()
| 23 | * Maps auth-runtime principal sources to capability-model AuthProviders. |
| 24 | */ |
| 25 | export function getAuthProvider(): AuthProvider { |
| 26 | try { |
| 27 | const session = getAuthRuntime().getCurrentSession() |
| 28 | const source = session.principalSource |
| 29 | |
| 30 | if (source === 'managed_oauth') { |
| 31 | return 'noumena-managed' |
| 32 | } |
| 33 | |
| 34 | if ( |
| 35 | source === 'console_api_key' || |
| 36 | source === 'api_key_helper' || |
| 37 | (source === 'direct_api_key_env' && |
| 38 | !isAnthropicDirectApiKeySource(session.rawApiKeySource) && |
| 39 | !isOpenAIDirectApiKeySource(session.rawApiKeySource)) |
| 40 | ) { |
| 41 | return 'noumena-apikey' |
| 42 | } |
| 43 | |
| 44 | if ( |
| 45 | source === 'third_party_provider' || |
| 46 | source === 'external_bearer_compat' || |
| 47 | (source === 'direct_api_key_env' && |
| 48 | isOpenAIDirectApiKeySource(session.rawApiKeySource)) |
| 49 | ) { |
| 50 | return 'byok-openai' |
| 51 | } |
| 52 | |
| 53 | if ( |
| 54 | source === 'direct_api_key_env' && |
| 55 | isAnthropicDirectApiKeySource(session.rawApiKeySource) |
| 56 | ) { |
| 57 | return 'byok-anthropic' |
| 58 | } |
| 59 | } catch { |
| 60 | // Auth runtime not initialized yet — fall through to env-based heuristics |
| 61 | } |
| 62 | |
| 63 | // Fallback: detect from environment using the same precedence as authEnv. |
| 64 | switch (getDirectApiKeyProviderKind()) { |
| 65 | case 'noumena': |
| 66 | return 'noumena-apikey' |
| 67 | case 'anthropic': |
| 68 | return 'byok-anthropic' |
| 69 | case 'openai_compat': |
| 70 | return 'byok-openai' |
| 71 | } |
| 72 | |
| 73 | // Default: assume noumena-managed if nothing else is set and we're not public |
| 74 | if (BUILD_SPIN_REFERENCE !== 'public') { |
| 75 | return 'noumena-managed' |
| 76 | } |
| 77 | |
| 78 | return 'byok-anthropic' |
| 79 | } |
| 80 | |
| 81 | /** |
| 82 | * Detect whether the current session is remote or direct. |
no test coverage detected