feat(videos): implement auth binding for video requests and enhance proxy handling

- Added auth binding logic to tie video requests to specific authentication IDs.
- Enhanced video content handlers to support proxy configuration based on selected auth.
- Introduced helper functions for creating HTTP clients with direct or global proxy fallback.
- Expanded unit tests to validate auth binding, proxy usage, and fallback behavior.

Author: luispater

sdk/api/handlers/openai/openai_videos_handlers.go

@@ -14,8 +14,11 @@ import (
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
+	"github.com/router-for-me/CLIProxyAPI/v7/internal/config"
 	"github.com/router-for-me/CLIProxyAPI/v7/internal/interfaces"
+	"github.com/router-for-me/CLIProxyAPI/v7/internal/runtime/executor/helps"
 	"github.com/router-for-me/CLIProxyAPI/v7/sdk/api/handlers"
+	coreauth "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/auth"
 	log "github.com/sirupsen/logrus"
 	"github.com/tidwall/gjson"
 	"github.com/tidwall/sjson"
@@ -738,7 +741,11 @@ func (h *OpenAIAPIHandler) VideosRetrieve(c *gin.Context) {
 
 	c.Header("Content-Type", "application/json")
 	cliCtx, cliCancel := h.GetContextWithCancel(h, c, context.Background())
+	selectedAuthID := ""
 	cliCtx = h.contextWithVideoAuthBinding(cliCtx, videoID)
+	cliCtx = handlers.WithSelectedAuthIDCallback(cliCtx, func(authID string) {
+		selectedAuthID = authID
+	})
 	stopKeepAlive := h.StartNonStreamingKeepAlive(c, cliCtx)
 	resp, upstreamHeaders, errMsg := h.ExecuteWithAuthManager(cliCtx, xaiVideosHandlerType, defaultXAIVideosModel, payload, "")
 	stopKeepAlive()
@@ -760,6 +767,7 @@ func (h *OpenAIAPIHandler) VideosRetrieve(c *gin.Context) {
 		return
 	}
 
+	videoAuthBindings.set(videoID, selectedAuthID, h.videoAuthBindingTTL())
 	handlers.WriteUpstreamHeaders(c.Writer.Header(), upstreamHeaders)
 	_, _ = c.Writer.Write(out)
 	cliCancel(nil)
@@ -795,7 +803,11 @@ func (h *OpenAIAPIHandler) VideosContent(c *gin.Context) {
 	payload, _ = sjson.SetBytes(payload, "request_id", videoID)
 
 	cliCtx, cliCancel := h.GetContextWithCancel(h, c, context.Background())
+	selectedAuthID := ""
 	cliCtx = h.contextWithVideoAuthBinding(cliCtx, videoID)
+	cliCtx = handlers.WithSelectedAuthIDCallback(cliCtx, func(authID string) {
+		selectedAuthID = authID
+	})
 	stopKeepAlive := h.StartNonStreamingKeepAlive(c, cliCtx)
 	resp, _, errMsg := h.ExecuteWithAuthManager(cliCtx, xaiVideosHandlerType, defaultXAIVideosModel, payload, "")
 	stopKeepAlive()
@@ -809,6 +821,7 @@ func (h *OpenAIAPIHandler) VideosContent(c *gin.Context) {
 		return
 	}
 
+	videoAuthBindings.set(videoID, selectedAuthID, h.videoAuthBindingTTL())
 	contentURL, err := xaiVideoContentURLFromPayload(resp)
 	if err != nil {
 		errMsg := &interfaces.ErrorMessage{StatusCode: http.StatusBadGateway, Error: err}
@@ -832,7 +845,8 @@ func (h *OpenAIAPIHandler) writeVideoContentFromURL(c *gin.Context, contentURL s
 		return err
 	}
 
-	resp, err := http.DefaultClient.Do(req)
+	httpClient := h.videoContentHTTPClient(c)
+	resp, err := httpClient.Do(req)
 	if err != nil {
 		errMsg := &interfaces.ErrorMessage{StatusCode: http.StatusBadGateway, Error: err}
 		h.WriteErrorResponse(c, errMsg)
@@ -864,6 +878,37 @@ func (h *OpenAIAPIHandler) writeVideoContentFromURL(c *gin.Context, contentURL s
 	return err
 }
 
