fix: apply channel header overrides to model-list probes (#2471)

* fix: apply channel header overrides to model-list probes, close #2445

* test(model-fetcher): use canonical X-Api-Key header spelling in override tests

---------

Co-authored-by: wangzhengzhuo05 <175673456+wangzhengzhuo05@users.noreply.github.com>

Author: wangzhengzhuo05

internal/server/biz/channel_override.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"maps"
+	"net/http"
 	"strings"
 
 	"github.com/samber/lo"
@@ -308,3 +309,57 @@ func deepMergeMap(base, override map[string]any) map[string]any {
 
 	return result
 }
+
+// ApplyModelFetchHeaderOverrides applies the channel's header override operations to an
+// HTTP request used for model-list probing.
+//
+// Model probing runs outside the LLM request pipeline, so there is no RenderContext to
+// evaluate against: operations guarded by a Condition and set-values containing a template
+// placeholder ("{{") are skipped. Unconditional literal operations use the same semantics as
+// the chat/completion path (applyOverrideOperationToHeaders in
+// internal/server/orchestrator/override.go): set, delete, rename, copy. The legacy
+// "__AXONHUB_CLEAR__" value deletes the header.
+func ApplyModelFetchHeaderOverrides(headers http.Header, ops []objects.OverrideOperation) {
+	if headers == nil || len(ops) == 0 {
+		return
+	}
+
+	for _, op := range ops {
+		if op.Condition != "" {
+			continue
+		}
+
+		switch op.Op {
+		case objects.OverrideOpSet:
+			if strings.Contains(op.Value, "{{") {
+				// A templated value cannot be rendered without an LLM request context;
+				// sending the raw template would corrupt the probe request.
+				continue
+			}
+
+			if op.Value == ClearHeaderDirective {
+				headers.Del(op.Path)
+				continue
+			}
+
+			headers.Set(op.Path, op.Value)
+		case objects.OverrideOpDelete:
+			headers.Del(op.Path)
+		case objects.OverrideOpRename:
+			values := headers.Values(op.From)
+			if len(values) == 0 {
+				continue
+			}
+
+			headers.Del(op.From)
+
+			for _, v := range values {
+				headers.Add(op.To, v)
+			}
+		case objects.OverrideOpCopy:
+			for _, v := range headers.Values(op.From) {
+				headers.Add(op.To, v)
+			}
+		}
+	}
+}

internal/server/biz/model_fetcher.go

@@ -17,6 +17,7 @@ import (
 
 	"github.com/looplj/axonhub/internal/ent"
 	"github.com/looplj/axonhub/internal/ent/channel"
+	"github.com/looplj/axonhub/internal/objects"
 	"github.com/looplj/axonhub/llm/httpclient"
 	"github.com/looplj/axonhub/llm/transformer/anthropic/claudecode"
 	"github.com/looplj/axonhub/llm/transformer/antigravity"
@@ -390,8 +391,9 @@ func (f *ModelFetcher) FetchModels(ctx context.Context, input FetchModelsInput)
 	}
 
 	var (
-		apiKey      string
-		proxyConfig *httpclient.ProxyConfig
+		apiKey            string
+		proxyConfig       *httpclient.ProxyConfig
+		headerOverrideOps []objects.OverrideOperation
 	)
 
 	if input.APIKey != nil && *input.APIKey != "" {
@@ -431,6 +433,15 @@ func (f *ModelFetcher) FetchModels(ctx context.Context, input FetchModelsInput)
 
 		if ch.Settings != nil {
 			proxyConfig = ch.Settings.Proxy
+
+			// The new schema field takes precedence; the legacy OverrideHeaders list is
+			// converted when the new field is absent (same precedence as
+			// (*Channel).GetHeaderOverrideOperations).
+			if ch.Settings.HeaderOverrideOperations != nil {
+				headerOverrideOps = ch.Settings.HeaderOverrideOperations
+			} else {
+				headerOverrideOps = objects.HeaderEntriesToOverrideOperations(ch.Settings.OverrideHeaders)
+			}
 		}
 	}
 
@@ -510,6 +521,13 @@ func (f *ModelFetcher) FetchModels(ctx context.Context, input FetchModelsInput)
 		req.Headers.Set("Authorization", "Bearer "+apiKey)
 	}
 
+	if req.Headers == nil {
+		req.Headers = make(http.Header)
+	}
+	// Channel header overrides win over the standard auth headers, matching the
+	// chat/completion path.
+	ApplyModelFetchHeaderOverrides(req.Headers, headerOverrideOps)
+
 	httpClient := f.httpClient
 	if proxyConfig != nil {
 		httpClient = f.httpClient.WithProxy(proxyConfig)

internal/server/biz/model_fetcher_test.go

@@ -1134,3 +1134,101 @@ func TestFetchModelsCommandCodeRejectsHTTP(t *testing.T) {
 	}
 	require.Zero(t, calls.Load())
 }
+
+func TestFetchModelsAppliesHeaderOverrideOperationsFromSettings(t *testing.T) {
+	var gotAPIKey, gotAuth string
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAPIKey = r.Header.Get("X-Api-Key")
+		gotAuth = r.Header.Get("Authorization")
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"data":[{"id":"override-model"}]}`))
+	}))
+	defer server.Close()
+
+	client := enttest.NewEntClient(t, "sqlite3", "file:fetch_models_header_override?mode=memory&_fk=0")
+	defer client.Close()
+
+	ctx := authz.WithSystemBypass(context.Background(), "test")
+	ch, err := client.Channel.Create().
+		SetName("header-override").
+		SetType(channel.TypeOpenai).
+		SetBaseURL(server.URL).
+		SetCredentials(objects.ChannelCredentials{APIKey: "stored-secret"}).
+		SetSupportedModels([]string{"override-model"}).
+		SetDefaultTestModel("override-model").
+		SetSettings(&objects.ChannelSettings{
+			HeaderOverrideOperations: []objects.OverrideOperation{
+				{Op: objects.OverrideOpSet, Path: "x-api-key", Value: "override-secret"},
+				{Op: objects.OverrideOpDelete, Path: "Authorization"},
+			},
+		}).
+		Save(ctx)
+	require.NoError(t, err)
+
+	fetcher := NewModelFetcher(
+		httpclient.NewHttpClientWithClient(server.Client()),
+		&ChannelService{AbstractService: &AbstractService{db: client}},
+	)
+
+	result, err := fetcher.FetchModels(ctx, FetchModelsInput{
+		ChannelType: channel.TypeOpenai.String(),
+		BaseURL:     server.URL + "/",
+		ChannelID:   &ch.ID,
+	})
+	require.NoError(t, err)
+	require.Nil(t, result.Error)
+	require.Len(t, result.Models, 1)
+	require.Equal(t, "override-model", result.Models[0].ID)
+
+	assert.Equal(t, "override-secret", gotAPIKey,
+		"the channel's header override must be applied to the /models probe request")
+	assert.Empty(t, gotAuth,
+		"a delete override must remove the standard Authorization header from the probe")
+}
+
+func TestFetchModelsAppliesLegacyOverrideHeaders(t *testing.T) {
+	var gotAPIKey string
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAPIKey = r.Header.Get("X-Api-Key")
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"data":[{"id":"legacy-model"}]}`))
+	}))
+	defer server.Close()
+
+	client := enttest.NewEntClient(t, "sqlite3", "file:fetch_models_header_override_legacy?mode=memory&_fk=0")
+	defer client.Close()
+
+	ctx := authz.WithSystemBypass(context.Background(), "test")
+	ch, err := client.Channel.Create().
+		SetName("legacy-header-override").
+		SetType(channel.TypeOpenai).
+		SetBaseURL(server.URL).
+		SetCredentials(objects.ChannelCredentials{APIKey: "stored-secret"}).
+		SetSupportedModels([]string{"legacy-model"}).
+		SetDefaultTestModel("legacy-model").
+		SetSettings(&objects.ChannelSettings{
+			OverrideHeaders: []objects.HeaderEntry{{Key: "x-api-key", Value: "legacy-secret"}},
+		}).
+		Save(ctx)
+	require.NoError(t, err)
+
+	fetcher := NewModelFetcher(
+		httpclient.NewHttpClientWithClient(server.Client()),
+		&ChannelService{AbstractService: &AbstractService{db: client}},
+	)
+
+	result, err := fetcher.FetchModels(ctx, FetchModelsInput{
+		ChannelType: channel.TypeOpenai.String(),
+		BaseURL:     server.URL + "/",
+		ChannelID:   &ch.ID,
+	})
+	require.NoError(t, err)
+	require.Nil(t, result.Error)
+	require.Len(t, result.Models, 1)
+	require.Equal(t, "legacy-model", result.Models[0].ID)
+
+	assert.Equal(t, "legacy-secret", gotAPIKey,
+		"the deprecated OverrideHeaders list must still be applied to the probe request")
+}