fix: follow redirects for download in genai passthrough

[TejasGhatte]

Summary

When a client requests a Gemini file download via GET /files/{id}:download, Google's API responds with a 302 redirect to /download/v1beta/.... The redirect target requires the API key, but since Bifrost is the only party holding it, the redirect was previously not followed — resulting in a 403 from Google. This PR fixes that by transparently following redirects (up to 5 hops) for :download GET requests while leaving all other passthrough calls unaffected.

Changes

• For GET requests whose path contains :download, the Gemini passthrough now calls MakeRequestWithContextFollowRedirects instead of MakeRequestWithContext, ensuring the API key is forwarded to the redirect target.
• All other requests (e.g. resumable upload 308 responses with no Location header) continue to use the non-redirect-following path, preventing breakage of those flows.
• Added passthrough_test.go covering three cases: the download redirect is followed and bytes are returned, a resumable upload 308 is forwarded as-is, and ordinary calls are unaffected.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

go test ./core/providers/gemini/...

The new tests spin up a local HTTP server that mimics Google's redirect behaviour. Expected outcomes:

• download follows the redirect and returns the bytes — status 200, body contains the file bytes, and the API key is present on the redirect hop.
• resumable upload 308 is forwarded, not followed — status 308, no error.
• ordinary calls are unaffected — status 404, no redirect handling triggered.

Screenshots/Recordings

N/A

Breaking changes

• Yes
• No

Related issues

N/A

Security considerations

The API key is intentionally forwarded to the redirect target (/download/v1beta/...), which is a first-party Google endpoint. The redirect-following logic is scoped strictly to :download GET requests to prevent the key from being forwarded to arbitrary third-party redirect destinations.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Gemini passthrough redirect handling

Layer / File(s)	Summary
Redirect-aware passthrough execution and validation core/providers/gemini/gemini.go, core/providers/gemini/passthrough_test.go	GET file-download requests follow up to five redirects while preserving the API key; resumable upload 308 responses and ordinary requests remain directly forwarded, with tests covering all three paths.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: akshaydeo, pratham-mishra04

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant GeminiPassthrough
  participant ProviderUtils
  participant UpstreamServer
  Client->>GeminiPassthrough: Send passthrough request
  GeminiPassthrough->>ProviderUtils: Follow redirects for GET :download
  ProviderUtils->>UpstreamServer: Request download endpoint
  UpstreamServer-->>ProviderUtils: 302 redirect
  ProviderUtils->>UpstreamServer: Request redirect target with API key
  UpstreamServer-->>ProviderUtils: Return video bytes
  ProviderUtils-->>GeminiPassthrough: Return response
  GeminiPassthrough-->>Client: Forward response

Loading

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR changes Gemini redirect handling, but issue #123 requires File API support like POST /v1/files uploads for providers.	Implement the File API support described in #123 or retarget the PR to the correct issue before merging.
Out of Scope Changes check	⚠️ Warning	The redirect-following changes are unrelated to the linked File API support requirements in issue #123.	Remove or justify the Gemini redirect work, or update the linked issue to match this scope.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly summarizes the main change: following Gemini download redirects in passthrough.
Description check	✅ Passed	The description matches the template well and covers summary, changes, testing, impact, issues, and security.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 07-27-fix_follow_redirects_for_download_in_genai_passthrough

---

_{Comment @coderabbitai help to get the list of available commands.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

tejas ghatte seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[TejasGhatte]

• fix: follow redirects for download in genai passthrough #5579 👈 (View in Graphite)
• fix: IncludeServerSideToolInvocations field in genai api #5576
• docs: responses retrieve stream #5570
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@core/providers/gemini/gemini.go`:
- Around line 4092-4098: Update the redirect handling in the download branch
around MakeRequestWithContextFollowRedirects so forwarded x-goog-api-key headers
cannot reach untrusted hosts. Constrain redirects to the expected Google
download origin, or remove the API key before any cross-host redirect, while
preserving trusted download redirect behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: f605d09b-d388-4479-9d90-35213877a841

📥 Commits

Reviewing files that changed from the base of the PR and between f3ebadb and b5a9f51.

📒 Files selected for processing (2)

• core/providers/gemini/gemini.go
• core/providers/gemini/passthrough_test.go

[akshaydeo]

Merge activity

• Jul 27, 12:23 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 27, 12:25 PM UTC: @akshaydeo merged this pull request with Graphite.

The base branch was changed.