mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-22 14:49:10 +02:00
Hand the agent config to every account member
The agent-config answer withheld the endpoint from callers no policy covers, so "account not set up" and "you have no access" were the same shape. The dashboard shows every user the same connection config, so Configured now tracks the account: once it has an endpoint every member gets it, with an empty providers list for those no policy covers. That list stays caller-scoped, and the endpoint authorizes nothing on its own since the gateway still refuses every request no policy permits. Rename the files and symbols the endpoint outgrew when it became /agent-network/agent-config: me_handler.go, setup.go and types/setup.go become agent_config.go, GetSetupForUser becomes GetAgentConfigForUser, and the AgentNetworkMeSetup schema becomes AgentNetworkAgentConfig. Regenerating types.gen.go from the untouched spec first reproduced it byte for byte, so the generated diff is only these renames.
This commit is contained in:
braginini
@@ -5807,27 +5807,27 @@ components:
|
||||
required:
|
||||
- name
|
||||
- checks
|
||||
AgentNetworkMeSetup:
|
||||
AgentNetworkAgentConfig:
|
||||
type: object
|
||||
description: The caller-scoped Agent Network connection info backing the "My Agent Network" self-service view. Available to every authenticated user; the answer is computed from the caller's own groups and carries display metadata only.
|
||||
description: The caller-scoped Agent Network connection config backing the self-service "Connect your agent" view. Available to every authenticated user; the providers are computed from the caller's own groups and the answer carries display metadata only.
|
||||
properties:
|
||||
configured:
|
||||
type: boolean
|
||||
description: False when the account has no Agent Network set up or the caller's groups authorize none of it. The two cases are deliberately indistinguishable.
|
||||
description: False only when the account has no Agent Network set up. A caller no policy covers yet still reads as configured, with an empty providers list.
|
||||
endpoint:
|
||||
type: string
|
||||
description: The account's Agent Network base URL, reachable over the NetBird tunnel only. Empty when configured is false.
|
||||
description: The account's Agent Network base URL, reachable over the NetBird tunnel only. Returned to every member of a configured account - it authorizes nothing on its own, since the gateway still refuses every request no policy permits. Empty when configured is false.
|
||||
example: https://calm-otter.proxy.example.com
|
||||
providers:
|
||||
type: array
|
||||
description: The providers at least one of the caller's policies authorizes, in creation order.
|
||||
description: The providers at least one of the caller's policies authorizes, in creation order. Empty when no policy covers the caller.
|
||||
items:
|
||||
$ref: '#/components/schemas/AgentNetworkMeProvider'
|
||||
$ref: '#/components/schemas/AgentNetworkAgentConfigProvider'
|
||||
required:
|
||||
- configured
|
||||
- endpoint
|
||||
- providers
|
||||
AgentNetworkMeProvider:
|
||||
AgentNetworkAgentConfigProvider:
|
||||
type: object
|
||||
description: One provider the caller may use, reduced to what a local tool needs for configuration.
|
||||
properties:
|
||||
@@ -13854,7 +13854,7 @@ paths:
|
||||
"$ref": "#/components/responses/internal_error"
|
||||
/api/agent-network/agent-config:
|
||||
get:
|
||||
summary: Retrieve the caller's Agent Network setup
|
||||
summary: Retrieve the caller's Agent Network agent config
|
||||
description: Returns everything the caller needs to configure a local AI tool and nothing more - the account's Agent Network endpoint plus the providers and models the caller's own policies allow. Available to every authenticated user regardless of role; the response never contains provider credentials, policy or guardrail configuration, or providers the caller cannot reach.
|
||||
tags: [ Agent Network ]
|
||||
security:
|
||||
@@ -13862,11 +13862,11 @@ paths:
|
||||
- TokenAuth: [ ]
|
||||
responses:
|
||||
'200':
|
||||
description: The caller-scoped Agent Network connection info
|
||||
description: The caller-scoped Agent Network agent config
|
||||
content:
|
||||
application/json:
|
||||
schema:
|
||||
$ref: '#/components/schemas/AgentNetworkMeSetup'
|
||||
$ref: '#/components/schemas/AgentNetworkAgentConfig'
|
||||
'401':
|
||||
"$ref": "#/components/responses/requires_authentication"
|
||||
'500':
|
||||
|
||||
@@ -1931,6 +1931,36 @@ type AgentNetworkAccessLogsResponse struct {
|
||||
TotalRecords int `json:"total_records"`
|
||||
}
|
||||
|
||||
// AgentNetworkAgentConfig The caller-scoped Agent Network connection config backing the self-service "Connect your agent" view. Available to every authenticated user; the providers are computed from the caller's own groups and the answer carries display metadata only.
