Skip to content

feat: add base_url support for OpenAI provider in managed mode#98

Merged
avivhalfon merged 6 commits intomainfrom
ah/feat-openai-base-url/TLP-1865
Mar 4, 2026
Merged

feat: add base_url support for OpenAI provider in managed mode#98
avivhalfon merged 6 commits intomainfrom
ah/feat-openai-base-url/TLP-1865

Conversation

@avivhalfon
Copy link
Contributor

@avivhalfon avivhalfon commented Mar 3, 2026

Important

Add optional base_url support to OpenAIProviderConfig for custom API URL configuration in managed mode.

  • Behavior:
    • Add base_url field to OpenAIProviderConfig in dto.rs for custom OpenAI API URL support.
    • Update transform_provider_dto() in config_provider_service.rs to include base_url in parameters if present.
  • Misc:
    • No changes to existing functionality; only adds optional configuration support.

This description was created by Ellipsis for 518fced. You can customize this summary. It will automatically update as commits are pushed.

Summary by CodeRabbit

  • New Features

    • OpenAI and Azure providers now accept an optional custom base URL for alternative API endpoints; existing configs remain compatible.
  • Behavior

    • When provided, base URLs are propagated into provider configuration parameters for use at request time.
  • Tests

    • Test suites updated and a new integration test verifies creating and retrieving providers with a custom base URL.

@CLAassistant
Copy link

CLAassistant commented Mar 3, 2026

CLA assistant check
All committers have signed the CLA.

Copy link
Contributor

@ellipsis-dev ellipsis-dev bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Important

Looks good to me! 👍

Reviewed everything up to 518fced in 7 seconds. Click for details.
  • Reviewed 26 lines of code in 2 files
  • Skipped 0 files when reviewing.
  • Skipped posting 0 draft comments. View those below.
  • Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.

Workflow ID: wflow_4uUY6Y5FGLMBRAvD

You can customize Ellipsis by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Mar 3, 2026

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Added an optional base_url: Option<String> to the OpenAI provider DTO and propagated trimmed, non-empty base_url into provider params for OpenAI and Azure in the config provider service; updated tests and added a test asserting persistence of base_url.

Changes

Cohort / File(s) Summary
DTO change
src/management/dto.rs
Added pub base_url: Option<String> to OpenAIProviderConfig.
Service propagation
src/management/services/config_provider_service.rs
transform_provider_dto now trims and checks base_url for non-empty values and inserts base_url into provider params for ProviderConfig::OpenAI and ProviderConfig::Azure.
Tests updated / added
tests/model_definition_api_tests.rs, tests/pipelines_api_integration_tests.rs, tests/provider_api_tests.rs
Updated test fixtures to include base_url: None where OpenAIProviderConfig is constructed; added test_create_openai_provider_with_base_url to assert base_url is stored and returned by the API.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 A tiny hop, a URL in tow,
I trimmed its tail so it would show,
Pushed it to OpenAI and Azure's door,
Stored and fetched — I’m thumping for more! 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 63.64% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: adding optional base_url support to OpenAIProviderConfig for managed mode, which is the core addition across all modified files.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch ah/feat-openai-base-url/TLP-1865

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.


Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions
Copy link
Contributor

github-actions bot commented Mar 3, 2026

🔒 Container Vulnerability Scan (hub-migrations - amd64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/v0.65/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub-migrations:f2f743de08eb2d2ce29144eab97ec6df559aee97-amd64 (debian 13.3)
===========================================================================
Total: 11 (UNKNOWN: 0, LOW: 7, MEDIUM: 3, HIGH: 1, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │  Status  │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-0861    │ HIGH     │ affected │ 2.41-12+deb13u1             │               │ glibc: Integer overflow in memalign leads to heap corruption │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-0861                    │
│         ├──────────────────┼──────────┤          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2025-15281   │ MEDIUM   │          │                             │               │ glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return    │
│         │                  │          │          │                             │               │ uninitialized memory                                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2025-15281                   │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-0915    │          │          │                             │               │ glibc: glibc: Information disclosure via zero-valued network │
│         │                  │          │          │                             │               │ query                                                        │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-0915                    │
│         ├──────────────────┼──────────┤          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │          │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │          │                             │               │ memory consumption due to...                                 │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │          │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │          │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │          │                             │               │ because of...                                                │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │          │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │          │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │          │                             │               │ pthread_created thread                                       │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤          ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │          │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │          │                             │               │ combine functions...                                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

