feat: add Amazon Bedrock support with credentials schema refactor #3005
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Author
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
✅ Deploy Preview for howto-fix-macos-audio-selection ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for hyprnote ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for hyprnote-storybook ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
devin-ai-integration
bot
changed the title
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
Contributor
|
/update |
yujonglee
force-pushed
the
devin/1768268311-add-bedrock-support
branch
from
fc72b7c to
15741bd
Compare
3 tasks
Contributor
Author
|
Devin is archived and cannot be woken up. Please unarchive Devin if you want to continue using it. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
apps/desktop/src/store/tinybase/persister/settings/transform.ts
Outdated
Show resolved
Hide resolved
Contributor
|
/update |
- Add Bedrock provider with access_key_id, secret_access_key, and region fields - Extend ConfigField type to support new credential fields - Update aiProviderSchema to include optional Bedrock credentials - Update SETTINGS_MAPPING and queries to handle new fields - Add form fields for Bedrock credentials in NonHyprProviderCard - Add Bedrock icon from @lobehub/icons Co-Authored-By: yujonglee <yujonglee.dev@gmail.com>
Co-Authored-By: yujonglee <yujonglee.dev@gmail.com>
- Import createAmazonBedrock from @ai-sdk/amazon-bedrock - Extend LLMConnectionInfo type with Bedrock credentials - Update resolveLLMConnection to extract and pass Bedrock credentials - Add amazon_bedrock case in createLanguageModel function Co-Authored-By: yujonglee <yujonglee.dev@gmail.com>
… structure - Update schema.ts with apiKeyCredentialsSchema and awsCredentialsSchema - Simplify TinyBase store schema to single credentials column - Update transform.ts for legacy migration and clean output - Update eligibility.ts to accept parsed Credentials type - Update UI forms to handle credentials JSON parsing and serialization - Update useLLMConnection.ts and useSTTConnection.ts to parse credentials JSON - Update llm/select.tsx and stt/select.tsx to use new credentials structure Co-Authored-By: yujonglee <yujonglee.dev@gmail.com>
Co-Authored-By: yujonglee <yujonglee.dev@gmail.com>
…figurations When configuring a provider for the first time (no existing credentials), the credential type is now determined from the provider's requirements. If the provider requires AWS fields (access_key_id, secret_access_key, region), the form defaults to 'aws' credential type instead of 'api_key'. Co-Authored-By: yujonglee <yujonglee.dev@gmail.com>
Co-Authored-By: yujonglee <yujonglee.dev@gmail.com>
When legacy data has no api_key, toCredentialsJson now returns null instead of creating invalid credentials with an empty api_key string that would fail the min(1) schema validation. The caller skips creating rows for unconfigured providers. Co-Authored-By: yujonglee <yujonglee.dev@gmail.com>
…ibility check - Fix missing baseUrl field in STT provider eligibility check (addresses Graphite comment) - Extract normalizeBaseUrl to @hypr/store package to avoid code duplication - Add test coverage for AWS credentials (Bedrock provider) Co-Authored-By: yujonglee <yujonglee.dev@gmail.com>
- Add requires_config_one_of requirement kind for either/or field requirements - Update Bedrock provider to accept either API Key OR AWS credentials (SigV4) - Add UI toggle for users to choose between authentication methods - Update useLLMConnection to handle both auth types for Bedrock Co-Authored-By: yujonglee <yujonglee.dev@gmail.com>
Co-Authored-By: yujonglee <yujonglee.dev@gmail.com>
- Fix silent data loss during migration by preserving provider configs with base_url but empty credentials - Add form validation to prevent saving invalid intermediate states - Improve error messages for requires_config_one_of by using a new blocker type - Add runtime type validation for credentials by accepting unknown type in parseCredentials Co-Authored-By: yujonglee <yujonglee.dev@gmail.com>
Co-Authored-By: yujonglee <yujonglee.dev@gmail.com>
yujonglee
force-pushed
the
devin/1768268311-add-bedrock-support
branch
from
2d5771d to
3960a18
Compare
Comment on lines
+124
to
+131
| if (data.access_key_id && data.secret_access_key && data.region) { | ||
| return JSON.stringify({ | ||
| type: "aws", | ||
| access_key_id: data.access_key_id.trim(), | ||
| secret_access_key: data.secret_access_key.trim(), | ||
| region: data.region.trim(), | ||
| }); | ||
| } |
Contributor
There was a problem hiding this comment.
