add the pangolin header information

server/routers/aiGateway/pipeline.ts

@@ -119,6 +119,28 @@ export type RequestUser = {
     role: string | null;
 };
 
+// Identity headers forwarded to the upstream inference endpoint when the
+// requesting user is known. Omitted entirely (not sent empty) when we
+// couldn't resolve a user for the request.
+export function applyRequestUserHeaders(
+    headers: Record<string, string>,
+    requestUser: RequestUser | null
+): void {
+    if (!requestUser) {
+        return;
+    }
+    headers["Remote-User"] = requestUser.username;
+    if (requestUser.email) {
+        headers["Remote-Email"] = requestUser.email;
+    }
+    if (requestUser.name) {
+        headers["Remote-Name"] = requestUser.name;
+    }
+    if (requestUser.role) {
+        headers["Remote-Role"] = requestUser.role;
+    }
+}
+
 async function buildRequestUser(
     userId: string,
     orgId: string | null
@@ -519,7 +541,12 @@ export async function handleAiGatewayProxy(
         const { provider } = selection;
 
         if (provider.type === "custom" && provider.routingMode === "target") {
-            return await proxyAiGatewayToSiteTarget(req, res, provider);
+            return await proxyAiGatewayToSiteTarget(
+                req,
+                res,
+                provider,
+                requestUser
+            );
         }
 
         const upstreamUrl = provider.upstreamUrl;
@@ -580,6 +607,7 @@ export async function handleAiGatewayProxy(
             config.getRawConfig().server.secret!
         );
         applyAiProviderAuthHeaders(headers, authType, apiKey);
+        applyRequestUserHeaders(headers, requestUser);
 
         const body = JSON.stringify(req.body);
 

server/routers/aiGateway/targetRouting.ts

@@ -12,6 +12,10 @@ import {
 } from "@server/lib/aiProviderDefaults";
 import logger from "@server/logger";
 import HttpCode from "@server/types/HttpCode";
+import {
+    applyRequestUserHeaders,
+    type RequestUser
+} from "@server/routers/aiGateway/pipeline";
 
 // Short TTL: long enough to spare the DB on a burst of requests, short
 // enough that target/site changes (added, removed, exit node moved) show up
@@ -147,7 +151,8 @@ function pathFromRequest(req: Request): string {
 export async function proxyAiGatewayToSiteTarget(
     req: Request,
     res: Response,
-    provider: AiProvider
+    provider: AiProvider,
+    requestUser: RequestUser | null
 ): Promise<void> {
     const providerTargets = await getProviderTargets(provider.providerId);
     if (providerTargets.length === 0) {
@@ -191,6 +196,7 @@ export async function proxyAiGatewayToSiteTarget(
         config.getRawConfig().server.secret!
     );
     applyAiProviderAuthHeaders(headers, authType, apiKey);
+    applyRequestUserHeaders(headers, requestUser);
 
     headers[PANGOLIN_DEST_HEADER] = target.destination;
     headers[PANGOLIN_HOST_HEADER] = target.hostHeader;