rails-ai-gateway 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 67143b76482c8cdcfc4e4badd4801e1d46c9ecc5bc309e2ddd137f14df7a0e67
+  data.tar.gz: 1ac58e22f791aead20feabf049dc8f89250eff16170b860c9f4da690b096af96
+SHA512:
+  metadata.gz: 6cdeafa5eaf720bd486ff259620eb6868aa0829f96b9c461626fbd6bb696227534330672480df8b4496fc8182ec56563bd422a476b6c0b4dabb1cfc4e16ddf7d
+  data.tar.gz: 550e16aece7e78223753f79cdbe2a2f6c3308767b3e259cce7b917687dd32055daadeae9e9df9134ce205741267208339126b3b2c531d6a2809ea22562a172de

data/CHANGELOG.md

@@ -0,0 +1,8 @@
+# Changelog
+
+## 0.1.0 - 2026-09-20
+
+- Add mountable Rails engine with OpenAI-compatible chat, embedding, and model endpoints.
+- Add ActiveRecord providers, model routing, gateway keys, request logs, and admin UI.
+- Add encrypted provider credentials, ordered fallback, bounded responses, SSE streaming, and SSRF protections.
+- Add initializer configuration for authorization, timeouts, limits, attempts, and network policy.

data/CONTRIBUTING.md

@@ -0,0 +1,64 @@
+# Contributing to Rails AI Gateway
+
+Bug reports, fixes, tests, documentation, and focused feature proposals are welcome.
+
+## Report Bugs
+
+Open GitHub issue with:
+
+- Rails, Ruby, database adapter, and gem versions
+- Minimal reproduction steps
+- Expected and actual behavior
+- Relevant exception and backtrace with secrets removed
+- Browser name and version for Web UI bugs
+- Upstream provider and endpoint type without API credentials
+
+Never include provider API keys, gateway keys, database passwords, prompts, responses, or
+other private application data.
+
+Report vulnerabilities privately through
+[GitHub security advisories](https://github.com/azmi2409/rails-ai-gateway/security/advisories/new).
+
+## Development Setup
+
+```bash
+git clone https://github.com/azmi2409/rails-ai-gateway.git
+cd rails-ai-gateway
+bundle install
+bundle exec ruby test/check.rb
+```
+
+Test uses temporary SQLite database and local fake upstream. No provider account or network
+request is required.
+
+To test PostgreSQL, create empty disposable database and pass its URL:
+
+```bash
+createdb rails_ai_gateway_test
+DATABASE_URL=postgresql:///rails_ai_gateway_test bundle exec ruby test/check.rb
+dropdb rails_ai_gateway_test
+```
+
+## Changes
+
+- Keep changes focused and backward compatible after public release.
+- Add or update integration checks for behavior changes.
+- Preserve Ruby 3.3 and Rails 8 compatibility.
+- Support SQLite and PostgreSQL unless change explicitly targets one adapter.
+- Avoid runtime dependencies when Ruby, Rails, or current dependencies cover need.
+- Keep Web UI dependency-free, responsive, keyboard-accessible, and screen-reader friendly.
+- Never weaken gateway-key authentication, credential encryption, request limits, SSRF
+  protections, CSRF protection, or default-deny admin authorization.
+- Never persist prompts, responses, raw gateway keys, or unencrypted provider credentials.
+- Never retry ambiguous upstream failures or a stream after response bytes are sent.
+
+## Pull Requests
+
+1. Create branch from `main`.
+2. Make focused change with test coverage.
+3. Run `bundle exec ruby test/check.rb`.
+4. Run PostgreSQL integration when changing migrations, models, or queries.
+5. Run `gem build rails_ai_gateway.gemspec`.
+6. Open pull request describing problem, solution, security impact, and verification.
+
+By contributing, you agree your contribution is licensed under project MIT license.

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rails AI Gateway contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,151 @@
+# Rails AI Gateway
+
+[![Gem Version](https://badge.fury.io/rb/rails-ai-gateway.svg)](https://rubygems.org/gems/rails-ai-gateway)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+Put one OpenAI-compatible endpoint in front of your AI providers without running another
+service. Rails AI Gateway mounts inside your Rails app, stores configuration and request
+metadata with ActiveRecord, and includes a Web UI for providers, model routes, and keys.
+
+## What You Get
+
+- OpenAI-compatible chat completions, embeddings, and model-list endpoints
+- Streaming chat completions over server-sent events
+- Public model aliases with ordered provider fallbacks
+- Encrypted provider API keys using ActiveRecord encryption
+- Scoped gateway keys stored as SHA-256 digests
+- Request status, latency, attempt, and reported token-usage logs
+- Configurable timeouts, body limits, fallback attempts, and network policy
+- SSRF protection with DNS validation and address pinning
+- Server-rendered, responsive, accessible admin UI
+- SQLite and PostgreSQL support through host Rails database
+- No prompts or responses persisted
+
+## Get Started
+
+Add gem:
+
+```ruby
+gem "rails-ai-gateway"
+```
+
+Set it up:
+
+```bash
+bundle install
+bin/rails generate rails_ai_gateway:install
+bin/rails db:migrate
+```
+
+Generator creates `config/initializers/rails_ai_gateway.rb`, copies migrations, and mounts
+engine at `/ai`. Configure admin authorization, restart Rails, then visit:
+
+<http://localhost:3000/ai/admin>
+
+Host app must configure
+[ActiveRecord encryption](https://guides.rubyonrails.org/active_record_encryption.html).
+Provider API keys cannot be saved without it.
+
+## Configure Gateway
+
+Web UI guides initial setup:
+
+1. Add provider with full API base URL, such as `https://api.openai.com/v1`.
+2. Add public model route, such as `fast-chat` mapped to `gpt-4o-mini`.
+3. Create gateway key and save token when shown. Raw token cannot be displayed again.
+
+Routes with same public model name form fallback chain. Lower priority runs first. Gateway
+retries connection failures before upstream accepts request and HTTP `429`, `500`, `502`,
+`503`, or `504`. Ambiguous timeouts and started streams are never retried.
+
+## Initializer
+
+Runtime and security policy live in `config/initializers/rails_ai_gateway.rb`:
+
+```ruby
+RailsAiGateway.configure do |config|
+  config.admin_controller = "ApplicationController"
+  config.admin_authorization = ->(controller) {
+    controller.current_user&.admin? == true
+  }
+
+  config.open_timeout = 5
+  config.read_timeout = 60
+  config.write_timeout = 30
+  config.request_timeout = 120
+  config.max_request_bytes = 2 * 1024 * 1024
+  config.max_response_bytes = 16 * 1024 * 1024
+  config.max_attempts = 3
+
+  config.allow_private_networks = false
+  config.allow_http = false
+end
+```
+
+Admin requests are denied until `admin_authorization` returns exactly `true`. Provider
+definitions, model routes, gateway keys, and logs stay database-backed and editable through
+Web UI.
+
+Need another mount path? Change host route:
+
+```ruby
+mount RailsAiGateway::Engine, at: "/gateway"
+```
+
+## Make Requests
+
+```bash
+curl http://localhost:3000/ai/v1/chat/completions \
+  -H "Authorization: Bearer rag_REPLACE_ME" \
+  -H "Content-Type: application/json" \
+  -d '{"model":"fast-chat","messages":[{"role":"user","content":"Hello"}]}'
+```
+
+Available endpoints:
+
+- `GET /ai/v1/models`
+- `POST /ai/v1/chat/completions`
+- `POST /ai/v1/embeddings`
+
+OpenAI clients can use `http://localhost:3000/ai/v1` as base URL.
+
+## Development
+
+```bash
+git clone https://github.com/azmi2409/rails-ai-gateway.git
+cd rails-ai-gateway
+bundle install
+bundle exec ruby test/check.rb
+gem build rails_ai_gateway.gemspec
+```
+
+SQLite integration runs by default. Run same suite against PostgreSQL with an empty test
+database:
+
+```bash
+DATABASE_URL=postgresql:///rails_ai_gateway_test bundle exec ruby test/check.rb
+```
+
+Found bug or have focused improvement? Read [CONTRIBUTING.md](CONTRIBUTING.md), then open
+issue or pull request. Release notes live in [CHANGELOG.md](CHANGELOG.md).
+
+## Security
+
+Never expose admin UI without host authentication and authorization. Keep
+`allow_private_networks` and `allow_http` disabled for public providers. Enable both only
+for trusted internal endpoints, such as local Ollama. Never commit provider or database
+credentials.
+
+Report security issues privately through
+[GitHub security advisories](https://github.com/azmi2409/rails-ai-gateway/security/advisories/new),
+not public issues.
+
+## Current Scope
+
+Current release supports OpenAI-compatible chat completions, embeddings, and model-list
+endpoints. Native Anthropic, Gemini, Bedrock, budgets, semantic caching, and multi-tenancy
+are not included.
+
+## License
+
+[MIT](LICENSE).

data/app/assets/stylesheets/rails_ai_gateway/admin.css

@@ -0,0 +1,41 @@
+:root { color-scheme: light; font-family: system-ui, sans-serif; color: #172538; background: #f5f7fa; line-height: 1.5; }
+* { box-sizing: border-box; }
+body { margin: 0; }
+header { background: #14283f; color: #fff; display: flex; justify-content: space-between; gap: 1rem; flex-wrap: wrap; padding: 1.25rem max(1rem, calc((100vw - 1200px) / 2)); }
+header a { color: #fff; text-decoration: none; }
+.brand { font-weight: 750; font-size: 1.15rem; }
+nav { display: flex; flex-wrap: wrap; gap: 1.25rem; }
+main, footer { max-width: 1200px; margin: auto; padding: 1.5rem; }
+h1 { font-size: 2rem; letter-spacing: -.03em; margin-bottom: .4rem; }
+h2 { margin-top: 0; }
+a { color: #175da1; }
+section { margin: 1.5rem 0; padding: 1.5rem; background: #fff; border: 1px solid #d8e0e9; border-radius: .5rem; scroll-margin-top: 1rem; }
+.muted, footer { color: #536477; }
+.stats { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 1rem; }
+.stats div { background: #fff; border: 1px solid #d8e0e9; padding: 1.25rem; border-radius: .5rem; }
+.stats span, .stats strong { display: block; }
+.stats strong { font-size: 2rem; margin-top: .4rem; }
+.grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(min(100%, 230px), 1fr)); gap: 1rem; align-items: end; margin: 1rem 0; }
+label { display: block; font-weight: 600; font-size: .875rem; margin-bottom: .35rem; }
+input, select, textarea, button { font: inherit; }
+input:not([type=checkbox]), select, textarea { width: 100%; padding: .6rem; border: 1px solid #8595a7; border-radius: .25rem; background: #fff; color: inherit; }
+button, input[type=submit] { background: #195a97; color: #fff; border: 1px solid #195a97; border-radius: .25rem; padding: .6rem .85rem; cursor: pointer; font-weight: 600; }
+button.danger { color: #a12828; background: #fff; border-color: #d5aaaa; font-size: .85rem; }
+input:disabled { opacity: .5; cursor: not-allowed; }
+.check { display: flex; align-items: center; gap: .5rem; min-height: 2.8rem; }
+.check label { margin: 0; }
+details { padding: .85rem 0; border-top: 1px solid #e3e8ef; }
+summary { cursor: pointer; font-weight: 600; overflow-wrap: anywhere; }
+.badge { font-weight: 400; color: #536477; font-size: .85rem; margin-left: .5rem; }
+.table-wrap { overflow-x: auto; }
+table { width: 100%; border-collapse: collapse; font-size: .9rem; }
+caption { text-align: left; color: #536477; margin-bottom: .75rem; }
+th, td { text-align: left; padding: .8rem .6rem; border-bottom: 1px solid #e3e8ef; vertical-align: top; }
+th { background: #f5f7fa; white-space: nowrap; }
+td details { border: 0; padding: 0; }
+code, pre, textarea { font-family: ui-monospace, monospace; overflow-wrap: anywhere; }
+pre { max-width: 28rem; white-space: pre-wrap; }
+:focus-visible { outline: 3px solid #b46b00; outline-offset: 3px; }
+.skip { position: absolute; left: -10000px; }
+.skip:focus { left: 1rem; top: .5rem; padding: .5rem; background: #fff; z-index: 1; }
+@media (max-width: 600px) { main, footer { padding: 1rem; } section { padding: 1rem; } }

data/app/controllers/rails_ai_gateway/admin_controller.rb

@@ -0,0 +1,90 @@
+module RailsAiGateway
+  class AdminController < RailsAiGateway.configuration.admin_controller.constantize
+    layout "rails_ai_gateway/admin"
+    protect_from_forgery with: :exception
+    before_action :authorize_admin
+    rescue_from ActiveRecord::RecordInvalid, with: :invalid_record
+    rescue_from ActiveRecord::RecordNotFound, with: -> { head :not_found }
+    rescue_from ActiveRecord::RecordNotUnique, with: -> { render plain: "Name or priority already exists", status: 422 }
+
+    def index
+      @providers = Provider.order(:name)
+      @routes = ModelRoute.includes(:provider).order(:name, :priority)
+      @keys = GatewayKey.order(created_at: :desc)
+      recent = RequestLog.where(created_at: 24.hours.ago..)
+      @requests = recent.count
+      @errors = recent.where(status: 400..599).count
+      @latency = recent.average(:duration_ms)&.round || 0
+      logs = RequestLog.order(id: :desc)
+      logs = logs.where(model: params[:model]) if params[:model].is_a?(String) && params[:model].present?
+      logs = logs.where(status: params[:status].to_i) if params[:status].to_s.match?(/\A[1-5][0-9]{2}\z/)
+      logs = logs.where("id < ?", params[:before].to_i) if params[:before].to_s.match?(/\A[0-9]+\z/)
+      @logs = logs.limit(50)
+    end
+
+    def create_provider
+      Provider.create!(provider_params)
+      redirect_to admin_path, status: :see_other
+    end
+
+    def update_provider
+      attributes = provider_params
+      attributes.delete(:api_key) if attributes[:api_key].blank?
+      attributes[:api_key] = nil if params[:clear_api_key] == "1"
+      Provider.find(params[:id]).update!(attributes)
+      redirect_to admin_path, status: :see_other
+    end
+
+    def create_model_route
+      ModelRoute.create!(route_params)
+      redirect_to admin_path, status: :see_other
+    end
+
+    def update_model_route
+      ModelRoute.find(params[:id]).update!(route_params)
+      redirect_to admin_path, status: :see_other
+    end
+
+    def destroy_model_route
+      ModelRoute.find(params[:id]).destroy!
+      redirect_to admin_path, status: :see_other
+    end
+
+    def create_gateway_key
+      attributes = params.require(:gateway_key).permit(:name, :allowed_models, :expires_at).to_h
+      attributes["allowed_models"] = attributes["allowed_models"].to_s.split(/[,\s]+/).reject(&:empty?).uniq
+      @key, @token = GatewayKey.issue!(**attributes.symbolize_keys)
+      render :key, status: :created
+    end
+
+    def revoke_gateway_key
+      GatewayKey.find(params[:id]).update!(revoked_at: Time.current)
+      redirect_to admin_path, status: :see_other
+    end
+
+    def style
+      send_file Engine.root.join("app/assets/stylesheets/rails_ai_gateway/admin.css"), type: "text/css", disposition: "inline"
+    end
+
+    private
+
+    def authorize_admin
+      response.headers["Cache-Control"] = "no-store"
+      response.headers["Referrer-Policy"] = "no-referrer"
+      head :forbidden unless RailsAiGateway.configuration.admin_authorization.call(self) == true
+    end
+
+    def provider_params
+      params.require(:provider).permit(:name, :base_url, :api_key, :enabled)
+    end
+
+    def route_params
+      params.require(:model_route).permit(:name, :provider_id, :upstream_model, :priority)
+    end
+
+    def invalid_record(exception)
+      @errors = exception.record.errors.full_messages
+      render :errors, status: 422
+    end
+  end
+end

data/app/models/rails_ai_gateway/application_record.rb

@@ -0,0 +1,5 @@
+module RailsAiGateway
+  class ApplicationRecord < ActiveRecord::Base
+    self.abstract_class = true
+  end
+end

data/app/models/rails_ai_gateway/gateway_key.rb

@@ -0,0 +1,35 @@
+require "digest"
+require "securerandom"
+
+module RailsAiGateway
+  class GatewayKey < ApplicationRecord
+    validates :name, presence: true, length: { maximum: 255 }
+    validates :token_digest, :prefix, presence: true
+    validates :token_digest, uniqueness: true
+    validate :valid_allowed_models
+
+    def self.issue!(**attributes)
+      token = "rag_#{SecureRandom.hex(32)}"
+      key = create!(**attributes, token_digest: Digest::SHA256.hexdigest(token), prefix: token.first(12))
+      [key, token]
+    end
+
+    def self.authenticate(token)
+      return unless token.is_a?(String) && token.match?(/\Arag_[0-9a-f]{64}\z/)
+      key = find_by(token_digest: Digest::SHA256.hexdigest(token), revoked_at: nil)
+      key if key && (!key.expires_at || key.expires_at.future?)
+    end
+
+    def allows?(model)
+      allowed_models.empty? || allowed_models.include?(model)
+    end
+
+    private
+
+    def valid_allowed_models
+      unless allowed_models.is_a?(Array) && allowed_models.all? { |name| name.is_a?(String) && name.present? && name.length <= 255 }
+        errors.add(:allowed_models, "must be an array of model names")
+      end
+    end
+  end
+end

data/app/models/rails_ai_gateway/model_route.rb

@@ -0,0 +1,8 @@
+module RailsAiGateway
+  class ModelRoute < ApplicationRecord
+    belongs_to :provider
+    validates :name, :upstream_model, presence: true, length: { maximum: 255 }
+    validates :priority, numericality: { only_integer: true, greater_than_or_equal_to: 0 }, uniqueness: { scope: :name }
+    scope :available, -> { joins(:provider).where(rails_ai_gateway_providers: { enabled: true }) }
+  end
+end

