feat: save compatible provider models to customModels DB for /v1/models listing by nyatoru · Pull Request #122 · diegosouzapw/OmniRoute

nyatoru · 2026-02-24T07:10:43Z

Add Custom Provider to support models endpoint

…ls listing

gemini-code-assist · 2026-02-24T07:10:56Z

Summary of Changes

Hello @nyatoru, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the management of compatible provider models by integrating them with a customModels database. The changes ensure that both manually added and imported models are persisted, allowing them to be correctly listed via the /v1/models endpoint. Furthermore, the deletion process has been updated to remove models from both their aliases and the custom database, maintaining data integrity.

Highlights

Model Persistence for Manual Additions: Implemented logic to save manually added compatible provider models to the customModels database via a new API endpoint (/api/provider-models) to ensure they appear in the /v1/models listing.
Model Persistence for Imports: Extended the model import process to also persist imported compatible provider models into the customModels database, ensuring their visibility in the /v1/models endpoint.
Unified Model Deletion: Introduced a unified handleDeleteModel function to remove models from both their alias configuration and the customModels database, ensuring complete removal and consistency.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

src/app/(dashboard)/dashboard/providers/[id]/page.tsx
- Added a POST request to /api/provider-models to save manually added models.
- Added a POST request to /api/provider-models to save imported models.
- Implemented handleDeleteModel to perform DELETE requests to /api/provider-models and delete aliases.
- Modified the onDeleteAlias callback to use handleDeleteModel.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces functionality to persist compatible provider models in a custom database, ensuring they appear in the /v1/models listing, and integrates their saving and deletion across various workflows. While the feature is useful, the implementation has several security vulnerabilities. New API endpoints for managing provider models and aliases lack authentication and authorization checks, allowing unauthorized modification of system configuration. Furthermore, a URL parameter injection vulnerability exists in the model deletion logic due to improper encoding of user-controlled variables. These security issues must be addressed before merging.

src/app/(dashboard)/dashboard/providers/[id]/page.tsx

gemini-code-assist · 2026-02-24T07:14:19Z

src/app/(dashboard)/dashboard/providers/[id]/page.tsx

+          // Save to customModels DB so it shows up in /v1/models
+          await fetch("/api/provider-models", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+              provider: providerStorageAlias,
+              modelId,
+              modelName: model.name || modelId,
+              source: "imported",
+            }),
+          });
+          // Also create alias for routing
          await onSetAlias(modelId, resolvedAlias, providerStorageAlias);


Similar to the manual add function, if the fetch call to save the imported model to the customModels database fails, the onSetAlias call still proceeds. This can result in an alias being created for a model that wasn't successfully recorded in the database, leading to data inconsistencies.

Ensure that the onSetAlias call is only executed if the model is successfully saved to the customModels database. This will prevent partial updates and maintain data integrity.

// Save to customModels DB so it shows up in /v1/models const res = await fetch("/api/provider-models", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ provider: providerStorageAlias, modelId, modelName: model.name || modelId, source: "imported", }), }); if (!res.ok) { const errorData = await res.json(); throw new Error(errorData.error?.message || "Failed to save imported model to custom DB"); } // Also create alias for routing await onSetAlias(modelId, resolvedAlias, providerStorageAlias);

gemini-code-assist · 2026-02-24T07:14:19Z

src/app/(dashboard)/dashboard/providers/[id]/page.tsx

+    try {
+      // Remove from customModels DB
+      await fetch(
+        `/api/provider-models?provider=${providerStorageAlias}&model=${encodeURIComponent(modelId)}`,


The providerStorageAlias variable is concatenated directly into the URL query string without proper encoding. Since providerStorageAlias is derived from the providerId URL parameter (which is user-controlled), an attacker could craft a malicious URL containing characters like & or = to inject additional query parameters into the API request, potentially manipulating the deletion logic (e.g., by injecting a different model parameter).

