Add support for extra headers by julien-nc · Pull Request #439 · nextcloud/integration_openai

julien-nc · 2026-09-29T15:56:15Z

closes #436
refs #430

Some services might require extra headers like a non-standard authentication header.

Add the ability to define service-specific extra headers that are sent with all network requests
Add support for one variable ({$conversation_id) in the header value. This variable is only resolved in chat providers. It resolves to the conversation_id optional input that is sent by the assistant (see Let the chat providers know about the conversation/session ID assistant#674 ). This header will only be sent for chat requests.

🤖 AI (if applicable)

The content of this PR was partly or fully generated using AI (N/A)

edward-ly · 2026-10-07T06:23:11Z

Besides OpenCode Go, are there any other services that might be able to take advantage of or require this? Perhaps it would be safer to limit which headers can be sent, or do you think this approach is still fine?

kyteinsky

maybe Summary, Translate, etc. tasks also need the conversation id injection since they use the same chat completion endpoint.
for opencode, they wouldn't work without the conversation id header.

kyteinsky · 2026-10-07T07:18:38Z

+			return header.name !== header.name.trim()
+				|| header.value !== header.value.trim()


not sure if this works well for UX, if there is a genuine space after the header name/value, it will not be registered, maybe we can still register it trimmed?
if new edits to the field land, a new request can be made to save that.
wdyt?

Trimmed values are saved now.

kyteinsky · 2026-10-07T07:19:53Z

+				|| this.headerNameInvalid(header.name)
+				|| this.headerValueInvalid(header.value)


it might be good to show an error/red the input box if these fail so the user is aware there is a mistake

ah this is already the case, maybe dirty header can be replaced with a debounce?

Could you give more details on your suggestion?

kyteinsky · 2026-10-07T07:25:13Z

+				$name = trim($header['name']);
+				if ($name !== '' && preg_match(ServiceConfig::HEADER_NAME_PATTERN, $name) !== 1) {


maybe empty header names can be rejected here too

Empty header names and values cannot be saved now.

kyteinsky · 2026-10-07T10:12:34Z

+	/** Characters an HTTP header name is made of (the RFC 7230 token) */
+	public const HEADER_NAME_PATTERN = '/^[a-zA-Z0-9!#$%&\'*+.^_`|~-]+$/';


perhaps the regex can be aligned with that of guzzle, especially the FIELD_VALUE_PATTERN one
https://github.com/guzzle/psr7/blob/a3059ba1a84c9139c4ae03cf0f45bea276c97c74/src/Rfc9110.php
https://github.com/guzzle/psr7/blob/a3059ba1a84c9139c4ae03cf0f45bea276c97c74/src/MessageTrait.php

kyteinsky · 2026-10-07T10:16:16Z

 				'body' => $body,
 				'content-type' => $contentTypeHeader,
 			];
 		} catch (ClientException|ServerException $e) {


\InvalidArgumentException can be thrown in the request too if headers are not valid, would be nice to catch them too here.
see the header regex link.

Done. It is useful indeed. Some header values could be revealed to the users.

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

…tion ID passed as an optional input field in the chat providers Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

…tion providers The {$conversation_id} extra header was only expanded for the chat providers. Summary, translate and all the other task types that go through the chat completion endpoint are as well concerned: services requiring that header reject their requests without it. Every provider reaching the chat completion endpoint now takes an optional conversation_id input and passes it along the completion request. The providers delegating to another one (enhanced audio to text, improved prompt image generation) forward it, and the translation service gained a conversation ID parameter. Assisted-by: OpenCode:qwen3.8-flash Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

… one The assistant generic form schedules tasks through the task processing endpoints directly, so it cannot pass the optional conversation ID input. Services requiring the conversation header then rejected the requests. Chat completion requests now always carry a conversation ID: a random throwaway one is generated when the task does not belong to a conversation, refreshed per request so unrelated tasks never share state on conversation-aware services. Non-chat endpoints keep dropping such a header. Assisted-by: OpenCode:qwen3.8-flash Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

julien-nc · 2026-10-08T13:20:58Z

@edward-ly

Besides OpenCode Go, are there any other services that might be able to take advantage of or require this? Perhaps it would be safer to limit which headers can be sent, or do you think this approach is still fine?

I think it's fine to let the admin set any extra headers. It makes it more generic. Some services might have some exotic authentication based on specific headers.

julien-nc requested review from kyteinsky and marcelklehr September 29, 2026 15:56

julien-nc added enhancement New feature or request 3. to review labels Sep 29, 2026

kyteinsky requested a review from edward-ly October 6, 2026 18:36

kyteinsky reviewed Oct 7, 2026

View reviewed changes

julien-nc force-pushed the enh/noid/extra-headers branch from 2ccc1d0 to 66b452f Compare October 8, 2026 12:29

julien-nc added 6 commits October 8, 2026 14:30

add support for service-specific extra headers

c65b16a

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

resolve {$conversation_id} in the extra header values to the conversa…

fc93a68

…tion ID passed as an optional input field in the chat providers Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

fix extra header item delete button alignment

c888355

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

fix: tests

e32e948

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

julien-nc force-pushed the enh/noid/extra-headers branch from 66b452f to 501efdc Compare October 8, 2026 12:30

julien-nc added 4 commits October 8, 2026 14:53

do not save incomplete headers, saved trimmed values

c39c7b5

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

reject empty header name on the backend side

1b8c31e

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

improve header name/value validation

cecfd14

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

catch invalid header exception to prevent if from bubbling too far up

2df190e

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

		return header.name !== header.name.trim()
		\|\| header.value !== header.value.trim()

		\|\| this.headerNameInvalid(header.name)
		\|\| this.headerValueInvalid(header.value)

		$name = trim($header['name']);
		if ($name !== '' && preg_match(ServiceConfig::HEADER_NAME_PATTERN, $name) !== 1) {

		/** Characters an HTTP header name is made of (the RFC 7230 token) */
		public const HEADER_NAME_PATTERN = '/^[a-zA-Z0-9!#$%&\'*+.^_`\|~-]+$/';

Conversation

julien-nc commented Sep 29, 2026

🤖 AI (if applicable)

Uh oh!

edward-ly commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kyteinsky left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

julien-nc commented Oct 8, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

edward-ly commented Oct 7, 2026 •

edited

Loading