Files
OmniRoute/tests/unit
diegosouzapw 124ed82f02 fix(api/combos): add API-key-safe GET /v1/combos endpoint (#2300)
The existing /api/combos GET requires a management token, which broke
read-only integrations (opencode-omniroute-auth plugin and similar) that
need to enrich combo capabilities from a normal Bearer API key. Those
clients got 403 AUTH_001 'Invalid management token' even though the same
API key could list models via /v1/models.

This adds GET /v1/combos with the same auth model as /v1/models:
- Accepts valid Bearer API key OR dashboard session cookie.
- Falls back to anonymous when REQUIRE_API_KEY=false (single-user local).
- Projects ONLY public metadata: name, strategy, description, model id,
  providerId, comboName (for combo-refs). Internal routing details
  (connectionId, weights, labels, sortOrder, config) are stripped.

/api/combos (management writes) is unchanged.
2026-05-16 10:14:06 -03:00
..
2026-04-19 19:50:30 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-04-30 01:27:03 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-04-30 01:27:03 -03:00
2026-04-30 01:27:03 -03:00
2026-05-10 00:55:06 -03:00
2026-04-30 14:08:50 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-04-30 01:27:03 -03:00
2026-04-30 01:27:03 -03:00
2026-04-30 01:27:03 -03:00
2026-04-28 10:03:39 -03:00
2026-04-28 20:46:25 -03:00
2026-05-10 00:55:06 -03:00
2026-04-28 20:46:25 -03:00
2026-04-30 14:08:50 -03:00
2026-05-10 00:55:06 -03:00
2026-05-10 00:55:06 -03:00
2026-04-30 01:27:03 -03:00