refactor(web): resolve LLM user from auth context

Author: brendan-kellam

packages/web/src/app/api/(server)/ee/chat/route.ts

@@ -135,10 +135,7 @@ export const POST = apiHandler(async (req: NextRequest) => {
                 return attachmentError;
             }
 
-            const { model, providerOptions, temperature } = await getAISDKLanguageModelAndOptions(
-                languageModelConfig,
-                user?.email,
-            );
+            const { model, providerOptions, temperature } = await getAISDKLanguageModelAndOptions(languageModelConfig);
 
             // Authoritative, server-side resolution of the model's input
             // modalities. The agent's multimodal content builder and degrade

packages/web/src/ee/features/chat/actions.ts

@@ -46,7 +46,6 @@ export const generateAndUpdateChatNameFromMessage = async ({ chatId, languageMod
         const name = await generateChatNameFromMessage({
             message,
             languageModelConfig,
-            userEmail: user?.email,
         });
 
         await prisma.chat.update({

packages/web/src/ee/features/chat/llm.server.ts

@@ -7,13 +7,11 @@ import { getAISDKLanguageModelAndOptions } from "@/features/chat/llm.server";
 export const generateChatNameFromMessage = async ({
     message,
     languageModelConfig,
-    userEmail,
 }: {
     message: string,
     languageModelConfig: LanguageModel,
-    userEmail?: string,
 }) => {
-    const { model } = await getAISDKLanguageModelAndOptions(languageModelConfig, userEmail);
+    const { model } = await getAISDKLanguageModelAndOptions(languageModelConfig);
 
     const prompt = `Convert this question into a short topic title (max 50 characters).
 

packages/web/src/ee/features/mcp/askCodebase.ts

@@ -84,10 +84,7 @@ export const askCodebase = (params: AskCodebaseParams): Promise<AskCodebaseResul
                 languageModelConfig = matchingModel;
             }
 
-            const { model, providerOptions, temperature } = await getAISDKLanguageModelAndOptions(
-                languageModelConfig,
-                user?.email,
-            );
+            const { model, providerOptions, temperature } = await getAISDKLanguageModelAndOptions(languageModelConfig);
             const modelName = languageModelConfig.displayName ?? languageModelConfig.model;
             const contextWindow = await resolveContextWindow(languageModelConfig);
             const { inputModalities, supportedDocumentTypes } = await resolveModelCapabilities(languageModelConfig);
@@ -214,7 +211,6 @@ export const askCodebase = (params: AskCodebaseParams): Promise<AskCodebaseResul
                 generateChatNameFromMessage({
                     message: query,
                     languageModelConfig,
-                    userEmail: user?.email,
                 })
             ]);
 

packages/web/src/features/chat/languageModelHeaders.server.test.ts

@@ -1,4 +1,6 @@
 import { beforeEach, describe, expect, test, vi } from 'vitest';
+import type { UserWithAccounts } from '@sourcebot/db';
+import { runWithCurrentUser } from '@/lib/currentUserContext';
 
 const mocks = vi.hoisted(() => ({
     env: {
@@ -15,37 +17,54 @@ import {
     SOURCEBOT_USER_EMAIL_HEADER,
 } from './languageModelHeaders.server';
 
+const resolveHeadersForUser = (
+    email: string,
+    configuredHeaders?: Parameters<typeof resolveLanguageModelHeaders>[0],
+) =>
+    runWithCurrentUser(
+        { email } as unknown as UserWithAccounts,
+        () => resolveLanguageModelHeaders(configuredHeaders),
+    );
+
 describe('resolveLanguageModelHeaders', () => {
     beforeEach(() => {
         mocks.env.SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED = 'false';
         mocks.getTokenFromConfig.mockReset();
     });
 
     test('does not add the user email header by default', async () => {
-        await expect(resolveLanguageModelHeaders(undefined, 'User@Example.com')).resolves.toBeUndefined();
+        await expect(resolveHeadersForUser('User@Example.com')).resolves.toBeUndefined();
     });
 
-    test('adds a lower-cased user email when enabled', async () => {
+    test('adds the current user email in lower case when enabled', async () => {
         mocks.env.SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED = 'true';
 
-        await expect(resolveLanguageModelHeaders(undefined, 'User@Example.COM')).resolves.toEqual({
+        await expect(resolveHeadersForUser('User@Example.COM')).resolves.toEqual({
             [SOURCEBOT_USER_EMAIL_HEADER]: 'user@example.com',
         });
     });
 
     test('omits the user email header for anonymous requests', async () => {
         mocks.env.SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED = 'true';
 
-        await expect(resolveLanguageModelHeaders(undefined, undefined)).resolves.toBeUndefined();
+        await expect(resolveLanguageModelHeaders(undefined)).resolves.toBeUndefined();
+    });
+
+    test('omits synthetic placeholder emails', async () => {
+        mocks.env.SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED = 'true';
+
+        await expect(resolveHeadersForUser(
+            'placeholder-internal-user-id@no-email.invalid',
+        )).resolves.toBeUndefined();
     });
 
     test('preserves configured headers and overrides a case-insensitive email header', async () => {
         mocks.env.SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED = 'true';
 
