Files
devplacepy/pyproject.toml
T
retoorandClaude Sonnet 5 c0e6abb923 Trust only the upstream X-Gateway-Model header in the AI gateway
An upstream the gateway forwards to may itself emit X-Gateway-* headers
(e.g. another DevPlace-style gateway), which can collide with the ones
about to be built for the response. Only X-Gateway-Model is ever trusted
from upstream and relayed as-is - it is the one field an upstream can
legitimately know better than we do (it may have resolved an alias or
served a different pinned version). Every other header (cost, tokens,
latency, context, app-reference) is always our own measurement and is
never overwritten, since blending in an upstream's own accounting would
corrupt the usage ledger's per-model rollups and the quota math built on
top of it.

usage.upstream_reported_model() extracts that one header defensively
(case-insensitive lookup, rejects anything oversized or containing a
control character) and gateway._apply_served_model() applies it, display-
only, at the tail of every response-header build across chat, streaming,
embeddings, images, and passthrough.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWJy6PrMMt5hwWxQwia2rd
2026-09-08 03:44:06 +02:00

62 lines
1.3 KiB
TOML

[project]
name = "devplacepy"
version = "1.0.5"
description = "DevPlace - The Developer Social Network"
requires-python = ">=3.12"
dependencies = [
"fastapi",
"uvicorn[standard]",
"jinja2",
"python-multipart",
"dataset",
"passlib[bcrypt]",
"python-dotenv",
"aiofiles",
"httpx[http2]",
"curl_cffi",
"brotli",
"zstandard",
"cryptography",
"PyJWT",
"multiavatar",
"locust",
"Pillow",
"imagehash",
"uuid_utils",
"mistune",
"emoji",
"pypdf",
"playwright",
"playwright-stealth",
"chromadb",
"weasyprint",
"cairosvg",
"sqlglot",
"curl_cffi",
"faker",
"defusedxml",
]
[project.scripts]
devplace = "devplacepy.cli:main"
devii = "devplacepy.services.devii.cli:main"
devplace-xmlrpc = "devplacepy.services.xmlrpc.server:main"
[project.optional-dependencies]
dev = ["pytest", "playwright", "requests", "coverage"]
bots = ["playwright", "faker"]
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"
[tool.pytest.ini_options]
testpaths = ["tests/unit", "tests/api", "tests/e2e"]
python_files = ["*.py"]
addopts = "--tb=line -rf -p no:xdist"
filterwarnings = [
"ignore:'crypt' is deprecated",
"ignore:Using `httpx` with `starlette.testclient` is deprecated",
"ignore:invalid escape sequence",
]