fix: synchronize auth provider configuration

[g-linville]

for #7667

This sets up proper synchronizing of provider configuration changes across multiple replicas. I added a new controller that runs in each replica and watches a new singleton called ProviderDaemonSync. This contains a mapping of provider names to generations, and each time it increases, the providers are stopped across all replicas so that they restart on the next request with the new configuration.

Actual provider configuration/deconfiguration is now handled by the main leader-elected controller. Previously, we handled deleting/editing/creating the credential in the API, but now we stage a credential (if necessary) and create a ProviderConfigurationChange object which gets processed by the controller, which does the actual configuration change and augments the generation on the ProviderDaemonSync singleton.

For Donnie: in our design discussion, I initially said that the ProviderDaemonSync would be just a timestamp. There were two issues with this: clock skew, and overly impactful daemon restarts, especially for model providers which could have long-lived connections and shouldn't have to restart just because a different provider was [de]configured. So that's why the final design here is a mapping of provider names to generations.

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[Copilot]

Pull request overview

Synchronizes provider credential changes across Obot replicas through persisted configuration tasks and replica-local daemon invalidation.

Changes:

• Adds staged, reconciled provider configuration changes.
• Broadcasts daemon refresh signals to every replica.
• Adds fresh model discovery, daemon-generation safety, and tests.

Reviewed changes

Copilot reviewed 22 out of 25 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/system/tools.go	Adds staged credential context.
pkg/system/ids.go	Adds provider synchronization IDs.
pkg/storage/openapi/generated/openapi_generated.go	Adds generated schemas.
pkg/storage/apis/obot.obot.ai/v1/zz_generated.openapi_modelname.go	Adds generated model names.
pkg/storage/apis/obot.obot.ai/v1/zz_generated.deepcopy.go	Adds generated deep-copy methods.
pkg/storage/apis/obot.obot.ai/v1/scheme.go	Registers new resources.
pkg/storage/apis/obot.obot.ai/v1/providerdaemonsync.go	Defines daemon synchronization resource.
pkg/storage/apis/obot.obot.ai/v1/providerconfigurationchange.go	Defines configuration-change resource.
pkg/storage/apis/obot.obot.ai/v1/constants.go	Removes obsolete auth sync annotation.
pkg/services/config.go	Creates the per-replica synchronization router.
pkg/gateway/server/dispatcher/dispatcher.go	Tracks model refresh sequences.
pkg/gateway/server/dispatcher/daemon.go	Adds bulk stopping and generation safety.
pkg/gateway/server/dispatcher/daemon_bulk_stop_test.go	Tests bulk daemon stopping.
pkg/gateway/server/dispatcher/availablemodels.go	Adds isolated model discovery daemons.
pkg/controller/routes.go	Registers synchronization reconcilers.
pkg/controller/handlers/providerdaemonsync/providerdaemonsync.go	Handles replica-local invalidation.
pkg/controller/handlers/providerdaemonsync/providerdaemonsync_test.go	Tests timestamp handling.
pkg/controller/handlers/providerconfigurationchange/providerconfigurationchange.go	Reconciles staged provider changes.
pkg/controller/handlers/providerconfigurationchange/providerconfigurationchange_test.go	Tests reconciliation and cleanup.
pkg/controller/handlers/provider/provider.go	Fixes auth credential lookup and model refresh status.
pkg/controller/controller.go	Initializes cleanup and synchronization.
pkg/api/handlers/providerconfigurationchange.go	Stages, submits, and awaits changes.
pkg/api/handlers/modelprovider.go	Routes model configuration through reconciliation.
pkg/api/handlers/authprovider.go	Routes auth configuration through reconciliation.
pkg/api/handlers/authprovider_test.go	Tests staging, conflicts, and cancellation.

Files not reviewed (2)

• pkg/storage/apis/obot.obot.ai/v1/zz_generated.deepcopy.go: Generated file
• pkg/storage/apis/obot.obot.ai/v1/zz_generated.openapi_modelname.go: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[g-linville]

@claude review

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.