@github-actions
Copy link
Contributor

github-actions bot commented Mar 3, 2026

🔒 Container Vulnerability Scan (hub-migrations - arm64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/v0.65/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub-migrations:f2f743de08eb2d2ce29144eab97ec6df559aee97-arm64 (debian 13.3)
===========================================================================
Total: 11 (UNKNOWN: 0, LOW: 7, MEDIUM: 3, HIGH: 1, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │  Status  │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-0861    │ HIGH     │ affected │ 2.41-12+deb13u1             │               │ glibc: Integer overflow in memalign leads to heap corruption │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-0861                    │
│         ├──────────────────┼──────────┤          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2025-15281   │ MEDIUM   │          │                             │               │ glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return    │
│         │                  │          │          │                             │               │ uninitialized memory                                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2025-15281                   │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-0915    │          │          │                             │               │ glibc: glibc: Information disclosure via zero-valued network │
│         │                  │          │          │                             │               │ query                                                        │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-0915                    │
│         ├──────────────────┼──────────┤          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │          │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │          │                             │               │ memory consumption due to...                                 │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │          │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │          │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │          │                             │               │ because of...                                                │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │          │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │          │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │          │                             │               │ pthread_created thread                                       │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤          ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │          │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │          │                             │               │ combine functions...                                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
src/management/dto.rs (1)

57-61: Add round-trip coverage for the new base_url field.

OpenAIProviderConfig.base_url is additive, but this module currently has no DTO tests for it. A serialize/deserialize test here would prevent silent regressions in request/response handling.

✅ Suggested test addition
+    #[test]
+    fn test_openai_provider_config_with_base_url_roundtrip() {
+        let config = OpenAIProviderConfig {
+            api_key: SecretObject::literal("k".to_string()),
+            organization_id: Some("org_123".to_string()),
+            base_url: Some("https://proxy.example.com/v1".to_string()),
+        };
+
+        let serialized = serde_json::to_value(&config).unwrap();
+        let deserialized: OpenAIProviderConfig = serde_json::from_value(serialized).unwrap();
+        assert_eq!(deserialized, config);
+    }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/management/dto.rs` around lines 57 - 61, Add a serde round-trip unit test
named something like test_openai_provider_config_roundtrip that constructs an
OpenAIProviderConfig with api_key, organization_id and base_url set (e.g.,
base_url = Some("https://example.com".into())), serializes it with
serde_json::to_string, then deserializes with serde_json::from_str and asserts
equality (or field equality) to verify base_url survives serialization; place
the test alongside other DTO tests and use the OpenAIProviderConfig type and its
SecretObject api_key to match existing test patterns.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/management/services/config_provider_service.rs`:
- Around line 136-138: The current insertion uses if let Some(base_url) =
c.base_url without trimming which lets whitespace-only values like Some("   ")
override defaults; update the check to trim and reject empty strings before
calling params.insert("base_url", ...). Concretely, for the block handling
c.base_url (the if let Some(base_url) = c.base_url {
params.insert("base_url"...) } section) trim the base_url and only insert when
the trimmed value is non-empty, and apply the identical trimmed/empty check to
the Azure branch that sets base_url so both code paths behave consistently.

---

Nitpick comments:
In `@src/management/dto.rs`:
- Around line 57-61: Add a serde round-trip unit test named something like
test_openai_provider_config_roundtrip that constructs an OpenAIProviderConfig
with api_key, organization_id and base_url set (e.g., base_url =
Some("https://example.com".into())), serializes it with serde_json::to_string,
then deserializes with serde_json::from_str and asserts equality (or field
equality) to verify base_url survives serialization; place the test alongside
other DTO tests and use the OpenAIProviderConfig type and its SecretObject
api_key to match existing test patterns.

ℹ️ Review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

  • Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 3168e81 and 518fced.

📒 Files selected for processing (2)
  • src/management/dto.rs
  • src/management/services/config_provider_service.rs

