feat: add `dual_credential_conflict_behavior` config option with UI selector for dual-auth conflict handling by BearTS · Pull Request #5235 · maximhq/bifrost

BearTS · 2026-07-15T09:22:09Z

Summary

Adds a configurable DualCredentialConflictBehavior setting that controls how inference requests presenting both an IDP access token (Authorization: Bearer) and a virtual key (x-bf-vk) are handled. Previously there was no explicit control over this conflict, and the behavior defaulted implicitly to preferring the IDP token.

Changes

Added dual_credential_conflict_behavior to the CoreConfig type with allowed values "prefer_idp", "prefer_vk", and "error", defaulting to "prefer_idp".
Updated the config update handler to only write DualCredentialConflictBehavior when the field is explicitly provided (non-empty), preventing accidental clearing of the stored default.
Added a Select dropdown in the Security settings view (enterprise-only) allowing users to choose between Prefer IDP token, Prefer virtual key, and Reject request.
Change detection for this field treats an unset value as equivalent to "prefer_idp" to avoid false positives when comparing against the default.

Type of change

Affected areas

How to test

# Core/Transports
go test ./transports/bifrost-http/...

# UI
cd ui
pnpm i
pnpm build

Navigate to Workspace → Config → Security on an Enterprise instance.
Confirm the Dual Credential Conflict Behavior dropdown is visible with three options: Prefer IDP token, Prefer virtual key, and Reject request.
Change the value and save — verify the setting persists across page reloads.
Send an inference request with both Authorization: Bearer <token> and x-bf-vk: <key> headers and confirm the gateway behaves according to the selected mode.
Confirm the dropdown is not visible on non-Enterprise instances.

Screenshots/Recordings

Add before/after screenshots of the Security settings panel showing the new dropdown.

Breaking changes

No

The default value (prefer_idp) preserves existing behavior, and the handler guard ensures an empty payload field does not overwrite a stored value.

Related issues

Link related issues and discussions. Example: Closes #123

Security considerations

This setting directly affects authentication precedence when dual credentials are presented. Operators should review their desired behavior — choosing "prefer_vk" drops the IDP token entirely, and "error" will reject any request presenting both credentials, which may impact existing clients sending both headers.

Checklist

I read docs/contributing/README.md and followed the guidelines
I added/updated tests where appropriate
I updated documentation where needed
I verified builds succeed (Go and UI)
I verified the CI pipeline passes locally if applicable

coderabbitai · 2026-07-15T09:22:16Z

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 17 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a3fdff4e-9ec6-4c24-903f-2371d0ca057a

📥 Commits

Reviewing files that changed from the base of the PR and between 7b7dcf6 and 013782d.

📒 Files selected for processing (3)

transports/bifrost-http/handlers/config.go
ui/app/workspace/config/views/securityView.tsx
ui/lib/types/config.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch 07-15-chore_add_dual_credential_conflict_behavior_settings_in_ui

_{Comment @coderabbitai help to get the list of available commands.}

BearTS · 2026-07-15T09:22:24Z

feat: add dual_credential_conflict_behavior config option with UI selector for dual-auth conflict handling #5235 👈 (View in Graphite)
feat: add dual_credential_conflict_behavior to resolve IDP token + VK conflicts on inference requests #5201
main

This stack of pull requests is managed by Graphite. Learn more about stacking.

greptile-apps · 2026-07-15T09:24:42Z

Confidence Score: 4/5

The config save path should be fixed before merging.

The UI selector and type changes are consistent.
The persistence failure path can still activate an unsaved authentication policy because the update candidate aliases the live config.

transports/bifrost-http/handlers/config.go

Important Files Changed

Filename	Overview
transports/bifrost-http/handlers/config.go	Adds the policy update guard and reorders persistence, but the live config is still mutated before the save completes.
ui/app/workspace/config/views/securityView.tsx	Adds the enterprise selector and default-aware change detection.
ui/lib/types/config.ts	Adds the policy type and default value.

_{Reviews (2): Last reviewed commit: "chore: add dual credential conflict beha..." | Re-trigger Greptile}

akshaydeo · 2026-07-16T04:20:44Z

Merge activity

Jul 16, 4:20 AM UTC: A user started a stack merge that includes this pull request via Graphite.
Jul 16, 4:22 AM UTC: @akshaydeo merged this pull request with Graphite.

The base branch was changed.