data/app/models/rails_ai_gateway/provider.rb

@@ -0,0 +1,24 @@
+require "uri"
+
+module RailsAiGateway
+  class Provider < ApplicationRecord
+    encrypts :api_key
+    has_many :model_routes, dependent: :restrict_with_error
+    validates :name, presence: true, uniqueness: true, length: { maximum: 255 }
+    validates :base_url, presence: true, length: { maximum: 2048 }
+    validates :api_key, format: { without: /[\r\n]/ }, allow_nil: true
+    validate :valid_base_url
+
+    private
+
+    def valid_base_url
+      uri = URI.parse(base_url.to_s)
+      schemes = RailsAiGateway.configuration.allow_http ? %w[https http] : %w[https]
+      unless schemes.include?(uri.scheme) && uri.host.present? && !uri.userinfo && !uri.query && !uri.fragment
+        errors.add(:base_url, "must be an HTTPS URL without credentials, query, or fragment")
+      end
+    rescue URI::InvalidURIError
+      errors.add(:base_url, "is invalid")
+    end
+  end
+end

data/app/models/rails_ai_gateway/request_log.rb

@@ -0,0 +1,5 @@
+module RailsAiGateway
+  class RequestLog < ApplicationRecord
+    belongs_to :gateway_key, optional: true
+  end
+end

data/app/views/layouts/rails_ai_gateway/admin.html.erb

@@ -0,0 +1,24 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>Rails AI Gateway</title>
+    <%= csrf_meta_tags %>
+    <%= stylesheet_link_tag style_path %>
+  </head>
+  <body>
+    <a class="skip" href="#main">Skip to content</a>
+    <header>
+      <%= link_to "Rails AI Gateway", admin_path, class: "brand" %>
+      <nav aria-label="Gateway sections">
+        <%= link_to "Providers", admin_path(anchor: "providers") %>
+        <%= link_to "Models", admin_path(anchor: "models") %>
+        <%= link_to "Keys", admin_path(anchor: "keys") %>
+        <%= link_to "Logs", admin_path(anchor: "logs") %>
+      </nav>
+    </header>
+    <main id="main"><%= yield %></main>
+    <footer>Rails AI Gateway <%= RailsAiGateway::VERSION %> · Request metadata only. Prompts and responses are not stored.</footer>
+  </body>
+</html>

data/app/views/rails_ai_gateway/admin/errors.html.erb

@@ -0,0 +1,3 @@
+<h1>Could not save changes</h1>
+<ul role="alert"><% @errors.each do |error| %><li><%= error %></li><% end %></ul>
+<%= link_to "Back to gateway", admin_path %>