@github-actions
Copy link
Contributor

github-actions bot commented Mar 3, 2026

🔒 Container Vulnerability Scan (hub - amd64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/v0.65/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub:f2f743de08eb2d2ce29144eab97ec6df559aee97-amd64 (debian 13.3)
================================================================
Total: 11 (UNKNOWN: 0, LOW: 7, MEDIUM: 3, HIGH: 1, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │  Status  │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-0861    │ HIGH     │ affected │ 2.41-12+deb13u1             │               │ glibc: Integer overflow in memalign leads to heap corruption │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-0861                    │
│         ├──────────────────┼──────────┤          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2025-15281   │ MEDIUM   │          │                             │               │ glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return    │
│         │                  │          │          │                             │               │ uninitialized memory                                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2025-15281                   │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-0915    │          │          │                             │               │ glibc: glibc: Information disclosure via zero-valued network │
│         │                  │          │          │                             │               │ query                                                        │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-0915                    │
│         ├──────────────────┼──────────┤          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │          │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │          │                             │               │ memory consumption due to...                                 │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │          │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │          │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │          │                             │               │ because of...                                                │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │          │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │          │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │          │                             │               │ pthread_created thread                                       │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤          ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │          │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │          │                             │               │ combine functions...                                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

@github-actions
Copy link
Contributor

github-actions bot commented Mar 3, 2026

🔒 Container Vulnerability Scan (hub - arm64)

Click to expand results

For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/v0.65/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


hub:f2f743de08eb2d2ce29144eab97ec6df559aee97-arm64 (debian 13.3)
================================================================
Total: 11 (UNKNOWN: 0, LOW: 7, MEDIUM: 3, HIGH: 1, CRITICAL: 0)

┌─────────┬──────────────────┬──────────┬──────────┬─────────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │  Vulnerability   │ Severity │  Status  │      Installed Version      │ Fixed Version │                            Title                             │
├─────────┼──────────────────┼──────────┼──────────┼─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6   │ CVE-2026-0861    │ HIGH     │ affected │ 2.41-12+deb13u1             │               │ glibc: Integer overflow in memalign leads to heap corruption │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-0861                    │
│         ├──────────────────┼──────────┤          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2025-15281   │ MEDIUM   │          │                             │               │ glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return    │
│         │                  │          │          │                             │               │ uninitialized memory                                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2025-15281                   │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-0915    │          │          │                             │               │ glibc: glibc: Information disclosure via zero-valued network │
│         │                  │          │          │                             │               │ query                                                        │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-0915                    │
│         ├──────────────────┼──────────┤          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2010-4756    │ LOW      │          │                             │               │ glibc: glob implementation can cause excessive CPU and       │
│         │                  │          │          │                             │               │ memory consumption due to...                                 │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2018-20796   │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010022 │          │          │                             │               │ glibc: stack guard protection bypass                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010023 │          │          │                             │               │ glibc: running ldd on malicious ELF leads to code execution  │
│         │                  │          │          │                             │               │ because of...                                                │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010024 │          │          │                             │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-1010025 │          │          │                             │               │ glibc: information disclosure of heap addresses of           │
│         │                  │          │          │                             │               │ pthread_created thread                                       │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│         ├──────────────────┤          │          │                             ├───────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2019-9192    │          │          │                             │               │ glibc: uncontrolled recursion in function                    │
│         │                  │          │          │                             │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├─────────┼──────────────────┼──────────┤          ├─────────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ zlib1g  │ CVE-2026-27171   │ MEDIUM   │          │ 1:1.3.dfsg+really1.3.1-1+b1 │               │ zlib: zlib: Denial of Service via infinite loop in CRC32     │
│         │                  │          │          │                             │               │ combine functions...                                         │
│         │                  │          │          │                             │               │ https://avd.aquasec.com/nvd/cve-2026-27171                   │
└─────────┴──────────────────┴──────────┴──────────┴─────────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

OS Packages (license)
=====================
Total: 29 (UNKNOWN: 0, LOW: 11, MEDIUM: 0, HIGH: 18, CRITICAL: 0)

┌─────────────┬───────────────────┬────────────────┬──────────┐
│   Package   │      License      │ Classification │ Severity │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ base-files  │ GPL-2.0-or-later  │ restricted     │ HIGH     │
├─────────────┤                   │                │          │
│ gcc-14-base │                   │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-only      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Artistic-2.0      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ LGPL-2.0-or-later │ restricted     │ HIGH     │
├─────────────┼───────────────────┤                │          │
│ libc6       │ LGPL-2.1-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-or-later │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-or-later  │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-2.0-only      │                │          │
│             ├───────────────────┤                │          │
│             │ GPL-3.0-or-later  │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Unicode-DFS-2016  │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ BSL-1.0           │                │          │
│             ├───────────────────┤                │          │
│             │ BSD-2-Clause      │                │          │
│             ├───────────────────┤                │          │
│             │ ISC               │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-3.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ LGPL-2.0-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-2.1-only     │                │          │
│             ├───────────────────┤                │          │
│             │ LGPL-3.0-only     │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libssl3t64  │ Apache-2.0        │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ Artistic-2.0      │                │          │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-1.0-or-later  │ restricted     │ HIGH     │
│             ├───────────────────┤                │          │
│             │ GPL-1.0-only      │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ libzstd1    │ BSD-3-Clause      │ notice         │ LOW      │
│             ├───────────────────┼────────────────┼──────────┤
│             │ GPL-2.0-only      │ restricted     │ HIGH     │
│             ├───────────────────┼────────────────┼──────────┤
│             │ Zlib              │ notice         │ LOW      │
│             ├───────────────────┤                │          │
│             │ MIT               │                │          │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ netbase     │ GPL-2.0-only      │ restricted     │ HIGH     │
├─────────────┼───────────────────┼────────────────┼──────────┤
│ zlib1g      │ Zlib              │ notice         │ LOW      │
└─────────────┴───────────────────┴────────────────┴──────────┘

