test(proxy): fence the LLM upstream against member identity#9
Merged
damonleelcx merged 1 commit intoJul 21, 2026
Merged
Conversation
T8 of feishu-first-login-no-email-verify. The first-login change gives every SSO member three new identifying values — the Feishu union_id, the tenant_key, and a synthetic account handle — all of which live in the control plane and have no business on the wire to a model provider. Two fences, because they fail differently: - TestUpstreamRequest_CarriesNoMemberIdentity: the namespace stripper removes identity-shaped annotations that do not exist yet, and leaves the headers the upstream actually needs. Anthropic's OAuth WAF answers an unrecognized header with a 429 carrying no X-RateLimit-Reset — a business rejection that reads as rate limiting and gets diagnosed as such for days. - TestProxySource_DoesNotReferenceMemberIdentityFields: the data plane must not reference union_id / tenant_key / sso.local at all. A stripper removes what someone put on; this asserts nobody has the vocabulary to put it on. If it ever fails, the answer is not another entry in the stripper. Fence proved red: narrowing the stripper to the one header known today -> "identity header \"X-Aikey-Union-Id\" survived and would reach the model provider" "header \"X-Aikey-Union-Id\" carries \"on_stub_union\" to the upstream" Test-only; no production code changed. Edition impact: Personal Y / Trial Y / Production Y / Cluster Y — one proxy forwarding path for all four. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Test-only. No production code changed. Companion to aikey-control-master#14.
Why
The first-login change gives every SSO member three new identifying values — the Feishu
union_id, thetenant_key, and a synthetic account handle. All three live in the control plane and have no business on the wire to a model provider.Anthropic's OAuth WAF answers an unrecognized header with a 429 carrying no
X-RateLimit-Reset— a business rejection that reads as rate limiting and gets diagnosed as such for days. And quite apart from the WAF, shipping a customer's employee identifiers to a third party is a data-collection surface nobody authorized.Two fences, because they fail differently
TestUpstreamRequest_CarriesNoMemberIdentity— the namespace stripper removes identity-shaped annotations that do not exist yet, and leaves the headers the upstream needs.TestProxySource_DoesNotReferenceMemberIdentityFields— the data plane must not referenceunion_id/tenant_key/sso.localat all. A stripper removes what someone put on; this asserts nobody has the vocabulary to put it on. If it ever fails, the answer is not another entry in the stripper.Proved red by narrowing the stripper to the single header known today.