Adding an assistant: provider presets and the endpoint's own model list 155cab142b63

- **Adding an assistant picks from what the provider offers (#109).** A provider list fills the name, endpoint and API (with *Other* for anything else), **List models** fetches the endpoint's own models into the Model field, and a model the endpoint does not list is refused on save with ones it does. Administration is a sectioned page with a left-hand menu, its audit log paged (#110).

  /* AI assistants (#109): a provider fills the name, endpoint and API;

     List models asks the endpoint what it offers and fills the model

     field's suggestions. Without this script, both are typed by hand. */

  document.querySelectorAll("[data-preset-select]").forEach(function (sel) {

    var form = sel.form;

    function apply() {

      var o = sel.options[sel.selectedIndex];

      if (!o || !o.value) return;

      var name = form.querySelector("[name=name]"), ep = form.querySelector("[name=endpoint]"), api = form.querySelector("[name=api]");

      name.placeholder = o.dataset.name; ep.value = o.dataset.endpoint; api.value = o.dataset.api;

    }

    sel.addEventListener("change", apply);

    apply();

  });

  document.querySelectorAll("[data-list-models]").forEach(function (b) {

    b.addEventListener("click", function () {

      var form = b.form, input = document.getElementById(b.dataset.for);

      var list = document.getElementById(b.dataset.for + "-list"), note = document.querySelector("[data-models-note='" + b.dataset.for + "']");

      var body = new URLSearchParams();

      body.set("_csrf", b.dataset.csrf);

      ["endpoint", "api", "token", "preset"].forEach(function (k) { var el = form.querySelector("[name=" + k + "]"); if (el) body.set(k, el.value); });

      if (b.dataset.id) body.set("id", b.dataset.id);

      if (note) note.textContent = "Asking the provider…";

      fetch(b.dataset.listModels, { method: "POST", body: body, credentials: "same-origin" })

        .then(function (r) { return r.json(); })

        .then(function (j) {

          if (j.models) {

            list.innerHTML = "";

            j.models.forEach(function (m) { var o = document.createElement("option"); o.value = m; list.appendChild(o); });

            if (note) note.textContent = j.models.length + " models: pick one in the Model field.";

            input.focus();

          } else if (note) {

            note.textContent = "No list: " + (j.error || "unknown") + ". Type the model's name.";

          }

        })

        .catch(function () { if (note) note.textContent = "The hub could not ask; type the model's name."; });

    });

  });

/// Providers the add form offers, with what they need (#109):

/// (id, label, name, endpoint, api).

pub const PRESETS: &[(&str, &str, &str, &str, &str)] = &[

    ("anthropic", "Anthropic (Claude)", "Claude", "https://api.anthropic.com/v1/messages", "anthropic-messages"),

    ("openai", "OpenAI (ChatGPT)", "ChatGPT", "https://api.openai.com/v1/chat/completions", "chat-completions"),

    ("gemini", "Google Gemini", "Gemini", "https://generativelanguage.googleapis.com/v1beta/openai/chat/completions", "chat-completions"),

    ("deepseek", "DeepSeek", "DeepSeek", "https://api.deepseek.com/chat/completions", "chat-completions"),

    ("mistral", "Mistral", "Mistral", "https://api.mistral.ai/v1/chat/completions", "chat-completions"),

    ("perplexity", "Perplexity", "Perplexity", "https://api.perplexity.ai/chat/completions", "chat-completions"),

    ("ollama", "Ollama (on your network)", "Ollama", "http://localhost:11434/v1/chat/completions", "chat-completions"),

];

/// Where an endpoint lists its models: `…/chat/completions` → `…/models`,

/// `…/messages` → `…/models`.

pub fn models_url(endpoint: &str) -> Option<String> {

    let e = endpoint.trim_end_matches('/');

    e.strip_suffix("/chat/completions").or_else(|| e.strip_suffix("/messages")).map(|base| format!("{base}/models"))

}

/// The chat models an endpoint offers for this token, sorted; `Err` when

/// it cannot say (no list, refused, unreachable). Embedding, speech and

/// image models are left out.

pub async fn list_models(endpoint: &str, api: &str, token: &str) -> Result<Vec<String>, String> {

    let url = models_url(endpoint).ok_or("this endpoint has no model list next to it")?;

    let client = reqwest::Client::builder()

        .timeout(std::time::Duration::from_secs(15))

        .user_agent(format!("oxygenhub/{}", env!("CARGO_PKG_VERSION")))

        .build()

        .map_err(|e| e.to_string())?;

    let mut req = client.get(&url);

    if api == "anthropic-messages" {

        req = req.header("anthropic-version", "2023-06-01");

        if !token.is_empty() {

            req = req.header("x-api-key", token);

        }

    } else if !token.is_empty() {

        req = req.header("authorization", format!("Bearer {token}"));

    }

    let r = req.send().await.map_err(|e| scrub(&e.to_string(), token))?;

    let status = r.status();

    if !status.is_success() {

        return Err(format!("the model list answered {}", status.as_u16()));

    }

    let v: serde_json::Value = r.json().await.map_err(|_| "the model list was not JSON".to_string())?;

    let skip = ["embed", "tts", "whisper", "dall-e", "moderation", "audio", "image", "realtime", "transcribe", "search-preview"];

    let mut out: Vec<String> = v["data"]

        .as_array()

        .or(v["models"].as_array())

        .ok_or("the model list had no data")?

        .iter()

        .filter_map(|m| m["id"].as_str().or(m["name"].as_str()))

        .map(|id| id.strip_prefix("models/").unwrap_or(id).to_string())

        .filter(|id| !skip.iter().any(|s| id.to_lowercase().contains(s)))

        .collect();

    out.sort();

    out.dedup();

    if out.is_empty() {

        return Err("the model list was empty".into());

    }

    Ok(out)

}

/// `POST /admin/assistants/models`: what a provider offers, as JSON (#109).

pub async fn assistant_models(

    State(app): State<Shared>,

    viewer: Viewer,

    Form(f): Form<super::assistants::ModelsForm>,

) -> Result<axum::Json<serde_json::Value>, Error> {

    let shell = Shell::new(&app, "/admin", &viewer);

    require_admin(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    Ok(axum::Json(super::assistants::models(&app, &site_assistants(), f).await.map_err(|e| Error::from_db(shell.clone(), e))?))

}

    /// A provider from the add form's list (#109), filling what is left empty.

    #[serde(default)]

    preset: String,

    pub presets: Vec<(&'static str, &'static str, &'static str, &'static str, &'static str)>,

        presets: assistants::PRESETS.to_vec(),

}

impl AssistantForm {

    fn clone_shallow(&self) -> AssistantForm {

        AssistantForm {

            csrf_token: String::new(),

            action: self.action.clone(),

            id: self.id,

            name: self.name.clone(),

            endpoint: self.endpoint.clone(),

            api: self.api.clone(),

            model: self.model.clone(),

            headers: self.headers.clone(),

            token: String::new(),

            enabled: self.enabled.clone(),

            budget: self.budget.clone(),

            prompt: String::new(),

            preset: self.preset.clone(),

        }

    }

}

/// When the endpoint lists its models, the model must be one of them

/// (#109); `Err` names a few it does offer.

async fn model_offered(fields: &Fields, token: &str) -> Result<(), String> {

    match assistants::list_models(&fields.endpoint, &fields.api, token).await {

        Ok(models) if !models.iter().any(|m| m == &fields.model) => {

            let close: Vec<&String> = {

                let stem = fields.model.split(['-', '.']).next().unwrap_or("").to_lowercase();

                let near: Vec<&String> = models.iter().filter(|m| m.to_lowercase().contains(&stem)).take(8).collect();

                if near.is_empty() {

                    models.iter().take(8).collect()

                } else {

                    near

                }

            };

            Err(format!(

                "{} is not a model this endpoint offers. It offers, among others: {}. Use List models to pick one.",

                fields.model,

                close.iter().map(|m| m.as_str()).collect::<Vec<_>>().join(", ")

            ))

        }

        _ => Ok(()),

    }

    let mut f_owned;

    let f = match assistants::PRESETS.iter().find(|p| p.0 == f.preset) {

        Some(&(_, _, name, endpoint, api)) => {

            f_owned = f.clone_shallow();

            if f_owned.name.trim().is_empty() {

                f_owned.name = name.into();

            }

            if f_owned.endpoint.trim().is_empty() {

                f_owned.endpoint = endpoint.into();

            }

            if !APIS.contains(&f_owned.api.as_str()) || f.endpoint.trim().is_empty() {

                f_owned.api = api.into();

            }

            &f_owned

        }

        None => f,

    };

            if let Err(e) = model_offered(&fields, f.token.trim()).await {

                return Ok(Err(e));

            }

            let stored = if token.is_empty() { app.assistant_key.open(&a.token).unwrap_or_default() } else { token.to_string() };

            if let Err(e) = model_offered(&fields, &stored).await {

                return Ok(Err(e));

            }

}

#[derive(Deserialize)]

pub struct ModelsForm {

    #[serde(rename = "_csrf")]

    pub csrf_token: String,

    #[serde(default)]

    id: Option<i64>,

    #[serde(default)]

    endpoint: String,

    #[serde(default)]

    api: String,

    #[serde(default)]

    token: String,

    #[serde(default)]

    preset: String,

}

/// The models a provider offers, as JSON for the form's List models

/// button (#109): `{"models": [...]}` or `{"error": "..."}`. With `id`,

/// the stored token of that assistant at this level is used when none is

/// typed.

pub async fn models(app: &Shared, at: &At, f: ModelsForm) -> sqlx::Result<serde_json::Value> {

    let preset = assistants::PRESETS.iter().find(|p| p.0 == f.preset);

    let endpoint =

        if f.endpoint.trim().is_empty() { preset.map(|p| p.3.to_string()).unwrap_or_default() } else { f.endpoint.trim().to_string() };

    let api = if APIS.contains(&f.api.as_str()) {

        f.api.clone()

    } else {

        preset.map(|p| p.4.to_string()).unwrap_or_else(|| "chat-completions".into())

    };

    let mut token = f.token.trim().to_string();

    if token.is_empty() {

        if let Some(id) = f.id {

            if let Some(a) = assistants::get(&app.db, id).await?.filter(|a| a.scope() == at.scope) {

                token = app.assistant_key.open(&a.token).unwrap_or_default();

            }

        }

    }

    Ok(match assistants::list_models(&endpoint, &api, &token).await {

        Ok(m) => serde_json::json!({ "models": m }),

        Err(e) => serde_json::json!({ "error": e }),

    })

        .route("/orgs/{name}/settings/assistants/models", post(orgs::assistant_models))

        .route("/admin/assistants/models", post(admin::assistant_models))

        .route("/{owner}/{name}/settings/assistants/models", post(repo_settings::assistant_models))

/// `POST /orgs/{name}/settings/assistants/models`: what a provider offers (#109).

pub async fn assistant_models(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(name): Path<String>,

    Form(f): Form<super::assistants::ModelsForm>,

) -> Result<axum::Json<serde_json::Value>, Error> {

    let shell = Shell::new(&app, &format!("/orgs/{name}/settings"), &viewer);

    let (_, org) = owned_org(&app, &shell, &viewer, &name).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    Ok(axum::Json(super::assistants::models(&app, &org_assistants(&org), f).await.map_err(|e| Error::from_db(shell.clone(), e))?))

}

/// `POST /{owner}/{name}/settings/assistants/models`: what a provider offers (#109).

pub async fn assistant_models(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name)): Path<(String, String)>,

    Form(f): Form<super::assistants::ModelsForm>,

) -> Result<axum::Json<serde_json::Value>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/settings"), &viewer);

    let (_, row, _) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Admin).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    Ok(axum::Json(super::assistants::models(&app, &repo_assistants(&row), f).await.map_err(|e| Error::from_db(shell.clone(), e))?))

}

#[tokio::test(flavor = "multi_thread")]

async fn adding_an_assistant_offers_providers_and_only_models_the_endpoint_lists() {

    let h = hub().await;

    let app = &h.app;

    let andy = register(app, "andy", "").await;

    let router = axum::Router::new()

        .route(

            "/v1/models",

            axum::routing::get(|headers: axum::http::HeaderMap| async move {

                assert_eq!(headers.get("authorization").and_then(|v| v.to_str().ok()), Some("Bearer sk-m"));

                axum::Json(serde_json::json!({ "data": [

                    { "id": "models/gemini-3-pro" }, { "id": "gemini-3-flash" }, { "id": "text-embedding-004" }

                ] }))

            }),

        )

        .route(

            "/v1/chat/completions",

            axum::routing::post(|| async { axum::Json(serde_json::json!({ "choices": [{ "message": { "content": "OK" } }] })) }),

        );

    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();

    let port = listener.local_addr().unwrap().port();

    tokio::spawn(async move { axum::serve(listener, router).await.unwrap() });

    let ep = format!("http%3A%2F%2F127.0.0.1%3A{port}%2Fv1%2Fchat%2Fcompletions");

    let page = get(app, "/admin", Some(&andy)).await.body;

    assert!(page.contains("data-preset-select") && page.contains("Google Gemini") && page.contains("Other (enter the endpoint)"), "{page}");

    assert!(page.contains("LIST MODELS"));

    let csrf = csrf_of(&page);

    // The model list, as the button asks for it: chat models only, prefixes gone.

    let r =

        post(app, "/admin/assistants/models", Some(&andy), &format!("_csrf={csrf}&endpoint={ep}&api=chat-completions&token=sk-m")).await;

    let v: serde_json::Value = serde_json::from_str(&r.body).unwrap();

    assert_eq!(v["models"], serde_json::json!(["gemini-3-flash", "gemini-3-pro"]), "{}", r.body);

    // A model the endpoint does not list is refused, with what it offers.

    let r = post(

        app,

        "/admin/assistants",

        Some(&andy),

        &format!("_csrf={csrf}&action=add&preset=gemini&endpoint={ep}&model=gemini-2.5-pro&token=sk-m&enabled=1"),

    )

    .await;

    assert!(r.body.contains("gemini-2.5-pro is not a model this endpoint offers") && r.body.contains("gemini-3-pro"), "{}", r.body);

    // One it lists is added, named after the provider when no name is given.

    let r = post(

        app,

        "/admin/assistants",

        Some(&andy),

        &format!("_csrf={csrf}&action=add&preset=gemini&endpoint={ep}&model=gemini-3-pro&token=sk-m&enabled=1"),

    )

    .await;

    assert!(r.body.contains("Gemini added and answered: OK"), "{}", r.body);

    let a = &oxygenhub::assistants::list(&app.db, oxygenhub::levels::Scope::Site).await.unwrap()[0];

    assert_eq!((a.name.as_str(), a.api.as_str(), a.model.as_str()), ("Gemini", "chat-completions", "gemini-3-pro"));

    // The stored token serves the edit form's button.

    let r =

        post(app, "/admin/assistants/models", Some(&andy), &format!("_csrf={csrf}&id={}&endpoint={ep}&api=chat-completions", a.id)).await;

    assert!(r.body.contains("gemini-3-flash"), "{}", r.body);

}

- **Adding one** (oxygenhub#109). The form offers providers (Anthropic, OpenAI, Google Gemini, DeepSeek, Mistral, Perplexity, Ollama) that fill the name, endpoint and API shape, and *Other* for an endpoint typed by hand. **List models** asks the endpoint's own list (`…/models` beside `…/chat/completions` or `…/messages`, with the token typed or, when editing, the one stored) and offers the chat models in the Model field; on save, a model the endpoint lists none of is refused with some it does offer. An endpoint without a list takes any name.

        <label for="am{{ r.id }}">Model</label>

        <div class="model-row"><input type="text" id="am{{ r.id }}" name="model" value="{{ r.model }}" list="am{{ r.id }}-list" autocomplete="off"><button type="button" class="small" data-list-models="{{ base }}/assistants/models" data-for="am{{ r.id }}" data-id="{{ r.id }}" data-csrf="{{ csrf }}">LIST MODELS</button></div>

        <datalist id="am{{ r.id }}-list"></datalist>

        <p class="small mute" data-models-note="am{{ r.id }}"></p>

    <label for="apreset">Provider</label>

    <select id="apreset" name="preset" data-preset-select>

      {% for p in a.presets %}<option value="{{ p.0 }}" data-name="{{ p.2 }}" data-endpoint="{{ p.3 }}" data-api="{{ p.4 }}">{{ p.1 }}</option>{% endfor %}

      <option value="">Other (enter the endpoint)</option>

    </select>

    <label for="aname">Name</label><input type="text" id="aname" name="name" placeholder="Claude">

    <p class="small mute">How it shows on reviews ("you via Claude"); the provider's name when left empty.</p>

    <label for="aendpoint">Endpoint</label><input type="text" id="aendpoint" name="endpoint" placeholder="https://api.anthropic.com/v1/messages" autocomplete="off">

    <select id="aapi" name="api">{% for api in a.apis %}<option value="{{ api }}">{{ api }}{% if *api == "chat-completions" %} (OpenAI, Gemini, DeepSeek, Mistral, Ollama, most others){% else %} (Anthropic){% endif %}</option>{% endfor %}</select>

    <label for="amodel">Model</label>

    <div class="model-row"><input type="text" id="amodel" name="model" list="amodel-list" placeholder="pick from List models" required autocomplete="off"><button type="button" class="small" data-list-models="{{ base }}/assistants/models" data-for="amodel" data-csrf="{{ csrf }}">LIST MODELS</button></div>

    <datalist id="amodel-list"></datalist>

    <p class="small mute" data-models-note="amodel">The endpoint's own list, once the provider and token are set. A model it does not list is refused on save.</p>

.model-row { display: flex; gap: 6px; align-items: center; }

.model-row input { flex: 1; }