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
tests/provider_api_tests.rs (1)

169-173: Add one positive-path assertion for custom base_url.

The new feature path is best validated by setting base_url: Some(...) in at least one OpenAI create/update success test and asserting it round-trips in the response/config.

🧪 Minimal test coverage tweak
-        config: ProviderConfig::OpenAI(OpenAIProviderConfig {
+        config: ProviderConfig::OpenAI(OpenAIProviderConfig {
             api_key: SecretObject::literal("test_openai_key".to_string()),
             organization_id: Some("test_org".to_string()),
-            base_url: None,
+            base_url: Some("https://proxy.openai.example/v1".to_string()),
         }),
 let updated_config = ProviderConfig::OpenAI(OpenAIProviderConfig {
     api_key: SecretObject::literal("updated_openai_key".to_string()),
     organization_id: Some("org_updated".to_string()),
-    base_url: None,
+    base_url: Some("https://proxy.openai.example/v1".to_string()),
 });

Also applies to: 515-519

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@tests/provider_api_tests.rs` around lines 169 - 173, Set and assert a
non-default OpenAI base_url in the positive-path create/update provider tests:
when constructing ProviderConfig::OpenAI with OpenAIProviderConfig set to
api_key: SecretObject::literal(...), organization_id: Some(...), set base_url:
Some("https://custom-openai.example") and then assert the returned
provider/config round-trips that same base_url (e.g., response.config or
returned OpenAIProviderConfig.base_url ==
Some("https://custom-openai.example")). Apply this to the create-success and
update-success tests that use ProviderConfig::OpenAI (the occurrences around the
shown block and the other occurrence at the referenced lines), ensuring both
request payload and response assertions include the custom base_url.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@tests/provider_api_tests.rs`:
- Around line 169-173: Set and assert a non-default OpenAI base_url in the
positive-path create/update provider tests: when constructing
ProviderConfig::OpenAI with OpenAIProviderConfig set to api_key:
SecretObject::literal(...), organization_id: Some(...), set base_url:
Some("https://custom-openai.example") and then assert the returned
provider/config round-trips that same base_url (e.g., response.config or
returned OpenAIProviderConfig.base_url ==
Some("https://custom-openai.example")). Apply this to the create-success and
update-success tests that use ProviderConfig::OpenAI (the occurrences around the
shown block and the other occurrence at the referenced lines), ensuring both
request payload and response assertions include the custom base_url.

ℹ️ Review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

  • Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 518fced and 17cff4b.

📒 Files selected for processing (3)
  • tests/model_definition_api_tests.rs
  • tests/pipelines_api_integration_tests.rs
  • tests/provider_api_tests.rs

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/management/services/config_provider_service.rs`:
- Around line 136-138: The long if-let expression with
c.base_url.map(...).filter(...) exceeds rustfmt width; break it into shorter
statements so cargo fmt passes — e.g., compute a trimmed BaseUrl in a separate
let binding using c.base_url.map(|s| s.trim().to_string()), then apply
.filter(|s| !s.is_empty()) or an if let Some(base_url) = ... on the next line,
and finally call params.insert("base_url".to_string(), base_url); this keeps the
logic (c.base_url, trim().to_string(), filter(|s| !s.is_empty()), params.insert)
intact while conforming to rustfmt line-length rules.
- Around line 144-146: The Azure branch should use the same trimming/filtering
pattern as the other branch: change the current if-let that consumes c.base_url
to use a non-consuming borrow and the identical map/trim/filter chain used
elsewhere (operate on c.base_url.as_ref() then map trim -> filter non-empty ->
clone/to_string), and then call params.insert("base_url".to_string(), base_url);
update the expression around c.base_url and the surrounding if let so formatting
and behavior match the other branch exactly.