data/app/views/rails_ai_gateway/admin/index.html.erb

@@ -0,0 +1,110 @@
+<h1>Gateway overview</h1>
+<p class="muted">One endpoint for your models. Configuration and traffic live in your Rails database.</p>
+<div class="stats" aria-label="Last 24 hours">
+  <div><span>Requests · 24 hours</span><strong><%= @requests %></strong></div>
+  <div><span>Errors · 24 hours</span><strong><%= @errors %></strong></div>
+  <div><span>Average latency</span><strong><%= @latency %> ms</strong></div>
+</div>
+
+<section id="providers">
+  <h2>Providers</h2>
+  <p>Use the complete API base URL, including <code>/v1</code> where required. Credentials are encrypted with ActiveRecord encryption.</p>
+  <% @providers.each do |provider| %>
+    <details>
+      <summary><%= provider.name %> <span class="badge"><%= provider.enabled? ? "Enabled" : "Disabled" %></span></summary>
+      <%= form_with scope: :provider, url: provider_path(provider), method: :patch, local: true, class: "grid", namespace: "provider_#{provider.id}" do |form| %>
+        <div><%= form.label :name %><%= form.text_field :name, value: provider.name, required: true %></div>
+        <div><%= form.label :base_url, "API base URL" %><%= form.url_field :base_url, value: provider.base_url, required: true %></div>
+        <div><%= form.label :api_key, "Replace API key (blank keeps existing)" %><%= form.password_field :api_key, autocomplete: "new-password" %></div>
+        <div class="check"><%= form.check_box :enabled, checked: provider.enabled? %><%= form.label :enabled %></div>
+        <div class="check"><%= check_box_tag :clear_api_key, "1", false, id: "clear_key_#{provider.id}" %><%= label_tag "clear_key_#{provider.id}", "Remove stored API key" %></div>
+        <%= form.submit "Save provider" %>
+      <% end %>
+    </details>
+  <% end %>
+  <details <%= "open" if @providers.empty? %>>
+    <summary>Add provider</summary>
+    <%= form_with scope: :provider, url: providers_path, local: true, class: "grid", namespace: "new_provider" do |form| %>
+      <div><%= form.label :name %><%= form.text_field :name, required: true, placeholder: "OpenAI" %></div>
+      <div><%= form.label :base_url, "API base URL" %><%= form.url_field :base_url, required: true, placeholder: "https://api.openai.com/v1" %></div>
+      <div><%= form.label :api_key, "API key (optional for local providers)" %><%= form.password_field :api_key, autocomplete: "new-password" %></div>
+      <%= form.submit "Add provider" %>
+    <% end %>
+  </details>
+</section>
+
+<section id="models">
+  <h2>Model routing</h2>
+  <p>Clients use the public model name. Lower priority runs first; matching names form an ordered fallback chain.</p>
+  <% @routes.each do |route| %>
+    <details>
+      <summary><%= route.name %> <span class="badge"><%= route.provider.name %> · priority <%= route.priority %></span></summary>
+      <%= form_with scope: :model_route, url: model_route_path(route), method: :patch, local: true, class: "grid", namespace: "route_#{route.id}" do |form| %>
+        <div><%= form.label :name, "Public model name" %><%= form.text_field :name, value: route.name, required: true %></div>
+        <div><%= form.label :provider_id %><%= form.collection_select :provider_id, @providers, :id, :name, selected: route.provider_id %></div>
+        <div><%= form.label :upstream_model %><%= form.text_field :upstream_model, value: route.upstream_model, required: true %></div>
+        <div><%= form.label :priority %><%= form.number_field :priority, value: route.priority, min: 0, required: true %></div>
+        <%= form.submit "Save route" %>
+      <% end %>
+      <%= button_to "Delete route", model_route_path(route), method: :delete, class: "danger" %>
+    </details>
+  <% end %>
+  <details>
+    <summary>Add model route</summary>
+    <%= form_with scope: :model_route, url: model_routes_path, local: true, class: "grid", namespace: "new_route" do |form| %>
+      <div><%= form.label :name, "Public model name" %><%= form.text_field :name, required: true, placeholder: "fast-chat" %></div>
+      <div><%= form.label :provider_id %><%= form.collection_select :provider_id, @providers, :id, :name %></div>
+      <div><%= form.label :upstream_model %><%= form.text_field :upstream_model, required: true, placeholder: "gpt-4o-mini" %></div>
+      <div><%= form.label :priority %><%= form.number_field :priority, value: 0, min: 0, required: true %></div>
+      <%= form.submit "Add route", disabled: @providers.empty? %>
+    <% end %>
+  </details>
+</section>
+
+<section id="keys">
+  <h2>Gateway keys</h2>
+  <div class="table-wrap">
+    <table>
+      <caption>Client access keys</caption>
+      <thead><tr><th scope="col">Name</th><th scope="col">Prefix</th><th scope="col">Models</th><th scope="col">Expires</th><th scope="col">Status</th><th scope="col">Action</th></tr></thead>
+      <tbody>
+        <% @keys.each do |key| %>
+          <tr><td><%= key.name %></td><td><code><%= key.prefix %>…</code></td><td><%= key.allowed_models.empty? ? "All models" : key.allowed_models.join(", ") %></td><td><%= key.expires_at || "Never" %></td><td><%= key.revoked_at ? "Revoked" : key.expires_at&.past? ? "Expired" : "Active" %></td><td><%= button_to "Revoke #{key.name}", gateway_key_path(key), method: :delete, class: "danger" unless key.revoked_at %></td></tr>
+        <% end %>
+      </tbody>
+    </table>
+  </div>
+  <details>
+    <summary>Create gateway key</summary>
+    <%= form_with scope: :gateway_key, url: gateway_keys_path, local: true, class: "grid" do |form| %>
+      <div><%= form.label :name %><%= form.text_field :name, required: true, placeholder: "Production app" %></div>
+      <div><%= form.label :allowed_models, "Allowed models (comma separated; blank allows all)" %><%= form.text_field :allowed_models, placeholder: "fast-chat, embeddings" %></div>
+      <div><%= form.label :expires_at, "Expires at (#{Time.zone.name})" %><%= form.datetime_local_field :expires_at %></div>
+      <%= form.submit "Create key" %>
+    <% end %>
+  </details>
+</section>
+
+<section id="logs">
+  <h2>Request logs</h2>
+  <%= form_with url: admin_path(anchor: "logs"), method: :get, local: true, class: "grid" do |form| %>
+    <div><%= form.label :model, "Model filter" %><%= form.text_field :model, value: params[:model] %></div>
+    <div><%= form.label :status, "HTTP status filter" %><%= form.number_field :status, value: params[:status], min: 100, max: 599 %></div>
+    <%= form.submit "Filter logs" %>
+  <% end %>
+  <div class="table-wrap">
+    <table>
+      <caption>Latest 50 matching requests</caption>
+      <thead><tr><th scope="col">Time</th><th scope="col">Model</th><th scope="col">Status</th><th scope="col">Latency</th><th scope="col">Reported tokens</th><th scope="col">Details</th></tr></thead>
+      <tbody>
+        <% @logs.each do |log| %>
+          <tr><td><%= log.created_at.strftime("%Y-%m-%d %H:%M:%S %Z") %></td><td><%= log.model %></td><td><%= log.status || "Pending" %></td><td><%= log.duration_ms %> ms</td><td><%= log.usage&.fetch("total_tokens", nil) || "Not reported" %></td><td><details><summary>Attempts and request ID</summary><code><%= log.request_id %></code><pre><%= JSON.pretty_generate(log.attempts) %></pre></details></td></tr>
+        <% end %>
+      </tbody>
+    </table>
+  </div>
+  <p class="muted">Streaming usage is not collected. Failed or interrupted streams are never retried.</p>
+  <% if @logs.size == 50 %>
+    <%= link_to "Older requests", admin_path(before: @logs.last.id, model: params[:model], status: params[:status], anchor: "logs") %>
+  <% end %>
+</section>

data/app/views/rails_ai_gateway/admin/key.html.erb

@@ -0,0 +1,5 @@
+<h1>Gateway key created</h1>
+<p>Copy this token now. Only its digest is stored; it cannot be displayed again.</p>
+<label for="new-token"><%= @key.name %></label>
+<textarea id="new-token" readonly rows="3" autocomplete="off" spellcheck="false"><%= @token %></textarea>
+<p><%= link_to "Back to gateway", admin_path %></p>

data/config/routes.rb

@@ -0,0 +1,16 @@
+RailsAiGateway::Engine.routes.draw do
+  get "v1/models", to: RailsAiGateway::Proxy.new("models")
+  post "v1/chat/completions", to: RailsAiGateway::Proxy.new("chat/completions")
+  post "v1/embeddings", to: RailsAiGateway::Proxy.new("embeddings")
+
+  root to: redirect("admin")
+  get "admin", to: "admin#index", as: :admin
+  post "admin/providers", to: "admin#create_provider", as: :providers
+  patch "admin/providers/:id", to: "admin#update_provider", as: :provider
+  post "admin/model_routes", to: "admin#create_model_route", as: :model_routes
+  patch "admin/model_routes/:id", to: "admin#update_model_route", as: :model_route
+  delete "admin/model_routes/:id", to: "admin#destroy_model_route"
+  post "admin/gateway_keys", to: "admin#create_gateway_key", as: :gateway_keys
+  delete "admin/gateway_keys/:id", to: "admin#revoke_gateway_key", as: :gateway_key
+  get "admin/style", to: "admin#style", as: :style
+end

