Implement multiple PR features: newer OpenAI models, enhanced conversion, passthrough mode, Docker improvements

This commit implements changes from PRs fuergaosi233#35, fuergaosi233#24, fuergaosi233#39, fuergaosi233#37, and fuergaosi233#32:

## PR fuergaosi233#35 + fuergaosi233#24: OpenAI Newer Models Support (o1, o3, o4, gpt-5)
- Add `is_newer_openai_model()` method to ModelManager to detect o1, o3, o4, gpt-5
- Add `is_o3_model()` method for specific o3 model detection
- Use `max_completion_tokens` instead of `max_tokens` for newer models
- Enforce `temperature=1` for newer OpenAI reasoning models
- Update test-connection endpoint to handle newer models correctly
- Fix compatibility with OpenAI's newer model API requirements

## PR fuergaosi233#39: Enhanced Conversion & Error Handling
- Add comprehensive input validation to request converter
- Validate Claude request structure before processing
- Add enhanced error handling in response converter
- Validate OpenAI response structure with detailed error messages
- Add prompt cache support for non-streaming responses
- Extract and include `cache_read_input_tokens` from prompt_tokens_details
- Improve error messages for debugging

## PR fuergaosi233#37: Multi-Tenant Passthrough Mode
- Add passthrough mode support for multi-tenant deployments
- Make OPENAI_API_KEY optional - enable passthrough mode when not set
- Add per-request API key support via `openai-api-key` header
- Update OpenAIClient to accept per-request API keys
- Add API key format validation (sk- prefix, minimum length)
- Update endpoints to extract and validate OpenAI API keys from headers
- Support both proxy mode (server key) and passthrough mode (user keys)
- Enable separate billing per tenant in passthrough mode

## PR fuergaosi233#32: Docker Improvements
- Add comprehensive .dockerignore file
- Exclude development files, tests, and sensitive data from Docker builds
- Reduce Docker image size by excluding unnecessary files
- Improve build performance with proper ignore patterns

## Additional Improvements
- Better error messages and logging throughout
- Enhanced API key validation
- Improved request/response handling

All changes maintain backward compatibility with existing deployments.

Author: claude

.dockerignore

@@ -0,0 +1,73 @@
+# Git files
+.git
+.gitignore
+.gitattributes
+
+# Python cache
+__pycache__
+*.py[cod]
+*$py.class
+*.so
+.Python
+
+# Virtual environments
+venv/
+env/
+ENV/
+.venv
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# Environment files (keep .env.example but exclude actual .env)
+.env
+.env.local
+.env.*.local
+
+# Test and development
+tests/
+*.pytest_cache/
+.coverage
+htmlcov/
+.tox/
+dist/
+build/
+*.egg-info/
+
+# Documentation
+docs/
+*.md
+!README.md
+
+# Logs and databases
+*.log
+*.db
+*.sqlite
+*.sqlite3
+usage_tracking.db
+
+# Temporary files
+*.tmp
+*.temp
+.DS_Store
+Thumbs.db
+
+# CI/CD
+.github/
+.gitlab-ci.yml
+.travis.yml
+
+# Docker files (no need to include in image)
+Dockerfile*
+docker-compose*.yml
+.dockerignore
+
+# Configuration modes
+modes.json
+
+# Scripts (unless needed at runtime)
+scripts/

src/api/endpoints.py

@@ -53,37 +53,72 @@
 # Configure per-model clients for hybrid deployments
 openai_client.configure_per_model_clients(config)
 
-async def validate_api_key(x_api_key: Optional[str] = Header(None), authorization: Optional[str] = Header(None)):
-    """Validate the client's API key from either x-api-key header or Authorization header."""
+async def validate_and_extract_api_key(
+    x_api_key: Optional[str] = Header(None),
+    authorization: Optional[str] = Header(None),
+    openai_api_key: Optional[str] = Header(None, alias="openai-api-key")
+) -> Optional[str]:
+    """
+    Validate and extract API keys based on operating mode.
+
+    Returns:
+        OpenAI API key to use for the request (None in proxy mode)
+
+    Raises:
+        HTTPException: If validation fails
+    """
     client_api_key = None
+    openai_key = None
 
-    # Extract API key from headers
+    # Extract Anthropic API key from headers (for Claude client validation)
     if x_api_key:
         client_api_key = x_api_key
         logger.debug(f"API key from x-api-key header: {client_api_key[:10]}...")
     elif authorization and authorization.startswith("Bearer "):
         client_api_key = authorization.replace("Bearer ", "")
         logger.debug(f"API key from Authorization header: {client_api_key[:10]}...")
 