ℹ️ Review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

  • Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 17cff4b and c6c0e42.

📒 Files selected for processing (1)
  • src/management/services/config_provider_service.rs

}
if let Some(base_url) = c
.base_url
.map(|s| s.trim().to_string())

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the trimming really necessary ?
I cant see that we are doing it for any other param

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i found it anoying when testing and code rabit suggested
what do you think?

Copy link

@nina-kollman nina-kollman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lets add test cases where the base_url is NOT none. The test should verify the correct value was chosen

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (1)
src/management/services/config_provider_service.rs (1)

136-138: ⚠️ Potential issue | 🟠 Major

Prevent empty/whitespace base_url from overriding OpenAI default endpoint.

Raw insertion allows Some("") / whitespace-only values, which disables the fallback in src/providers/openai/provider.rs and can cause runtime request failures.

🛠️ Proposed fix
-                if let Some(base_url) = c.base_url {
-                    params.insert("base_url".to_string(), base_url);
-                }
+                if let Some(base_url) = c
+                    .base_url
+                    .map(|s| s.trim().to_string())
+                    .filter(|s| !s.is_empty())
+                {
+                    params.insert("base_url".to_string(), base_url);
+                }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@src/management/services/config_provider_service.rs` around lines 136 - 138,
The current insertion of c.base_url into params allows Some("") or
whitespace-only values to override the OpenAI default endpoint; update the check
where you handle c.base_url so you trim the string and only call
params.insert("base_url", ...) when c.base_url is Some and the trimmed value is
non-empty (i.e., filter out empty/whitespace-only strings before inserting into
params), referencing the existing c.base_url and params.insert call to locate
the change.
🧹 Nitpick comments (1)
tests/provider_api_tests.rs (1)

883-919: Nice happy-path coverage for OpenAI base_url persistence.

Please add one negative-path case for invalid base_url (e.g., whitespace-only) to lock expected validation/normalization behavior.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@tests/provider_api_tests.rs` around lines 883 - 919, Add a negative-path test
alongside test_create_openai_provider_with_base_url: create a new async test
(e.g., test_create_openai_provider_with_invalid_base_url) that builds a
CreateProviderRequest using OpenAIProviderConfig with base_url set to a
whitespace-only string (Some("   ".to_string())), POST it to
"/api/v1/management/providers" using the same client setup, and assert the
response status is axum::http::StatusCode::BAD_REQUEST (or the API’s validation
error code) and that the response body contains a validation error mentioning
"base_url" (or the service’s validation message) to lock the expected
validation/normalization behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@src/management/services/config_provider_service.rs`:
- Around line 136-138: The current insertion of c.base_url into params allows
Some("") or whitespace-only values to override the OpenAI default endpoint;
update the check where you handle c.base_url so you trim the string and only
call params.insert("base_url", ...) when c.base_url is Some and the trimmed
value is non-empty (i.e., filter out empty/whitespace-only strings before
inserting into params), referencing the existing c.base_url and params.insert
call to locate the change.

---

Nitpick comments:
In `@tests/provider_api_tests.rs`:
- Around line 883-919: Add a negative-path test alongside
test_create_openai_provider_with_base_url: create a new async test (e.g.,
test_create_openai_provider_with_invalid_base_url) that builds a
CreateProviderRequest using OpenAIProviderConfig with base_url set to a
whitespace-only string (Some("   ".to_string())), POST it to
"/api/v1/management/providers" using the same client setup, and assert the
response status is axum::http::StatusCode::BAD_REQUEST (or the API’s validation
error code) and that the response body contains a validation error mentioning
"base_url" (or the service’s validation message) to lock the expected
validation/normalization behavior.

ℹ️ Review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

  • Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 66c0019 and bf2bfa1.

📒 Files selected for processing (2)
  • src/management/services/config_provider_service.rs
  • tests/provider_api_tests.rs

@avivhalfon avivhalfon force-pushed the ah/feat-openai-base-url/TLP-1865 branch from bf2bfa1 to d669d15 Compare March 4, 2026 09:09
@avivhalfon avivhalfon merged commit 060c55d into main Mar 4, 2026
14 checks passed
@avivhalfon avivhalfon deleted the ah/feat-openai-base-url/TLP-1865 branch March 4, 2026 09:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants