fix(alibaba): make it work again after EU Frankfurt update

[vicovaro]

🔴 URGENT

Since the Alibaba EU-Frankfurt region update (#3525), all standard-routing (bare model id) requests to Alibaba models are broken for coding/DevPass plan users. qwen3.7-flash, qwen3.7-plus, qwen3-vl-flash, qwen3.6-flash and the other latest Alibaba models are Alibaba-only — there is no fallback provider, and on coding plans neither alibaba/ prefix (403) nor :region suffix (400) is allowed. These users have no workaround; they cannot route to Alibaba models at all until this ships. Please prioritize review + release.

Problem

After the Alibaba EU-Frankfurt region update (#3525) and the region-less managed-credentials fix (#3528), bare Alibaba model ids (qwen3.7-flash, qwen3.7-plus, and other latest Alibaba models — no alibaba/ prefix, no :region suffix) still skip region routing entirely.

A bare id makes useExpandedRoutingProviders false, so the catalogue keeps the un-expanded provider mapping (one Alibaba entry, region: undefined). The single-provider shortcut in chat.ts (iamFilteredModelProviders.length === 1) then pins usedRegion = undefined, and the request falls through to the provider's default region. The region-expanded, credential-filtered list that the multi-provider branch prices over is never consulted.

On coding/DevPass plans there is no workaround: provider prefixes are 403 ("Direct provider routing is not available on coding plans") and :region suffixes are 400. So standard routing (bare ids) is the only path those users have — and it cannot resolve Alibaba's per-region routing.

Fix

Gate the single-provider shortcut on the expanded candidate count instead of the provider-level count:

• if (iamFilteredModelProviders.length === 1) → if (expandedIamFilteredModelProviders.length === 1) (shortcut site)
• Same mirror change at the routing-metadata label site

A single provider with several regions (Alibaba with singapore/eu-frankfurt/us-virginia/cn-beijing) now flows through the normal routing branch, where collapseProvidersToBestRegionPerProvider prices regions against each other and resolves a concrete, credentialed region. Genuinely single-candidate models (no regions array) keep the shortcut, unchanged.

Also corrects: bare ids + a provider-key region pin (e.g. alibaba_region: cn-beijing) now honor the pin, since the routing branch applies buildProviderLockedRegions; the shortcut previously ignored it.

Impact

Checked for the shared regional providers: google-vertex, aws-mantle, aws-bedrock (shared credentials across regions), azure (region-scoped, filtered at the same pre-routing step). service_tier narrowing updates both candidate lists in lockstep. Session stickiness is preserved on both paths.

Tests

• New unit tests in apps/gateway/src/chat/managed-credentials.spec.ts (21/21 pass):
  • bare qwen3.7-plus with singapore + eu-frankfurt credentials routes to eu-frankfurt (cheapest), asserting upstream host + credential
  • bare qwen3.7-plus with only the default-region (singapore) credential still resolves to it via the routing branch
  • bare qwen3.7-plus with a BYOK key pinned via options: { alibaba_region: "cn-beijing" } routes to cn-beijing — the pin the shortcut previously bypassed is honored
  • bare qwen3-vl-235b-a22b-instruct (alibaba + novita + deepinfra catalog) with only a novita credential routes to novita
• fix(gateway): fix region-less managed credentials #3528 regression coverage preserved: the default-region credential test now uses qwen-omni-turbo (no regional variants).
• pnpm build — passes (17/17 tasks).
• pnpm test:unit — 0 failures across apps/gateway; the only repo-wide failures are apps/api Stripe/wallet/webhook specs that require a Postgres test DB + external services not provisioned in this environment (pre-existing, unrelated to this change).
• E2E not run (no DashScope key in this environment).

Tested against upstream/main @ e8b84aa.

Summary by CodeRabbit

• Bug Fixes

  • Improved provider routing for models with multiple regional mappings.
  • Ensured bare model IDs consistently use the default region or the most appropriate eligible region.
  • Added support for provider-specific region selection and credential-aware provider routing.

• Tests

  • Expanded coverage for regional routing, default-region behavior, and managed credentials.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0cab1431-8185-4261-b32e-34d38fdaf2d0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Bare model routing now evaluates expanded regional candidates before using the single-provider shortcut. Managed-credential tests cover default-region fallback, cheapest eligible region, provider-key pinning, and provider selection.

Changes

Bare model regional routing

Layer / File(s)	Summary
Single-provider routing guard apps/gateway/src/chat/chat.ts	The shortcut applies only when both provider candidate lists contain one mapping. Multi-region candidates continue through regional routing.
Managed-credential routing coverage apps/gateway/src/chat/managed-credentials.spec.ts	Fixtures accept nullable options. Tests cover default-region routing, cheapest eligible regional routing, default fallback, alibaba_region pinning, and credentialed provider selection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• theopenco/llmgateway#3528: Adds related routing and managed-credential handling for bare model requests.
• theopenco/llmgateway#3234: Modifies managed-credential routing in chat.ts and related tests.
• theopenco/llmgateway#3104: Modifies provider-region routing and default-region selection.

Suggested reviewers: steebchen

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The change routes multi-region bare Alibaba models through expanded routing while preserving single-candidate behavior, satisfying issue #3530.
Out of Scope Changes check	✅ Passed	The code and tests directly support regional routing, credential selection, and regression coverage described in issue #3530.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Alibaba routing fix and its relation to the EU Frankfurt update.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vicovaro]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[steebchen]

Thanks for digging into this — the underlying observation is real and it's now tracked as #3530, but this PR's framing and two of its claims don't hold up, so I'm closing it in favour of #3540, which lands the same one-line gate with a corrected description and a test that's verified red-before/green-after.

I checked all of this against a running gateway on main @ ef4ab7af0, credits mode, using the seeded DevPass Pro org.

The 🔴 URGENT claim does not reproduce. Bare Alibaba ids work fine on coding plans:

request	result
qwen3.7-plus	200 → alibaba/qwen3.7-plus:singapore
qwen3.7-flash	200 → :singapore
qwen3.6-flash	200 → :singapore
qwen3-vl-flash	200 → :singapore

#3528 already covers the region-less case: a mapping with no region is judged on the provider's default region, so the singapore credential serves it. Nobody is locked out, and there is nothing to hotfix.

The provider-key region pin was never ignored. With a BYOK key carrying options: {alibaba_region: "cn-beijing"}, a bare qwen3.7-plus already routes to :cn-beijing on main — the pin is applied at request execution, below the shortcut. So routes a bare multi-region id to a provider-key-pinned region passes before the change too and guards nothing.

The one configuration that genuinely cannot route isn't fixed here. If the deployment has managed Alibaba credentials but none for the default region (I seeded an eu-frankfurt-only credential), the un-expanded mapping is dropped by platformKeyCoversMappingRegion, leaving iamFilteredModelProviders empty — so the request fails before the shortcut is reached. Verified 403 both with and without this patch. If production is actually erroring, that's the shape to chase.

What is real is exactly what #3530 describes: bare ids skip cheapest-region selection. Measured on the same request with singapore + eu-frankfurt credentials — before :singapore at 1.52e-05, after :eu-frankfurt at 1.185e-05. That's worth having, which is why #3540 keeps your gate; it adds the per-provider impact review #3530 asked for (aws-bedrock is unaffected via pinDefaultRegion, aws-mantle's three regions are price-identical, vertex-openai has no multi-region mappings today).

[vicovaro]

@steebchen as long it's getting fixed quickly, I am good.