Skip to content

fix(provider): register the hosted demo loader under its real id (synsci)#119

Merged
Aayam Bansal (aayambansal) merged 1 commit into
mainfrom
fix/provider-demo-loader-key
Jul 7, 2026
Merged

fix(provider): register the hosted demo loader under its real id (synsci)#119
Aayam Bansal (aayambansal) merged 1 commit into
mainfrom
fix/provider-demo-loader-key

Conversation

@aayambansal

Copy link
Copy Markdown
Member

Audit finding #16 (High). The CUSTOM_LOADERS entry for the zero-cost hosted demo was keyed openscience, but the catalog provider id is synsci (confirmed: models-api.json uses "id":"synsci", and everything else — managedProviderAllowed, getSmallModel, defaultModel — keys off synsci). The loader loop did database["openscience"] → undefined → logged Provider does not exist in model list openscience and continued, so the loader never ran:

  • the demo's apiKey: "public" sentinel was never set → a brand-new user with no key couldn't use the zero-cost demo at all;
  • the "drop paid models when no key" gating was skipped.

Rename the loader key to synsci (the id that must not change, per the wire contract) and read the provider via input.id. Only keyless users are affected — it enables the demo they currently can't reach; a user with a synsci key is unchanged (hasKey → options {}).

Typecheck + full backend suite (929 tests) green.

…sci)

The CUSTOM_LOADERS entry for the zero-cost hosted demo was keyed
'openscience', but the catalog provider id is 'synsci' (the Atlas
wire-contract id). The loader loop looked up database['openscience'],
found nothing, logged 'Provider does not exist in model list openscience',
and skipped the loader entirely. Consequences: the demo's apiKey:'public'
sentinel was never set, so a brand-new user with no key couldn't use the
zero-cost demo at all; and the 'drop paid models when no key' gating never
ran. Rename the loader key to 'synsci' and read the provider via input.id.
@vercel

vercel Bot commented Jul 7, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
openscience Ready Ready Preview, Comment Jul 7, 2026 3:14am

Request Review

@aayambansal Aayam Bansal (aayambansal) merged commit b23df88 into main Jul 7, 2026
11 checks passed
@aayambansal Aayam Bansal (aayambansal) deleted the fix/provider-demo-loader-key branch July 7, 2026 03:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant