feat: filter ListAllModels provider fan-out by virtual key's allowed providers to suppress noisy governance errors

[BearTS]

Summary

When GET /v1/models is called with a virtual key, ListAllModels previously fanned out to every configured provider. Governance would then reject providers outside the virtual key's allowed set, producing noisy, expected errors in request logs. This PR scopes the provider fan-out to only the providers permitted by the virtual key.

Changes

• Added filterProvidersByContext in core/bifrost.go that reads BifrostContextKeyAvailableProviders from the request context and filters the provider list before fan-out. If the context value is malformed, it fails closed and returns an empty list.
• Added applyListModelsVirtualKeyProviderFilter in a new list_models_vk.go handler file. When a virtual key is present on a GET /v1/models request with no explicit provider, it resolves the virtual key, extracts its allowed providers, and sets BifrostContextKeyAvailableProviders on the Bifrost context before the fan-out occurs. Inactive or missing virtual keys are silently skipped; lookup failures return an error response.
• The listModels handler in inference.go now calls applyListModelsVirtualKeyProviderFilter before dispatching to ListAllModels when no specific provider is requested.
• Updated the BifrostContextKeyAvailableProviders comment to clarify it is set by internal bifrost components rather than bifrost alone.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

go test ./core/... ./transports/bifrost-http/handlers/...

• Make a GET /v1/models request with a virtual key scoped to a subset of providers and confirm only those providers' models are returned with no governance rejection errors in the logs.
• Make a GET /v1/models request without a virtual key and confirm all configured providers are still queried.
• Make a GET /v1/models request with an inactive or unknown virtual key and confirm all providers are still queried without errors.

Screenshots/Recordings

N/A

Breaking changes

• Yes
• No

Related issues

N/A

Security considerations

The virtual key lookup fails closed on malformed context values and returns a 503 if the config store is unavailable, preventing unintended provider exposure. An unrecognized or inactive virtual key falls through without restricting providers, preserving existing behavior.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

Summary by CodeRabbit

• New Features

  • Model listing now supports provider filtering through virtual key configurations, enabling restricted access to specific providers based on authentication context.

• Tests

  • Added comprehensive test coverage for virtual key-based provider filtering and context handling.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5556e92b-c1a2-4733-a689-d017c5b038c1

📥 Commits

Reviewing files that changed from the base of the PR and between a841dd4 and aef283d.

📒 Files selected for processing (2)

• core/bifrost.go
• core/bifrost_test.go

---

📝 Walkthrough

Walkthrough

This PR implements context-driven provider filtering for the model listing endpoint. Virtual-key information from HTTP requests populates a context key that the core ListAllModels function reads to restrict which providers are queried, enabling VK-based access control at the provider fan-out level.

Changes

VK-Based Provider Filtering

Layer / File(s)	Summary
Core provider filtering mechanism core/bifrost.go, core/bifrost_test.go	filterProvidersByContext reads BifrostContextKeyAvailableProviders from context and intersects with configured providers, failing closed on malformation; ListAllModels applies this filter before launching concurrent provider queries; tests verify no-filter pass-through, valid intersection, empty denial, and type-safety failure cases.
Virtual-key-based HTTP handler filtering transports/bifrost-http/handlers/list_models_vk.go, transports/bifrost-http/handlers/list_models_vk_test.go	Handler applyListModelsVirtualKeyProviderFilter extracts and validates VK from request, resolves via ConfigStore, and populates context with active provider names (trimmed, non-empty) or returns early for missing/not-found/inactive VK; returns 503 on missing ConfigStore, 500 on resolution errors; comprehensive test suite covers success, error, not-found, and inactive scenarios.
Endpoint integration transports/bifrost-http/handlers/inference.go	listModels handler invokes VK filtering before model listing when no explicit provider is specified, short-circuiting on filter errors.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related issues

• maximhq/bifrost#2887: Context-based provider filtering prevents unwanted multi-provider fan-out from ListAllModels when VK access restrictions apply.
• maximhq/bifrost#2993: Same code area fix—restricts provider selection in ListAllModels via context-driven filtering from VK configuration.

Possibly related PRs

• maximhq/bifrost#3924: Both PRs use schemas.BifrostContextKeyAvailableProviders to constrain provider selection; this PR filters model-list fan-out, while #3924 applies the same key to router/fallback selection.

Suggested reviewers

• danpiths
• roroghost17

Poem

🐰 A virtual key arrives with a whisper,
Provider names trim and filter, a glister,
Context flows deep through the core,
Concurrent queries now constrained more—
Fan-out tamed by context's decree! 🌾

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main feature: filtering ListAllModels provider fan-out based on virtual key permissions to reduce governance errors.
Description check	✅ Passed	The description covers all required template sections with comprehensive details about changes, testing instructions, security considerations, and completed checklist items.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/2887-vk-list-models-filter

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[BearTS]

• feat: filter ListAllModels provider fan-out by virtual key's allowed providers to suppress noisy governance errors #3796 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 5/5

Safe to merge; the filtering logic is correct, all edge cases are tested, and the change is narrowly scoped to the ListAllModels fan-out path.

The core filtering logic in filterProvidersByContext is sound — nil context, absent key, malformed type-assertion, and empty allow-list are all handled correctly. The IsActiveValue() usage in list_models_vk.go correctly treats a nil IsActive pointer as active, closing the gap flagged in the prior review thread. The only open item is a documentation discrepancy: the schema comment for BifrostContextKeyAvailableProviders was not updated despite being mentioned in the PR description, but this does not affect runtime behavior.

core/schemas/bifrost.go — the BifrostContextKeyAvailableProviders comment was not updated despite being mentioned in the PR description.

Important Files Changed

Filename	Overview
core/bifrost.go	Adds filterProvidersByContext to scope ListAllModels fan-out by BifrostContextKeyAvailableProviders; correctly handles nil context, absent key, malformed value, and empty allowed list.
core/bifrost_test.go	Adds unit tests for filterProvidersByContext covering nil context, normal filter, empty allow-list, and malformed context value; good coverage.
transports/bifrost-http/handlers/inference.go	Wires in applyListModelsVirtualKeyProviderFilter before the fan-out only when no explicit provider is requested; short-circuits correctly on failure.
transports/bifrost-http/handlers/list_models_vk.go	New handler helper resolves virtual key, extracts allowed providers, and sets BifrostContextKeyAvailableProviders; uses IsActiveValue() correctly, error/nil handling is sound.
transports/bifrost-http/handlers/list_models_vk_test.go	Comprehensive tests covering active VK, lookup failure, missing config store, nil/ErrNotFound return, and inactive VK; the ErrNotFound sub-case from the prior review thread is now present.

_{Reviews (4): Last reviewed commit: "fix: isActive pointer references" | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@transports/bifrost-http/handlers/list_models_vk.go`:
- Line 39: The SendError call currently includes the raw error
(fmt.Sprintf("Failed to resolve virtual key: %v", err)) which may leak DB
internals; change it to send a generic client-facing message like "Failed to
resolve virtual key" via SendError(ctx, fasthttp.StatusInternalServerError,
"Failed to resolve virtual key") and log the full error separately using the
request/context logger (e.g., processLogger.Errorf or ctx-logger) so the
detailed error is recorded for operators while the client only receives
non-sensitive text; update the call in list_models_vk.go where SendError is
invoked and add a separate log statement that includes err.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ee9557c3-fb14-4f1a-b578-9eec7355bdb1

📥 Commits

Reviewing files that changed from the base of the PR and between 3805879 and a841dd4.

📒 Files selected for processing (6)

• core/bifrost.go
• core/bifrost_test.go
• core/schemas/bifrost.go
• transports/bifrost-http/handlers/inference.go
• transports/bifrost-http/handlers/list_models_vk.go
• transports/bifrost-http/handlers/list_models_vk_test.go

[akshaydeo]

Merge activity

• Jun 4, 4:58 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 4, 4:59 PM UTC: @akshaydeo merged this pull request with Graphite.