-    # Skip validation if ANTHROPIC_API_KEY is not set in the environment
-    if not config.anthropic_api_key:
-        logger.debug("ANTHROPIC_API_KEY not set, skipping client validation")
-        return
+    # Extract OpenAI API key from headers (for passthrough mode)
+    if openai_api_key:
+        openai_key = openai_api_key
+        logger.debug(f"OpenAI API key from header: {openai_key[:10]}...")
+
+    # Passthrough mode: Require OpenAI API key from user
+    if config.passthrough_mode:
+        if not openai_key:
+            raise HTTPException(
+                status_code=401,
+                detail="Passthrough mode: Please provide your OpenAI API key via 'openai-api-key' header"
+            )
 
-    logger.debug(f"Expected ANTHROPIC_API_KEY: {config.anthropic_api_key}")
+        # Validate OpenAI API key format
+        if not config.validate_api_key(openai_key):
+            raise HTTPException(
+                status_code=401,
+                detail="Invalid OpenAI API key format. Key must start with 'sk-' and be at least 20 characters"
+            )
 
-    # Validate the client API key
-    if not client_api_key or not config.validate_client_api_key(client_api_key):
-        logger.warning(f"Invalid API key provided by client. Expected: {config.anthropic_api_key}, Got: {client_api_key[:10] if client_api_key else 'None'}...")
-        raise HTTPException(
-            status_code=401,
-            detail="Invalid API key. Please provide a valid Anthropic API key."
-        )
+        logger.debug("Passthrough mode: OpenAI API key validated")
+        return openai_key
 
-    logger.debug("API key validation passed")
+    # Proxy mode: Validate Anthropic client key if configured
+    if config.anthropic_api_key:
+        if not client_api_key or not config.validate_client_api_key(client_api_key):
+            logger.warning(f"Invalid API key provided by client. Expected: {config.anthropic_api_key}, Got: {client_api_key[:10] if client_api_key else 'None'}...")
+            raise HTTPException(
+                status_code=401,
+                detail="Invalid API key. Please provide a valid Anthropic API key."
+            )
+        logger.debug("Proxy mode: Anthropic API key validation passed")
+
+    return None  # Proxy mode: use server-configured API key
 
 @router.post("/v1/messages")
-async def create_message(request: ClaudeMessagesRequest, http_request: Request, _: None = Depends(validate_api_key)):
+async def create_message(
+    request: ClaudeMessagesRequest,
+    http_request: Request,
+    openai_api_key: Optional[str] = Depends(validate_and_extract_api_key)
+):
     request_start_time = time.time()
     request_id = str(uuid.uuid4())
 
@@ -204,7 +239,7 @@ async def create_message(request: ClaudeMessagesRequest, http_request: Request,
             logger.debug(f"Starting streaming response for request_id: {request_id}")
             try:
                 openai_stream = openai_client.create_chat_completion_stream(
-                    openai_request, request_id, config
+                    openai_request, request_id, config, api_key=openai_api_key
                 )
                 logger.debug(f"OpenAI stream created for request_id: {request_id}")
                 return StreamingResponse(
@@ -251,7 +286,7 @@ async def create_message(request: ClaudeMessagesRequest, http_request: Request,
             # Non-streaming response
             logger.debug(f"Starting non-streaming response for request_id: {request_id}")
             openai_response = await openai_client.create_chat_completion(
-                openai_request, request_id, config
+                openai_request, request_id, config, api_key=openai_api_key
             )
             logger.debug(f"OpenAI response received for request_id: {request_id}")
 
@@ -383,7 +418,10 @@ async def create_message(request: ClaudeMessagesRequest, http_request: Request,
 
 
 @router.post("/v1/messages/count_tokens")
-async def count_tokens(request: ClaudeTokenCountRequest, _: None = Depends(validate_api_key)):
+async def count_tokens(
+    request: ClaudeTokenCountRequest,
+    openai_api_key: Optional[str] = Depends(validate_and_extract_api_key)
+):
     try:
         # For token counting, we'll use a simple estimation
         # In a real implementation, you might want to use tiktoken or similar
@@ -437,12 +475,23 @@ async def test_connection():
     """Test API connectivity to OpenAI"""
     try:
         # Simple test request to verify API connectivity
+        # Check if the test model is a newer OpenAI model
+        is_newer_model = model_manager.is_newer_openai_model(config.small_model)
+
+        test_request = {
+            "model": config.small_model,
+            "messages": [{"role": "user", "content": "Hello"}],
+        }
+
+        # Newer OpenAI models (o1, o3, o4, gpt-5) require max_completion_tokens and temperature=1
+        if is_newer_model:
+            test_request["max_completion_tokens"] = 200
+            test_request["temperature"] = 1
+        else:
+            test_request["max_tokens"] = 5
+
         test_response = await openai_client.create_chat_completion(
-            {
-                "model": config.small_model,
-                "messages": [{"role": "user", "content": "Hello"}],
-                "max_tokens": 5,
-            },
+            test_request,
             config=config
         )
 

src/conversion/request_converter.py

@@ -127,7 +127,20 @@ def _apply_reasoning_config(
 def convert_claude_to_openai(
     claude_request: ClaudeMessagesRequest, model_manager
 ) -> Dict[str, Any]:
-    """Convert Claude API request format to OpenAI format."""
+    """Convert Claude API request format to OpenAI format with enhanced validation."""
+
+    # Validate input request
+    if not claude_request:
+        raise ValueError("Claude request cannot be None")
+
+    if not claude_request.messages:
+        raise ValueError("Claude request must contain at least one message")
+
+    if not isinstance(claude_request.messages, list):
+        raise ValueError("Claude request messages must be a list")
+
+    if claude_request.max_tokens < 1:
+        raise ValueError(f"max_tokens must be at least 1, got {claude_request.max_tokens}")
 
