fix(llm): consolidate Azure-OpenAI key resolution across 4 call sites

Pre-fix, the Azure-OpenAI provider in rag/llm had 4 unfixed call sites
with 3 different patterns for parsing the key:

  - chat (chat_model.py:1649-1651): bare json.loads(key).get(...) with
    no try/except; crashes with JSONDecodeError on a plain Portal API
    key (the most common user mistake) and AttributeError on any JSON
    non-object input.
  - vision / CV (cv_model.py:380): local helper with silent fallback
    for non-object JSON, silently using the raw key string.
  - embed (embedding_model.py:325): identical local helper, a duplicate
    copy of the CV one.
  - seq2txt (sequence2txt_model.py:386): raw key passed straight to
    AzureOpenAI; a JSON string was used as the api_key and the call
    silently failed at the API with a 401.

Unify all 4 through a single _resolve_azure_credentials helper in
rag/llm/key_utils.py that follows the same pattern as the other 5
helpers in the JSON-decode family (Bedrock, BaiduYiyan, VolcEngine,
OpenRouter, GoogleCV):

  1. Accepts a dict (returned verbatim) or a JSON-string-encoded dict.
  2. On non-JSON input, raises a clear ModelException (retryable=False)
     naming the required fields and pointing at conf/models/azure.json,
     instead of letting json.loads bubble up as JSONDecodeError.
  3. On a JSON top-level type that is not a dict (list, string,
     number, bool, null), raises the same clear ModelException instead
     of calling .get('api_key') on the value and getting AttributeError.

Returns (api_key, api_version) where api_version defaults to
'2024-02-01' and api_key defaults to '' if missing.

The two duplicate _resolve_azure_credentials definitions in
cv_model.py and embedding_model.py are removed in favor of the
shared helper.

Fixes infiniflow#17675. Supersedes the partial infiniflow#17215 (which only touched the
chat branch and used a silent-fallback helper).

Author: Harsh23Kashyap

rag/llm/chat_model.py

@@ -36,7 +36,7 @@
 from common.llm_request_context import current_llm_user
 from common.token_utils import num_tokens_from_string, total_token_count_from_response, usage_from_response
 from rag.llm import FACTORY_DEFAULT_BASE_URL, LITELLM_PROVIDER_PREFIX, SupportedLiteLLMProvider
-from rag.llm.key_utils import _normalize_replicate_key
+from rag.llm.key_utils import _normalize_replicate_key, _resolve_azure_credentials
 from rag.llm.mws_utils import mws_api_url, require_mws_token
 from rag.llm.tool_decorator import FunctionToolSession, is_tool
 from rag.nlp import is_chinese, is_english
@@ -1835,8 +1835,17 @@ def __init__(self, key, model_name, base_url=None, **kwargs):
                 self.api_key = key
                 self.provider_order = ""
         elif self.provider == SupportedLiteLLMProvider.Azure_OpenAI:
-            self.api_key = json.loads(key).get("api_key", "")
-            self.api_version = json.loads(key).get("api_version", "2024-02-01")
+            # Parse the key via the shared helper. Pre-fix, the bare
+            # ``json.loads(key).get(...)`` calls crashed with
+            # ``json.decoder.JSONDecodeError`` on a plain API key
+            # (the most common Azure Portal mistake) and
+            # ``AttributeError`` on any JSON non-object input. The
+            # helper raises a clear ``ModelException`` instead.
+            # PR #17215 was a partial fix that only modified this
+            # branch and used a silent-fallback helper. This PR
+            # consolidates the Azure-OpenAI pattern with the other 5
+            # helpers in ``rag/llm/key_utils.py``. See #17675.
+            self.api_key, self.api_version = _resolve_azure_credentials(key)
         elif self.provider == SupportedLiteLLMProvider.MiniMax:
             # MiniMax requires GroupId as a query parameter for API authentication
             try:

rag/llm/cv_model.py

@@ -32,6 +32,7 @@
 
 from common.aimlapi_utils import attribution_headers
 from common.token_utils import num_tokens_from_string, total_token_count_from_response
+from rag.llm.key_utils import _resolve_azure_credentials
 from rag.nlp import is_english
 from rag.prompts.generator import vision_llm_describe_prompt
 from rag.utils.url_utils import ensure_v1
@@ -362,21 +363,17 @@ def describe_with_prompt(self, image, prompt=None):
         return res.choices[0].message.content.strip(), total_token_count_from_response(res)
 
 
-def _resolve_azure_credentials(key):
-    try:
-        key_obj = json.loads(key)
-        if isinstance(key_obj, dict):
-            return key_obj.get("api_key", ""), key_obj.get("api_version", "2024-02-01")
-        logging.warning("Azure credential payload parsed as JSON but is not an object; using raw api_key string")
-    except (json.JSONDecodeError, TypeError):
-        logging.warning("Azure credential payload is not valid JSON; using raw api_key string")
-    return key, "2024-02-01"
-
-
 class AzureGptV4(GptV4):
     _FACTORY_NAME = "Azure-OpenAI"
 
     def __init__(self, key, model_name, lang="Chinese", **kwargs):
+        # Parse the key via the shared helper in rag.llm.key_utils. The
+        # local copy of ``_resolve_azure_credentials`` was removed in
+        # favor of the shared helper to consolidate the Azure-OpenAI
+        # pattern with the other 5 providers (Bedrock, BaiduYiyan,
+        # VolcEngine, OpenRouter, GoogleCV) and align the silent
+        # fallback for JSON non-object input with a clear
+        # ``ModelException``. See #17675.
         api_key, api_version = _resolve_azure_credentials(key)
         self.base_url = ensure_v1(kwargs["base_url"])
         self.client = AzureOpenAI(api_key=api_key, azure_endpoint=self.base_url, api_version=api_version)

rag/llm/embedding_model.py

@@ -32,7 +32,7 @@
 from common.aimlapi_utils import attribution_headers
 from common.exceptions import ModelException
 from common.token_utils import num_tokens_from_string, truncate, total_token_count_from_response
-from rag.llm.key_utils import _normalize_replicate_key
+from rag.llm.key_utils import _normalize_replicate_key, _resolve_azure_credentials
 from rag.llm.mws_utils import mws_api_url, require_mws_token
 from rag.utils.url_utils import append_api_path, ensure_v1
 import logging
@@ -306,23 +306,19 @@ def encode_queries(self, text):
         return vectors[0], token_count
 
 
-def _resolve_azure_credentials(key):
-    try:
-        key_obj = json.loads(key)
-        if isinstance(key_obj, dict):
-            return key_obj.get("api_key", ""), key_obj.get("api_version", "2024-02-01")
-        logging.warning("Azure credential payload parsed as JSON but is not an object; using raw api_key string")
-    except (json.JSONDecodeError, TypeError):
-        logging.warning("Azure credential payload is not valid JSON; using raw api_key string")
-    return key, "2024-02-01"
-
-
 class AzureEmbed(OpenAIEmbed):
     _FACTORY_NAME = "Azure-OpenAI"
 
     def __init__(self, key, model_name, **kwargs):
         from openai.lib.azure import AzureOpenAI
 
+        # Parse the key via the shared helper in rag.llm.key_utils. The
+        # local copy of ``_resolve_azure_credentials`` was removed in
+        # favor of the shared helper to consolidate the Azure-OpenAI
+        # pattern with the other 5 providers (Bedrock, BaiduYiyan,
+        # VolcEngine, OpenRouter, GoogleCV) and align the silent
+        # fallback for JSON non-object input with a clear
+        # ``ModelException``. See #17675.
         api_key, api_version = _resolve_azure_credentials(key)
         self.base_url = ensure_v1(kwargs["base_url"])
         self.client = AzureOpenAI(api_key=api_key, azure_endpoint=self.base_url, api_version=api_version)

rag/llm/key_utils.py

@@ -14,6 +14,9 @@
 #  limitations under the License.
 #
 import json
+import logging
+
+from common.exceptions import ModelException
 
 
 def _normalize_replicate_key(key):
@@ -31,4 +34,63 @@ def _normalize_replicate_key(key):
     return key
 
 
-__all__ = ["_normalize_replicate_key"]
+def _resolve_azure_credentials(key):
+    """Parse an Azure-OpenAI ``key`` and return ``(api_key, api_version)``.
+
+    The Azure-OpenAI provider requires a JSON object key with at least
+    ``api_key``; ``api_version`` defaults to ``"2024-02-01"`` if missing.
+    See ``conf/llm_factories.json`` for the factory entry and
+    ``conf/models/azure.json`` for the model class.
+
+    On non-JSON input -- for example a user pasting a plain Azure API
+    key like ``"abc...123"`` from the Azure Portal -- we raise a clear
+    :class:`ModelException` pointing at the required schema, instead of
+    letting ``json.loads`` bubble up as ``json.decoder.JSONDecodeError:
+    Expecting value: line 1 column 1 (char 0)`` from inside ``rag/llm``
+    internals. Mirrors the fix shape of ``_resolve_bedrock_credentials``
+    for #17373 and the Azure fix for #17204 / #17215.
+
+    On a JSON top-level type that is not a dict (e.g. a list, string, or
+    number), we also raise the same clear error rather than calling
+    ``.get("api_key")`` on the value and getting an ``AttributeError``.
+
+    Returns ``(api_key, api_version)``. Both default to ``""`` and
+    ``"2024-02-01"`` respectively if missing from a valid dict.
+    """
+    if isinstance(key, dict):
+        payload = key
+    elif isinstance(key, str):
+        try:
+            payload = json.loads(key)
+        except (json.JSONDecodeError, TypeError):
+            logging.warning(
+                "Azure-OpenAI key is not valid JSON; expected a JSON object with 'api_key' (and optionally 'api_version') (see conf/models/azure.json).",
+            )
+            raise ModelException(
+                'Azure-OpenAI requires a JSON key with at least \'api_key\'. Example: {"api_key": "...", "api_version": "2024-02-01"}. See conf/models/azure.json for the model class.',
+                retryable=False,
+            )
+    else:
+        logging.warning(
+            "Azure-OpenAI key is not a string or dict (got %s); expected a JSON object with 'api_key' (and optionally 'api_version').",
+            type(key).__name__,
+        )
+        raise ModelException(
+            f"Azure-OpenAI requires a JSON key, got {type(key).__name__}. See conf/models/azure.json for the model class.",
+            retryable=False,
+        )
+
+    if not isinstance(payload, dict):
+        logging.warning(
+            "Azure-OpenAI key parsed as JSON but is not a dict (got %s).",
+            type(payload).__name__,
+        )
+        raise ModelException(
+            f"Azure-OpenAI key must be a JSON object, got {type(payload).__name__}. See conf/models/azure.json for the model class.",
+            retryable=False,
+        )
+
+    return payload.get("api_key", ""), payload.get("api_version", "2024-02-01")
+
+
+__all__ = ["_normalize_replicate_key", "_resolve_azure_credentials"]

rag/llm/sequence2txt_model.py

@@ -394,8 +394,17 @@ class AzureSeq2txt(Base):
     _FACTORY_NAME = "Azure-OpenAI"
 
     def __init__(self, key, model_name, lang="Chinese", **kwargs):
+        from rag.llm.key_utils import _resolve_azure_credentials
+
+        # Parse the key via the shared helper. Pre-fix, the raw ``key``
+        # was passed straight to the AzureOpenAI client, so a JSON
+        # string like ``"{\"api_key\": \"...\"}"`` was used as the
+        # ``api_key`` and the call silently failed at the API with a
+        # 401. The helper raises a clear ``ModelException`` on
+        # non-JSON or JSON non-object input. See #17675.
+        api_key, api_version = _resolve_azure_credentials(key)
         self.base_url = ensure_v1(kwargs["base_url"])
-        self.client = AzureOpenAI(api_key=key, azure_endpoint=self.base_url, api_version="2024-02-01")
+        self.client = AzureOpenAI(api_key=api_key, azure_endpoint=self.base_url, api_version=api_version)
         self.model_name = model_name
         self.lang = lang