Proxy from any backend

Authorization: Bearer <organization API key>
x-opengeni-external-actor: <percent-encoded JSON>
  {"mode":"external","identity":{"externalId":"<your user id>","source":"<your app>"}}
x-opengeni-api-contract: <copied from the browser's request>
Content-Type: application/json            (requests with a body)
Last-Event-ID: <copied from the browser>  (SSE only)

# urls.py: path("api/opengeni/<path:rest>", views.opengeni_proxy)
import json, os, re, urllib.parse

import httpx
from django.http import HttpResponse, JsonResponse, StreamingHttpResponse

API = os.environ["OPENGENI_API_BASE_URL"].rstrip("/")
KEY = os.environ["OPENGENI_API_KEY"]
SOURCE = "acme-app"

ROUTES = [  # (method, pattern); {ws} is replaced with the resolved workspace id
    ("GET", r"config/client"),
    ("GET", r"workspaces/{ws}(/model-catalog|/live-events/stream)?"),
    ("POST", r"workspaces/{ws}/(inference-control|files/uploads(/[^/]+/complete)?|files/[^/]+/download-url)"),
    ("GET", r"workspaces/{ws}/sessions"),
    ("POST", r"workspaces/{ws}/sessions"),
    ("GET", r"workspaces/{ws}/sessions/[^/]+(/events(/stream)?|/queue|/composer-draft|/human-input-requests(/[^/]+)?)?"),
    ("PATCH", r"workspaces/{ws}/sessions/[^/]+"),
    ("PUT", r"workspaces/{ws}/sessions/[^/]+/(archive|composer-draft)"),
    ("POST", r"workspaces/{ws}/sessions/[^/]+/(events|steer|control|composer-draft/submit|queue/[^/]+/(move|edit|steer|delete))"),
]

def upstream_headers(request, user_id):
    actor = {"mode": "external", "identity": {"externalId": user_id, "source": SOURCE}}
    headers = {
        "Authorization": f"Bearer {KEY}",
        "x-opengeni-external-actor": urllib.parse.quote(json.dumps(actor), safe=""),
        "Content-Type": "application/json",
    }
    for name in ("x-opengeni-api-contract", "Last-Event-ID"):
        if name in request.headers:
            headers[name] = request.headers[name]
    return headers

def opengeni_proxy(request, rest):
    user = request.user  # your auth; CsrfViewMiddleware covers POST/PUT/PATCH
    if not user.is_authenticated:
        return JsonResponse({"error": {"code": "unauthorized"}}, status=401)
    ws = user.profile.opengeni_workspace_id  # resolved on the server, never from the request
    path = rest.removeprefix("v1/")
    if not any(m == request.method and re.fullmatch(p.replace("{ws}", re.escape(ws)), path)
               for m, p in ROUTES):
        return JsonResponse({"error": {"code": "route_not_allowed"}}, status=404)
    body = request.body if request.method != "GET" else None
    if body and len(body) > 1_048_576:
        return JsonResponse({"error": {"code": "body_too_large"}}, status=413)
    # Apply the body rules from the table here (create fields, message rules,
    # control actions, event types), build the full session request for
    # POST .../sessions, and add the creator filter to the session list.
    headers = upstream_headers(request, str(user.id))
    url = f"{API}/v1/{path}"
    if path.endswith("/stream"):
        client = httpx.Client(timeout=None)
        upstream = client.send(
            client.build_request("GET", url, headers=headers, params=request.GET), stream=True)
        response = StreamingHttpResponse(upstream.iter_raw(), status=upstream.status_code,
                                         content_type="text/event-stream")
        response["Cache-Control"] = "no-store"
        response["X-Accel-Buffering"] = "no"
        return response
    upstream = httpx.request(request.method, url, headers=headers, params=request.GET,
                             content=body, timeout=60)
    if path == "config/client" and upstream.status_code == 200:
        # The browser speaks its own SDK's contract; an OpenGeni deploy must not look stale.
        config = upstream.json()
        config["apiContractRevision"] = request.headers.get(
            "x-opengeni-api-contract", config["apiContractRevision"])
        config["sandboxFiles"] = False  # sandbox-path reads are not proxied
        config.pop("artifacts", None)  # upstream capabilities never cover this proxy
        return JsonResponse(config)
    return HttpResponse(upstream.content, status=upstream.status_code,
                        content_type=upstream.headers.get("content-type", "application/json"))