feat: AI gateway integration via deployment region config

- Add AI usecase (state/thunks/selectors) with initializeStart/initializeSucceed/initializeFailed lifecycle actions
- getToken() returns a discriminated result type in the Ai port — no-account (403) vs error cases handled without leaking adapter details into usecases
- Gracefully disable AI features on init failure; show a link to the gateway URL when user has no account
- Add AccountAiGatewayTab with token/model display and full i18n for all 9 languages

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ddecrulle

api

@@ -0,0 +1 @@
+export * from "./openWebUi";

web/src/core/adapters/ai/index.ts

@@ -0,0 +1,12 @@
+import type { Ai } from "core/ports/Ai";
+
+export function createAi(params: { webUiUrl: string }): Ai {
+    const { webUiUrl } = params;
+
+    return {
+        webUiUrl,
+        apiBase: `${webUiUrl}/api`,
+        getToken: async () => ({ status: "success" as const, token: "mock-ai-token" }),
+        listModels: async () => ["llama3.2", "mistral-7b", "codestral"]
+    };
+}

web/src/core/adapters/ai/mock.ts

@@ -0,0 +1,45 @@
+import type { Ai, GetTokenResult } from "core/ports/Ai";
+import { oidcTokenExchange, OidcTokenExchangeError } from "core/tools/oidcTokenExchange";
+
+export function createAi(params: {
+    webUiUrl: string;
+    oauthProvider: string;
+    getOidcAccessToken: () => Promise<string>;
+}): Ai {
+    const { webUiUrl, oauthProvider, getOidcAccessToken } = params;
+
+    const apiBase = `${webUiUrl}/api`;
+
+    return {
+        webUiUrl,
+        apiBase,
+        getToken: async (): Promise<GetTokenResult> => {
+            const oidcAccessToken = await getOidcAccessToken();
+
+            return oidcTokenExchange({
+                tokenExchangeEndpoint: `${webUiUrl}/api/v1/auths/oauth/${oauthProvider}/token/exchange`,
+                oidcAccessToken
+            })
+                .then(token => ({ status: "success" as const, token }))
+                .catch((error: unknown) => {
+                    if (error instanceof OidcTokenExchangeError && error.status === 403) {
+                        return { status: "no-account" as const };
+                    }
+                    return { status: "error" as const };
+                });
+        },
+        listModels: async (token: string) => {
+            const response = await fetch(`${apiBase}/models`, {
+                headers: { Authorization: `Bearer ${token}` }
+            });
+
+            if (!response.ok) {
+                throw new Error(`Failed to list models (${response.status})`);
+            }
+
+            const data = await response.json();
+
+            return (data.data as { id: string }[]).map(m => m.id);
+        }
+    };
+}

web/src/core/adapters/ai/openWebUi.ts

@@ -82,6 +82,11 @@ export type ApiTypes = {
                 };
             };
             data?: {
+                ai?: {
+                    URL: string;
+                    oauthProvider: string;
+                    oidcConfiguration?: Partial<ApiTypes.OidcConfiguration>;
+                };
                 S3?: ArrayOrNot<{
                     URL: string;
                     pathStyleAccess?: true;

web/src/core/adapters/onyxiaApi/ApiTypes.ts

@@ -435,6 +435,17 @@ export function createOnyxiaApi(params: {
                                                   apiRegion.vault.oidcConfiguration
                                               )
                                       },
+                            ai:
+                                apiRegion.data?.ai === undefined
+                                    ? undefined
+                                    : {
+                                          url: apiRegion.data.ai.URL,
+                                          oauthProvider: apiRegion.data.ai.oauthProvider,
+                                          oidcParams:
+                                              apiTypesOidcConfigurationToOidcParams_Partial(
+                                                  apiRegion.data.ai.oidcConfiguration
+                                              )
+                                      },
                             proxyInjection:
                                 apiRegion.proxyInjection === undefined
                                     ? undefined

web/src/core/adapters/onyxiaApi/onyxiaApi.ts

@@ -8,6 +8,7 @@ import type { OnyxiaApi } from "core/ports/OnyxiaApi";
 import type { SqlOlap } from "core/ports/SqlOlap";
 import { usecases } from "./usecases";
 import type { SecretsManager } from "core/ports/SecretsManager";
+import type { Ai } from "core/ports/Ai";
 import type { Oidc } from "core/ports/Oidc";
 import type { Language } from "core/ports/OnyxiaApi/Language";
 import { createDuckDbSqlOlap } from "core/adapters/sqlOlap";
@@ -38,6 +39,7 @@ export type Context = {
     onyxiaApi: OnyxiaApi;
     secretsManager: SecretsManager;
     sqlOlap: SqlOlap;
+    ai: Ai | undefined;
 };
 