`/api/provider-models?provider=${encodeURIComponent(providerStorageAlias)}&model=${encodeURIComponent(modelId)}`,

gemini-code-assist · 2026-02-24T07:14:19Z

src/app/(dashboard)/dashboard/providers/[id]/page.tsx

+      // Also delete the alias
+      await onDeleteAlias(alias);
+    } catch (error) {
+      console.log("Error deleting model:", error);


The handleDeleteModel function only logs errors to the console. For a user-facing action like deleting a model, it would be beneficial to provide visual feedback to the user if the deletion fails. This could be an alert, a toast notification, or an error message displayed on the UI.

Consider adding a user-friendly error notification to improve the user experience.

console.error("Error deleting model:", error); alert("Failed to delete model. Please try again.");

…ndling

…ability checks

nyatoru · 2026-02-24T11:59:14Z

@gemini-code-assist

gemini-code-assist · 2026-02-24T11:59:25Z

Hello @nyatoru! I'm here to help. Do you have any specific questions about the pull request or my previous summary and review comments? Feel free to ask, or if you'd like me to perform another action, you can use commands like /gemini review for a new review or /gemini summary for an updated summary.

nyatoru · 2026-02-24T12:00:11Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces significant enhancements to model management and API security. Key changes include updating the ComboFormModal to match provider nodes by ID or prefix, and refactoring model addition and deletion logic in CompatibleModelsSection to first interact with a customModels database before managing aliases. A new handleDeleteModel function was added to ensure models are removed from both the database and alias system. Authentication has been added to several API routes (/api/models/alias and /api/provider-models) by introducing a verifyAuth function that checks for API keys or JWT cookies. The /api/v1/models endpoint now incorporates providerNodes to better handle custom model prefixes and activation checks for compatible providers. Model display in ModelSelectModal and model availability checks in chat.ts were updated to correctly resolve custom prefixes using getModelInfo. The getModelInfo service itself was refactored to prioritize checking custom provider nodes for both alias and non-alias model strings.

Review comments highlight several areas for improvement: the verifyAuth function is duplicated across multiple API routes and should be extracted into a shared utility; the variable providerPart in ComboFormModal could be renamed for better clarity; error handling for customModelRes.json() could be more explicit; and alert calls for user feedback should be replaced with a non-blocking notification system. Additionally, user-facing notifications are suggested for failed imported model saves and model deletions. Finally, the review questions the suitability of providerId as a fallback for nodePrefix if it's a UUID, and asks for assurance that prefixToCheck in getModelInfo is always a concise identifier.

gemini-code-assist · 2026-02-24T12:10:35Z

src/app/api/models/alias/route.ts

+async function verifyAuth(request) {
+  // Check API key (for external clients)
+  const apiKey = extractApiKey(request);
+  if (apiKey && (await isValidApiKey(apiKey))) {
+    return true;
+  }
+
+  // Check JWT cookie (for dashboard session)
+  if (process.env.JWT_SECRET) {
+    try {
+      const cookieStore = await cookies();
+      const token = cookieStore.get("auth_token")?.value;
+      if (token) {
+        const secret = new TextEncoder().encode(process.env.JWT_SECRET);
+        await jwtVerify(token, secret);
+        return true;
+      }
+    } catch {
+      // Invalid/expired token or cookies not available
+    }
+  }
+
+  return false;


The verifyAuth function is duplicated across src/app/api/models/alias/route.ts and src/app/api/provider-models/route.ts. This leads to code duplication and makes maintenance harder. It would be better to extract this authentication logic into a shared utility function or middleware that can be imported and reused across different API routes. This improves maintainability and ensures consistent authentication logic.

/** * Verify authentication - check API key or JWT cookie */ // This function is duplicated. Consider moving it to a shared utility file. // For example: import { verifyAuth } from "@/lib/authUtils"; async function verifyAuth(request) { // Check API key (for external clients) const apiKey = extractApiKey(request); if (apiKey && (await isValidApiKey(apiKey))) { return true; } // Check JWT cookie (for dashboard session) if (process.env.JWT_SECRET) { try { const cookieStore = await cookies(); const token = cookieStore.get("auth_token")?.value; if (token) { const secret = new TextEncoder().encode(process.env.JWT_SECRET); await jwtVerify(token, secret); return true; } } catch { // Invalid/expired token or cookies not available } } return false; }

