fix(vertex): support API-key/context-header auth in cached content methods

[TransactCharlie]

Summary

The Vertex cached content methods (create / list / retrieve / update / delete) all authenticate through the shared vertexAuthHeaders helper, which unconditionally fetched an OAuth token from the key credentials and set it on the Authorization header. Because SetExtraHeaders runs first and vertexAuthHeaders runs after, any Authorization header a caller injected via context extra headers was overwritten.

This is the same limitation that affected Embedding before #4200. It prevents a caller that holds short-lived credentials out of band (e.g. a proxy/gateway) from supplying its own bearer token — the exact pattern the Gemini generation endpoints already support via the API-key query-parameter escape hatch.

Changes

vertexAuthHeaders now takes the API-key query-parameter path when the key carries a value (?key=<value>), mirroring the Gemini generation endpoints, and leaves an existing Authorization header (set from context extra headers) intact. When the key has no value it falls back to the previous OAuth-token behaviour.

Because every cached content method funnels through this one helper, the single change covers all five operations.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to Test

Added TestVertexAuthHeaders_APIKeyPreservesInjectedAuthHeader (internal package vertex) asserting that, with an API-key-valued key, the injected Authorization header is preserved and the key query parameter is set.

Breaking changes

• Yes
• No

Related issues

Follow-up to #4200, which applied the same escape hatch to the Embedding method.

Security considerations

No new auth mechanisms introduced. The change reuses the existing authQuery pattern already present in ChatCompletion(), Responses(), and ResponsesStream(). The API key is URL-encoded via url.QueryEscape consistent with all other call sites.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9a16e600-d290-4259-9589-5284d295a9b1

📥 Commits

Reviewing files that changed from the base of the PR and between ac9b4a1 and 19a2b30.

📒 Files selected for processing (2)

• core/providers/vertex/cachedcontents.go
• core/providers/vertex/cachedcontents_auth_test.go

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved Vertex authentication for API key requests by adding the API key to the request while preserving any pre-existing Authorization header.
  • When no API key is provided, requests continue to use OAuth bearer tokens for authentication.
• Tests
  • Added coverage to ensure Authorization headers remain unchanged when using API keys and that the request includes the expected key parameter.

Walkthrough

Vertex cached-content authentication now uses an API key query parameter when provided and preserves existing authorization headers. It retains OAuth bearer-token handling when no API key is provided. A test covers the API key behavior.

Changes

Vertex authentication

Layer / File(s)	Summary
Authentication selection and validation core/providers/vertex/cachedcontents.go, core/providers/vertex/cachedcontents_auth_test.go	vertexAuthHeaders uses the API key query parameter when present. Otherwise, it sets an OAuth bearer token. The test verifies API key injection and preservation of the existing Authorization header.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the Vertex cached content authentication fix and the supported API-key and context-header behavior.
Description check	✅ Passed	The description covers the purpose, changes, testing, affected area, security considerations, breaking changes, related issue, and checklist.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

The merge-base changed after approval.

[TransactCharlie]

I updated this branch to resolve conflicts. Please review and merge if you are happy with this change.

[TransactCharlie]

Heya -- Gentle prod to see if this could be merged if it's acceptable please.

[TransactCharlie]

Hi again -- we'd really appreciate this getting merged if you think it is acceptable. We are considering having to fork and we would really rather avoid that. Appreciate there are hundreds of open PR's but this one I think is pretty tiny with a scoped blast radius.

🙏

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.