fix(inference): add _enforce_credentials=False to passthrough AsyncOpenAI client

[NickGagan]

Issue: #6343

What does this PR do?

Fixes a regression in the remote::passthrough inference provider that breaks all requests (model listing, inference, background refresh) on openai >= 2.34.0.

The passthrough provider hardcodes api_key="" when constructing its AsyncOpenAI client so that auth flows entirely through default_headers. This was valid when the project required openai>=2.30.0, but openai 2.34.0 added a constructor-level credentials enforcement check that raises Missing credentials when api_key is empty — before any headers are read or any request is made.

The regression was introduced in v1.1.0 when PR #6047 bumped the openai requirement from >=2.30.0 to >=2.41.0, silently crossing the 2.34.0 boundary where enforcement was introduced.

_enforce_credentials=False bypasses the constructor check without changing any auth behavior. It is available in all openai versions OGX currently requires (>=2.41.0).

The bug was invisible in the test suite because all tests that exercise _get_openai_client() mock AsyncOpenAI entirely, so the real SDK constructor — and its validation — never runs.

Impact without this fix:

• GET /v1/models returns {"object":"list","data":[]} — exception caught silently, logged only at DEBUG
• POST /v1/responses returns HTTP 500
• Background model refresh fails silently — no models ever registered in the KV registry

Verified against quay.io/opendatahub/odh-ogx-core:latest (openai 2.46.0).

Test Plan

Start OGX with a passthrough provider configured against any OpenAI-compatible endpoint:

providers:
  inference:
  - provider_id: anthropic-passthrough
    provider_type: remote::passthrough
    config:
      base_url: https://api.anthropic.com
      api_key: "<ANTHROPIC_API_KEY>"
      refresh_models: true
registered_resources:
  models:
  - provider_id: anthropic-passthrough
    model_id: claude-haiku-4-5-20251001
    provider_model_id: claude-haiku-4-5-20251001
    model_type: llm

Before fix — POST /v1/responses returns 500:

curl -s -X POST http://localhost:8323/v1/responses \
  -H "Content-Type: application/json" \
  -d '{"model":"anthropic-passthrough/claude-haiku-4-5-20251001","input":"Say hello","stream":false}'

Output:

{"detail":"An unexpected error occurred while generating the response."}
HTTP 500

Server log:

WARNING ogx.core.routing_tables.models:104 Model refresh failed
        error=Missing credentials. Please pass an `api_key`, `workload_identity`,
        `admin_api_key`, or set the `OPENAI_API_KEY` or `OPENAI_ADMIN_KEY` environment variable.

After fix — POST /v1/responses returns 200:

curl -s -X POST http://localhost:8323/v1/responses \
  -H "Content-Type: application/json" \
  -d '{"model":"anthropic-passthrough/claude-haiku-4-5-20251001","input":"Say hello","stream":false}'

Output:

{
  "id": "resp_c0b3b7a8-476d-40c6-90bc-ae303378fa16",
  "object": "response",
  "model": "anthropic-passthrough/claude-haiku-4-5-20251001",
  "status": "completed",
  "output": [{"role": "assistant", "content": [{"type": "output_text", "text": "Hello!"}]}],
  "usage": {"input_tokens": 12, "output_tokens": 5, "total_tokens": 17}
}

Additional details:
passthrough-debug.txt

[skamenan7]

Thanks for fixing this @NickGagan . The change looks right, but can we add a regression test using the real AsyncOpenAI constructor? The current tests mock it, so this failure could come back without CI catching it.

[skamenan7]

One comment/nit.

Note for us, looks like we should also backport this to release-1.1.x

[cdoern]

@Mergifyio backport release-1.1.x release-1.2.x

[mergify]

backport release-1.1.x release-1.2.x

✅ Backports have been created

Details

• #6364 fix(inference): add _enforce_credentials=False to passthrough AsyncOpenAI client (backport #6344) has been created for branch release-1.1.x
• #6365 fix(inference): add _enforce_credentials=False to passthrough AsyncOpenAI client (backport #6344) has been created for branch release-1.2.x