import type { TFunction } from "i18next"

import {

type ProviderSettings,

type OrganizationAllowList,

type RouterModels,

getModelId,

isDynamicProvider,

parseOpenAiExtraBody,

providerIdentifiers,

githubCopilotLanguageModel,

} from "@roo-code/types"

type OpenAiExtraBodyParseResult = ReturnType<typeof parseOpenAiExtraBody>

type OpenAiExtraBodyTranslationKey = `settings:validation.openAiExtraBody.${

"invalidJson" | "objectRequired" | "reservedKeys"}`

type OpenAiExtraBodyTranslationFunction = (key: OpenAiExtraBodyTranslationKey, options?: { keys: string }) => string

export function formatOpenAiExtraBodyValidationError(

result: OpenAiExtraBodyParseResult,

t: OpenAiExtraBodyTranslationFunction,

): string | undefined {

if (result.success) {

return undefined

}

if (result.reason === "reservedKeys") {

return t("settings:validation.openAiExtraBody.reservedKeys", {

keys: result.reservedKeys?.join(", ") ?? "",

})

}

return t(`settings:validation.openAiExtraBody.${result.reason}`)

}

function validateOpenAiExtraBody(apiConfiguration: ProviderSettings, t: TFunction): string | undefined {

if (apiConfiguration.apiProvider !== providerIdentifiers.openai) {

return undefined

}

return formatOpenAiExtraBodyValidationError(parseOpenAiExtraBody(apiConfiguration.openAiExtraBody), t)

}

export function validateApiConfiguration(

apiConfiguration: ProviderSettings,

t: TFunction,

routerModels?: RouterModels,

organizationAllowList?: OrganizationAllowList,

zooCodeIsAuthenticated?: boolean,

): string | undefined {

const keysAndIdsPresentErrorMessage = validateModelsAndKeysProvided(apiConfiguration, t, zooCodeIsAuthenticated)

if (keysAndIdsPresentErrorMessage) {

return keysAndIdsPresentErrorMessage

}

const extraBodyError = validateOpenAiExtraBody(apiConfiguration, t)

if (extraBodyError) {

return extraBodyError

}

const organizationAllowListError = validateProviderAgainstOrganizationSettings(

apiConfiguration,

t,

organizationAllowList,

)

if (organizationAllowListError) {

return organizationAllowListError.message

}

return validateDynamicProviderModelId(apiConfiguration, t, routerModels)

}

function validateModelsAndKeysProvided(

apiConfiguration: ProviderSettings,

t: TFunction,

zooCodeIsAuthenticated?: boolean,

): string | undefined {

switch (apiConfiguration.apiProvider) {

case providerIdentifiers.openrouter:

if (!apiConfiguration.openRouterApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.requesty:

if (!apiConfiguration.requestyApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.unbound:

if (!apiConfiguration.unboundApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.litellm:

if (!apiConfiguration.litellmApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.anthropic:

if (!apiConfiguration.apiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.bedrock:

if (!apiConfiguration.awsRegion) {

return t("settings:validation.awsRegion")

}

break

case providerIdentifiers.vertex:

if (!apiConfiguration.vertexProjectId || !apiConfiguration.vertexRegion) {

return t("settings:validation.googleCloud")

}

break

case providerIdentifiers.gemini:

if (!apiConfiguration.geminiApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.openaiNative:

if (!apiConfiguration.openAiNativeApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.mistral:

if (!apiConfiguration.mistralApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.openai:

if (!apiConfiguration.openAiBaseUrl || !apiConfiguration.openAiApiKey || !apiConfiguration.openAiModelId) {

return t("settings:validation.openAi")

}

break

case providerIdentifiers.ollama:

if (!apiConfiguration.ollamaModelId) {

return t("settings:validation.modelId")

}

break

case providerIdentifiers.lmstudio:

if (!apiConfiguration.lmStudioModelId) {

return t("settings:validation.modelId")

}

break

case providerIdentifiers.vscodeLm:

if (!apiConfiguration.vsCodeLmModelSelector) {

return t("settings:validation.modelSelector")

}

break

case providerIdentifiers.githubCopilot:

if (

apiConfiguration.vsCodeLmModelSelector?.vendor !== githubCopilotLanguageModel.vendor ||

(!apiConfiguration.vsCodeLmModelSelector.id && !apiConfiguration.vsCodeLmModelSelector.family)

) {

return t("settings:validation.modelSelector")

}

break

case providerIdentifiers.fireworks:

if (!apiConfiguration.fireworksApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.friendli:

if (!apiConfiguration.friendliApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.qwenCode:

if (!apiConfiguration.qwenCodeOauthPath) {

return t("settings:validation.qwenCodeOauthPath")

}

break

case providerIdentifiers.kimiCode:

if ((apiConfiguration.kimiCodeAuthMethod ?? "oauth") === "api-key" && !apiConfiguration.kimiCodeApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.vercelAiGateway:

if (!apiConfiguration.vercelAiGatewayApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.opencodeGo:

if (!apiConfiguration.opencodeGoApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.kenari:

if (!apiConfiguration.kenariApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.ioIntelligence:

if (!apiConfiguration.ioIntelligenceApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.nanogpt:

if (!apiConfiguration.nanoGptApiKey) {

return t("settings:validation.apiKey")

}

break

case providerIdentifiers.zooGateway:

if (!apiConfiguration.zooSessionToken && !zooCodeIsAuthenticated) {

return t("settings:validation.zooGatewaySignIn")

