Files
Aakash BakhleandGitHub 9c68eed676 fix(captain): send custom tool API key headers (#15008)
Captain custom tools configured with API key authentication now send the
configured key in the requested HTTP header. Existing tools begin
working without needing to be recreated or reconfigured, while
credentials remain protected across redirects.

## How to reproduce

1. Create a Captain custom tool using API Key authentication.
2. Configure `X-API-Key` as the header name and save the tool.
3. Invoke the tool and inspect the incoming request.
4. Before this change, the API key header is absent; after this change,
the configured endpoint receives it.

## What changed

The UI persists API key authentication as `name` and `key`, but the
request builder also required an unused `location: header` property. The
request builder now treats API key authentication as header-based,
matching the only mode exposed by the UI.

Custom authentication headers are also registered as sensitive with
`SafeFetch`. They are retained for the configured endpoint and
same-origin redirects, but stripped when a redirect crosses origins to
prevent credential leakage. Factory, request, and redirect specs cover
the real UI payload and both public and private-network fetch paths.
2026-07-15 22:43:30 +05:30

124 lines
4.4 KiB
Ruby

module Concerns::Toolable
extend ActiveSupport::Concern
# Isolated namespace for user-defined custom tool classes.
# Keeps them separate from built-in classes in Captain::Tools (e.g., HttpTool, CustomHttpTool).
module CustomTools; end
def tool(assistant, base_class: Captain::Tools::HttpTool, **)
custom_tool_record = self
class_name = custom_tool_record.slug.underscore.camelize
# Always create a fresh class to reflect current metadata
tool_slug = custom_tool_record.slug
tool_class = Class.new(base_class) do
description custom_tool_record.description
# Override name to use the slug directly, avoiding the namespace prefix
# that RubyLLM's default normalization would produce (e.g., "captain--tools--custom_dog_facts").
define_method(:name) { tool_slug }
custom_tool_record.param_schema.each do |param_def|
param param_def['name'].to_sym,
type: param_def['type'],
desc: param_def['description'],
required: param_def.fetch('required', true)
end
end
# Register as a constant so the class gets a proper name (Class#name).
# Anonymous classes return nil for #name, which causes "Invalid 'tools[].function.name':
# empty string" errors from the LLM API. We use CustomTools as the namespace to avoid
# collisions with real classes in Captain::Tools.
CustomTools.send(:remove_const, class_name) if CustomTools.const_defined?(class_name, false)
CustomTools.const_set(class_name, tool_class)
tool_class.new(assistant, self, **)
end
def build_request_url(params)
return endpoint_url if endpoint_url.blank? || endpoint_url.exclude?('{{')
render_template(endpoint_url, params)
end
def build_request_body(params)
return nil if request_template.blank?
render_template(request_template, params)
end
def build_auth_headers
return {} if auth_none?
case auth_type
when 'bearer'
{ 'Authorization' => "Bearer #{auth_config['token']}" }
when 'api_key'
{ auth_config['name'] => auth_config['key'] }
else
{}
end
end
def build_basic_auth_credentials
return nil unless auth_type == 'basic'
[auth_config['username'], auth_config['password']]
end
def build_metadata_headers(state)
{}.tap do |headers|
add_base_headers(headers, state)
add_conversation_headers(headers, state[:conversation]) if state[:conversation]
add_contact_headers(headers, state[:contact]) if state[:contact]
add_contact_inbox_headers(headers, state[:contact_inbox])
end
end
def add_base_headers(headers, state)
headers['X-Chatwoot-Account-Id'] = state[:account_id].to_s if state[:account_id]
headers['X-Chatwoot-Assistant-Id'] = state[:assistant_id].to_s if state[:assistant_id]
headers['X-Chatwoot-Tool-Slug'] = slug if slug.present?
end
def add_conversation_headers(headers, conversation)
headers['X-Chatwoot-Conversation-Id'] = conversation[:id].to_s if conversation[:id]
headers['X-Chatwoot-Conversation-Display-Id'] = conversation[:display_id].to_s if conversation[:display_id]
end
def add_contact_headers(headers, contact)
headers['X-Chatwoot-Contact-Id'] = contact[:id].to_s if contact[:id]
headers['X-Chatwoot-Contact-Email'] = contact[:email].to_s if contact[:email].present?
headers['X-Chatwoot-Contact-Phone'] = contact[:phone_number].to_s if contact[:phone_number].present?
end
def add_contact_inbox_headers(headers, contact_inbox)
headers['X-Chatwoot-Contact-Inbox-Id'] = contact_inbox[:id].to_s if contact_inbox&.[](:id)
headers['X-Chatwoot-Contact-Inbox-Verified'] = (contact_inbox&.[](:hmac_verified) || false).to_s
end
def format_response(raw_response_body)
return raw_response_body if response_template.blank?
response_data = parse_response_body(raw_response_body)
render_template(response_template, { 'response' => response_data, 'r' => response_data })
end
private
def render_template(template, context)
liquid_template = Liquid::Template.parse(template, error_mode: :strict)
liquid_template.render(context.deep_stringify_keys, registers: {}, strict_variables: true, strict_filters: true)
rescue Liquid::SyntaxError, Liquid::UndefinedVariable, Liquid::UndefinedFilter => e
Rails.logger.error("Liquid template error: #{e.message}")
raise "Template rendering failed: #{e.message}"
end
def parse_response_body(body)
JSON.parse(body)
rescue JSON::ParserError
body
end
end