Module: OpenAI::Providers

Defined in:

lib/openai/providers/azure.rb,
lib/openai/providers/bedrock.rb,
sig/openai/providers.rbs

Defined Under Namespace

Modules: Azure, Bedrock

Class Method Summary

• .azure(endpoint: OpenAI::Internal::OMIT, api_key: OpenAI::Internal::OMIT, token_provider: nil) ⇒ OpenAI::Provider

  Configure the standard OpenAI client for the Azure OpenAI v1 API.

• .bedrock(endpoint: nil, region: nil, base_url: OpenAI::Internal::OMIT, api_key: OpenAI::Internal::OMIT, token_provider: nil, access_key_id: nil, secret_access_key: nil, session_token: nil, profile: nil, credentials_provider: nil) ⇒ OpenAI::Provider

  Configure the standard OpenAI client for Amazon Bedrock Mantle or Runtime.

Class Method Details

.azure(endpoint: OpenAI::Internal::OMIT, api_key: OpenAI::Internal::OMIT, token_provider: nil) ⇒ OpenAI::Provider

Configure the standard OpenAI client for the Azure OpenAI v1 API.

Parameters:

• endpoint (String, nil) (defaults to: OpenAI::Internal::OMIT) —

  Azure OpenAI resource endpoint. Defaults to AZURE_OPENAI_ENDPOINT. /openai/v1 is appended when absent.

• api_key (String, nil) (defaults to: OpenAI::Internal::OMIT) —

  Azure OpenAI API key. Defaults to AZURE_OPENAI_API_KEY when no token provider is configured. Passing nil explicitly skips the environment fallback.

• token_provider (#call, nil) (defaults to: nil) —

  Callable returning a Microsoft Entra bearer token before each request attempt.

Returns:

• (OpenAI::Provider)

Raises:

• (ArgumentError)

# File 'lib/openai/providers/azure.rb', line 166

def azure(
  endpoint: OpenAI::Internal::OMIT,
  api_key: OpenAI::Internal::OMIT,
  token_provider: nil
)
  configured_endpoint = if endpoint.equal?(OpenAI::Internal::OMIT)
    Azure.normalize_optional_string(ENV["AZURE_OPENAI_ENDPOINT"])
  else
    normalized = Azure.normalize_optional_string(endpoint)
    if !endpoint.nil? && normalized.nil?
      raise ArgumentError, "The Azure OpenAI `endpoint` must not be empty."
    end

    normalized
  end

  raise ArgumentError, Azure::MISSING_ENDPOINT_MESSAGE if configured_endpoint.nil?
  base_url = Azure.normalize_endpoint(configured_endpoint)

  explicit_api_key = !api_key.equal?(OpenAI::Internal::OMIT) && !api_key.nil?
  normalized_api_key = Azure.normalize_optional_string(api_key)
  if explicit_api_key && normalized_api_key.nil?
    raise ArgumentError, "The Azure OpenAI API key must not be empty."
  end

  unless token_provider.nil? || token_provider.respond_to?(:call)
    raise ArgumentError, "The Azure OpenAI `token_provider` must respond to `call`."
  end

  if explicit_api_key && !token_provider.nil?
    raise(
      ArgumentError,
      "The Azure OpenAI `api_key` and `token_provider` options are mutually exclusive."
    )
  end

  environment_api_key = if api_key.equal?(OpenAI::Internal::OMIT) && token_provider.nil?
    Azure.normalize_optional_string(ENV["AZURE_OPENAI_API_KEY"])
  end

  resolved_api_key = normalized_api_key || environment_api_key
  if resolved_api_key.nil? && token_provider.nil?
    raise ArgumentError, Azure::MISSING_CREDENTIALS_MESSAGE
  end

  if token_provider
    credential_provider = token_provider
    authentication = :bearer
  else
    resolved_api_key.freeze
    credential_provider = -> { resolved_api_key }
    authentication = :api_key
  end

  definition = Azure::Definition.new(
    base_url: base_url,
    credential_provider: credential_provider,
    authentication: authentication
  )
  OpenAI::Internal::Provider.create(definition)
end

.bedrock(endpoint: nil, region: nil, base_url: OpenAI::Internal::OMIT, api_key: OpenAI::Internal::OMIT, token_provider: nil, access_key_id: nil, secret_access_key: nil, session_token: nil, profile: nil, credentials_provider: nil) ⇒ OpenAI::Provider

Configure the standard OpenAI client for Amazon Bedrock Mantle or Runtime.