data/db/migrate/20260920000000_create_rails_ai_gateway.rb

@@ -0,0 +1,48 @@
+class CreateRailsAiGateway < ActiveRecord::Migration[8.0]
+  def change
+    create_table :rails_ai_gateway_providers do |t|
+      t.string :name, null: false
+      t.string :base_url, null: false
+      t.text :api_key
+      t.boolean :enabled, default: true, null: false
+      t.timestamps
+    end
+    add_index :rails_ai_gateway_providers, :name, unique: true
+
+    create_table :rails_ai_gateway_model_routes do |t|
+      t.references :provider, null: false, foreign_key: { to_table: :rails_ai_gateway_providers }
+      t.string :name, null: false
+      t.string :upstream_model, null: false
+      t.integer :priority, null: false, default: 0
+      t.timestamps
+    end
+    add_index :rails_ai_gateway_model_routes, [:name, :priority], unique: true
+    add_check_constraint :rails_ai_gateway_model_routes, "priority >= 0", name: "gateway_route_priority"
+
+    create_table :rails_ai_gateway_gateway_keys do |t|
+      t.string :name, null: false
+      t.string :token_digest, null: false
+      t.string :prefix, null: false
+      t.json :allowed_models, null: false, default: []
+      t.datetime :expires_at
+      t.datetime :revoked_at
+      t.timestamps
+    end
+    add_index :rails_ai_gateway_gateway_keys, :token_digest, unique: true
+
+    create_table :rails_ai_gateway_request_logs do |t|
+      t.string :request_id, null: false
+      t.references :gateway_key, foreign_key: { to_table: :rails_ai_gateway_gateway_keys }
+      t.string :model, null: false
+      t.string :endpoint, null: false
+      t.integer :status
+      t.integer :duration_ms
+      t.json :attempts, null: false, default: []
+      t.json :usage
+      t.timestamps
+    end
+    add_index :rails_ai_gateway_request_logs, :request_id, unique: true
+    add_index :rails_ai_gateway_request_logs, :created_at
+    add_index :rails_ai_gateway_request_logs, [:model, :created_at]
+  end
+end

data/lib/generators/rails_ai_gateway/install_generator.rb

@@ -0,0 +1,15 @@
+require "rails/generators"
+
+module RailsAiGateway
+  class InstallGenerator < Rails::Generators::Base
+    source_root File.expand_path("templates", __dir__)
+    desc "Install Rails AI Gateway configuration, migrations, and mount route"
+
+    def install
+      template "initializer.rb", "config/initializers/rails_ai_gateway.rb"
+      rake "rails_ai_gateway:install:migrations"
+      route 'mount RailsAiGateway::Engine, at: "/ai"'
+      say "Configure admin_authorization and ActiveRecord encryption, then run bin/rails db:migrate."
+    end
+  end
+end

data/lib/generators/rails_ai_gateway/templates/initializer.rb

@@ -0,0 +1,17 @@
+RailsAiGateway.configure do |config|
+  # Deny by default. With Devise, for example:
+  # config.admin_controller = "ApplicationController"
+  # config.admin_authorization = ->(controller) { controller.current_user&.admin? == true }
+
+  config.open_timeout = 5
+  config.read_timeout = 60
+  config.write_timeout = 30
+  config.request_timeout = 120 # Total deadline across fallback attempts, including streams.
+  config.max_request_bytes = 2 * 1024 * 1024
+  config.max_response_bytes = 16 * 1024 * 1024 # Buffered, non-streaming responses.
+  config.max_attempts = 3
+
+  # Enable only for trusted internal providers, such as a local Ollama server.
+  config.allow_private_networks = false
+  config.allow_http = false
+end

data/lib/rails_ai_gateway/configuration.rb

@@ -0,0 +1,37 @@
+module RailsAiGateway
+  class Configuration
+    attr_accessor :admin_authorization, :admin_controller, :open_timeout, :read_timeout,
+      :write_timeout, :request_timeout, :max_request_bytes, :max_response_bytes,
+      :max_attempts, :allow_private_networks, :allow_http
+
+    def initialize
+      @admin_controller = "ActionController::Base"
+      @admin_authorization = ->(_controller) { false }
+      @open_timeout = 5
+      @read_timeout = 60
+      @write_timeout = 30
+      @request_timeout = 120
+      @max_request_bytes = 2 * 1024 * 1024
+      @max_response_bytes = 16 * 1024 * 1024
+      @max_attempts = 3
+      @allow_private_networks = false
+      @allow_http = false
+    end
+
+    def validate!
+      %i[open_timeout read_timeout write_timeout request_timeout].each do |name|
+        value = public_send(name)
+        raise ArgumentError, "#{name} must be positive and finite" unless value.is_a?(Numeric) && value.finite? && value.positive?
+      end
+      %i[max_request_bytes max_response_bytes max_attempts].each do |name|
+        value = public_send(name)
+        raise ArgumentError, "#{name} must be a positive integer" unless value.is_a?(Integer) && value.positive?
+      end
+      %i[allow_private_networks allow_http].each do |name|
+        raise ArgumentError, "#{name} must be boolean" unless [true, false].include?(public_send(name))
+      end
+      raise ArgumentError, "admin_authorization must be callable" unless admin_authorization.respond_to?(:call)
+      raise ArgumentError, "admin_controller must be a class name" unless admin_controller.is_a?(String) && !admin_controller.empty?
+    end
+  end
+end

data/lib/rails_ai_gateway/engine.rb

@@ -0,0 +1,16 @@
+require "rails"
+require "active_record/railtie"
+require "action_controller/railtie"
+require "rails_ai_gateway/proxy"
+
+module RailsAiGateway
+  class Engine < ::Rails::Engine
+    isolate_namespace RailsAiGateway
+
+    initializer "rails_ai_gateway.filter_parameters" do |app|
+      app.config.filter_parameters += %i[api_key token token_digest authorization]
+    end
+
+    config.after_initialize { RailsAiGateway.configuration.validate! }
+  end
+end