     # Parse model name and extract reasoning configuration
     openai_model, reasoning_config = model_manager.parse_and_map_model(claude_request.model)
@@ -192,17 +205,31 @@ def convert_claude_to_openai(
         i += 1
 
     # Build OpenAI request
+    # Check if this is a newer OpenAI model (o1, o3, o4, gpt-5)
+    is_newer_model = model_manager.is_newer_openai_model(openai_model)
+
+    # Calculate token limit
+    token_limit = min(
+        max(claude_request.max_tokens, config.min_tokens_limit),
+        config.max_tokens_limit,
+    )
+
     openai_request = {
         "model": openai_model,
         "messages": openai_messages,
-        "max_tokens": min(
-            max(claude_request.max_tokens, config.min_tokens_limit),
-            config.max_tokens_limit,
-        ),
-        "temperature": claude_request.temperature,
         "stream": claude_request.stream,
     }
-    logger.debug(f"Converted request: model={openai_model}, messages={len(openai_messages)}, max_tokens={openai_request['max_tokens']}")
+
+    # Newer OpenAI models (o1, o3, o4, gpt-5) require max_completion_tokens instead of max_tokens
+    if is_newer_model:
+        openai_request["max_completion_tokens"] = token_limit
+        # Newer reasoning models require temperature=1
+        openai_request["temperature"] = 1
+        logger.debug(f"Converted request (newer model): model={openai_model}, messages={len(openai_messages)}, max_completion_tokens={token_limit}, temperature=1")
+    else:
+        openai_request["max_tokens"] = token_limit
+        openai_request["temperature"] = claude_request.temperature
+        logger.debug(f"Converted request: model={openai_model}, messages={len(openai_messages)}, max_tokens={token_limit}")
     # Add optional parameters
     if claude_request.stop_sequences:
         openai_request["stop"] = claude_request.stop_sequences

src/conversion/response_converter.py

@@ -8,14 +8,36 @@
 def convert_openai_to_claude_response(
     openai_response: dict, original_request: ClaudeMessagesRequest
 ) -> dict:
-    """Convert OpenAI response to Claude format."""
+    """Convert OpenAI response to Claude format with enhanced error handling."""
 
-    # Extract response data
+    # Validate response structure
+    if not isinstance(openai_response, dict):
+        raise HTTPException(
+            status_code=500,
+            detail="Invalid OpenAI response format: expected dictionary"
+        )
+
+    # Extract response data with validation
     choices = openai_response.get("choices", [])
     if not choices:
-        raise HTTPException(status_code=500, detail="No choices in OpenAI response")
+        raise HTTPException(
+            status_code=500,
+            detail="No choices in OpenAI response"
+        )
+
+    if not isinstance(choices, list):
+        raise HTTPException(
+            status_code=500,
+            detail="Invalid choices format in OpenAI response"
+        )
 
     choice = choices[0]
+    if not isinstance(choice, dict):
+        raise HTTPException(
+            status_code=500,
+            detail="Invalid choice format in OpenAI response"
+        )
+
     message = choice.get("message", {})
 
     # Build Claude content blocks
@@ -58,7 +80,20 @@ def convert_openai_to_claude_response(
         "function_call": Constants.STOP_TOOL_USE,
     }.get(finish_reason, Constants.STOP_END_TURN)
 
-    # Build Claude response
+    # Build Claude response with prompt cache support
+    usage = openai_response.get("usage", {})
+    usage_data = {
+        "input_tokens": usage.get("prompt_tokens", 0),
+        "output_tokens": usage.get("completion_tokens", 0),
+    }
+
+    # Add prompt cache tokens if available (OpenAI prompt caching)
+    prompt_tokens_details = usage.get("prompt_tokens_details", {})
+    if prompt_tokens_details:
+        cache_read_input_tokens = prompt_tokens_details.get("cached_tokens", 0)
+        if cache_read_input_tokens > 0:
+            usage_data["cache_read_input_tokens"] = cache_read_input_tokens
+
     claude_response = {
         "id": openai_response.get("id", f"msg_{uuid.uuid4()}"),
         "type": "message",
@@ -67,12 +102,7 @@ def convert_openai_to_claude_response(
         "content": content_blocks,
         "stop_reason": stop_reason,
         "stop_sequence": None,
-        "usage": {
-            "input_tokens": openai_response.get("usage", {}).get("prompt_tokens", 0),
-            "output_tokens": openai_response.get("usage", {}).get(
-                "completion_tokens", 0
-            ),
-        },
+        "usage": usage_data,
     }
 
     return claude_response