Release 3.6.0

CHANGELOG.md

@@ -11,6 +11,105 @@ target.
 
 ## [Unreleased]
 
+## [3.6.0] — 2026-10-12
+
+A key shown once can go straight into ThinkWatch Lite: the console's key
+screens offer Add to ThinkWatch Lite, and the Configuration Guide has a tab
+for it. Every user, not only administrators, now sees the gateway address
+an administrator configured, and the model listings name only the models
+the calling key may use.
+
+### Read before upgrading
+
+- **Model listings follow the calling key.** `GET /v1/models` and
+  `GET /v1beta/models` listed every routed model whatever the key; they
+  now list only the models a request with that key is let through for
+  (see Fixed). A client that lists models with a narrowed key sees fewer
+  of them, and a key whose allow-list and owner's roles have nothing in
+  common lists none. No setting, schema, Helm value or Redis key changes.
+- **`general.public_host` must be a host name or an IP address.** Saving
+  it used to accept anything without `/` or `://`, such as
+  `gateway.example.com:8443`, and the Configuration Guide then built a
+  broken URL from it. Such a value is now refused when saved, and one
+  already stored counts as not set: the guide uses the host the console is
+  open at instead. If yours carries a port, move the port to
+  `general.public_port`.
+- **The console's Content-Security-Policy allows `frame-src thinkwatch:`.**
+  The web image's nginx now sends
+  `frame-src 'self' thinkwatch:`, which Add to ThinkWatch Lite needs to hand
+  its link to the app (see Added). A policy of your own in front of the
+  console needs the same directive, or the button does nothing.
+
+### Added
+
+- **"Add to ThinkWatch Lite" for a key shown once.** The new-key and
+  rotated-key dialogs have an Add to ThinkWatch Lite button next to Copy;
+  at the end of first-run setup it is on its own line under the key. It
+  opens a `thinkwatch://import` link with this gateway and the key, and
+  ThinkWatch Lite (2026.10.16 or later) opens its New upstream dialog with
+  them filled in; the upstream is created when the user confirms it there.
+  The link is built in the browser from the key on screen and the
+  gateway's public address, and is sent nowhere. It is opened in a hidden
+  frame, so a browser without Lite installed keeps the page, and the key
+  on it, instead of showing an error page in its place. The button is
+  unavailable, with the reason beside it, for a key without the
+  `ai_gateway` surface, for a user whose roles do not grant
+  `ai_gateway:use` (a key is always its creator's, and the gateway would
+  refuse its every request), and for a gateway whose public address Lite
+  does not accept. Lite takes `https://`, and plain `http://` only on this
+  machine or a private network: private IPv4 ranges (`10/8`, `172.16/12`,
+  `192.168/16`, `100.64/10`, `169.254/16`), private IPv6 ranges
+  (`fc00::/7`, `fe80::/10`), and names with no dot or ending in `.local`,
+  `.lan`, `.internal`, `.intranet`, `.corp`, `.home.arpa` or `.localhost`.
+  Elsewhere, set `general.public_protocol` to `https` where the gateway is
+  served over TLS. Once clicked, a line under it links to the download
+  page. Phones get Copy only.
+- **The Configuration Guide has a ThinkWatch Lite tab**, first among the
+  AI gateway clients: what Lite does, and a button that opens the new-key
+  dialog filled in for it (named "ThinkWatch Lite", AI gateway only).
+  Users without `api_keys:create` are told how to get a key and add it by
+  hand.
+- **`GET /api/gateway/info`** on the console port gives any signed-in user
+  the configured parts of the gateway's public address:
+  `{"public_protocol": "https", "public_host": "gateway.example.com", "public_port": 443, "gateway_port": 3000}`.
+  `public_protocol`, `public_host` and `public_port` are
+  `general.public_protocol`, `general.public_host` and
+  `general.public_port`, each `null` when not set (or when the stored value
+  is not one the setting accepts); `gateway_port` is the port the gateway
+  listens on. The console fills in what is not set from the address it is
+  open at, the browser's scheme and host, and uses `gateway_port` when no
+  public port is set. The server reads no request headers for it.
+
+### Fixed
+
+- **The Configuration Guide shows the configured gateway address to every
+  user.** It read the address from `GET /api/admin/settings/system`, which
+  needs `settings:read`: everyone else got 403 and an address built from
+  the browser's host and port 3000, whatever `general.public_*` said. It
+  now reads `GET /api/gateway/info`. Until that has loaded, and if it
+  cannot be read, the examples use the browser's scheme and host with port
+  3000, as before.
+- **`GET /v1/models` and `GET /v1beta/models` list only the models the
+  calling key may use**: the key's `allowed_models` intersected with what
+  its owner's roles grant, matched exactly or by prefix, the check a
+  request for the model meets. They listed every routed model, and a
+  request for one outside that scope was then refused. A model named in
+  that allow-list is listed when a route serves it, so a key narrowed to
+  `gpt-4o` lists `gpt-4o` when the route is a prefix such as the `gpt-`
+  route of a provider with no routes of its own.
+- **Saving `general.public_host` checks it** (see Read before upgrading):
+  `PATCH /api/admin/settings` answers 400, naming what the setting takes,
+  for a value with a scheme, a port, a path, a user or anything else
+  beyond a host name or an IP address. In Settings, the field's save
+  marker turns to an error that gives this message.
+
+### Changed
+
+- The Public Gateway URL hint in Settings says where an empty protocol or
+  host comes from (the address the console is open at) and that port 0 is
+  the gateway's listening port, and names Add to ThinkWatch Lite among
+  what uses the address.
+
 ## [3.5.0] — 2026-10-11
 