 export type Core = GenericCore<typeof usecases, Context>;
@@ -83,7 +85,6 @@ export async function bootstrapCore(
                     );
             } catch (error) {
                 if (error instanceof AccessError) {
-                    // NOTE: Not initialized yet, it's not a bug.
                     return undefined;
                 }
                 throw error;
@@ -105,7 +106,6 @@ export async function bootstrapCore(
                     );
             } catch (error) {
                 if (error instanceof AccessError) {
-                    // NOTE: Not initialized yet, it's not a bug.
                     return undefined;
                 }
                 throw error;
@@ -137,7 +137,6 @@ export async function bootstrapCore(
 
     if (isAuthGloballyRequired && !oidc.isUserLoggedIn) {
         await oidc.login({ doesCurrentHrefRequiresAuth: true });
-        // NOTE: Never reached
     }
 
     const context: Context = {
@@ -177,7 +176,8 @@ export async function bootstrapCore(
                     s3_region: s3Profile.paramsOfCreateS3Client.region
                 };
             }
-        })
+        }),
+        ai: undefined
     };
 
     const { core, dispatch, getState } = createCore({
@@ -275,6 +275,49 @@ export async function bootstrapCore(
         await dispatch(usecases.s3ProfilesManagement.protectedThunks.initialize());
     }
 
+    init_ai: {
+        if (!oidc.isUserLoggedIn) {
+            break init_ai;
+        }
+
+        const deploymentRegion =
+            usecases.deploymentRegionManagement.selectors.currentDeploymentRegion(
+                getState()
+            );
+
+        if (deploymentRegion.ai === undefined) {
+            break init_ai;
+        }
+
+        const [{ createAi }, { createOidc, mergeOidcParams }, { oidcParams }] =
+            await Promise.all([
+                import("core/adapters/ai"),
+                import("core/adapters/oidc"),
+                onyxiaApi.getAvailableRegionsAndOidcParams()
+            ]);
+
+        assert(oidcParams !== undefined);
+
+        const oidc_ai = await createOidc({
+            ...mergeOidcParams({
+                oidcParams,
+                oidcParams_partial: deploymentRegion.ai.oidcParams
+            }),
+            transformBeforeRedirectForKeycloakTheme,
+            getCurrentLang,
+            autoLogin: true,
+            enableDebugLogs: enableOidcDebugLogs
+        });
+
+        context.ai = createAi({
+            webUiUrl: deploymentRegion.ai.url,
+            oauthProvider: deploymentRegion.ai.oauthProvider,
+            getOidcAccessToken: async () => (await oidc_ai.getTokens()).accessToken
+        });
+
+        await dispatch(usecases.ai.protectedThunks.initialize());
+    }
+
     pluginSystemInitCore({ core, context });
 
     return { core };

web/src/core/bootstrap.ts

@@ -0,0 +1,11 @@
+export type Ai = {
+    webUiUrl: string;
+    apiBase: string;
+    getToken: () => Promise<GetTokenResult>;
+    listModels: (token: string) => Promise<string[]>;
+};
+
+export type GetTokenResult =
+    | { status: "success"; token: string }
+    | { status: "no-account" }
+    | { status: "error" };

web/src/core/ports/Ai.ts

@@ -44,6 +44,13 @@ export type DeploymentRegion = {
               oidcParams: OidcParams_Partial;
           }
         | undefined;
+    ai:
+        | {
+              url: string;
+              oauthProvider: string;
+              oidcParams: OidcParams_Partial;
+          }
+        | undefined;
     proxyInjection:
         | {
               enabled: boolean | undefined;

web/src/core/ports/OnyxiaApi/DeploymentRegion.ts

@@ -182,6 +182,14 @@ export type XOnyxiaContext = {
         useCertManager: boolean;
         certManagerClusterIssuer: string | undefined;
     };
+    ai:
+        | {
+              enabled: true;
+              token: string;
+              apiBase: string;
+              model: string;
+          }
+        | undefined;
     proxyInjection:
         | {
               enabled: boolean | undefined;