gemini-code-assist · 2026-02-24T12:10:35Z

src/app/api/provider-models/route.ts

+async function verifyAuth(request) {
+  // Check API key (for external clients)
+  const apiKey = extractApiKey(request);
+  if (apiKey && (await isValidApiKey(apiKey))) {
+    return true;
+  }
+
+  // Check JWT cookie (for dashboard session)
+  if (process.env.JWT_SECRET) {
+    try {
+      const cookieStore = await cookies();
+      const token = cookieStore.get("auth_token")?.value;
+      if (token) {
+        const secret = new TextEncoder().encode(process.env.JWT_SECRET);
+        await jwtVerify(token, secret);
+        return true;
+      }
+    } catch {
+      // Invalid/expired token or cookies not available
+    }
+  }
+
+  return false;


The verifyAuth function is duplicated across src/app/api/models/alias/route.ts and src/app/api/provider-models/route.ts. This leads to code duplication and makes maintenance harder. It would be better to extract this authentication logic into a shared utility function or middleware that can be imported and reused across different API routes. This improves maintainability and ensures consistent authentication logic.

/** * Verify authentication - check API key or JWT cookie */ // This function is duplicated. Consider moving it to a shared utility file. // For example: import { verifyAuth } from "@/lib/authUtils"; async function verifyAuth(request) { // Check API key (for external clients) const apiKey = extractApiKey(request); if (apiKey && (await isValidApiKey(apiKey))) { return true; } // Check JWT cookie (for dashboard session) if (process.env.JWT_SECRET) { try { const cookieStore = await cookies(); const token = cookieStore.get("auth_token")?.value; if (token) { const secret = new TextEncoder().encode(process.env.JWT_SECRET); await jwtVerify(token, secret); return true; } } catch { // Invalid/expired token or cookies not available } } return false; }

src/app/(dashboard)/dashboard/combos/page.tsx

src/app/(dashboard)/dashboard/providers/[id]/page.tsx

gemini-code-assist · 2026-02-24T12:10:36Z

src/app/(dashboard)/dashboard/providers/[id]/page.tsx

      console.log("Error adding model:", error);
+      alert(error instanceof Error ? error.message : "Failed to add model. Please try again.");


The alert function is generally not recommended for user feedback in modern web applications, as it's blocking and can lead to a poor user experience. Consider using a more integrated notification system (like the notify.error used elsewhere in the codebase) to provide feedback to the user without interrupting their workflow.

console.log("Error adding model:", error); // Use a non-blocking notification system instead of alert // notify.error(error instanceof Error ? error.message : "Failed to add model. Please try again."); alert(error instanceof Error ? error.message : "Failed to add model. Please try again.");

gemini-code-assist · 2026-02-24T12:10:36Z

src/app/(dashboard)/dashboard/providers/[id]/page.tsx

+          if (!customModelRes.ok) {
+            console.error("Failed to save imported model to customModels DB");


Similar to the previous comment, console.error is used here for an error that might be user-facing. While it's good for debugging, if this failure is due to user input or a known API issue, it might be better to provide user feedback through a notification system rather than just logging to the console. This ensures the user is aware of why the import failed.

if (!customModelRes.ok) { console.error("Failed to save imported model to customModels DB"); // Consider adding user-facing notification here, e.g., notify.error("Failed to save imported model."); return false; }

gemini-code-assist · 2026-02-24T12:10:36Z

src/app/(dashboard)/dashboard/providers/[id]/page.tsx

+  const handleDeleteModel = async (modelId: string, alias: string) => {
+    try {
+      // Remove from customModels DB
+      await fetch(
+        `/api/provider-models?provider=${providerStorageAlias}&model=${encodeURIComponent(modelId)}`,
+        { method: "DELETE" }
+      );
+      // Also delete the alias
+      await onDeleteAlias(alias);
+    } catch (error) {
+      console.log("Error deleting model:", error);
+    }
+  };


The handleDeleteModel function is well-structured. However, it only logs the error to the console. For a user-initiated action like deleting a model, it's important to provide feedback to the user if the deletion fails. Consider adding a user-facing notification (e.g., using notify.error) to inform the user about the failure.

