fix(vertex): support API-key/context-header auth in cached content methods

core/providers/vertex/cachedcontents.go

@@ -85,8 +85,16 @@ func expandVertexModelPath(model, projectID, region string) string {
 	return fmt.Sprintf("projects/%s/locations/%s/publishers/google/models/%s", projectID, region, model)
 }
 
-// vertexAuthHeaders pulls an OAuth bearer token from the key and applies it.
+// vertexAuthHeaders applies Vertex AI authentication to the request. When the key
+// carries an API key value, it is passed as the "key" query parameter (mirroring
+// the Gemini generation endpoints) and any Authorization header already set from
+// context extra headers is left intact. Otherwise an OAuth bearer token is fetched
+// from the key credentials and set on the Authorization header.
 func vertexAuthHeaders(req *fasthttp.Request, key schemas.Key) *schemas.BifrostError {
+	if key.Value.GetValue() != "" {
+		req.URI().QueryArgs().Set("key", key.Value.GetValue())
+		return nil
+	}
 	tokenSource, err := getAuthTokenSource(key)
 	if err != nil {
 		return providerUtils.NewBifrostOperationError("error creating auth token source", err)

core/providers/vertex/cachedcontents_auth_test.go

@@ -0,0 +1,32 @@
+package vertex
+
+import (
+	"testing"
+
+	"github.com/maximhq/bifrost/core/schemas"
+	"github.com/valyala/fasthttp"
+)
+
+// TestVertexAuthHeaders_APIKeyPreservesInjectedAuthHeader verifies that when the
+// key carries an API key value, vertexAuthHeaders passes it as the "key" query
+// parameter and leaves an Authorization header (set upstream from context extra
+// headers) untouched. This mirrors the Gemini generation endpoints and lets a
+// caller inject its own bearer token via context extra headers.
+func TestVertexAuthHeaders_APIKeyPreservesInjectedAuthHeader(t *testing.T) {
+	req := fasthttp.AcquireRequest()
+	defer fasthttp.ReleaseRequest(req)
+	req.SetRequestURI("https://us-central1-aiplatform.googleapis.com/v1/projects/p/locations/us-central1/cachedContents")
+	req.Header.Set("Authorization", "Bearer injected-token")
+
+	key := schemas.Key{Value: *schemas.NewSecretVar("api-key-123")}
+	if err := vertexAuthHeaders(req, key); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if got := string(req.Header.Peek("Authorization")); got != "Bearer injected-token" {
+		t.Errorf("Authorization header was overwritten: got %q, want the injected token preserved", got)
+	}
+	if got := string(req.URI().QueryArgs().Peek("key")); got != "api-key-123" {
+		t.Errorf("key query parameter: got %q, want %q", got, "api-key-123")
+	}
+}