| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
feat(hooks): add pre_auth hook framework + minimal demo 新增可选的 pre_auth hook 框架,让定制逻辑(加前缀/查表转换/拒审等) 以 cdylib 插件形式接入,gateway 不需要为每家定制逻辑重编。 架构: - boom-hooks-sdk (叶子 crate,0 个 boom-* 依赖): 定义 wire types (PreAuthRequest/Action/Response) + pre_auth_entry/hook_init_entry helper,封装 catch_unwind + JSON 序列化 + buffer 写入 + return code - boom-main/src/hooks/mod.rs: HookRegistry 用 libloading 加载 .so, Symbol<'static> transmute(lib Arc 在同 struct 保活),failure_mode 在 registry 层消化(allow 降级走原生认证,deny 返回 500) - boom-config: HooksConfig/PreAuthHookConfig,默认全关闭 - extractor: 认证入口插入 pre_auth 调用点,5 种 outcome (NoHook/Continue/Replace/Reject/Deny) 安全边界: - C ABI + JSON wire protocol(跨 .so 不传 Rust 类型) - catch_unwind 隔离 plugin panic - allowed_headers 白名单(默认全屏蔽,避免敏感 header 泄漏) - hook 可选: 不配置时零开销走原路径;加载失败启动报错; 运行期 panic 按 failure_mode 兜底 仓库根目录 hook/ 是一个最简 pre_auth demo,独立 workspace: - mask_key(): 前 3 字符 + 中间全 * (len-9) + 末 6,长度 < 9 退化为全脱敏 + (len=N) 避免泄漏 - pre_auth 符号打印 masked key + allowed_headers 到 stderr, 返回 Continue 让 gateway 用原 raw_key 走原生认证 - 5 个单元测试覆盖 13/15/9 字符边界、过短、Unicode 场景 Signed-off-by: liqiang <liqiang64@huawei.com> | 8 天前 | |
feat(workflow): add direct synthesis workflow Add a configurable direct synthesis workflow with concurrent panel calls, aggregator synthesis, OpenAI-compatible streaming, and aggregated standard usage. Register workflow models as exclusive virtual providers in boom-routing so child calls re-enter the shared Router and retain KVC scheduling, flow control, inflight tracking, request-rate accounting, key affinity, and priority headers. Reject recursive virtual-provider child routing and workflow model namespace conflicts across YAML, DB deployments, aliases, reloads, and Dashboard mutations. Aggregate successful child usage and model-specific costs through the existing parent audit, limiter, and billing paths, including partial usage when the parent fails or a stream ends without final usage. Keep responses on the standard OpenAI schema without creating a parallel workflow audit system or per-child audit rows. Add optional panel and flow-control queue timeouts, configuration validation, Dashboard fields, design documentation, and a process-level compatibility test for configurations created before workflow support. Core-Author: gpt-5.6-sol | 11 天前 | |
feat(workflow): add direct synthesis workflow Add a configurable direct synthesis workflow with concurrent panel calls, aggregator synthesis, OpenAI-compatible streaming, and aggregated standard usage. Register workflow models as exclusive virtual providers in boom-routing so child calls re-enter the shared Router and retain KVC scheduling, flow control, inflight tracking, request-rate accounting, key affinity, and priority headers. Reject recursive virtual-provider child routing and workflow model namespace conflicts across YAML, DB deployments, aliases, reloads, and Dashboard mutations. Aggregate successful child usage and model-specific costs through the existing parent audit, limiter, and billing paths, including partial usage when the parent fails or a stream ends without final usage. Keep responses on the standard OpenAI schema without creating a parallel workflow audit system or per-child audit rows. Add optional panel and flow-control queue timeouts, configuration validation, Dashboard fields, design documentation, and a process-level compatibility test for configurations created before workflow support. Core-Author: gpt-5.6-sol | 11 天前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 8 天前 | ||
| 11 天前 | ||
| 11 天前 |