Authentication precedence is an explicit bearer or AWS mode, then AWS_BEARER_TOKEN_BEDROCK, then the standard AWS credential chain.

Parameters:

• endpoint (String, Symbol, nil) (defaults to: nil) —

  Bedrock endpoint family. Defaults to Mantle unless a canonical Runtime base_url is supplied.

• region (String, nil) (defaults to: nil) —

  AWS signing region. Defaults to AWS_REGION, AWS_DEFAULT_REGION, or the selected profile's configured region.

• base_url (String, nil) (defaults to: OpenAI::Internal::OMIT) —

  Bedrock API root. Defaults to AWS_BEDROCK_BASE_URL or the selected regional Bedrock endpoint.

• api_key (String, nil) (defaults to: OpenAI::Internal::OMIT) —

  Explicit Bedrock bearer credential. Passing nil explicitly skips the AWS_BEARER_TOKEN_BEDROCK fallback.

• token_provider (#call, nil) (defaults to: nil) —

  Callable returning a fresh bearer credential before each request attempt.

• access_key_id (String, nil) (defaults to: nil) —

  Explicit AWS access key ID. Must be paired with secret_access_key.

• secret_access_key (String, nil) (defaults to: nil) —

  Explicit AWS secret access key.

• session_token (String, nil) (defaults to: nil) —

  Optional session token for explicit temporary AWS credentials.

• profile (String, nil) (defaults to: nil) —

  Explicit AWS shared-config profile.

• credentials_provider (#credentials, #call, nil) (defaults to: nil) —

  Refreshable AWS credentials provider. A callable must return an AWS credential identity.

Returns:

• (OpenAI::Provider)

# File 'lib/openai/providers/bedrock.rb', line 487

def bedrock(
  endpoint: nil,
  region: nil,
  base_url: OpenAI::Internal::OMIT,
  api_key: OpenAI::Internal::OMIT,
  token_provider: nil,
  access_key_id: nil,
  secret_access_key: nil,
  session_token: nil,
  profile: nil,
  credentials_provider: nil
)
  normalized_endpoint = Bedrock.normalize_endpoint(endpoint)
  normalized_region = Bedrock.normalize_optional_string(region)
  if !region.nil? && normalized_region.nil?
    raise ArgumentError, "The Bedrock AWS `region` must not be empty."
  end

  Bedrock.validate_region!(normalized_region) if normalized_region

  normalized_profile = Bedrock.normalize_optional_string(profile)
  if !profile.nil? && normalized_profile.nil?
    raise ArgumentError, "The Bedrock AWS `profile` must not be empty."
  end

  configured_base_url = if base_url.equal?(OpenAI::Internal::OMIT)
    Bedrock.normalize_optional_string(ENV["AWS_BEDROCK_BASE_URL"])
  elsif base_url.nil?
    nil
  else
    normalized = Bedrock.normalize_optional_string(base_url)
    raise ArgumentError, "The Bedrock `base_url` must not be empty." unless normalized
    normalized
  end

  configured_base_url = Bedrock.normalize_base_url(configured_base_url) if configured_base_url
  canonical_endpoint = if configured_base_url
    Bedrock.parse_endpoint_hostname(URI(configured_base_url).host)
  end

  resolved_endpoint = normalized_endpoint || canonical_endpoint&.fetch(:endpoint) || :mantle

  has_access_key = !access_key_id.nil?
  has_secret_key = !secret_access_key.nil?
  if has_access_key != has_secret_key || (!session_token.nil? && !has_access_key)
    raise ArgumentError, Bedrock::PARTIAL_STATIC_CREDENTIALS_MESSAGE
  end