 Limits hold where they used to leak: route caps are enforced, a limits
@@ -1923,7 +2022,8 @@ unreleased builds should: stop the gateway, run `db/schema.sql`
 against PostgreSQL, restart against this tag. The schema is
 idempotent end-to-end, so the apply is safe to repeat.
 
-[Unreleased]: https://github.com/ThinkWatchProject/ThinkWatch/compare/v3.5.0...HEAD
+[Unreleased]: https://github.com/ThinkWatchProject/ThinkWatch/compare/v3.6.0...HEAD
+[3.6.0]: https://github.com/ThinkWatchProject/ThinkWatch/releases/tag/v3.6.0
 [3.5.0]: https://github.com/ThinkWatchProject/ThinkWatch/releases/tag/v3.5.0
 [3.4.0]: https://github.com/ThinkWatchProject/ThinkWatch/releases/tag/v3.4.0
 [3.3.1]: https://github.com/ThinkWatchProject/ThinkWatch/releases/tag/v3.3.1

Cargo.toml

@@ -10,7 +10,7 @@ members = [
 ]
 
 [workspace.package]
-version = "3.5.0"
+version = "3.6.0"
 edition = "2024"
 # The MSRV: the newest `rust-version` among the locked dependencies
 # (sqlx 0.9 and the aws-smithy crates under aws-sigv4). Without it,

crates/common/src/dynamic_config.rs

@@ -699,9 +699,12 @@ fn validate_setting(key: &str, value: &Value) -> anyhow::Result<()> {
             if s.len() > 253 {
                 anyhow::bail!("{key}: host too long");
             }
-            // Reject schemes / paths — host is just a hostname or IP
-            if s.contains("://") || s.contains('/') {
-                anyhow::bail!("{key}: must be a hostname only (no scheme or path)");
+            // A host name or an IP address and nothing else: a value the
+            // gateway address would pass over as not set is refused here.
+            if !s.is_empty() && crate::validation::bare_host(s).is_none() {
+                anyhow::bail!(
+                    "{key}: must be a host name or an IP address only (no scheme, port, path or user)"
+                );
             }
         }
         "general.public_port" => {

crates/common/src/validation.rs

@@ -219,6 +219,33 @@ pub fn validate_url(url_str: &str) -> Result<(), AppError> {
     Ok(())
 }
 
+/// `host` as it goes into a URL — a domain name in lower case, an IPv4
+/// address, or an IPv6 address in brackets (given with or without them) —
+/// or `None` when it is empty or is anything more than a host: a scheme, a
+/// port, a path, a user or anything else that would change the URL's
+/// shape.
+///
+/// The rule for `general.public_host`: saving a value it refuses is an
+/// error, and one already stored counts as not set.
+pub fn bare_host(host: &str) -> Option<String> {
+    let host = host.trim();
+    if host.is_empty() {
+        return None;
+    }
+    let bracketed;
+    let host = if host.parse::<std::net::Ipv6Addr>().is_ok() {
+        bracketed = format!("[{host}]");
+        bracketed.as_str()
+    } else {
+        host
+    };
+    let parsed = url::Host::parse(host).ok()?.to_string();
+    parsed
+        .chars()
+        .all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '_' | ':' | '[' | ']'))
+        .then_some(parsed)
+}
+
 /// Checks an AWS region code such as `us-east-1` or `us-gov-west-1`.
 ///
 /// Bedrock providers keep a region where other providers keep a URL, and
@@ -507,6 +534,33 @@ mod tests {
         assert!(!is_private_ip(&"100.63.255.255".parse().unwrap()));
     }
 
