fix: SGL provider - send Authorization header on streaming requests

[hensapir]

Summary

Both streaming entry points in the SGL provider — ChatCompletionStream (core/providers/sgl/sgl.go:205) and TextCompletionStream (core/providers/sgl/sgl.go:153) — pass nil for the authHeader map[string]string parameter to the shared OpenAI streaming helpers (core/providers/sgl/sgl.go:217 and :164). As a result, no Authorization: Bearer <key> header is attached to outbound streaming requests.

SGLang servers configured with --api-key always require the header, so streaming requests fail with HTTP 401 even though non-streaming requests on the same provider work correctly.

The signature mismatch between the two OpenAI helpers is the root cause:

• The non-streaming helper, HandleOpenAIChatCompletionRequest (core/providers/openai/openai.go:795-797), takes the Key directly and builds the auth header itself.
• The streaming helper, HandleOpenAIChatCompletionStreaming (core/providers/openai/openai.go:936), takes a prebuilt authHeader map — the caller is responsible for building it.

Every other openai-compatible provider builds it. vLLM is the canonical pattern (core/providers/vllm/vllm.go:150-153 for TextCompletionStream and :203-206 for ChatCompletionStream):

var authHeader map[string]string
if key.Value.GetValue() != "" {
    authHeader = map[string]string{"Authorization": "Bearer " + key.Value.GetValue()}
}

This PR applies that exact 4-line snippet to both SGL streaming methods.

Changes

• core/providers/sgl/sgl.go — In ChatCompletionStream and TextCompletionStream, build authHeader from key.Value and pass it to the OpenAI streaming helpers, mirroring vLLM.
• core/providers/sgl/chat_test.go — Add TestChatCompletionStream_SetsAuthorizationHeader and TestTextCompletionStream_SetsAuthorizationHeader regression tests. Each spins up an httptest.NewServer configured as the per-key sgl_key_config.url, captures the inbound Authorization header, and asserts it equals "Bearer <key>". Verified that both tests fail on main and pass with this fix. Required minor scaffolding for the test helper: set streamingClient and a no-op logger on newTestSGLProvider, plus a small noopPostHookRunner.
• core/changelog.md — [fix] entry per docs/contributing/raising-a-pr.mdx.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Unit tests (added in this PR)

cd core
go test ./providers/sgl/... -run 'TestChatCompletionStream_SetsAuthorizationHeader|TestTextCompletionStream_SetsAuthorizationHeader' -v

Both tests pass on this branch and fail on main.

Empirical reproduction against a real SGLang backend

With a minimal config:

"sgl": {
  "keys": [{
    "name": "test",
    "value": "<the SGLang --api-key value>",
    "weight": 1,
    "models": ["my-model"],
    "sgl_key_config": { "url": "https://my-sglang-server" }
  }]
}

Before the fix:

• POST /v1/chat/completions with {"stream": false} → 200 OK; upstream receives Authorization: Bearer <key>.
• POST /v1/chat/completions with {"stream": true} → 401 from upstream; no Authorization header sent.

Same pattern for /v1/completions (text completion).

After the fix, the streaming variant matches the non-streaming behavior and returns 200 OK with the auth header attached.

Breaking changes

• Yes
• No

Related issues

None linked — happy to file one if maintainers prefer.

Security considerations

The fix sends the API key in the Authorization header on streaming requests, identical to the non-streaming path and to every peer openai-compatible provider. No new secret-handling surface.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

Summary by CodeRabbit

• Bug Fixes
  • Fixed SGL provider to properly send the Authorization header on streaming requests. Previously, authentication credentials were not included when using streaming for chat and text completions. This has been corrected to ensure all streaming requests are properly authenticated and maintain consistent behavior across endpoints.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0efc45f2-a1f0-4981-b2ad-d3e6aaea32ed

📥 Commits

Reviewing files that changed from the base of the PR and between 97cdf66 and 2fdc757.

📒 Files selected for processing (2)

• core/changelog.md
• core/providers/sgl/sgl.go

---

📝 Walkthrough

Walkthrough

The PR ensures SGL streaming endpoints send Authorization: Bearer <key> when an API key is present, updates tests/utilities to capture streaming requests, and adds a changelog entry documenting the fix.

Changes

SGL Streaming Authorization Header Fix

Layer / File(s)	Summary
Core Implementation core/providers/sgl/sgl.go	TextCompletionStream and ChatCompletionStream now build per-request authHeader maps with Authorization: Bearer <key> when key.Value is non-empty and pass them to the OpenAI streaming handlers instead of nil.
Test Utilities core/providers/sgl/chat_test.go	Adds testLogger, a shared fasthttp.Client in newTestSGLProvider, noopPostHookRunner, drainStream, and streamCaptureServer to capture streaming requests and avoid goroutine leaks.
Regression Tests core/providers/sgl/chat_test.go	TestChatCompletionStream_SetsAuthorizationHeader and TestTextCompletionStream_SetsAuthorizationHeader assert streaming requests include Authorization: Bearer <apiKey> and drain streams.
Documentation core/changelog.md	Adds a changelog entry describing the streaming authorization header fix.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related issues

• [Bug]: Ollama provider streaming requests omit Authorization header for Ollama Cloud #3905 — Addresses the same missing Authorization header behavior in a provider's streaming path.

Suggested reviewers

• akshaydeo
• danpiths

Poem

I hopped through streams to find the key,
A Bearer token set for all to see,
Tests stood guard and caught the call,
Streams sing true — no headers fall. 🐇✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: fixing the SGL provider to send the Authorization header on streaming requests, which directly matches the core issue addressed in the PR.
Description check	✅ Passed	The description comprehensively covers all major template sections: summary of the problem, detailed changes across three files, type of change, affected areas, testing instructions with specific commands, security considerations, and a completed checklist.
Docstring Coverage	✅ Passed	Docstring coverage is 85.71% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Confidence Score: 4/5

The streaming auth fix is correct and well-tested; the only blocker is that the changelog file was accidentally emptied instead of having a new entry prepended.

The core change in sgl.go is a straightforward, well-precedented fix that correctly mirrors the vLLM pattern and is covered by two new regression tests. The changelog file, however, was left completely empty — all 23 existing release-history entries were removed and no new fix entry was added — which is a concrete data-loss issue that needs to be corrected before merging.

core/changelog.md — all existing entries deleted, new fix entry missing.

Important Files Changed

Filename	Overview
core/providers/sgl/sgl.go	Adds authHeader construction to TextCompletionStream and ChatCompletionStream, mirroring the vLLM pattern exactly; fix is correct and complete.
core/providers/sgl/chat_test.go	Adds two regression tests with an httptest server, buffered auth capture channel, and goroutine-safe drainStream helper; test scaffolding is solid.
core/changelog.md	All 23 existing entries were deleted and no new entry was added; the file is now empty, which erases release history.

_{Reviews (3): Last reviewed commit: "Merge branch 'dev' into fix/sgl-streamin..." | Re-trigger Greptile}

The base branch was changed.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ hensapir
❌ akshaydeo
_{You have signed the CLA already but the status is still pending? Let us recheck it.}