data/lib/rails_ai_gateway/proxy.rb

@@ -0,0 +1,246 @@
+require "net/http"
+require "json"
+require "ipaddr"
+require "socket"
+require "timeout"
+require "securerandom"
+
+module RailsAiGateway
+  class Proxy
+    class Failure < StandardError
+      attr_reader :status
+
+      def initialize(message, status = 502)
+        @status = status
+        super(message)
+      end
+    end
+
+    # Bounded queue applies backpressure. Rack closes the body on disconnect.
+    class Stream
+      def initialize(queue, thread)
+        @queue, @thread = queue, thread
+      end
+
+      def each
+        loop do
+          chunk = @queue.pop
+          break if chunk.nil?
+          yield chunk
+        end
+      ensure
+        close
+      end
+
+      def close
+        @thread.kill if @thread.alive?
+        @thread.join
+      end
+    end
+
+    RETRY_STATUSES = [429, 500, 502, 503, 504].freeze
+    PRIVATE_RANGES = %w[0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16
+      172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.168.0.0/16 198.18.0.0/15
+      198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4 ::/128 ::1/128
+      fc00::/7 fe80::/10 ff00::/8 2001:db8::/32].map { |range| IPAddr.new(range) }.freeze
+
+    def initialize(endpoint)
+      @endpoint = endpoint
+    end
+
+    def call(env)
+      request = Rack::Request.new(env)
+      token = request.get_header("HTTP_AUTHORIZATION").to_s[/\ABearer (\S+)\z/i, 1]
+      key = GatewayKey.authenticate(token)
+      return error("Invalid or expired gateway key", 401) unless key
+
+      if @endpoint == "models"
+        names = ModelRoute.available.distinct.pluck(:name).select { |name| key.allows?(name) }.sort
+        return json(200, object: "list", data: names.map { |name| { id: name, object: "model", created: 0, owned_by: "rails_ai_gateway" } })
+      end
+
+      payload = parse_request(request)
+      return error("Model is not allowed", 403) unless key.allows?(payload["model"])
+      routes = ModelRoute.available.where(name: payload["model"]).includes(:provider).order(:priority).limit(config.max_attempts).to_a
+      return error("No route for requested model", 404) if routes.empty?
+
+      log = RequestLog.create!(request_id: SecureRandom.uuid, gateway_key: key, model: payload["model"], endpoint: @endpoint)
+      if payload["stream"]
+        stream_response(routes, payload, log.id, log.request_id)
+      else
+        perform(routes, payload, log.id, log.request_id)
+      end
+    rescue JSON::ParserError
+      error("Invalid JSON", 400)
+    rescue Failure => exception
+      error(exception.message, exception.status)
+    end
+
+    private
+
+    def config
+      RailsAiGateway.configuration
+    end
+
+    def parse_request(request)
+      raise Failure.new("Content-Type must be application/json", 415) unless request.media_type == "application/json"
+      raise Failure.new("Request body too large", 413) if request.content_length.to_i > config.max_request_bytes
+      raw = request.body.read(config.max_request_bytes + 1)
+      raise Failure.new("Request body too large", 413) if raw.bytesize > config.max_request_bytes
+      payload = JSON.parse(raw)
+      unless payload.is_a?(Hash) && payload["model"].is_a?(String) && payload["model"].present? && payload["model"].length <= 255
+        raise Failure.new("A model name is required", 400)
+      end
+      if payload.key?("stream") && ![true, false].include?(payload["stream"])
+        raise Failure.new("stream must be boolean", 400)
+      end
+      if @endpoint == "chat/completions"
+        messages = payload["messages"]
+        unless messages.is_a?(Array) && messages.any? && messages.all? { |message| message.is_a?(Hash) && %w[developer system user assistant tool function].include?(message["role"]) }
+          raise Failure.new("messages must be a nonempty array with valid roles", 400)
+        end
+      else
+        input = payload["input"]
+        valid = input.is_a?(String) && !input.empty? || input.is_a?(Array) && !input.empty? && (
+          input.all? { |item| item.is_a?(String) && !item.empty? } ||
+          input.all? { |item| item.is_a?(Integer) && item >= 0 } ||
+          input.all? { |item| item.is_a?(Array) && item.any? && item.all? { |id| id.is_a?(Integer) && id >= 0 } })
+        raise Failure.new("input must contain text or token IDs; embeddings cannot stream", 400) unless valid && !payload["stream"]
+      end
+      payload
+    end
+
+    def stream_response(routes, payload, log_id, request_id)
+      ready, chunks = Queue.new, SizedQueue.new(4)
+      thread = Thread.new do
+        Thread.current.report_on_exception = false
+        Rails.application.executor.wrap do
+          sent_headers = false
+          begin
+            result = perform(routes, payload, log_id, request_id) do |headers, response|
+              sent_headers = true
+              ready << [response.code.to_i, headers]
+              response.read_body { |chunk| chunks << chunk }
+            end
+            ready << result unless sent_headers
+          rescue StandardError
+            ready << error("Gateway failed", 500) unless sent_headers
+          ensure
+            chunks.close
+          end
+        end
+      end
+      result = ready.pop
+      if result.length == 2
+        [*result, Stream.new(chunks, thread)]
+      else
+        thread.join
+        result
+      end
+    rescue Exception
+      thread&.kill
+      thread&.join
+      raise
+    end
+
+    def perform(routes, payload, log_id, request_id)
+      started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      attempts, usage, status, streaming = [], nil, 502, false
+      Timeout.timeout(config.request_timeout, Failure, "Upstream deadline exceeded") do
+        routes.each_with_index do |route, index|
+          attempt = { provider_id: route.provider_id, upstream_model: route.upstream_model }
+          attempts << attempt
+          begin
+            uri, address = destination(route.provider)
+            http = Net::HTTP.new(uri.hostname, uri.port, nil) # Do not inherit HTTP_PROXY or leak credentials to it.
+            http.ipaddr = address # Pin validated DNS result, preserving hostname for TLS verification.
+            http.use_ssl = uri.scheme == "https"
+            http.open_timeout, http.read_timeout, http.write_timeout = config.open_timeout, config.read_timeout, config.write_timeout
+            http.max_retries = 0
+            request = Net::HTTP::Post.new(uri.request_uri)
+            request["Content-Type"] = "application/json"
+            request["Accept"] = payload["stream"] ? "text/event-stream" : "application/json"
+            request["Accept-Encoding"] = "identity"
+            request["Authorization"] = "Bearer #{route.provider.api_key}" if route.provider.api_key.present?
+            request.body = JSON.generate(payload.merge("model" => route.upstream_model))
+            result = nil
+            http.start do
+              http.request(request) do |response|
+                status = attempt[:status] = response.code.to_i
+                raise Failure, "Upstream redirects are not supported" if (300..399).cover?(status)
+                headers = { "content-type" => "application/json", "cache-control" => "no-store", "x-request-id" => request_id }
+                if payload["stream"] && (200..299).cover?(status)
+                  raise Failure, "Upstream did not return an event stream" unless response["content-type"].to_s.split(";").first == "text/event-stream"
+                  headers.merge!("content-type" => "text/event-stream", "x-accel-buffering" => "no")
+                  streaming = true
+                  yield headers, response
+                  result = [status, headers, []]
+                else
+                  body = +""
+                  response.read_body do |chunk|
+                    raise Failure, "Upstream response too large" if body.bytesize + chunk.bytesize > config.max_response_bytes
+                    body << chunk
+                  end
+                  unless RETRY_STATUSES.include?(status) && index < routes.length - 1
+                    begin
+                      parsed = JSON.parse(body)
+                    rescue JSON::ParserError
+                      raise Failure, "Upstream did not return JSON"
+                    end
+                    raise Failure, "Upstream did not return a JSON object" unless parsed.is_a?(Hash)
+                    usage = parsed["usage"].slice("prompt_tokens", "completion_tokens", "total_tokens").select { |_, value| value.is_a?(Integer) && value >= 0 } if parsed["usage"].is_a?(Hash)
+                    result = [status, headers, [body]]
+                  end
+                end
+              end
+            end
+            return result if result
+          rescue Net::OpenTimeout, Errno::ECONNREFUSED, Errno::EHOSTUNREACH, SocketError => exception
+            attempt[:error] = exception.class.name
+            raise Failure, "Upstream connection failed" if streaming || index == routes.length - 1
+          end
+        end
+      end
+    rescue Failure, Timeout::Error, IOError, SystemCallError, OpenSSL::SSL::SSLError, Net::HTTPBadResponse => exception
+      status = exception.is_a?(Timeout::Error) || exception.message == "Upstream deadline exceeded" ? 504 : 502
+      attempts.last[:error] = exception.class.name if attempts.last
+      # Never replay an ambiguous failure or append a second provider to a partial stream.
+      error(exception.is_a?(Failure) ? exception.message : "Upstream request failed", status, request_id)
+    ensure
+      duration = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round
+      begin
+        RequestLog.connection_pool.with_connection do
+          RequestLog.find(log_id).update!(status: status, duration_ms: duration, attempts: attempts, usage: usage)
+        end
+      rescue StandardError => exception
+        Rails.logger.error("RailsAiGateway request log write failed: #{exception.class}")
+      end
+    end
+
+    def destination(provider)
+      raise Failure, "Invalid provider URL" unless provider.valid?
+      uri = URI.parse("#{provider.base_url.delete_suffix('/')}/#{@endpoint}")
+      addresses = Addrinfo.getaddrinfo(uri.hostname, uri.port, nil, :STREAM).map(&:ip_address).uniq
+      raise Failure, "Provider address unavailable" if addresses.empty?
+      unless config.allow_private_networks
+        addresses.each do |address|
+          ip = IPAddr.new(address)
+          ip = ip.native if ip.ipv4_mapped?
+          raise Failure, "Private provider networks are disabled" if PRIVATE_RANGES.any? { |range| range.include?(ip) } || ip.ipv6? && !IPAddr.new("2000::/3").include?(ip)
+        end
+      end
+      [uri, addresses.first]
+    end
+
+    def error(message, status, request_id = nil)
+      response = json(status, error: { message: message, type: "gateway_error", code: status })
+      response[1]["www-authenticate"] = "Bearer" if status == 401
+      response[1]["x-request-id"] = request_id if request_id
+      response
+    end
+
+    def json(status, payload)
+      [status, { "content-type" => "application/json", "cache-control" => "no-store" }, [JSON.generate(payload)]]
+    end
+  end
+end

