Method getClient

server/handler.go:157–208

getClient resolves the LLM client to use, optionally overriding provider/model. If clientAPIKey is non-empty or providerConfig has entries, creates a new client using the caller's credentials instead of the server's default ones. When metrics are enabled, the returned client is wrapped with instrume

(provider, model, clientAPIKey string, providerConfig map[string]string)

// using the caller's credentials instead of the server's default ones.
// When metrics are enabled, the returned client is wrapped with instrumentation.
func (h *Handler) getClient(provider, model, clientAPIKey string, providerConfig map[string]string) (client.LLMClient, error) {
	if provider == "" {
		provider = h.defaultProvider
	}
	if model == "" {
		model = h.defaultModel
	}

	var (
		c   client.LLMClient
		err error
	)

	// Security: SSRF prevention — validate provider_config URLs before use (H1)
	if len(providerConfig) > 0 && h.ssrfValidator != nil {
		if err := h.ssrfValidator.ValidateProviderConfig(providerConfig); err != nil {
			h.logger.Warn("SSRF: blocked provider config",
				zap.String("provider", provider),
				zap.Error(err),
			)
			return nil, fmt.Errorf("invalid provider configuration: %w", err)
		}
	}

	// Client-forwarded credentials with provider-specific config (StackSpot, Ollama, etc.)
	if len(providerConfig) > 0 {
		h.logger.Info(i18n.T("server.handler.client_config"),
			zap.String("provider", provider),
			zap.Int("config_keys", len(providerConfig)),
		)
		c, err = h.llmManager.CreateClientWithConfig(provider, model, clientAPIKey, providerConfig)
	} else if clientAPIKey != "" {
		// Client-forwarded API key only (OpenAI, Claude, Google, xAI)
		h.logger.Info(i18n.T("server.handler.client_api_key"),
			zap.String("provider", provider),
		)
		c, err = h.llmManager.CreateClientWithKey(provider, model, clientAPIKey)
	} else {
		c, err = h.llmManager.GetClient(provider, model)
	}

	if err != nil {
		return nil, err
	}

	// Wrap with metrics instrumentation if enabled
	if h.llmMetrics != nil {
		return client.NewInstrumentedClient(c, &llmMetricsAdapter{m: h.llmMetrics}, provider), nil
	}

	return c, nil
}

// llmMetricsAdapter bridges metrics.LLMMetrics to client.MetricsRecorder interface.
type llmMetricsAdapter struct {