chore: import upstream snapshot with attribution

apps/sim/app/api/providers/together/models/route.test.ts

@@ -0,0 +1,259 @@
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockFilterBlacklistedModels,
+  mockIsProviderBlacklisted,
+  mockGetBYOKKey,
+  mockGetSession,
+  mockGetUserEntityPermissions,
+  mockFetch,
+  mutableEnv,
+} = vi.hoisted(() => ({
+  mockFilterBlacklistedModels: vi.fn(),
+  mockIsProviderBlacklisted: vi.fn(),
+  mockGetBYOKKey: vi.fn(),
+  mockGetSession: vi.fn(),
+  mockGetUserEntityPermissions: vi.fn(),
+  mockFetch: vi.fn(),
+  mutableEnv: { TOGETHER_API_KEY: undefined as string | undefined },
+}))
+
+vi.mock('@/providers/utils', () => ({
+  filterBlacklistedModels: mockFilterBlacklistedModels,
+  isProviderBlacklisted: mockIsProviderBlacklisted,
+}))
+
+vi.mock('@/lib/api-key/byok', () => ({
+  getBYOKKey: mockGetBYOKKey,
+}))
+
+vi.mock('@/lib/auth', () => ({
+  getSession: mockGetSession,
+}))
+
+vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  getUserEntityPermissions: mockGetUserEntityPermissions,
+}))
+
+vi.mock('@/lib/core/config/env', () => ({
+  env: mutableEnv,
+}))
+
+import { GET } from '@/app/api/providers/together/models/route'
+
+const TOGETHER_MODELS_URL = 'https://api.together.ai/v1/models'
+
+const okResponse = (body: unknown) => ({
+  ok: true,
+  status: 200,
+  statusText: 'OK',
+  json: vi.fn().mockResolvedValue(body),
+})
+
+const errorResponse = (status: number, statusText = 'Unauthorized') => ({
+  ok: false,
+  status,
+  statusText,
+  json: vi.fn().mockResolvedValue({}),
+})
+
+/**
+ * Builds a request whose query string carries the given workspaceId. Passing
+ * `undefined` omits the param entirely; passing `''` produces `?workspaceId=`.
+ */
+const requestWithWorkspace = (workspaceId?: string) => {
+  const url = new URL('http://localhost:3000/api/providers/together/models')
+  if (workspaceId !== undefined) {
+    url.searchParams.set('workspaceId', workspaceId)
+  }
+  return createMockRequest('GET', undefined, {}, url.toString())
+}
+
+const fetchAuthHeader = () => {
+  const init = mockFetch.mock.calls[0]?.[1] as RequestInit | undefined
+  const headers = init?.headers as Record<string, string> | undefined
+  return headers?.Authorization
+}
+
+describe('GET /api/providers/together/models', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.stubGlobal('fetch', mockFetch)
+
+    mutableEnv.TOGETHER_API_KEY = undefined
+    mockIsProviderBlacklisted.mockReturnValue(false)
+    mockFilterBlacklistedModels.mockImplementation((models: string[]) => models)
+    mockGetBYOKKey.mockResolvedValue(null)
+    mockGetSession.mockResolvedValue(null)
+    mockGetUserEntityPermissions.mockResolvedValue(null)
+  })
+
+  it('returns empty models without calling fetch when the provider is blacklisted', async () => {
+    mockIsProviderBlacklisted.mockReturnValue(true)
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('returns empty models when there is no workspaceId and no env key', async () => {
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('fetches with the env key and prefixes each model id with together/', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockResolvedValue(
+      okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }, { id: 'Qwen/Qwen2.5-72B-Instruct-Turbo' }])
+    )
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({
+      models: ['together/moonshotai/Kimi-K2-Instruct', 'together/Qwen/Qwen2.5-72B-Instruct-Turbo'],
+    })
+
+    expect(mockFetch).toHaveBeenCalledTimes(1)
+    expect(mockFetch.mock.calls[0][0]).toBe(TOGETHER_MODELS_URL)
+    expect(fetchAuthHeader()).toBe('Bearer env-together-key')
+  })
+
+  it('uses the BYOK key when a workspace, session, and permission are present', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockGetUserEntityPermissions.mockResolvedValue('admin')
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'byok-together-key' })
+    mockFetch.mockResolvedValue(okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }]))
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['together/moonshotai/Kimi-K2-Instruct'] })
+
+    expect(mockGetBYOKKey).toHaveBeenCalledWith('ws-1', 'together')
+    expect(fetchAuthHeader()).toBe('Bearer byok-together-key')
+  })
+
+  it('falls back to the env key when a workspaceId is given but there is no session', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockGetSession.mockResolvedValue(null)
+    mockFetch.mockResolvedValue(okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }]))
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['together/moonshotai/Kimi-K2-Instruct'] })
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+    expect(fetchAuthHeader()).toBe('Bearer env-together-key')
+  })
+
+  it('falls back to the env key when the session user lacks workspace permission', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockGetUserEntityPermissions.mockResolvedValue(null)
+    mockFetch.mockResolvedValue(okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }]))
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['together/moonshotai/Kimi-K2-Instruct'] })
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+    expect(fetchAuthHeader()).toBe('Bearer env-together-key')
+  })
+
+  it('returns empty models when the upstream fetch responds non-ok', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockResolvedValue(errorResponse(401, 'Unauthorized'))
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('returns empty models when the upstream fetch throws', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockRejectedValue(new Error('network down'))
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('returns a validation error for an empty workspaceId query param', async () => {
+    const res = await GET(requestWithWorkspace(''))
+
+    expect(res.status).toBe(400)
+    const body = (await res.json()) as { error: string }
+    expect(body.error).toBe('Validation error')
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('dedupes duplicate model ids from the upstream array', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockResolvedValue(
+      okResponse([
+        { id: 'moonshotai/Kimi-K2-Instruct' },
+        { id: 'moonshotai/Kimi-K2-Instruct' },
+        { id: 'Qwen/Qwen2.5-72B-Instruct-Turbo' },
+      ])
+    )
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({
+      models: ['together/moonshotai/Kimi-K2-Instruct', 'together/Qwen/Qwen2.5-72B-Instruct-Turbo'],
+    })
+  })
+
+  it('applies the blacklist filter to the deduped model list', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFilterBlacklistedModels.mockImplementation((models: string[]) =>
+      models.filter((m) => !m.includes('Qwen'))
+    )
+    mockFetch.mockResolvedValue(
+      okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }, { id: 'Qwen/Qwen2.5-72B-Instruct-Turbo' }])
+    )
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['together/moonshotai/Kimi-K2-Instruct'] })
+    expect(mockFilterBlacklistedModels).toHaveBeenCalledWith([
+      'together/moonshotai/Kimi-K2-Instruct',
+      'together/Qwen/Qwen2.5-72B-Instruct-Turbo',
+    ])
+  })
+
+  it('filters out non-chat model types (image, embedding, rerank, etc.)', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockResolvedValue(
+      okResponse([
+        { id: 'meta-llama/Llama-3.3-70B-Instruct-Turbo', type: 'chat' },
+        { id: 'black-forest-labs/FLUX.1-schnell', type: 'image' },
+        { id: 'BAAI/bge-large-en-v1.5', type: 'embedding' },
+        { id: 'Salesforce/Llama-Rank-V1', type: 'rerank' },
+        { id: 'openai/whisper-large-v3', type: 'transcribe' },
+      ])
+    )
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({
+      models: ['together/meta-llama/Llama-3.3-70B-Instruct-Turbo'],
+    })
+  })
+})

apps/sim/app/api/providers/together/models/route.ts

@@ -0,0 +1,105 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  providerModelsResponseSchema,
+  togetherProviderModelsQuerySchema,
+  togetherUpstreamResponseSchema,
+} from '@/lib/api/contracts/providers'
+import { validationErrorResponse } from '@/lib/api/server'
+import { getBYOKKey } from '@/lib/api-key/byok'
+import { getSession } from '@/lib/auth'
+import { env } from '@/lib/core/config/env'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+import { filterBlacklistedModels, isProviderBlacklisted } from '@/providers/utils'
+
+const logger = createLogger('TogetherModelsAPI')
+
+/** Together's catalog includes non-text models; only chat models work with chat completions. */
+const NON_CHAT_MODEL_TYPES = new Set([
+  'image',
+  'video',
+  'audio',
+  'transcribe',
+  'embedding',
+  'moderation',
+  'rerank',
+])
+
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  if (isProviderBlacklisted('together')) {
+    logger.info('Together provider is blacklisted, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  let apiKey: string | undefined
+
+  const queryValidation = togetherProviderModelsQuerySchema.safeParse({
+    workspaceId: request.nextUrl.searchParams.get('workspaceId') ?? undefined,
+  })
+  if (!queryValidation.success) return validationErrorResponse(queryValidation.error)
+  const { workspaceId } = queryValidation.data
+  if (workspaceId) {
+    const session = await getSession()
+    if (session?.user?.id) {
+      const permission = await getUserEntityPermissions(session.user.id, 'workspace', workspaceId)
+      if (permission) {
+        const byokResult = await getBYOKKey(workspaceId, 'together')
+        if (byokResult) {
+          apiKey = byokResult.apiKey
+        }
+      }
+    }
+  }
+
+  if (!apiKey) {
+    apiKey = env.TOGETHER_API_KEY
+  }
+
+  if (!apiKey) {
+    logger.info('No Together API key available, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  try {
+    const response = await fetch('https://api.together.ai/v1/models', {
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      cache: 'no-store',
+    })
+
+    if (!response.ok) {
+      logger.warn('Failed to fetch Together models', {
+        status: response.status,
+        statusText: response.statusText,
+      })
+      return NextResponse.json({ models: [] })
+    }
+
+    const data = togetherUpstreamResponseSchema.parse(await response.json())
+
+    const allModels: string[] = []
+    for (const model of data) {
+      if (model.type && NON_CHAT_MODEL_TYPES.has(model.type)) continue
+      allModels.push(`together/${model.id}`)
+    }
+
+    const uniqueModels = Array.from(new Set(allModels))
+    const models = filterBlacklistedModels(uniqueModels)
+
+    logger.info('Successfully fetched Together models', {
+      count: models.length,
+      filtered: uniqueModels.length - models.length,
+    })
+
+    return NextResponse.json(providerModelsResponseSchema.parse({ models }))
+  } catch (error) {
+    logger.error('Error fetching Together models', {
+      error: getErrorMessage(error, 'Unknown error'),
+    })
+    return NextResponse.json({ models: [] })
+  }
+})