Critical Bug: Whitespace-only strings bypass validation
The truthy check allows whitespace-only strings (e.g., " ") to pass, but they become empty after .trim(). This creates invalid AWS credentials with empty strings.
// Current code allows whitespace to pass:
if (data.access_key_id && data.secret_access_key && data.region) {
return JSON.stringify({
type: "aws",
access_key_id: data.access_key_id.trim(), // Could be empty!
secret_access_key: data.secret_access_key.trim(),
region: data.region.trim(),
});
}
// Fix: Check after trimming
const trimmedKeyId = typeof data.access_key_id === "string" ? data.access_key_id.trim() : "";
const trimmedSecret = typeof data.secret_access_key === "string" ? data.secret_access_key.trim() : "";
const trimmedRegion = typeof data.region === "string" ? data.region.trim() : "";
if (trimmedKeyId && trimmedSecret && trimmedRegion) {
return JSON.stringify({
type: "aws",
access_key_id: trimmedKeyId,
secret_access_key: trimmedSecret,
region: trimmedRegion,
});
}This would cause authentication failures when migrating legacy AWS credentials that contain whitespace.
Suggested change
| if (data.access_key_id && data.secret_access_key && data.region) { | |
| return JSON.stringify({ | |
| type: "aws", | |
| access_key_id: data.access_key_id.trim(), | |
| secret_access_key: data.secret_access_key.trim(), | |
| region: data.region.trim(), | |
| }); | |
| } | |
| const trimmedKeyId = typeof data.access_key_id === "string" ? data.access_key_id.trim() : ""; | |
| const trimmedSecret = typeof data.secret_access_key === "string" ? data.secret_access_key.trim() : ""; | |
| const trimmedRegion = typeof data.region === "string" ? data.region.trim() : ""; | |
| if (trimmedKeyId && trimmedSecret && trimmedRegion) { | |
| return JSON.stringify({ | |
| type: "aws", | |
| access_key_id: trimmedKeyId, | |
| secret_access_key: trimmedSecret, | |
| region: trimmedRegion, | |
| }); | |
| } |
Spotted by Graphite Agent
Is this helpful? React 👍 or 👎 to let us know.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Adds Amazon Bedrock as a new LLM provider option and refactors the AI provider credentials storage from flat fields to a discriminated union JSON structure.
Bedrock Provider:
access_key_id,secret_access_key, andregion@lobehub/iconscreateAmazonBedrockintegration inuseLLMConnection.tswith conditional auth handlingCredentials Schema Refactor:
base_url/api_keyfields with discriminated unioncredentialsJSON fieldapi_key(base_url?, api_key) andaws(access_key_id, secret_access_key, region)credentialscolumntransform.tsto convert legacy flat fields to new JSON formatProviderEligibilityContextto accept parsedCredentialstype instead of flat configuseLLMConnection.ts,useSTTConnection.ts) to parse credentials JSONUpdates since last revision:
requires_config_one_ofrequirement kind for providers that accept multiple credential types (either/or field requirements)useLLMConnection.tsto check forapiKeyfirst and use API Key auth, otherwise fall back to SigV4 authapi_keybaseUrlfield in STT provider eligibility checknormalizeBaseUrlto shared utility in@hypr/storeFixes from code review (latest):
base_urlbut empty credentials are now preserved instead of being silently droppedisFormValidhelper prevents saving invalid intermediate states during auto-submitmissing_config_one_ofblocker type properly explains either/or credential requirements instead of listing all fields as requiredparseCredentialsnow acceptsunknowntype and validates input is a string before parsing, removing unsafe type casts throughout the codebaseReview & Testing Checklist for Human
base_url(no API key), verify they are preserved after the migrationRecommended test plan:
settings.jsonfile to confirm flat field format is preservedNotes
The credentials are stored internally as JSON strings in TinyBase but transformed back to flat fields when writing to
settings.jsonfor human readability. The migration from legacy format happens transparently on load viasettingsToProviderRows().The Bedrock integration uses
@ai-sdk/amazon-bedrockwhich was already a dependency. The provider defaults tous-east-1region if none is specified. Per the Vercel AI SDK docs, API Key authentication is the recommended method, with SigV4 as a fallback.Requested by @yujonglee
Link to Devin run: https://app.devin.ai/sessions/9e517eda38854c9fabea1213efa088da