chore: import upstream snapshot with attribution

apps/sim/app/api/providers/ollama-cloud/models/route.test.ts

@@ -0,0 +1,238 @@
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockFilterBlacklistedModels,
+  mockIsProviderBlacklisted,
+  mockGetBYOKKey,
+  mockGetSession,
+  mockGetUserEntityPermissions,
+  mockFetch,
+} = vi.hoisted(() => ({
+  mockFilterBlacklistedModels: vi.fn(),
+  mockIsProviderBlacklisted: vi.fn(),
+  mockGetBYOKKey: vi.fn(),
+  mockGetSession: vi.fn(),
+  mockGetUserEntityPermissions: vi.fn(),
+  mockFetch: vi.fn(),
+}))
+
+vi.mock('@/providers/utils', () => ({
+  filterBlacklistedModels: mockFilterBlacklistedModels,
+  isProviderBlacklisted: mockIsProviderBlacklisted,
+}))
+
+vi.mock('@/lib/api-key/byok', () => ({
+  getBYOKKey: mockGetBYOKKey,
+}))
+
+vi.mock('@/lib/auth', () => ({
+  getSession: mockGetSession,
+}))
+
+vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  getUserEntityPermissions: mockGetUserEntityPermissions,
+}))
+
+import { GET } from '@/app/api/providers/ollama-cloud/models/route'
+
+const OLLAMA_CLOUD_TAGS_URL = 'https://ollama.com/api/tags'
+
+const okResponse = (body: unknown) => ({
+  ok: true,
+  status: 200,
+  statusText: 'OK',
+  json: vi.fn().mockResolvedValue(body),
+})
+
+const errorResponse = (status: number, statusText = 'Unauthorized') => ({
+  ok: false,
+  status,
+  statusText,
+  json: vi.fn().mockResolvedValue({}),
+})
+
+/**
+ * Builds a request whose query string carries the given workspaceId. Passing
+ * `undefined` omits the param entirely; passing `''` produces `?workspaceId=`.
+ */
+const requestWithWorkspace = (workspaceId?: string) => {
+  const url = new URL('http://localhost:3000/api/providers/ollama-cloud/models')
+  if (workspaceId !== undefined) {
+    url.searchParams.set('workspaceId', workspaceId)
+  }
+  return createMockRequest('GET', undefined, {}, url.toString())
+}
+
+const fetchAuthHeader = () => {
+  const init = mockFetch.mock.calls[0]?.[1] as RequestInit | undefined
+  const headers = init?.headers as Record<string, string> | undefined
+  return headers?.Authorization
+}
+
+/** Grants a session + workspace permission so the BYOK lookup is reached. */
+const grantWorkspaceAccess = () => {
+  mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+  mockGetUserEntityPermissions.mockResolvedValue('admin')
+}
+
+describe('GET /api/providers/ollama-cloud/models', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.stubGlobal('fetch', mockFetch)
+
+    mockIsProviderBlacklisted.mockReturnValue(false)
+    mockFilterBlacklistedModels.mockImplementation((models: string[]) => models)
+    mockGetBYOKKey.mockResolvedValue(null)
+    mockGetSession.mockResolvedValue(null)
+    mockGetUserEntityPermissions.mockResolvedValue(null)
+  })
+
+  it('returns empty models without calling fetch when the provider is blacklisted', async () => {
+    mockIsProviderBlacklisted.mockReturnValue(true)
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('returns empty models when there is no workspaceId (BYOK only, no env fallback)', async () => {
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockFetch).not.toHaveBeenCalled()
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+  })
+
+  it('returns empty models when the workspace has no stored BYOK key (never falls back to a hosted key)', async () => {
+    grantWorkspaceAccess()
+    mockGetBYOKKey.mockResolvedValue(null)
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockGetBYOKKey).toHaveBeenCalledWith('ws-1', 'ollama-cloud')
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('fetches /api/tags with the BYOK key and prefixes each model name with ollama-cloud/', async () => {
+    grantWorkspaceAccess()
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'byok-ollama-key' })
+    mockFetch.mockResolvedValue(
+      okResponse({
+        models: [{ name: 'gpt-oss:120b' }, { name: 'deepseek-v3.1:671b' }],
+      })
+    )
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({
+      models: ['ollama-cloud/gpt-oss:120b', 'ollama-cloud/deepseek-v3.1:671b'],
+    })
+
+    expect(mockFetch).toHaveBeenCalledTimes(1)
+    expect(mockFetch.mock.calls[0][0]).toBe(OLLAMA_CLOUD_TAGS_URL)
+    expect(fetchAuthHeader()).toBe('Bearer byok-ollama-key')
+  })
+
+  it('does not call getBYOKKey when there is a workspaceId but no session', async () => {
+    mockGetSession.mockResolvedValue(null)
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('does not call getBYOKKey when the session user lacks workspace permission', async () => {
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockGetUserEntityPermissions.mockResolvedValue(null)
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('returns empty models when the upstream fetch responds non-ok', async () => {
+    grantWorkspaceAccess()
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'byok-ollama-key' })
+    mockFetch.mockResolvedValue(errorResponse(401, 'Unauthorized'))
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('returns empty models when the upstream fetch throws', async () => {
+    grantWorkspaceAccess()
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'byok-ollama-key' })
+    mockFetch.mockRejectedValue(new Error('network down'))
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('returns a validation error for an empty workspaceId query param', async () => {
+    const res = await GET(requestWithWorkspace(''))
+
+    expect(res.status).toBe(400)
+    const body = (await res.json()) as { error: string }
+    expect(body.error).toBe('Validation error')
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('dedupes duplicate model names from the upstream response', async () => {
+    grantWorkspaceAccess()
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'byok-ollama-key' })
+    mockFetch.mockResolvedValue(
+      okResponse({
+        models: [{ name: 'gpt-oss:120b' }, { name: 'gpt-oss:120b' }, { name: 'qwen3-coder:480b' }],
+      })
+    )
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({
+      models: ['ollama-cloud/gpt-oss:120b', 'ollama-cloud/qwen3-coder:480b'],
+    })
+  })
+
+  it('applies the blacklist filter to the deduped model list', async () => {
+    grantWorkspaceAccess()
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'byok-ollama-key' })
+    mockFilterBlacklistedModels.mockImplementation((models: string[]) =>
+      models.filter((m) => !m.includes('qwen'))
+    )
+    mockFetch.mockResolvedValue(
+      okResponse({
+        models: [{ name: 'gpt-oss:120b' }, { name: 'qwen3-coder:480b' }],
+      })
+    )
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['ollama-cloud/gpt-oss:120b'] })
+    expect(mockFilterBlacklistedModels).toHaveBeenCalledWith([
+      'ollama-cloud/gpt-oss:120b',
+      'ollama-cloud/qwen3-coder:480b',
+    ])
+  })
+})

apps/sim/app/api/providers/ollama-cloud/models/route.ts

@@ -0,0 +1,91 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  ollamaCloudProviderModelsQuerySchema,
+  ollamaUpstreamResponseSchema,
+  providerModelsResponseSchema,
+} from '@/lib/api/contracts/providers'
+import { validationErrorResponse } from '@/lib/api/server'
+import { getBYOKKey } from '@/lib/api-key/byok'
+import { getSession } from '@/lib/auth'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+import { filterBlacklistedModels, isProviderBlacklisted } from '@/providers/utils'
+
+const logger = createLogger('OllamaCloudModelsAPI')
+
+/**
+ * Get available Ollama Cloud models.
+ *
+ * Ollama Cloud is BYOK-only — Sim never supplies a hosted key and never bills
+ * usage. Models are listed only when the workspace has stored its own Ollama
+ * API key, which is used to authenticate against the cloud `/api/tags` endpoint.
+ */
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  if (isProviderBlacklisted('ollama-cloud')) {
+    logger.info('Ollama Cloud provider is blacklisted, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  const queryValidation = ollamaCloudProviderModelsQuerySchema.safeParse({
+    workspaceId: request.nextUrl.searchParams.get('workspaceId') ?? undefined,
+  })
+  if (!queryValidation.success) return validationErrorResponse(queryValidation.error)
+  const { workspaceId } = queryValidation.data
+
+  let apiKey: string | undefined
+  if (workspaceId) {
+    const session = await getSession()
+    if (session?.user?.id) {
+      const permission = await getUserEntityPermissions(session.user.id, 'workspace', workspaceId)
+      if (permission) {
+        const byokResult = await getBYOKKey(workspaceId, 'ollama-cloud')
+        if (byokResult) {
+          apiKey = byokResult.apiKey
+        }
+      }
+    }
+  }
+
+  if (!apiKey) {
+    logger.info('No Ollama Cloud API key available, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  try {
+    const response = await fetch('https://ollama.com/api/tags', {
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      cache: 'no-store',
+    })
+
+    if (!response.ok) {
+      logger.warn('Failed to fetch Ollama Cloud models', {
+        status: response.status,
+        statusText: response.statusText,
+      })
+      return NextResponse.json({ models: [] })
+    }
+
+    const data = ollamaUpstreamResponseSchema.parse(await response.json())
+
+    const allModels = data.models.map((model) => `ollama-cloud/${model.name}`)
+    const uniqueModels = Array.from(new Set(allModels))
+    const models = filterBlacklistedModels(uniqueModels)
+
+    logger.info('Successfully fetched Ollama Cloud models', {
+      count: models.length,
+      filtered: uniqueModels.length - models.length,
+    })
+
+    return NextResponse.json(providerModelsResponseSchema.parse({ models }))
+  } catch (error) {
+    logger.error('Error fetching Ollama Cloud models', {
+      error: getErrorMessage(error, 'Unknown error'),
+    })
+    return NextResponse.json({ models: [] })
+  }
+})