mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-24 16:41:30 +02:00
5a49b58d5d
Adds POST /api/agent-network/catalog/providers/models, so the provider form can offer the models an operator's own credential can reach instead of only the compiled-in catalog. A caller names a catalog provider and supplies either the key they are typing (the record does not exist yet) or the id of a saved record whose stored credential should be reused — which lets the dashboard refresh a list without ever holding the key. The two are mutually exclusive: accepting both would run an arbitrary credential under the identity of a record the caller may only be permitted to read. When a record id is given, the catalog id and upstream come from the record too, so the credential cannot be aimed at a different vendor's endpoint. Gated on Create rather than Read. This spends the operator's credential against a third party, which is not something a read-only role should be able to make the server do. A provider with no listing endpoint answers 422 rather than 500: the caller falls back to the catalog's own models on that outcome, so it has to be distinguishable from a failure. The region is read back out of the configured upstream by matching it against the catalog's host template, since a provider record has no region field and the operator already encoded one when they set up inference. An upstream matching no template is refused rather than guessed at — a wrong region would dial another account's endpoint.