feat:Add Amazon Bedrock to support the leading large language models such as Amazon Nova, Claude, Llama, Mistral, and others.

.env.template

@@ -76,3 +76,10 @@ ANTHROPIC_URL=
 
 ### (optional)
 WHITE_WEBDAV_ENDPOINTS=
+
+
+### bedrock  (optional)
+AWS_REGION=
+AWS_ACCESS_KEY=AKIA
+AWS_SECRET_KEY=
+

app/api/[provider]/[...path]/route.ts

@@ -1,6 +1,7 @@
 import { ApiPath } from "@/app/constant";
 import { NextRequest } from "next/server";
 import { handle as openaiHandler } from "../../openai";
+import { handle as bedrockHandler } from "../../bedrock";
 import { handle as azureHandler } from "../../azure";
 import { handle as googleHandler } from "../../google";
 import { handle as anthropicHandler } from "../../anthropic";
@@ -22,12 +23,15 @@ async function handle(
   const apiPath = `/api/${params.provider}`;
   console.log(`[${params.provider} Route] params `, params);
   switch (apiPath) {
+    case ApiPath.Bedrock:
+      return bedrockHandler(req, { params });
     case ApiPath.Azure:
       return azureHandler(req, { params });
     case ApiPath.Google:
       return googleHandler(req, { params });
     case ApiPath.Anthropic:
       return anthropicHandler(req, { params });
+
     case ApiPath.Baidu:
       return baiduHandler(req, { params });
     case ApiPath.ByteDance:

app/api/auth.ts

@@ -52,7 +52,6 @@ export function auth(req: NextRequest, modelProvider: ModelProvider) {
       msg: "you are not allowed to access with your own api key",
     };
   }
-
   // if user does not provide an api key, inject system api key
   if (!apiKey) {
     const serverConfig = getServerSideConfig();
@@ -101,6 +100,14 @@ export function auth(req: NextRequest, modelProvider: ModelProvider) {
       case ModelProvider.ChatGLM:
         systemApiKey = serverConfig.chatglmApiKey;
         break;
+      case ModelProvider.Bedrock:
+        systemApiKey =
+          serverConfig.awsRegion +
+          ":" +
+          serverConfig.awsAccessKey +
+          ":" +
+          serverConfig.awsSecretKey;
+        break;
       case ModelProvider.GPT:
       default:
         if (req.nextUrl.pathname.includes("azure/deployments")) {

app/api/bedrock.ts

@@ -0,0 +1,177 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "./auth";
+import {
+  sign,
+  decrypt,
+  getBedrockEndpoint,
+  BedrockCredentials,
+} from "../utils/aws";
+import { getServerSideConfig } from "../config/server";
+import { ModelProvider } from "../constant";
+import { prettyObject } from "../utils/format";
+
+const ALLOWED_PATH = new Set(["chat", "models"]);
+
+async function getBedrockCredentials(
+  req: NextRequest,
+): Promise<BedrockCredentials> {
+  // Get AWS credentials from server config first
+  const config = getServerSideConfig();
+  let awsRegion = config.awsRegion;
+  let awsAccessKey = config.awsAccessKey;
+  let awsSecretKey = config.awsSecretKey;
+
+  // If server-side credentials are not available, parse from Authorization header
+  if (!awsRegion || !awsAccessKey || !awsSecretKey) {
+    const authHeader = req.headers.get("Authorization");
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+      throw new Error("Missing or invalid Authorization header");
+    }
+
+    const [_, credentials] = authHeader.split("Bearer ");
+    const [encryptedRegion, encryptedAccessKey, encryptedSecretKey] =
+      credentials.split(":");
+
+    if (!encryptedRegion || !encryptedAccessKey || !encryptedSecretKey) {
+      throw new Error("Invalid Authorization header format");
+    }
+    const encryptionKey = req.headers.get("XEncryptionKey") || "";
+    // Decrypt the credentials
+    [awsRegion, awsAccessKey, awsSecretKey] = await Promise.all([
+      decrypt(encryptedRegion, encryptionKey),
+      decrypt(encryptedAccessKey, encryptionKey),
+      decrypt(encryptedSecretKey, encryptionKey),
+    ]);
+
+    if (!awsRegion || !awsAccessKey || !awsSecretKey) {
+      throw new Error(
+        "Failed to decrypt AWS credentials. Please ensure ENCRYPTION_KEY is set correctly.",
+      );
+    }
+  }
+
+  return {
+    region: awsRegion,
+    accessKeyId: awsAccessKey,
+    secretAccessKey: awsSecretKey,
+  };
+}
+
+async function requestBedrock(req: NextRequest) {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), 10 * 60 * 1000);
+
+  try {
+    // Get credentials and model info
+    const credentials = await getBedrockCredentials(req);
+    const modelId = req.headers.get("XModelID");
+    const shouldStream = req.headers.get("ShouldStream") !== "false";
+
+    if (!modelId) {
+      throw new Error("Missing model ID");
+    }
+
+    // Parse and validate request body
+    const bodyText = await req.clone().text();
+    if (!bodyText) {
+      throw new Error("Request body is empty");
+    }
+    let bodyJson;
+    try {
+      bodyJson = JSON.parse(bodyText);
+    } catch (e) {
+      throw new Error(`Invalid JSON in request body: ${e}`);
+    }
+    console.log("[Bedrock Request] Initiating request");
+    // Get endpoint and prepare request
+    const endpoint = getBedrockEndpoint(
+      credentials.region,
+      modelId,
+      shouldStream,
+    );
+    const requestBody: any = {
+      ...bodyJson,
+    };
+    // Sign request
+    const headers = await sign({
+      method: "POST",
+      url: endpoint,
+      region: credentials.region,
+      accessKeyId: credentials.accessKeyId,
+      secretAccessKey: credentials.secretAccessKey,
+      body: JSON.stringify(requestBody),
+      service: "bedrock",
+      isStreaming: shouldStream,
+    });
+
+    // Make request to AWS Bedrock
+    // console.log(
+    //   "[Bedrock Request] Final Body:",
+    //   JSON.stringify(requestBody, null, 2),
+    // );
+    const res = await fetch(endpoint, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(requestBody),
+      redirect: "manual",
+      // @ts-ignore
+      duplex: "half",
+      signal: controller.signal,
+    });
+
+    if (!res.ok) {
+      const error = await res.text();
+      console.error("[Bedrock Error] Request failed with status:", res.status);
+      try {
+        const errorJson = JSON.parse(error);
+        throw new Error(errorJson.message || error);
+      } catch {
+        throw new Error(
+          `Bedrock request failed with status ${res.status}: ${
+            error || "No error message"
+          }`,
+        );
+      }
+    }
+
+    if (!res.body) {
+      console.error("[Bedrock Error] Empty response body");
+      throw new Error(
+        "Empty response from Bedrock. Please check AWS credentials and permissions.",
+      );
+    }
+    return res;
+  } catch (e) {
+    console.error("[Bedrock Request Error]:", e);
+    throw e;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+
+export async function handle(
+  req: NextRequest,
+  { params }: { params: { path: string[] } },
+) {
+  const subpath = params.path.join("/");
+  if (!ALLOWED_PATH.has(subpath)) {
+    return NextResponse.json(
+      { error: true, msg: "you are not allowed to request " + subpath },
+      { status: 403 },
+    );
+  }
+
+  const authResult = auth(req, ModelProvider.Bedrock);
+  if (authResult.error) {
+    return NextResponse.json(authResult, {
+      status: 401,
+    });
+  }
+
+  try {
+    return await requestBedrock(req);
+  } catch (e) {
+    console.error("Handler error:", e);
+    return NextResponse.json(prettyObject(e));
+  }
+}

app/client/api.ts

@@ -23,6 +23,7 @@ import { SparkApi } from "./platforms/iflytek";
 import { DeepSeekApi } from "./platforms/deepseek";
 import { XAIApi } from "./platforms/xai";
 import { ChatGLMApi } from "./platforms/glm";
+import { BedrockApi } from "./platforms/bedrock";
 
 export const ROLES = ["system", "user", "assistant"] as const;
 export type MessageRole = (typeof ROLES)[number];
@@ -131,6 +132,9 @@ export class ClientApi {
 
   constructor(provider: ModelProvider = ModelProvider.GPT) {
     switch (provider) {
+      case ModelProvider.Bedrock:
+        this.llm = new BedrockApi();
+        break;
       case ModelProvider.GeminiPro:
         this.llm = new GeminiProApi();
         break;
@@ -243,6 +247,7 @@ export function getHeaders(ignoreHeaders: boolean = false) {
 
   function getConfig() {
     const modelConfig = chatStore.currentSession().mask.modelConfig;
+    const isBedrock = modelConfig.providerName === ServiceProvider.Bedrock;
     const isGoogle = modelConfig.providerName === ServiceProvider.Google;
     const isAzure = modelConfig.providerName === ServiceProvider.Azure;
     const isAnthropic = modelConfig.providerName === ServiceProvider.Anthropic;
@@ -279,6 +284,7 @@ export function getHeaders(ignoreHeaders: boolean = false) {
         : ""
       : accessStore.openaiApiKey;
     return {
+      isBedrock,
       isGoogle,
       isAzure,
       isAnthropic,
@@ -306,6 +312,7 @@ export function getHeaders(ignoreHeaders: boolean = false) {
   }
 
   const {
+    isBedrock,
     isGoogle,
     isAzure,
     isAnthropic,
@@ -325,24 +332,32 @@ export function getHeaders(ignoreHeaders: boolean = false) {
 
   const authHeader = getAuthHeader();
 
-  const bearerToken = getBearerToken(
-    apiKey,
-    isAzure || isAnthropic || isGoogle,
-  );
-
-  if (bearerToken) {
-    headers[authHeader] = bearerToken;
-  } else if (isEnabledAccessControl && validString(accessStore.accessCode)) {
-    headers["Authorization"] = getBearerToken(
-      ACCESS_CODE_PREFIX + accessStore.accessCode,
+  if (isBedrock) {
+    if (apiKey) {
+      headers[authHeader] = getBearerToken(apiKey);
+    }
+  } else {
+    const bearerToken = getBearerToken(
+      apiKey,
+      isAzure || isAnthropic || isGoogle,
     );
+
+    if (bearerToken) {
+      headers[authHeader] = bearerToken;
+    } else if (isEnabledAccessControl && validString(accessStore.accessCode)) {
+      headers["Authorization"] = getBearerToken(
+        ACCESS_CODE_PREFIX + accessStore.accessCode,
+      );
+    }
   }
 
   return headers;
 }
 
 export function getClientApi(provider: ServiceProvider): ClientApi {
   switch (provider) {
+    case ServiceProvider.Bedrock:
+      return new ClientApi(ModelProvider.Bedrock);
     case ServiceProvider.Google:
       return new ClientApi(ModelProvider.GeminiPro);
     case ServiceProvider.Anthropic: