goclaw/internal/http/chatgpt_oauth_pool_validation.go

package http

import (
	"context"
	"encoding/json"
	"fmt"
	"slices"
	"strings"

	"github.com/google/uuid"

	"github.com/nextlevelbuilder/goclaw/internal/store"
)

func marshalJSONRaw(value any) (json.RawMessage, error) {
	if value == nil {
		return nil, nil
	}
	data, err := json.Marshal(value)
	if err != nil {
		return nil, err
	}
	return json.RawMessage(data), nil
}

func normalizedProviderNamesForValidation(names []string) []string {
	if len(names) == 0 {
		return nil
	}
	seen := make(map[string]bool, len(names))
	result := make([]string, 0, len(names))
	for _, name := range names {
		name = strings.TrimSpace(name)
		if name == "" || seen[name] {
			continue
		}
		seen[name] = true
		result = append(result, name)
	}
	return result
}

func validateChatGPTOAuthPoolGraph(providers []store.LLMProviderData) error {
	providersByName := make(map[string]store.LLMProviderData, len(providers))
	for _, provider := range providers {
		providersByName[provider.Name] = provider
	}

	ownerByMember := map[string]string{}
	hasPoolConfig := map[string]bool{}

	for _, provider := range providers {
		settings := store.ParseChatGPTOAuthProviderSettings(provider.Settings)
		if settings == nil {
			continue
		}
		if provider.ProviderType != store.ProviderChatGPTOAuth {
			return fmt.Errorf("provider %q must be chatgpt_oauth to manage an OpenAI Codex pool", provider.Name)
		}

		hasPoolConfig[provider.Name] = true
		for _, memberName := range normalizedProviderNamesForValidation(settings.CodexPool.ExtraProviderNames) {
			if memberName == provider.Name {
				return fmt.Errorf("provider %q cannot include itself in its OpenAI Codex pool", provider.Name)
			}

			member, ok := providersByName[memberName]
			if !ok {
				return fmt.Errorf("provider %q references unknown OpenAI Codex pool member %q", provider.Name, memberName)
			}
			if member.ProviderType != store.ProviderChatGPTOAuth {
				return fmt.Errorf("provider %q can only add chatgpt_oauth members; %q is %s", provider.Name, memberName, member.ProviderType)
			}

			if existingOwner, ok := ownerByMember[memberName]; ok && existingOwner != provider.Name {
				return fmt.Errorf("provider %q already belongs to pool %q", memberName, existingOwner)
			}
			ownerByMember[memberName] = provider.Name
		}
	}

	for ownerName := range hasPoolConfig {
		if existingOwner, ok := ownerByMember[ownerName]; ok {
			return fmt.Errorf("provider %q already belongs to pool %q and cannot manage its own pool", ownerName, existingOwner)
		}
	}

	return nil
}

func validateChatGPTOAuthProviderCandidate(
	ctx context.Context,
	providerStore store.ProviderStore,
	currentID uuid.UUID,
	candidate *store.LLMProviderData,
) error {
	if providerStore == nil || candidate == nil {
		return nil
	}

	existingProviders, err := providerStore.ListProviders(ctx)
	if err != nil {
		return err
	}

	finalProviders := make([]store.LLMProviderData, 0, len(existingProviders)+1)
	replaced := false
	for _, provider := range existingProviders {
		if currentID != uuid.Nil && provider.ID == currentID {
			finalProviders = append(finalProviders, *candidate)
			replaced = true
			continue
		}
		finalProviders = append(finalProviders, provider)
	}
	if currentID == uuid.Nil || !replaced {
		finalProviders = append(finalProviders, *candidate)
	}

	return validateChatGPTOAuthPoolGraph(finalProviders)
}

func validateChatGPTOAuthAgentRouting(
	ctx context.Context,
	providerStore store.ProviderStore,
	providerName string,
	routing *store.ChatGPTOAuthRoutingConfig,
) error {
	if providerStore == nil || providerName == "" || routing == nil {
		return nil
	}

	tenantID := store.TenantIDFromContext(ctx)
	baseProvider, err := lookupProviderByNameWithMasterFallback(ctx, providerStore, tenantID, providerName)
	if err != nil || baseProvider == nil || baseProvider.ProviderType != store.ProviderChatGPTOAuth {
		return nil
	}

	defaultSettings := store.ParseChatGPTOAuthProviderSettings(baseProvider.Settings)
	defaultMembers := []string{}
	if defaultSettings != nil {
		defaultMembers = normalizedProviderNamesForValidation(defaultSettings.CodexPool.ExtraProviderNames)
	}

	if len(defaultMembers) == 0 {
		if routing.Strategy != store.ChatGPTOAuthStrategyPrimaryFirst || len(routing.ExtraProviderNames) > 0 {
			return fmt.Errorf("configure OpenAI Codex pool members on provider %q before enabling agent-level routing", providerName)
		}
		return nil
	}

	if routing.OverrideMode == store.ChatGPTOAuthOverrideInherit {
		return nil
	}

	if len(routing.ExtraProviderNames) == 0 {
		return nil
	}

	if !slices.Equal(
		normalizedProviderNamesForValidation(routing.ExtraProviderNames),
		defaultMembers,
	) {
		return fmt.Errorf("agent routing cannot change pool membership for provider %q; manage members on the provider instead", providerName)
	}

	return nil
}