Marc-André Bombeck 3ef6a7119b test(ai): pin the gateway provider's isolation and host policy ...

The properties this provider has to keep: it resolves against the base
URL that was saved for it, the pinned OpenAI arm cannot see that URL and
still posts to api.openai.com, and the OpenAI key never travels to the
gateway. Each is asserted at the wire, not on internals.

The SSRF floor is checked through the same alt-notation classes the
Local provider is checked against, and the pinned tags are shown to keep
requiring a public host even when the operator opened every private one.

The AI settings connect-src is pinned to what it already allowed: the
gateway is called server-side, so no CSP change is needed, and a future
change that needs one will turn this red.

2026-07-26 22:27:48 +02:00

..

__tests__

test(ai): pin the gateway provider's isolation and host policy

2026-07-26 22:27:48 +02:00

route.ts

feat(ai): resolve an OpenAI-compatible gateway as its own provider

2026-07-26 22:27:48 +02:00