+func (h *OpenAIAPIHandler) videoContentHTTPClient(c *gin.Context) *http.Client {
+	ctx := context.Background()
+	if c != nil && c.Request != nil {
+		ctx = c.Request.Context()
+	}
+	var cfg *config.Config
+	if h != nil && h.BaseAPIHandler != nil && h.Cfg != nil {
+		cfg = &config.Config{SDKConfig: *h.Cfg}
+	}
+	return helps.NewProxyAwareHTTPClient(ctx, cfg, h.videoContentDownloadAuth(c), 0)
+}
+
+func (h *OpenAIAPIHandler) videoContentDownloadAuth(c *gin.Context) *coreauth.Auth {
+	if h == nil || h.BaseAPIHandler == nil || h.AuthManager == nil || c == nil {
+		return nil
+	}
+	videoID := strings.TrimSpace(c.Param("video_id"))
+	if videoID == "" {
+		return nil
+	}
+	authID, ok := videoAuthBindings.get(videoID)
+	if !ok {
+		return nil
+	}
+	auth, ok := h.AuthManager.GetByID(authID)
+	if !ok {
+		return nil
+	}
+	return auth
+}
+
 func copyVideoContentHeaders(dst http.Header, src http.Header) {
 	for _, key := range []string{"Content-Type", "Content-Length", "Content-Disposition", "Cache-Control", "ETag", "Last-Modified"} {
 		if value := src.Get(key); value != "" {

sdk/api/handlers/openai/openai_videos_handlers_test.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"strconv"
 	"strings"
 	"sync"
 	"testing"
@@ -62,9 +63,10 @@ func performVideosRouteRequest(t *testing.T, method string, routePath string, re
 }
 
 type videoAuthCaptureExecutor struct {
-	mu        sync.Mutex
-	requestID string
-	authIDs   []string
+	mu         sync.Mutex
+	requestID  string
+	contentURL string
+	authIDs    []string
 }
 
 func (e *videoAuthCaptureExecutor) Identifier() string { return "xai" }
@@ -82,7 +84,11 @@ func (e *videoAuthCaptureExecutor) Execute(_ context.Context, auth *coreauth.Aut
 	if requestID == "" {
 		requestID = e.requestID
 	}
-	payload := []byte(`{"request_id":"` + requestID + `","status":"completed","progress":100,"video":{"url":"https://vidgen.x.ai/video.mp4","duration":4}}`)
+	contentURL := strings.TrimSpace(e.contentURL)
+	if contentURL == "" {
+		contentURL = "https://vidgen.x.ai/video.mp4"
+	}
+	payload := []byte(`{"request_id":` + strconv.Quote(requestID) + `,"status":"completed","progress":100,"video":{"url":` + strconv.Quote(contentURL) + `,"duration":4}}`)
 	return coreexecutor.Response{Payload: payload}, nil
 }
 
@@ -394,7 +400,8 @@ func TestWriteVideoContentFromURL(t *testing.T) {
 	ctx, _ := gin.CreateTestContext(resp)
 	ctx.Request = httptest.NewRequest(http.MethodGet, "/openai/v1/videos/video_123/content", nil)
 
-	handler := &OpenAIAPIHandler{}
+	base := apihandlers.NewBaseAPIHandlers(&sdkconfig.SDKConfig{}, nil)
+	handler := NewOpenAIAPIHandler(base)
 	if err := handler.writeVideoContentFromURL(ctx, upstream.URL+"/video.mp4"); err != nil {
 		t.Fatalf("writeVideoContentFromURL() error = %v", err)
 	}
@@ -413,6 +420,151 @@ func TestWriteVideoContentFromURL(t *testing.T) {
 	}
 }
 