data/lib/rails_ai_gateway/version.rb

@@ -0,0 +1,3 @@
+module RailsAiGateway
+  VERSION = "0.1.0"
+end

data/lib/rails_ai_gateway.rb

@@ -0,0 +1,15 @@
+require "rails_ai_gateway/version"
+require "rails_ai_gateway/configuration"
+
+module RailsAiGateway
+  def self.configuration
+    @configuration ||= Configuration.new
+  end
+
+  def self.configure
+    yield configuration
+    configuration.validate!
+  end
+end
+
+require "rails_ai_gateway/engine"

metadata

@@ -0,0 +1,167 @@
+--- !ruby/object:Gem::Specification
+name: rails-ai-gateway
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Rails AI Gateway contributors
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: railties
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+- !ruby/object:Gem::Dependency
+  name: activerecord
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+- !ruby/object:Gem::Dependency
+  name: actionpack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '8.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+- !ruby/object:Gem::Dependency
+  name: net-http
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.4'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.4'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1'
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.7'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.7'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+description: OpenAI-compatible AI gateway mounted inside Rails, with ActiveRecord
+  routing, encrypted provider keys, request logs, fallbacks, streaming, and an admin
+  UI.
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- CONTRIBUTING.md
+- LICENSE
+- README.md
+- app/assets/stylesheets/rails_ai_gateway/admin.css
+- app/controllers/rails_ai_gateway/admin_controller.rb
+- app/models/rails_ai_gateway/application_record.rb
+- app/models/rails_ai_gateway/gateway_key.rb
+- app/models/rails_ai_gateway/model_route.rb
+- app/models/rails_ai_gateway/provider.rb
+- app/models/rails_ai_gateway/request_log.rb
+- app/views/layouts/rails_ai_gateway/admin.html.erb
+- app/views/rails_ai_gateway/admin/errors.html.erb
+- app/views/rails_ai_gateway/admin/index.html.erb
+- app/views/rails_ai_gateway/admin/key.html.erb
+- config/routes.rb
+- db/migrate/20260920000000_create_rails_ai_gateway.rb
+- lib/generators/rails_ai_gateway/install_generator.rb
+- lib/generators/rails_ai_gateway/templates/initializer.rb
+- lib/rails_ai_gateway.rb
+- lib/rails_ai_gateway/configuration.rb
+- lib/rails_ai_gateway/engine.rb
+- lib/rails_ai_gateway/proxy.rb
+- lib/rails_ai_gateway/version.rb
+homepage: https://github.com/azmi2409/rails-ai-gateway
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://github.com/azmi2409/rails-ai-gateway
+  changelog_uri: https://github.com/azmi2409/rails-ai-gateway/blob/main/CHANGELOG.md
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.3'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.4
+specification_version: 4
+summary: Mountable Rails AI gateway with ActiveRecord and an admin UI
+test_files: []