Merge pull request #1117 from b4s36t4/fix/azure-plugin-custom-host

Author: VisargD

package-lock.json

@@ -1,3 +1,4 @@
+import { Agent } from 'https';
 import {
   HookEventType,
   PluginContext,
@@ -63,7 +64,7 @@ export const handler: PluginHandler<{
 
   const apiVersion = parameters.apiVersion || '2024-11-01';
 
-  const url = `https://${credentials.resourceName}.cognitiveservices.azure.com/contentsafety/text:analyze?api-version=${apiVersion}`;
+  const url = `${credentials.customHost || `https://${credentials.resourceName}.cognitiveservices.azure.com`}/contentsafety/text:analyze?api-version=${apiVersion}`;
 
   const { token, error: tokenError } = await getAccessToken(
     credentials as any,
@@ -80,6 +81,17 @@ export const handler: PluginHandler<{
     };
   }
 
+  let agent: Agent | null = null;
+  // privatelink doesn't contain a valid certificate, skipping verification if it's customHost.
+  // SECURITY NOTE: The following disables SSL certificate validation for custom hosts.
+  // This is necessary for Azure Private Link endpoints that may use self-signed certificates,
+  // but should only be used with trusted private endpoints.
+  if (credentials.customHost) {
+    agent = new Agent({
+      rejectUnauthorized: false,
+    });
+  }
+
   const headers: Record<string, string> = {
     'Content-Type': 'application/json',
     'User-Agent': 'portkey-ai-plugin/',
@@ -100,7 +112,12 @@ export const handler: PluginHandler<{
   const timeout = parameters.timeout || 5000;
   let response;
   try {
-    response = await post(url, request, { headers }, timeout);
+    response = await post(
+      url,
+      request,
+      { headers, dispatcher: agent },
+      timeout
+    );
   } catch (e) {
     return { error: e, verdict: true, data };
   }

plugins/azure/contentSafety.ts

@@ -123,6 +123,10 @@
         "tenantId": {
           "type": "string",
           "description": "Tenant ID for Azure Entra ID authentication"
+        },
+        "customHost": {
+          "type": "string",
+          "description": "Custom host for Azure AI services (Private Link etc.)"
         }
       },
       "anyOf": [

plugins/azure/manifest.json

@@ -1,3 +1,4 @@
+import { Agent } from 'https';
 import {
   HookEventType,
   PluginContext,
@@ -29,7 +30,7 @@ const redact = async (
 
   const apiVersion = parameters.apiVersion || '2024-11-01';
 
-  const url = `https://${credentials?.resourceName}.cognitiveservices.azure.com/language/:analyze-text?api-version=${apiVersion}`;
+  const url = `${credentials?.customHost || `https://${credentials?.resourceName}.cognitiveservices.azure.com`}/language/:analyze-text?api-version=${apiVersion}`;
 
   const { token, error: tokenError } = await getAccessToken(
     credentials as any,
@@ -53,8 +54,24 @@ const redact = async (
     throw new Error('Unable to get access token');
   }
 
+  let agent: Agent | null = null;
+  // privatelink doesn't contain a valid certificate, skipping verification if it's customHost.
+  // SECURITY NOTE: The following disables SSL certificate validation for custom hosts.
+  // This is necessary for Azure Private Link endpoints that may use self-signed certificates,
+  // but should only be used with trusted private endpoints.
+  if (credentials?.customHost) {
+    agent = new Agent({
+      rejectUnauthorized: false,
+    });
+  }
+
   const timeout = parameters.timeout || 5000;
-  const response = await post(url, body, { headers }, timeout);
+  const response = await post(
+    url,
+    body,
+    { headers, dispatcher: agent },
+    timeout
+  );
   return response;
 };
 

plugins/azure/pii.ts

@@ -5,4 +5,5 @@ export interface AzureCredentials {
   clientId?: string;
   clientSecret?: string;
   tenantId?: string;
+  customHost?: string;
 }

plugins/azure/types.ts

@@ -2,6 +2,7 @@ import { HookEventType, PluginContext } from './types';
 
 interface PostOptions extends RequestInit {
   headers?: Record<string, string>;
+  [key: string]: any;
 }
 
 export interface ErrorResponse {