The AI gateway for
Supabase Edge Functions.

// supabase/functions/_shared/odnoga.ts
import { createClient } from "jsr:@supabase/supabase-js@2";

const BASE = "https://api.odnoga.com/v1";

// Resolve the caller, or refuse. Your odnoga key is a paid credential: if
// this throws before it is used, an unauthenticated request cannot spend it.
export async function requireUser(req: Request): Promise<string> {
  const jwt = (req.headers.get("authorization") ?? "").split(" ")[1];
  if (!jwt) throw new Response("Unauthorized", { status: 401 });
  const supabase = createClient(
    Deno.env.get("SUPABASE_URL")!,
    Deno.env.get("SUPABASE_ANON_KEY")!,
  );
  // VERIFY the token. A decoded-but-unverified subject can be forged, and
  // the spend would land on someone else's account.
  const { data, error } = await supabase.auth.getUser(jwt);
  if (error || !data.user) throw new Response("Unauthorized", { status: 401 });
  return data.user.id;
}

// One caller per request, bound to the verified Supabase user.
export function odnoga(endUser: string, fn = "edge") {
  return (path: string, body: unknown) =>
    fetch(BASE + path, {
      method: "POST",
      headers: {
        "content-type": "application/json",
        Authorization: `Bearer ${Deno.env.get("ODNOGA_API_KEY")}`,
        "x-odnoga-end-user": endUser,   // whose usage this is
        "x-odnoga-function": fn,        // which of your functions spent it
      },
      body: JSON.stringify(body),
    });
}

import { odnoga, requireUser } from "../_shared/odnoga.ts";

Deno.serve(async (req) => {
  let userId: string;
  try {
    userId = await requireUser(req);
  } catch (refusal) {
    return refusal as Response;   // 401, before the paid key is touched
  }

  const { message } = await req.json();
  const ai = odnoga(userId, "chat");
  const r = await ai("/chat/completions", {
    model: "gpt-5.1",
    messages: [{ role: "user", content: message }],
  });
  // Pass the status through: a 402 (credits used) or 429 must not
  // reach your client as a 200.
  return new Response(r.body, {
    status: r.status,
    headers: { "content-type": "application/json" },
  });
});