|
||||
type AgentNetworkAgentConfig struct {
|
||||
// Configured False only when the account has no Agent Network set up. A caller no policy covers yet still reads as configured, with an empty providers list.
|
||||
Configured bool `json:"configured"`
|
||||
|
||||
// Endpoint The account's Agent Network base URL, reachable over the NetBird tunnel only. Returned to every member of a configured account - it authorizes nothing on its own, since the gateway still refuses every request no policy permits. Empty when configured is false.
|
||||
Endpoint string `json:"endpoint"`
|
||||
|
||||
// Providers The providers at least one of the caller's policies authorizes, in creation order. Empty when no policy covers the caller.
|
||||
Providers []AgentNetworkAgentConfigProvider `json:"providers"`
|
||||
}
|
||||
|
||||
// AgentNetworkAgentConfigProvider One provider the caller may use, reduced to what a local tool needs for configuration.
|
||||
type AgentNetworkAgentConfigProvider struct {
|
||||
// AllModelsAllowed True when no model allowlist restricts this provider for the caller; models then lists the declared or catalog models as a courtesy.
|
||||
AllModelsAllowed bool `json:"all_models_allowed"`
|
||||
|
||||
// ApiFlavor Request-body shape the provider speaks ("anthropic", "openai"). Empty when the gateway dispatches it by URL path instead.
|
||||
ApiFlavor string `json:"api_flavor"`
|
||||
|
||||
// CatalogId Catalog entry id naming the provider type.
|
||||
CatalogId string `json:"catalog_id"`
|
||||
|
||||
// Models The effective model allowlist for the caller (or the declared/catalog models when all_models_allowed is true).
|
||||
Models []string `json:"models"`
|
||||
|
||||
// Name Operator-assigned provider label.
|
||||
Name string `json:"name"`
|
||||
}
|
||||
|
||||
// AgentNetworkBudgetRule Account-level budget rule. A limit-only rule bound to groups and/or users that applies across all policies as a min-wins ceiling. Empty targets means it applies to every caller.
|
||||
type AgentNetworkBudgetRule struct {
|
||||
CreatedAt *time.Time `json:"created_at,omitempty"`
|
||||
@@ -2194,36 +2224,6 @@ type AgentNetworkGuardrailRequest struct {
|
||||
Name string `json:"name"`
|
||||
}
|
||||
|
||||
// AgentNetworkMeProvider One provider the caller may use, reduced to what a local tool needs for configuration.
|
||||
type AgentNetworkMeProvider struct {
|
||||
// AllModelsAllowed True when no model allowlist restricts this provider for the caller; models then lists the declared or catalog models as a courtesy.
|
||||
AllModelsAllowed bool `json:"all_models_allowed"`
|
||||
|
||||
// ApiFlavor Request-body shape the provider speaks ("anthropic", "openai"). Empty when the gateway dispatches it by URL path instead.
|
||||
ApiFlavor string `json:"api_flavor"`
|
||||
|
||||
// CatalogId Catalog entry id naming the provider type.
|
||||
CatalogId string `json:"catalog_id"`
|
||||
|
||||
// Models The effective model allowlist for the caller (or the declared/catalog models when all_models_allowed is true).
|
||||
Models []string `json:"models"`
|
||||
|
||||
// Name Operator-assigned provider label.
|
||||
Name string `json:"name"`
|
||||
}
|
||||
|
||||
// AgentNetworkMeSetup The caller-scoped Agent Network connection info backing the "My Agent Network" self-service view. Available to every authenticated user; the answer is computed from the caller's own groups and carries display metadata only.
|
||||
type AgentNetworkMeSetup struct {
|
||||
// Configured False when the account has no Agent Network set up or the caller's groups authorize none of it. The two cases are deliberately indistinguishable.
|
||||
Configured bool `json:"configured"`
|
||||
|
||||
// Endpoint The account's Agent Network base URL, reachable over the NetBird tunnel only. Empty when configured is false.
|
||||
Endpoint string `json:"endpoint"`
|
||||
|
||||
// Providers The providers at least one of the caller's policies authorizes, in creation order.
|
||||
Providers []AgentNetworkMeProvider `json:"providers"`
|
||||
}
|
||||
|
||||
// AgentNetworkModelDiscoveryRequest defines model for AgentNetworkModelDiscoveryRequest.
|
||||
type AgentNetworkModelDiscoveryRequest struct {
|
||||
// ApiKey Credential to query the vendor with, for a provider that has not been saved yet. Mutually exclusive with provider_id.
|
||||
|
||||
Reference in New Issue
Block a user