fix(auth): support x-api-key header for /v1/models endpoint

[RedwindA]

PR 类型

• Bug 修复
• 新功能
• 文档更新
• 其他

PR 是否包含破坏性更新？

• 是
• 否

PR 描述

修复 #2422

问题: 当客户端仅使用 Anthropic 的 x-api-key 头部（不带 Bearer Token）请求 /v1/models 端点时，返回 401 未授权错误。

原因: middleware/auth.go 中的 TokenAuth() 中间件仅对 /v1/messages 路径提取 x-api-key 头部，未对 /v1/models 路径进行相同处理。

解决方案: 扩展 TokenAuth() 中间件的路径检查条件，使其同时支持 /v1/messages 和 /v1/models 路径的 x-api-key 头部认证。

这与 router/relay-router.go 中已有的 Anthropic 格式路由适配保持一致。

Summary by CodeRabbit

• Bug Fixes
  • Enhanced authentication validation to properly verify API credentials for additional endpoints, strengthening security coverage across supported operations.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

The TokenAuth middleware path check is expanded from only detecting "/v1/messages" to detecting both "/v1/messages" and "/v1/models" endpoints. The Anthropic API key lookup and Authorization header setting now apply to both paths.

Changes

Cohort / File(s)	Summary
Anthropic auth path expansion middleware/auth.go	Broadened path condition in TokenAuth from /v1/messages only to include /v1/models using logical OR, enabling Anthropic Authorization header for both endpoints

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

• Single-file change affecting only a conditional expression
• Straightforward logic expansion with minimal complexity
• No new functionality or control-flow changes introduced

Possibly related PRs

• fix: fetch upstream models #2394: Updates middleware to add Anthropic Authorization for /v1/models endpoint when fetching models, directly aligned with this change.
• Fix/gemini-fetch-models #1517: Modifies /v1/models endpoint handling to use Authorization headers instead of embedding keys in requests.
• feat: add GetClaudeAuthHeader function and update FetchUpstreamModels to support Anthropic channel type #1984: Adds Claude-specific header helpers and updates model fetching to use Anthropic auth headers in a related manner.

Suggested reviewers

• seefs001

Poem

🐰 Two paths now dance in auth's embrace,
/v1/messages, /v1/models in the same space,
Where Anthropic keys unlock the door,
Headers set for both—and more!
Middleware hops with joy once more! 🔐✨

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately describes the main change: extending x-api-key header support to the /v1/models endpoint in the auth middleware.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

middleware/auth.go (1)

196-202: LGTM! Change correctly extends x-api-key support to /v1/models endpoint.

The logic change successfully addresses the PR objective by allowing the /v1/models endpoint to accept Anthropic's x-api-key header. The implementation mirrors the existing /v1/messages handling.

Optional: Consider using HasPrefix for more precise matching.

The current implementation uses strings.Contains(), which performs substring matching. This could match unintended paths (e.g., /api/v1/models, /v1/models_backup). For consistency with the Gemini API handling (lines 204-206) and more precise matching, consider refactoring to use strings.HasPrefix():

-	// 检查path包含/v1/messages或/v1/models
-	if strings.Contains(c.Request.URL.Path, "/v1/messages") || strings.Contains(c.Request.URL.Path, "/v1/models") {
+	// 检查path以/v1/messages或/v1/models开头
+	if strings.HasPrefix(c.Request.URL.Path, "/v1/messages") || strings.HasPrefix(c.Request.URL.Path, "/v1/models") {
 		anthropicKey := c.Request.Header.Get("x-api-key")
 		if anthropicKey != "" {
 			c.Request.Header.Set("Authorization", "Bearer "+anthropicKey)
 		}
 	}

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 689c431 and 61328a0.

📒 Files selected for processing (1)

• middleware/auth.go (1 hunks)

[RedwindA]

与 #2425 重复