-        await expect(resolveLanguageModelHeaders({
+        await expect(resolveHeadersForUser('Authenticated@Example.com', {
             'x-sourcebot-user-email': 'configured@example.com',
             'X-Custom-Header': 'custom-value',
-        }, 'Authenticated@Example.com')).resolves.toEqual({
+        })).resolves.toEqual({
             'X-Custom-Header': 'custom-value',
             [SOURCEBOT_USER_EMAIL_HEADER]: 'authenticated@example.com',
         });
@@ -55,7 +74,7 @@ describe('resolveLanguageModelHeaders', () => {
         const token = { env: 'CUSTOM_HEADER' };
         mocks.getTokenFromConfig.mockResolvedValue('resolved-value');
 
-        await expect(resolveLanguageModelHeaders({ Authorization: token }, undefined)).resolves.toEqual({
+        await expect(resolveLanguageModelHeaders({ Authorization: token })).resolves.toEqual({
             Authorization: 'resolved-value',
         });
         expect(mocks.getTokenFromConfig).toHaveBeenCalledWith(token);

packages/web/src/features/chat/languageModelHeaders.server.ts

@@ -2,12 +2,13 @@ import 'server-only';
 
 import { Token } from '@sourcebot/schemas/v3/shared.type';
 import { env, getTokenFromConfig } from '@sourcebot/shared';
+import { getCurrentUser } from '@/lib/currentUserContext';
 
 export const SOURCEBOT_USER_EMAIL_HEADER = 'X-Sourcebot-User-Email';
+const PLACEHOLDER_EMAIL_PATTERN = /^placeholder-.+@no-email\.invalid$/i;
 
 export const resolveLanguageModelHeaders = async (
     configuredHeaders: Record<string, string | Token> | undefined,
-    userEmail: string | undefined,
 ): Promise<Record<string, string> | undefined> => {
     const headers: Record<string, string> = {};
 
@@ -17,7 +18,12 @@ export const resolveLanguageModelHeaders = async (
             : await getTokenFromConfig(value);
     }
 
-    if (env.SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED === 'true' && userEmail) {
+    const userEmail = getCurrentUser()?.email;
+    if (
+        env.SOURCEBOT_LLM_USER_EMAIL_HEADER_ENABLED === 'true' &&
+        userEmail &&
+        !PLACEHOLDER_EMAIL_PATTERN.test(userEmail)
+    ) {
         // Header names are case-insensitive. Remove any configured variant so
         // the authenticated user's email is always the authoritative value.
         for (const key of Object.keys(headers)) {

packages/web/src/features/chat/llm.server.ts

@@ -32,13 +32,13 @@ import { resolveLanguageModelHeaders } from './languageModelHeaders.server';
 // review agent). The re-licensed Ask logic (prompts, tools, threads, chat
 // name generation) lives in `@/ee/features/chat`.
 
-export const getAISDKLanguageModelAndOptions = async (config: LanguageModel, userEmail?: string): Promise<{
+export const getAISDKLanguageModelAndOptions = async (config: LanguageModel): Promise<{
     model: AISDKLanguageModelV3,
     providerOptions?: Record<string, Record<string, JSONValue>>,
     temperature?: number,
 }> => {
     const { provider, model: modelId } = config;
-    const headers = await resolveLanguageModelHeaders(config.headers, userEmail);
+    const headers = await resolveLanguageModelHeaders(config.headers);
 
     const { model: _model, providerOptions } = await (async (): Promise<{
         model: AISDKLanguageModelV3,

packages/web/src/features/searchAssist/actions.ts

@@ -26,7 +26,7 @@ ${SEARCH_SYNTAX_DESCRIPTION}
 `;
 
 export const translateSearchQuery = async ({ prompt }: { prompt: string }) => sew(() =>
-    withOptionalAuth(async ({ user }) => {
+    withOptionalAuth(async () => {
         const models = await getConfiguredLanguageModels();
 
         if (models.length === 0) {
@@ -37,7 +37,7 @@ export const translateSearchQuery = async ({ prompt }: { prompt: string }) => se
             } satisfies ServiceError;
         }
 
-        const { model } = await getAISDKLanguageModelAndOptions(models[0], user?.email);
+        const { model } = await getAISDKLanguageModelAndOptions(models[0]);
 
         const { object } = await generateObject({
             model,

packages/web/src/lib/currentUserContext.ts

@@ -0,0 +1,12 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import type { UserWithAccounts } from '@sourcebot/db';
+
+const currentUserStorage = new AsyncLocalStorage<UserWithAccounts | undefined>();
+
+export function runWithCurrentUser<T>(user: UserWithAccounts | undefined, fn: () => T): T {
+    return currentUserStorage.run(user, fn);
+}
+
+export function getCurrentUser(): UserWithAccounts | undefined {
+    return currentUserStorage.getStore();
+}

packages/web/src/middleware/withAuth.test.ts

@@ -9,6 +9,7 @@ import { ErrorCode } from '../lib/errorCodes';
 import { StatusCodes } from 'http-status-codes';
 import { userScopedPrismaClientExtension } from '@/prisma';
 import { runWithRequestContext } from '@/lib/requestContext';
+import { getCurrentUser } from '@/lib/currentUserContext';
 
 const TEST_OAUTH_SCOPE = 'read';
 
@@ -481,7 +482,9 @@ describe('getAuthContext', () => {
         prisma.userToOrg.updateMany.mockResolvedValue({ count: 1 });
 
         setMockSession(createMockSession({ user: { id: userId } }));
-        const cb = vi.fn();
+        const cb = vi.fn(async () => {
+            expect(getCurrentUser()).toMatchObject({ id: userId });
+        });
         const result = await withAuth(cb);
 
         expect(result).toBeUndefined();