  normalized_access_key_id = Bedrock.normalize_optional_string(access_key_id)
  normalized_secret_access_key = Bedrock.normalize_optional_string(secret_access_key)
  normalized_session_token = Bedrock.normalize_optional_string(session_token)
  if has_access_key && [normalized_access_key_id, normalized_secret_access_key].any?(&:nil?)
    raise(
      ArgumentError,
      "Static AWS credentials require non-empty `access_key_id` and `secret_access_key` values."
    )
  end

  if !session_token.nil? && normalized_session_token.nil?
    raise ArgumentError, "A static AWS `session_token` must not be empty when provided."
  end

  explicit_api_key = !api_key.equal?(OpenAI::Internal::OMIT) && !api_key.nil?
  normalized_api_key = Bedrock.normalize_optional_string(api_key)
  if explicit_api_key && normalized_api_key.nil?
    raise ArgumentError, "The Bedrock bearer credential must not be empty."
  end

  if explicit_api_key && !token_provider.nil?
    raise(
      ArgumentError,
      "The `api_key` and `token_provider` options are mutually exclusive. Configure only one."
    )
  end

  if !token_provider.nil? && !token_provider.respond_to?(:call)
    raise ArgumentError, "The Bedrock `token_provider` must respond to `call`."
  end

  if !credentials_provider.nil? &&
      !credentials_provider.respond_to?(:call) &&
      !credentials_provider.respond_to?(:credentials)
    raise(
      ArgumentError,
      "The Bedrock `credentials_provider` must respond to `call` or `credentials`."
    )
  end

  explicit_bearer = explicit_api_key || !token_provider.nil?
  aws_modes = [has_access_key, !normalized_profile.nil?, !credentials_provider.nil?].count(true)
  if aws_modes > 1
    raise ArgumentError, Bedrock::AMBIGUOUS_AWS_AUTH_MESSAGE
  end

  if explicit_bearer && aws_modes.positive?
    raise ArgumentError, Bedrock::AMBIGUOUS_AUTH_MESSAGE
  end

  skip_environment_bearer = !api_key.equal?(OpenAI::Internal::OMIT) && api_key.nil?
  environment_bearer = !explicit_bearer &&
    aws_modes.zero? &&
    !skip_environment_bearer &&
    !Bedrock.normalize_optional_string(ENV["AWS_BEARER_TOKEN_BEDROCK"]).nil?
  bearer_provider = if explicit_api_key
    normalized_api_key.freeze
    -> { normalized_api_key }
  elsif !token_provider.nil?
    token_provider
  elsif environment_bearer
    lambda do
      ENV["AWS_BEARER_TOKEN_BEDROCK"] ||
        raise(OpenAI::Errors::Error, Bedrock::MISSING_CREDENTIALS_MESSAGE)
    end
  end

  if normalized_region.nil? && (bearer_provider.nil? || configured_base_url.nil?)
    normalized_region = Bedrock.normalize_optional_string(ENV["AWS_REGION"]) ||
      Bedrock.normalize_optional_string(ENV["AWS_DEFAULT_REGION"])
    Bedrock.validate_region!(normalized_region) if normalized_region
  end

  if configured_base_url
    Bedrock.validate_canonical_endpoint!(configured_base_url, resolved_endpoint, normalized_region)
  end

  if bearer_provider && configured_base_url.nil? && normalized_region.nil?
    raise ArgumentError, Bedrock::MISSING_REGION_MESSAGE
  end

  definition = Bedrock::Definition.new(
    endpoint: resolved_endpoint,
    region: normalized_region,
    base_url: configured_base_url,
    bearer_provider: bearer_provider,
    profile: normalized_profile,
    access_key_id: normalized_access_key_id,
    secret_access_key: normalized_secret_access_key,
    session_token: normalized_session_token,
    credentials_provider: credentials_provider,
    default_chain: aws_modes.zero?
  )
  OpenAI::Internal::Provider.create(definition)
end