…elector for dual-auth conflict handling (maximhq#5235) ## Summary Adds a configurable `DualCredentialConflictBehavior` setting that controls how inference requests presenting both an IDP access token (`Authorization: Bearer`) and a virtual key (`x-bf-vk`) are handled. Previously there was no explicit control over this conflict, and the behavior defaulted implicitly to preferring the IDP token. ## Changes - Added `dual_credential_conflict_behavior` to the `CoreConfig` type with allowed values `"prefer_idp"`, `"prefer_vk"`, and `"error"`, defaulting to `"prefer_idp"`. - Updated the config update handler to only write `DualCredentialConflictBehavior` when the field is explicitly provided (non-empty), preventing accidental clearing of the stored default. - Added a `Select` dropdown in the Security settings view (enterprise-only) allowing users to choose between **Prefer IDP token**, **Prefer virtual key**, and **Reject request**. - Change detection for this field treats an unset value as equivalent to `"prefer_idp"` to avoid false positives when comparing against the default. ## Type of change - [ ] Bug fix - [x] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [ ] Core (Go) - [x] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [x] UI (React) - [ ] Docs ## How to test ```sh # Core/Transports go test ./transports/bifrost-http/... # UI cd ui pnpm i pnpm build ``` 1. Navigate to **Workspace → Config → Security** on an Enterprise instance. 2. Confirm the **Dual Credential Conflict Behavior** dropdown is visible with three options: `Prefer IDP token`, `Prefer virtual key`, and `Reject request`. 3. Change the value and save — verify the setting persists across page reloads. 4. Send an inference request with both `Authorization: Bearer <token>` and `x-bf-vk: <key>` headers and confirm the gateway behaves according to the selected mode. 5. Confirm the dropdown is **not** visible on non-Enterprise instances. ## Screenshots/Recordings _Add before/after screenshots of the Security settings panel showing the new dropdown._ ## Breaking changes - [x] No The default value (`prefer_idp`) preserves existing behavior, and the handler guard ensures an empty payload field does not overwrite a stored value. ## Related issues Link related issues and discussions. Example: Closes maximhq#123 ## Security considerations This setting directly affects authentication precedence when dual credentials are presented. Operators should review their desired behavior — choosing `"prefer_vk"` drops the IDP token entirely, and `"error"` will reject any request presenting both credentials, which may impact existing clients sending both headers. ## Checklist - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable

feat: add dual credential conflict configuration

7b7dcf6

BearTS marked this pull request as ready for review July 15, 2026 09:22

BearTS mentioned this pull request Jul 15, 2026

feat: add dual_credential_conflict_behavior to resolve IDP token + VK conflicts on inference requests #5201

Merged

18 tasks

BearTS changed the title ~~chore: add dual credential conflict behavior settings in ui~~ feat: add dual_credential_conflict_behavior config option with UI selector for dual-auth conflict handling Jul 15, 2026

greptile-apps Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread transports/bifrost-http/handlers/config.go

chore: add dual credential conflict behavior settings in ui

013782d

BearTS force-pushed the 07-15-chore_add_dual_credential_conflict_behavior_settings_in_ui branch from ea64c24 to 013782d Compare July 15, 2026 10:18

coderabbitai Bot previously approved these changes Jul 15, 2026

View reviewed changes

BearTS mentioned this pull request Jul 15, 2026

chore: release Bifrost Helm chart v2.1.29 #5241

Merged

18 tasks

akshaydeo changed the base branch from 07-14-feat_add_dual_credential_conflict_configuration to graphite-base/5235 July 16, 2026 04:21

akshaydeo changed the base branch from graphite-base/5235 to main July 16, 2026 04:21

akshaydeo merged commit 23da971 into main Jul 16, 2026
11 checks passed

akshaydeo deleted the 07-15-chore_add_dual_credential_conflict_behavior_settings_in_ui branch July 16, 2026 04:22

Navigation Menu

feat: add `dual_credential_conflict_behavior` config option with UI selector for dual-auth conflict handling - #5235

feat: add `dual_credential_conflict_behavior` config option with UI selector for dual-auth conflict handling#5235
akshaydeo merged 2 commits into
mainfrom
07-15-chore_add_dual_credential_conflict_behavior_settings_in_ui

BearTS commented Jul 15, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 15, 2026 •

edited

Loading

Review limit reached

Uh oh!

BearTS commented Jul 15, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Jul 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

akshaydeo commented Jul 16, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

BearTS commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Type of change

Affected areas

How to test

Screenshots/Recordings

Breaking changes

Related issues

Security considerations

Checklist

Uh oh!

coderabbitai Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

BearTS commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 4/5

Important Files Changed

Uh oh!

Uh oh!

akshaydeo commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge activity

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

BearTS commented Jul 15, 2026 •

edited

Loading

coderabbitai Bot commented Jul 15, 2026 •

edited

Loading

BearTS commented Jul 15, 2026 •

edited

Loading

greptile-apps Bot commented Jul 15, 2026 •

edited

Loading

akshaydeo commented Jul 16, 2026 •

edited

Loading