Conversation
|
|
Collaborator
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
This was referenced Apr 16, 2026
Contributor
📝 WalkthroughWalkthroughRetires Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Confidence Score: 5/5Safe to merge — migration is metadata-only, context propagation is consistent, and the only finding is a cosmetic variable naming nit. All remaining findings are P2 style suggestions. The migration is safe on Postgres, the GORM model matches the DB column, and the relay/logging propagation follows established patterns throughout the codebase. No files require special attention. Important Files Changed
Reviews (5): Last reviewed commit: "feat: consolidate user identity context ..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
plugins/governance/main.go (1)
1436-1477:⚠️ Potential issue | 🟠 MajorUser-authenticated MCP calls stop being tracked here.
Line 1441 clears
virtualKeywhenuserIDis present, and Line 1446 then returns before anyUsageUpdateis queued. After this key migration, MCP requests carryingschemas.BifrostContextKeyUserIDwill skip post-call accounting entirely, so user-scoped governance limits/cost tracking never advance.💡 Suggested fix
// When user auth is present, skip VK usage tracking to avoid double-counting if userID != "" { virtualKey = "" } - // Skip if no virtual key - if virtualKey == "" { + // Skip only when neither a virtual key nor a user identity is available. + if virtualKey == "" && userID == "" { return resp, bifrostErr, nil } @@ usageUpdate := &UsageUpdate{ VirtualKey: virtualKey, + UserID: userID, Success: success, Cost: toolCost, RequestID: requestID, IsStreaming: false,🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@plugins/governance/main.go` around lines 1436 - 1477, The code clears virtualKey when userID != "" and then returns early, which prevents creating and queuing the UsageUpdate (so user-authenticated MCP calls are never accounted); instead, stop returning early — always build and queue the UsageUpdate even when userID is present: preserve the existing virtualKey/clear it only for attribution logic (or populate a new UserID field on UsageUpdate if available) and remove the early return after setting virtualKey; ensure the UsageUpdate (referenced by UsageUpdate, virtualKey, userID, requestID) is created and queued regardless of userID so MCP post-call accounting runs for user-authenticated requests.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@plugins/governance/main.go`:
- Around line 1436-1477: The code clears virtualKey when userID != "" and then
returns early, which prevents creating and queuing the UsageUpdate (so
user-authenticated MCP calls are never accounted); instead, stop returning early
— always build and queue the UsageUpdate even when userID is present: preserve
the existing virtualKey/clear it only for attribution logic (or populate a new
UserID field on UsageUpdate if available) and remove the early return after
setting virtualKey; ensure the UsageUpdate (referenced by UsageUpdate,
virtualKey, userID, requestID) is created and queued regardless of userID so MCP
post-call accounting runs for user-authenticated requests.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 1211572b-2486-447f-a07b-66941298fd9d
📒 Files selected for processing (12)
core/mcp/toolmanager.gocore/schemas/bifrost.goframework/logstore/migrations.goframework/logstore/tables.goframework/oauth2/main.goplugins/governance/main.goplugins/logging/main.goplugins/logging/writer.gotransports/bifrost-http/handlers/mcpserver.gotransports/bifrost-http/handlers/realtime_client_secrets.gotransports/bifrost-http/handlers/realtime_client_secrets_test.gotransports/bifrost-http/handlers/webrtc_realtime.go
danpiths
force-pushed
the
feature/04-16-feat_consolidate_user_identity_context_key_and_propagate_user_name
branch
from
50ff0e0 to
af73b47
Compare
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
transports/bifrost-http/handlers/realtime_client_secrets.go (1)
100-105: Minor naming inconsistency:governanceUserIDvariable name is now misleading.Since
BifrostContextKeyUserIDis no longer governance-scoped (after removingBifrostContextKeyGovernanceUserID), the variable namegovernanceUserIDis slightly confusing. Consider renaming touserIDfor clarity.♻️ Suggested rename for clarity
-if governanceUserID, ok := ctx.UserValue(schemas.BifrostContextKeyUserID).(string); ok && governanceUserID != "" { - bifrostCtx.SetValue(schemas.BifrostContextKeyUserID, governanceUserID) +if userID, ok := ctx.UserValue(schemas.BifrostContextKeyUserID).(string); ok && userID != "" { + bifrostCtx.SetValue(schemas.BifrostContextKeyUserID, userID) }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@transports/bifrost-http/handlers/realtime_client_secrets.go` around lines 100 - 105, The variable name governanceUserID is misleading because BifrostContextKeyUserID is no longer governance-scoped; rename the local variable to userID in the block that reads ctx.UserValue(schemas.BifrostContextKeyUserID) and then calls bifrostCtx.SetValue(schemas.BifrostContextKeyUserID, ...), so change references of governanceUserID to userID to improve clarity in the realtime_client_secrets.go snippet.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@transports/bifrost-http/handlers/realtime_client_secrets.go`:
- Around line 100-105: The variable name governanceUserID is misleading because
BifrostContextKeyUserID is no longer governance-scoped; rename the local
variable to userID in the block that reads
ctx.UserValue(schemas.BifrostContextKeyUserID) and then calls
bifrostCtx.SetValue(schemas.BifrostContextKeyUserID, ...), so change references
of governanceUserID to userID to improve clarity in the
realtime_client_secrets.go snippet.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 88268575-27b2-4046-8297-2671bec02783
📒 Files selected for processing (12)
core/mcp/toolmanager.gocore/schemas/bifrost.goframework/logstore/migrations.goframework/logstore/tables.goframework/oauth2/main.goplugins/governance/main.goplugins/logging/main.goplugins/logging/writer.gotransports/bifrost-http/handlers/mcpserver.gotransports/bifrost-http/handlers/realtime_client_secrets.gotransports/bifrost-http/handlers/realtime_client_secrets_test.gotransports/bifrost-http/handlers/webrtc_realtime.go
✅ Files skipped from review due to trivial changes (4)
- transports/bifrost-http/handlers/mcpserver.go
- core/mcp/toolmanager.go
- plugins/governance/main.go
- framework/logstore/tables.go
🚧 Files skipped from review as they are similar to previous changes (5)
- transports/bifrost-http/handlers/webrtc_realtime.go
- plugins/logging/main.go
- transports/bifrost-http/handlers/realtime_client_secrets_test.go
- framework/logstore/migrations.go
- core/schemas/bifrost.go
danpiths
force-pushed
the
feature/04-16-feat_consolidate_user_identity_context_key_and_propagate_user_name
branch
2 times, most recently
from
529faf5 to
313d58b
Compare
danpiths
force-pushed
the
feature/04-16-feat_consolidate_user_identity_context_key_and_propagate_user_name
branch
from
313d58b to
3bd057e
Compare
akshaydeo
approved these changes
Apr 17, 2026
Contributor
Merge activity
|
akshaydeo
deleted the
feature/04-16-feat_consolidate_user_identity_context_key_and_propagate_user_name
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates the Bifrost context key used for user identity: removes the
governance-scoped
BifrostContextKeyGovernanceUserIDin favor of a singleBifrostContextKeyUserID(bifrost-user-id), and adds a companionBifrostContextKeyUserName(bifrost-user-name). The user name is threadedthrough the logging + realtime relay paths and persisted as a new
user_namecolumn on the
logstable so downstream UIs can display it without a separatelookup.
Changes
core/schemas/bifrost.go: dropBifrostContextKeyGovernanceUserID; changeBifrostContextKeyUserIDvalue from"user_id"to"bifrost-user-id"; addcompanion
BifrostContextKeyUserNamenext to it. Both carry matching docannotations ("set by enterprise auth middleware — DO NOT SET THIS MANUALLY")
so the pair is discoverable together.
BifrostContextKeyUserID:core/mcp/toolmanager.go,framework/oauth2/main.go,plugins/governance/main.go,transports/bifrost-http/handlers/mcpserver.go,transports/bifrost-http/handlers/realtime_client_secrets.go(+ its test),transports/bifrost-http/handlers/webrtc_realtime.go.plugins/logging/main.go+plugins/logging/writer.go: readUserNamefromcontext and thread it through
applyOutputFieldsToEntryto the log entry.transports/bifrost-http/handlers/realtime_client_secrets.go+webrtc_realtime.go: propagateUserNamefrom the request context onto thebifrost context (and through the realtime relay context).
framework/logstore/tables.go: add nullableUserName *stringto theLogmodel with a
varchar(255)type.framework/logstore/migrations.go: addmigrationAddUserNameColumn— nullable column add, safe on Postgres (metadataonly, no rewrite).
Type of change
Affected areas
How to test
Verify end-to-end:
BifrostContextKeyUserNamevalue via the enterprise authmiddleware (or
X-Bf-User-Id/ OAuth flow that sets user identity).user_nameshould be populated alongsidethe existing
user_id.Realtime:
/v1/realtime/client_secretswithuser-identity headers set and confirm the governance evaluation receives the
consolidated
UserIDand the relay context carries bothUserIDandUserName.No new configs or environment variables are introduced.
Screenshots/Recordings
N/A — backend-only change.
Breaking changes
The old
BifrostContextKeyGovernanceUserIDconstant is removed, but it wasonly documented as "set by enterprise governance plugin — DO NOT SET THIS
MANUALLY", so external callers should not be referencing it. Plugins and
handlers in this repo are updated in-place.
The
BifrostContextKeyUserIDstring value changes from"user_id"to"bifrost-user-id". Any external code that serialized this context key by itsraw string must be updated.
Related issues
N/A
Security considerations
user_namecolumn stores a user-supplied display name on log rows.It inherits the same retention, access-control, and PII posture as the
existing
user_idcolumn.headers without explicit plugin/middleware cooperation.
Checklist
docs/contributing/README.mdand followed the guidelines