+func TestWriteVideoContentFromURLUsesPinnedAuthProxy(t *testing.T) {
+	resetVideoAuthBindingsForTest(t)
+
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "video/mp4")
+		_, _ = w.Write([]byte("video-bytes"))
+	}))
+	defer upstream.Close()
+
+	manager := coreauth.NewManager(nil, &coreauth.RoundRobinSelector{}, nil)
+	authID := "video-content-auth"
+	auth := &coreauth.Auth{
+		ID:       authID,
+		Provider: "xai",
+		Status:   coreauth.StatusActive,
+		ProxyURL: "direct",
+	}
+	if _, errRegister := manager.Register(context.Background(), auth); errRegister != nil {
+		t.Fatalf("manager.Register() error = %v", errRegister)
+	}
+
+	base := apihandlers.NewBaseAPIHandlers(&sdkconfig.SDKConfig{ProxyURL: "http://global-proxy.example.com:8080"}, manager)
+	handler := NewOpenAIAPIHandler(base)
+	videoAuthBindings.set("video_123", authID, time.Hour)
+
+	gin.SetMode(gin.TestMode)
+	resp := httptest.NewRecorder()
+	ctx, _ := gin.CreateTestContext(resp)
+	ctx.Params = gin.Params{{Key: "video_id", Value: "video_123"}}
+	ctx.Request = httptest.NewRequest(http.MethodGet, "/openai/v1/videos/video_123/content", nil)
+
+	if err := handler.writeVideoContentFromURL(ctx, upstream.URL+"/video.mp4"); err != nil {
+		t.Fatalf("writeVideoContentFromURL() error = %v", err)
+	}
+
+	client := handler.videoContentHTTPClient(ctx)
+	transport, ok := client.Transport.(*http.Transport)
+	if !ok {
+		t.Fatalf("transport type = %T, want *http.Transport", client.Transport)
+	}
+	if transport.Proxy != nil {
+		t.Fatal("expected pinned auth direct proxy to bypass global proxy")
+	}
+	if resp.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d body=%s", resp.Code, http.StatusOK, resp.Body.String())
+	}
+}
+
+func TestWriteVideoContentFromURLFallsBackToGlobalProxy(t *testing.T) {
+	resetVideoAuthBindingsForTest(t)
+
+	base := apihandlers.NewBaseAPIHandlers(&sdkconfig.SDKConfig{ProxyURL: "http://global-proxy.example.com:8080"}, nil)
+	handler := NewOpenAIAPIHandler(base)
+
+	gin.SetMode(gin.TestMode)
+	resp := httptest.NewRecorder()
+	ctx, _ := gin.CreateTestContext(resp)
+	ctx.Params = gin.Params{{Key: "video_id", Value: "video_456"}}
+	ctx.Request = httptest.NewRequest(http.MethodGet, "/openai/v1/videos/video_456/content", nil)
+
+	client := handler.videoContentHTTPClient(ctx)
+	transport, ok := client.Transport.(*http.Transport)
+	if !ok {
+		t.Fatalf("transport type = %T, want *http.Transport", client.Transport)
+	}
+
+	req, errRequest := http.NewRequest(http.MethodGet, "https://example.com/video.mp4", nil)
+	if errRequest != nil {
+		t.Fatalf("http.NewRequest() error = %v", errRequest)
+	}
+	proxyURL, errProxy := transport.Proxy(req)
+	if errProxy != nil {
+		t.Fatalf("transport.Proxy() error = %v", errProxy)
+	}
+	if proxyURL == nil || proxyURL.String() != "http://global-proxy.example.com:8080" {
+		t.Fatalf("proxy URL = %v, want http://global-proxy.example.com:8080", proxyURL)
+	}
+}
+
+func TestVideosContentUsesSelectedAuthProxyForDownload(t *testing.T) {
+	resetVideoAuthBindingsForTest(t)
+
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "video/mp4")
+		_, _ = w.Write([]byte("video-bytes"))
+	}))
+	defer upstream.Close()
+
+	var proxyMu sync.Mutex
+	proxyHits := 0
+	globalProxy := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		proxyMu.Lock()
+		proxyHits++
+		proxyMu.Unlock()
+		http.Error(w, "unexpected proxy", http.StatusBadGateway)
+	}))
+	defer globalProxy.Close()
+
+	videoID := "video-content-selected"
+	authID := "video-content-selected-auth"
+	executor := &videoAuthCaptureExecutor{
+		requestID:  videoID,
+		contentURL: upstream.URL + "/video.mp4",
+	}
+	manager := coreauth.NewManager(nil, &coreauth.RoundRobinSelector{}, nil)
+	manager.RegisterExecutor(executor)
+	auth := &coreauth.Auth{
+		ID:       authID,
+		Provider: "xai",
+		Status:   coreauth.StatusActive,
+		ProxyURL: "direct",
+	}
+	if _, errRegister := manager.Register(context.Background(), auth); errRegister != nil {
+		t.Fatalf("manager.Register() error = %v", errRegister)
+	}
+	registry.GetGlobalRegistry().RegisterClient(authID, auth.Provider, []*registry.ModelInfo{{ID: defaultXAIVideosModel}})
+	t.Cleanup(func() {
+		registry.GetGlobalRegistry().UnregisterClient(authID)
+	})
+
+	base := apihandlers.NewBaseAPIHandlers(&sdkconfig.SDKConfig{ProxyURL: globalProxy.URL}, manager)
+	handler := NewOpenAIAPIHandler(base)
+
+	resp := performVideosRouteRequest(t, http.MethodGet, openAIVideosPath+"/:video_id/content", openAIVideosPath+"/"+videoID+"/content", "", nil, handler.VideosContent)
+	if resp.Code != http.StatusOK {
+		t.Fatalf("content status = %d, want %d: %s", resp.Code, http.StatusOK, resp.Body.String())
+	}
+	if got := resp.Body.String(); got != "video-bytes" {
+		t.Fatalf("content body = %q, want video-bytes", got)
+	}
+	authIDs := executor.AuthIDs()
+	if len(authIDs) != 1 || authIDs[0] != authID {
+		t.Fatalf("authIDs = %v, want [%s]", authIDs, authID)
+	}
+	if boundAuthID, ok := videoAuthBindings.get(videoID); !ok || boundAuthID != authID {
+		t.Fatalf("bound auth = %q ok=%v, want %s", boundAuthID, ok, authID)
+	}
+	proxyMu.Lock()
+	gotProxyHits := proxyHits
+	proxyMu.Unlock()
+	if gotProxyHits != 0 {
+		t.Fatalf("global proxy hits = %d, want 0", gotProxyHits)
+	}
+}
+
 func TestVideosCreateRejectsUnsupportedModel(t *testing.T) {
 	handler := &OpenAIAPIHandler{}
 	body := strings.NewReader(`{"model":"not-a-video-model","prompt":"make a video"}`)