}

break

case providerIdentifiers.baseten:

if (!apiConfiguration.basetenApiKey) {

return t("settings:validation.apiKey")

}

break

}

return undefined

}

type ValidationError = {

message: string

code: "PROVIDER_NOT_ALLOWED" | "MODEL_NOT_ALLOWED"

}

function validateProviderAgainstOrganizationSettings(

apiConfiguration: ProviderSettings,

t: TFunction,

organizationAllowList?: OrganizationAllowList,

): ValidationError | undefined {

if (organizationAllowList && !organizationAllowList.allowAll) {

const provider = apiConfiguration.apiProvider

if (!provider) {

return undefined

}

const providerConfig = organizationAllowList.providers[provider]

if (!providerConfig) {

return {

message: t("settings:validation.providerNotAllowed", { provider }),

code: "PROVIDER_NOT_ALLOWED",

}

}

if (!providerConfig.allowAll) {

const modelId = getModelId(apiConfiguration)

const allowedModels = providerConfig.models || []

if (modelId && !allowedModels.includes(modelId)) {

return {

message: t("settings:validation.modelNotAllowed", {

model: modelId,

provider,

}),

code: "MODEL_NOT_ALLOWED",

}

}

}

}

}

/**

* Validates an Amazon Bedrock ARN and optionally checks if the region in

* the ARN matches the provided region.

*

* Note: This function does not perform strict format validation on the ARN.

* Users entering custom ARNs are advanced users who should be trusted to

* provide valid ARNs without restriction. See issue #10108.

*

* @param arn The ARN string to validate

* @param t Translates the region mismatch message

* @param region Optional region to check against the ARN's region

* @returns An object with validation results: { isValid, arnRegion, errorMessage }

*/

export function validateBedrockArn(arn: string, t: TFunction, region?: string) {

// Try to extract region from ARN for region mismatch warning.

// This is a permissive regex that attempts to find the region component

// without enforcing strict ARN format validation.

const regionMatch = arn.match(/^arn:[^:]+:[^:]+:([^:]+):/)

const arnRegion = regionMatch?.[1]

// Check if region in ARN matches provided region (if specified).

if (region && arnRegion && arnRegion !== region) {

return {

isValid: true,

arnRegion,

errorMessage: t("settings:validation.arn.regionMismatch", { arnRegion, region }),

}

}

// ARN is always considered valid - trust the user to enter valid ARNs.

return { isValid: true, arnRegion, errorMessage: undefined }

}

function validateDynamicProviderModelId(

apiConfiguration: ProviderSettings,

t: TFunction,

routerModels?: RouterModels,

): string | undefined {

const provider = apiConfiguration.apiProvider ?? ""

// We only validate model ids from dynamic providers.

if (!isDynamicProvider(provider)) {

return undefined

}

const modelId = getModelId(apiConfiguration)

if (!modelId) {

return t("settings:validation.modelId")

}

const models = routerModels?.[provider]

if (models && Object.keys(models).length > 1 && !Object.keys(models).includes(modelId)) {

return t("settings:validation.modelAvailability", { modelId })

}

return undefined

}

/**

* Extracts model-specific validation errors from the API configuration.

* This is used to show model errors specifically in the model selector components.

*/

export function getModelValidationError(

apiConfiguration: ProviderSettings,

t: TFunction,

routerModels?: RouterModels,

organizationAllowList?: OrganizationAllowList,

): string | undefined {

const modelId = getModelId(apiConfiguration) ?? apiConfiguration.apiModelId

const configWithModelId = {

...apiConfiguration,

apiModelId: modelId || "",

}

const orgError = validateProviderAgainstOrganizationSettings(configWithModelId, t, organizationAllowList)

if (orgError && orgError.code === "MODEL_NOT_ALLOWED") {

return orgError.message

}

return validateDynamicProviderModelId(configWithModelId, t, routerModels)

}

/**

* Validates API configuration but excludes model-specific errors.

* This is used for the general API error display to prevent duplication

* when model errors are shown in the model selector.

*

* Zoo Gateway's sign-in error is rendered inline by the `ZooGateway` provider

* component, so we skip the keys/sign-in check here. Organization provider

* restrictions still need to be enforced for zoo-gateway, so the org allowlist

* check below runs for every provider.

*/

export function validateApiConfigurationExcludingModelErrors(

apiConfiguration: ProviderSettings,

t: TFunction,

_routerModels?: RouterModels, // Keeping this for compatibility with the old function.

organizationAllowList?: OrganizationAllowList,

): string | undefined {

if (apiConfiguration.apiProvider !== providerIdentifiers.zooGateway) {

const keysAndIdsPresentErrorMessage = validateModelsAndKeysProvided(apiConfiguration, t)

if (keysAndIdsPresentErrorMessage) {

return keysAndIdsPresentErrorMessage

}

}

const extraBodyError = validateOpenAiExtraBody(apiConfiguration, t)

if (extraBodyError) {

return extraBodyError

}

const organizationAllowListError = validateProviderAgainstOrganizationSettings(

apiConfiguration,

t,

organizationAllowList,

)

// Only return organization errors if they're not model-specific.

if (organizationAllowListError && organizationAllowListError.code === "PROVIDER_NOT_ALLOWED") {

return organizationAllowListError.message

}

// Skip model validation errors as they'll be shown in the model selector.

return undefined

}