Fix code review issues: add header forwarding and improve safety

Co-authored-by: rootfs <[email protected]>

Author: Copilot

e2e-tests/testcases/go.sum

@@ -51,8 +51,6 @@ github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzM
 github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
-github.com/samber/lo v1.52.0 h1:Rvi+3BFHES3A8meP33VPAxiBZX/Aws5RxrschYGjomw=
-github.com/samber/lo v1.52.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
 github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
 github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=

src/semantic-router/pkg/ensemble/factory.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"strings"
 	"sync"
 	"time"
 
@@ -117,11 +118,11 @@ func (f *Factory) Execute(req *Request) *Response {
 		}
 	}
 
-	// Build metadata
+	// Build metadata (only include successful responses)
 	metadata.TotalLatencyMs = totalLatency
 	metadata.ModelLatenciesMs = make(map[string]int64)
 	metadata.ConfidenceScores = make(map[string]float64)
-	for _, resp := range responses {
+	for _, resp := range successfulResponses {
 		metadata.ModelLatenciesMs[resp.ModelName] = resp.Latency.Milliseconds()
 		if resp.Confidence > 0 {
 			metadata.ConfidenceScores[resp.ModelName] = resp.Confidence
@@ -145,8 +146,12 @@ func (f *Factory) queryModels(req *Request) []ModelResponse {
 	responses := make([]ModelResponse, len(req.Models))
 	var wg sync.WaitGroup
 
-	// Limit concurrent requests
-	semaphore := make(chan struct{}, f.config.MaxConcurrentRequests)
+	// Limit concurrent requests (ensure at least 1)
+	maxConcurrent := f.config.MaxConcurrentRequests
+	if maxConcurrent <= 0 {
+		maxConcurrent = 10 // Default to 10 if not set or invalid
+	}
+	semaphore := make(chan struct{}, maxConcurrent)
 
 	for i, modelName := range req.Models {
 		wg.Add(1)
@@ -157,7 +162,7 @@ func (f *Factory) queryModels(req *Request) []ModelResponse {
 			semaphore <- struct{}{}
 			defer func() { <-semaphore }()
 
-			responses[idx] = f.queryModel(req.Context, model, req.OriginalRequest)
+			responses[idx] = f.queryModel(req.Context, model, req.OriginalRequest, req.Headers)
 		}(i, modelName)
 	}
 
@@ -166,7 +171,7 @@ func (f *Factory) queryModels(req *Request) []ModelResponse {
 }
 
 // queryModel queries a single model endpoint
-func (f *Factory) queryModel(ctx context.Context, modelName string, requestBody []byte) ModelResponse {
+func (f *Factory) queryModel(ctx context.Context, modelName string, requestBody []byte, headers map[string]string) ModelResponse {
 	startTime := time.Now()
 
 	endpoint, ok := f.endpoints[modelName]
@@ -200,6 +205,15 @@ func (f *Factory) queryModel(ctx context.Context, modelName string, requestBody
 
 	httpReq.Header.Set("Content-Type", "application/json")
 
+	// Forward authentication and other headers from original request
+	for key, value := range headers {
+		// Forward authorization and other important headers
+		lowerKey := strings.ToLower(key)
+		if lowerKey == "authorization" || lowerKey == "x-api-key" || strings.HasPrefix(lowerKey, "x-") {
+			httpReq.Header.Set(key, value)
+		}
+	}
+
 	// Execute request
 	resp, err := f.httpClient.Do(httpReq)
 	if err != nil {

src/semantic-router/pkg/ensemble/types.go

@@ -57,6 +57,9 @@ type Request struct {
 	// OriginalRequest is the original OpenAI API request body
 	OriginalRequest []byte
 
+	// Headers contains HTTP headers to forward to model endpoints (e.g., Authorization)
+	Headers map[string]string
+
 	// Context for cancellation and timeout
 	Context context.Context
 }

src/semantic-router/pkg/extproc/req_filter_ensemble.go

@@ -24,12 +24,13 @@ func (r *OpenAIRouter) handleEnsembleRequest(ctx *RequestContext) (*ext_proc.Pro
 
 	logging.Infof("Processing ensemble request with %d models: %v", len(ctx.EnsembleModels), ctx.EnsembleModels)
 
-	// Build ensemble request
+	// Build ensemble request with headers for authentication
 	ensembleReq := &ensemble.Request{
 		Models:           ctx.EnsembleModels,
 		Strategy:         ensemble.Strategy(ctx.EnsembleStrategy),
 		MinResponses:     ctx.EnsembleMinResponses,
 		OriginalRequest:  ctx.OriginalRequestBody,
+		Headers:          ctx.Headers, // Forward original request headers for authentication
 		Context:          ctx.TraceContext,
 	}