const handleDeleteModel = async (modelId: string, alias: string) => { try { // Remove from customModels DB await fetch( `/api/provider-models?provider=${providerStorageAlias}&model=${encodeURIComponent(modelId)}`, { method: "DELETE" } ); // Also delete the alias await onDeleteAlias(alias); // notify.success("Model deleted successfully"); // Example user feedback } catch (error) { console.log("Error deleting model:", error); // notify.error("Failed to delete model. Please try again."); // Example user feedback } };

src/shared/components/ModelSelectModal.tsx

src/sse/services/model.ts

…x custom provider model resolution

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

nyatoru · 2026-02-24T14:32:39Z

/gemini review

gemini-code-assist

Code Review

The pull request introduces significant improvements by enhancing model handling for custom providers, centralizing authentication logic, and refining the model import/delete processes. The changes improve flexibility and security across the application. However, there are a couple of minor issues that need to be addressed.

gemini-code-assist · 2026-02-24T14:38:52Z

src/app/(dashboard)/dashboard/providers/[id]/page.tsx

+        }
+        throw new Error(errorData.error?.message || "Failed to save custom model");
+      }
+      }


There's an extra closing brace } on this line. This will cause a syntax error and prevent the application from compiling or running correctly.

…ution

- Fix URL parameter injection: apply encodeURIComponent on providerStorageAlias and providerId in all API calls - Replace blocking alert() with non-blocking notify.error/notify.success toast notifications - Add success feedback for model add and delete operations - Improve error handling: use console.error consistently and add user-facing notifications for import failures - Check DELETE response status before proceeding with alias removal

…DB for /v1/models listing Includes security hardening and UX improvements: - Authentication on /api/provider-models via isAuthenticated - URL parameter injection prevention (encodeURIComponent) - Replaced alert() with notify.error/notify.success toasts - Transactional save: DB first, then alias creation - Consistent error handling across all model operations

feat: save compatible provider models to customModels DB for /v1/mode…

024c59e

…ls listing

nyatoru changed the title ~~feat: save compatible provider models to customModels DB for /v1/mode…~~ feat: save compatible provider models to customModels DB for /v1/models listing Feb 24, 2026

gemini-code-assist bot reviewed Feb 24, 2026

View reviewed changes

nyatoru added 6 commits February 24, 2026 14:28

feat: add authentication to alias API and improve model save error ha…

c44b8c9

…ndling

feat: use provider node prefixes for custom model alias generatiovv

0c9ffb1

feat: use provider node type for active provider resolution

a2f0313

feat: use provider prefix for model value resolution

ebe4f71

feat: fix custom provider node matching in model resolution

3b15082

feat: use getModelInfo for proper custom provider resolution in avail…

8731213

…ability checks

gemini-code-assist bot reviewed Feb 24, 2026

View reviewed changes

nyatoru and others added 5 commits February 24, 2026 21:19

feat: extract shared auth utility a cooldown/availability checksnd fi…

1750ac1

…x custom provider model resolution

refactor: rename providerPart to providerIdentifier for clarity

59afce0

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

fix: improve error handling in custom model API call

46d76ed

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

docs: add comment for nodePrefix UUID fallback caveat

3e007d0

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

docs: add comments clarifying prefixToCheck logic in model.ts

77d7792

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

gemini-code-assist bot reviewed Feb 24, 2026

View reviewed changes

feat: extract shared auth utility and fix custom provider model resol…

6f7ba1f

…ution

diegosouzapw merged commit 6f7ba1f into diegosouzapw:main Feb 24, 2026
10 of 11 checks passed

		console.log("Error adding model:", error);
		alert(error instanceof Error ? error.message : "Failed to add model. Please try again.");

		if (!customModelRes.ok) {
		console.error("Failed to save imported model to customModels DB");

Conversation

nyatoru commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot commented Feb 24, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

nyatoru commented Feb 24, 2026

Uh oh!

gemini-code-assist bot commented Feb 24, 2026

Uh oh!

nyatoru commented Feb 24, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

nyatoru commented Feb 24, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nyatoru commented Feb 24, 2026 •

edited

Loading