+    #[test]
+    fn bare_host_takes_a_host_name_or_an_ip_address_only() {
+        assert_eq!(
+            bare_host("GW.Example.com").as_deref(),
+            Some("gw.example.com")
+        );
+        assert_eq!(bare_host(" 10.0.0.5 ").as_deref(), Some("10.0.0.5"));
+        assert_eq!(bare_host("gateway").as_deref(), Some("gateway"));
+        assert_eq!(bare_host("::1").as_deref(), Some("[::1]"));
+        assert_eq!(bare_host("[fd00::5]").as_deref(), Some("[fd00::5]"));
+        for bad in [
+            "",
+            "   ",
+            "gw.example.com:8443",
+            "https://gw.example.com",
+            "gw.example.com/v1",
+            "user@gw.example.com",
+            "gw.example.com?x=1",
+            "gw example",
+            "gw.example.com#top",
+            "${GATEWAY_HOST}",
+            "[::1]:3000",
+        ] {
+            assert_eq!(bare_host(bad), None, "{bad:?}");
+        }
+    }
+
     #[test]
     fn is_link_local_ipv4() {
         assert!(is_link_local(&"169.254.1.1".parse().unwrap()));

crates/gateway/src/lifecycle/mod.rs

@@ -847,16 +847,10 @@ impl Surface for ChatCompletionSurface {
         ))
     }
 
-    /// `None` = unrestricted; otherwise the model must match an entry
-    /// (exactly or by prefix). An empty list allows nothing — it is what
-    /// a key narrowed to models its owner's roles do not grant ends up
-    /// with, and the MCP surface reads `[]` the same way.
+    /// See [`GatewayRequestIdentity::may_call`]. The MCP surface reads
+    /// an empty list the same way: nothing is allowed.
     fn is_access_allowed(identity: &Self::Identity, candidate: &str) -> bool {
-        identity.allowed_models.as_ref().is_none_or(|allowed| {
-            allowed
-                .iter()
-                .any(|m| candidate == *m || candidate.starts_with(m))
-        })
+        identity.may_call(candidate)
     }
 
     fn access_denied_response(candidate: &str) -> Self::Response {

crates/gateway/src/proxy/mod.rs

@@ -134,6 +134,29 @@ pub struct GatewayRequestIdentity {
     pub key_expires_at: Option<chrono::DateTime<chrono::Utc>>,
 }
 
+impl GatewayRequestIdentity {
+    /// Whether this caller may call `model` (the name after aliases).
+    /// `allowed_models` is the key's list intersected with its owner's
+    /// role grants: `None` is unrestricted; otherwise the model must
+    /// match an entry exactly or start with it. An empty list allows
+    /// nothing — it is what a key narrowed to models its owner's roles
+    /// do not grant ends up with.
+    ///
+    /// The one decision behind both the request-time check
+    /// (`check_access`) and the model listings: `/v1/models` lists only
+    /// models a request would be let through for. It cannot list every
+    /// one of them — a prefix entry allows names nobody enumerates — so it
+    /// lists the routed names and the allow-list's own entries that pass
+    /// (see `models::callable_models`).
+    pub fn may_call(&self, model: &str) -> bool {
+        self.allowed_models.as_ref().is_none_or(|allowed| {
+            allowed
+                .iter()
+                .any(|m| model == m || model.starts_with(m.as_str()))
+        })
+    }
+}
+
 /// Thin wrapper kept for call-site readability; delegates to
 /// `GatewayError::status_code` so the error-path `gateway_logs` row,
 /// the streaming `StreamOutcome::UpstreamError` log row, and
@@ -467,4 +490,21 @@ mod helper_tests {
         };
         assert_eq!(err.retry_after_secs(), Some(3600));
     }
+
+    #[test]
+    fn a_model_is_callable_when_an_entry_matches_it_exactly_or_as_a_prefix() {
+        let with = |allowed: Option<&[&str]>| GatewayRequestIdentity {
+            allowed_models: allowed.map(|a| a.iter().map(|m| m.to_string()).collect()),
+            ..Default::default()
+        };
+        assert!(with(None).may_call("anything"));
+        let narrowed = with(Some(&["gpt-4o", "claude-"]));
+        assert!(narrowed.may_call("gpt-4o"));
+        assert!(narrowed.may_call("gpt-4o-mini"));
+        assert!(narrowed.may_call("claude-sonnet-4-5"));
+        assert!(!narrowed.may_call("gpt-4"));
+        assert!(!narrowed.may_call("gemini-2.5-pro"));
+        // An empty list allows nothing.
+        assert!(!with(Some(&[])).may_call("gpt-4o"));
+    }
 }