_access_key",
        ] {
            assert!(is_reserved_credential(name), "{name} must be reserved");
        }
        for name in ["MY_GATEWAY_API_KEY", "AZURE_OPENAI_API_KEY", "TEST_API_KEY"] {
            assert!(!is_reserved_credential(name), "{name} is custom-named");
        }
        let owned = provider_hosts();
        let hosts = |name: &str| owned.get(name).cloned().unwrap_or_default();
        assert_eq!(
            hosts("OPENAI_API_KEY"),
            ["api.openai.com".to_string()].into()
        );
        assert_eq!(
            hosts("ANTHROPIC_API_KEY"),
            ["api.anthropic.com".to_string()].into()
        );
        assert_eq!(
            hosts("GOOGLE_API_KEY"),
            ["generativelanguage.googleapis.com".to_string()].into()
        );
        assert_eq!(
            hosts("ELEVENLABS_API_KEY"),
            ["api.elevenlabs.io".to_string()].into()
        );
        assert_eq!(
            hosts("OPENROUTER_API_KEY"),
            ["openrouter.ai".to_string()].into()
        );
        for unsent in ["GITHUB_TOKEN", "GEMINI_API_KEY", "AWS_SECRET_ACCESS_KEY"] {
            assert!(hosts(unsent).is_empty(), "{unsent} has no provider host");
        }
    }

    #[test]
    fn a_reserved_key_sent_to_a_foreign_host_is_reported() {
        let foreign = foreign_reserved_credential(&remote(
            ApiProtocol::OpenAiCompat,
            "https://evil.example/v1",
            "OPENAI_API_KEY",
        ))
        .expect("OPENAI_API_KEY to evil.example is foreign");
        assert_eq!(foreign.credential, "OPENAI_API_KEY");
        assert_eq!(foreign.host.as_deref(), Some("evil.example"));
        assert_eq!(foreign.provider_hosts, ["api.openai.com"]);

        for (endpoint, host) in [
            // A provider host as userinfo or a subdomain prefix is not that host.
            ("https://api.openai.com@evil.example", Some("evil.example")),
            (
                "https://api.openai.com.evil.example",
                Some("api.openai.com.evil.example"),
            ),
            ("http://127.0.0.1:8080/v1", Some("127.0.0.1")),
            // No absolute URL, no host: nothing can match.
            ("api.openai.com", None),
        ] {
            let foreign = foreign_reserved_credential(&remote(
                ApiProtocol::OpenAiCompat,
                endpoint,
                "OPENAI_API_KEY",
            ))
            .unwrap_or_else(|| panic!("{endpoint} must be foreign"));
            assert_eq!(foreign.host.as_deref(), host, "{endpoint}");
        }
    }

    #[test]
    fn a_reserved_key_in_another_case_is_still_reserved() {
        let foreign = foreign_reserved_credential(&remote(
            ApiProtocol::OpenAiCompat,
            "https://evil.example/v1",
            "openai_api_key",
        ))
        .expect("openai_api_key reaches OPENAI_API_KEY on Windows");
        assert_eq!(foreign.credential, "openai_api_key");
        assert_eq!(foreign.provider_hosts, ["api.openai.com"]);
        // ...and at its own provider's host it is allowed in any case.
        assert_eq!(
            foreign_reserved_credential(&remote(
                ApiProtocol::OpenAiCompat,
                "https://api.openai.com/v1",
                "openai_api_key",
            )),
            None
        );
    }

    #[test]
    fn every_reserved_credential_slot_on_a_row_is_checked() {
        // A pooled key in `api_key_envs`.
        let mut pooled = remote(ApiProtocol::OpenAiCompat, "https://evil.example", "MY_KEY");
        if let ModelSource::RemoteApi { api_key_envs, .. } = &mut pooled.source {
            api_key_envs.push("ANTHROPIC_API_KEY".into());
        }
        assert_eq!(
            foreign_reserved_credential(&pooled).unwrap().credential,
            "ANTHROPIC_API_KEY"
        );
        // A proprietary row's bearer or api-key env.
        for auth in [
            ProprietaryAuth::BearerTokenEnv {
                env_var: "AWS_SECRET_ACCESS_KEY".into(),
            },
            ProprietaryAuth::ApiKeyEnv {
                env_var: "GITHUB_TOKEN".into(),
            },
        ] {
            let schema = proprietary("https://evil.example", auth);
            assert!(foreign_reserved_credential(&schema).is_some(), "{schema:?}");
        }
        // An OpenRouter row sends the OpenRouter credential whatever it names.
        let openrouter = remote(
            ApiProtocol::OpenRouter,
            "https://evil.example/api",
            "MY_KEY",
        );
        assert_eq!(
            foreign_reserved_credential(&openrouter).unwrap().credential,
            "OPENROUTER_API_KEY"
        );
        // A daemon-private credential has no provider host at all.
        let private = remote(
            ApiProtocol::OpenAiCompat,
            "https://api.openai.com",
            car_secrets::PARSLEE_ACCESS_TOKEN_KEY,
        );
        assert!(foreign_reserved_credential(&private).is_some());
    }

    #[test]
    fn a_provider_host_and_a_custom_credential_are_allowed() {
        for (protocol, endpoint, credential) in [
            (
                ApiProtocol::OpenAiResponses,
                "https://api.openai.com",
                "OPENAI_API_KEY",
            ),
            // Ports, paths and letter case do not change who receives it.
            (
                ApiProtocol::OpenAiCompat,
                "https://API.OpenAI.com:443/v1/",
                "OPENAI_API_KEY",
            ),
            (
                ApiProtocol::Anthropic,
                "https://api.anthropic.com/v1/messages",
                "ANTHROPIC_API_KEY",
            ),
            (
                ApiProtocol::Google,
                "https://generativelanguage.googleapis.com",
                "GOOGLE_API_KEY",
            ),
            (
                ApiProtocol::OpenRouter,
                "https://openrouter.ai/api",
                "OPENROUTER_API_KEY",
            ),
            // A custom-named credential may go anywhere.
            (
                ApiProtocol::OpenAiCompat,
                "https://evil.example/v1",
                "MY_GATEWAY_API_KEY",
            ),
            (
                ApiProtocol::AzureOpenAi,
                "https://me.openai.azure.com",
                "AZURE_OPENAI_API_KEY",
            ),
        ] {
            assert_eq!(
                foreign_reserved_credential(&remote(protocol, endpoint, credential)),
                None,
                "{endpoint} with {credential}"
            );
        }
        assert_eq!(
            foreign_reserved_credential(&proprietary(
                "https://api.elevenlabs.io",
                ProprietaryAuth::ApiKeyEnv {
                    env_var: "ELEVENLABS_API_KEY".into()
                },
            )),
            None
        );
        // Bedrock signs with the AWS keys to the region's host; its endpoint
        // field is the region, not a destination for a bearer.
        assert_eq!(
            foreign_reserved_credential(&remote(
                ApiProtocol::Bedrock,
                "us-east-1",
                "AWS_ACCESS_KEY_ID"
            )),
            None
        );
    }

    #[test]
    fn every_built_in_row_passes_its_own_check() {
        for schema in crate::registry::builtin_catalog() {
            assert_eq!(foreign_reserved_credential(&schema), None, "{}", schema.id);
        }
    }
}