fix(api): skip CSRF for Bearer-authenticated requests

apps/web/src/app/(authenticated)/settings/providers/page.tsx

@@ -85,14 +85,6 @@ const INITIAL_FORM: ProviderFormState = {
   isActive: true,
 };
 
-function mapProviderTypeToApi(type: string): "ollama" | "openai" | "claude" {
-  if (type === "ollama" || type === "claude") {
-    return type;
-  }
-
-  return "openai";
-}
-
 function getErrorMessage(error: unknown, fallback: string): string {
   if (error instanceof Error && error.message.trim().length > 0) {
     return error.message;
@@ -101,6 +93,18 @@ function getErrorMessage(error: unknown, fallback: string): string {
   return fallback;
 }
 
+function buildProviderName(displayName: string, type: string): string {
+  const slug = displayName
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+/, "")
+    .replace(/-+$/, "");
+
+  const candidate = `${type}-${slug.length > 0 ? slug : "provider"}`;
+  return candidate.slice(0, 100);
+}
+
 function normalizeProviderModels(models: unknown): FleetProviderModel[] {
   if (!Array.isArray(models)) {
     return [];
@@ -149,11 +153,11 @@ function modelsToEditorText(models: unknown): string {
     .join("\n");
 }
 
-function parseModelsText(value: string): string[] {
+function parseModelsText(value: string): FleetProviderModel[] {
   const seen = new Set<string>();
 
   return value
-    .split(/\r?\n/g)
+    .split(/\n|,/g)
     .map((segment) => segment.trim())
     .filter((segment) => segment.length > 0)
     .filter((segment) => {
@@ -162,7 +166,8 @@ function parseModelsText(value: string): string[] {
       }
       seen.add(segment);
       return true;
-    });
+    })
+    .map((id) => ({ id, name: id }));
 }
 
 function maskApiKey(value: string): string {
@@ -274,7 +279,6 @@ export default function ProvidersSettingsPage(): ReactElement {
     }
 
     const models = parseModelsText(form.modelsText);
-    const providerModels = models.map((id) => ({ id, name: id }));
     const baseUrl = form.baseUrl.trim();
     const apiKey = form.apiKey.trim();
 
@@ -285,7 +289,7 @@ export default function ProvidersSettingsPage(): ReactElement {
         const updatePayload: UpdateFleetProviderRequest = {
           displayName,
           isActive: form.isActive,
-          models: providerModels,
+          models,
         };
 
         if (baseUrl.length > 0) {
@@ -299,27 +303,21 @@ export default function ProvidersSettingsPage(): ReactElement {
         await updateFleetProvider(editingProvider.id, updatePayload);
         setSuccessMessage(`Updated provider "${displayName}".`);
       } else {
-        const config: CreateFleetProviderRequest["config"] = {};
+        const createPayload: CreateFleetProviderRequest = {
+          name: buildProviderName(displayName, form.type),
+          displayName,
+          type: form.type,
+          models,
+        };
 
         if (baseUrl.length > 0) {
-          config.endpoint = baseUrl;
+          createPayload.baseUrl = baseUrl;
         }
 
         if (apiKey.length > 0) {
-          config.apiKey = apiKey;
+          createPayload.apiKey = apiKey;
         }
 
-        if (models.length > 0) {
-          config.models = models;
-        }
-
-        const createPayload: CreateFleetProviderRequest = {
-          displayName,
-          providerType: mapProviderTypeToApi(form.type),
-          config,
-          isEnabled: form.isActive,
-        };
-
         await createFleetProvider(createPayload);
         setSuccessMessage(`Added provider "${displayName}".`);
       }

apps/web/src/lib/api/fleet-settings.test.ts

@@ -34,25 +34,17 @@ describe("createFleetProvider", (): void => {
     vi.mocked(client.apiPost).mockResolvedValueOnce({ id: "provider-1" } as never);
 
     await createFleetProvider({
-      providerType: "openai",
+      name: "openai-main",
       displayName: "OpenAI Main",
-      config: {
-        endpoint: "https://api.openai.com/v1",
-        apiKey: "sk-test",
-        models: ["gpt-4.1-mini", "gpt-4o-mini"],
-      },
-      isEnabled: true,
+      type: "openai",
+      apiKey: "sk-test",
     });
 
     expect(client.apiPost).toHaveBeenCalledWith("/api/fleet-settings/providers", {
-      providerType: "openai",
+      name: "openai-main",
       displayName: "OpenAI Main",
-      config: {
-        endpoint: "https://api.openai.com/v1",
-        apiKey: "sk-test",
-        models: ["gpt-4.1-mini", "gpt-4o-mini"],
-      },
-      isEnabled: true,
+      type: "openai",
+      apiKey: "sk-test",
     });
   });
 });

apps/web/src/lib/api/fleet-settings.ts

@@ -16,16 +16,13 @@ export interface FleetProvider {
 }
 
 export interface CreateFleetProviderRequest {
-  providerType: "ollama" | "openai" | "claude";
+  name: string;
   displayName: string;
-  config: {
-    endpoint?: string;
-    apiKey?: string;
-    models?: string[];
-    timeout?: number;
-  };
-  isDefault?: boolean;
-  isEnabled?: boolean;
+  type: string;
+  baseUrl?: string;
+  apiKey?: string;
+  apiType?: string;
+  models?: FleetProviderModel[];
 }
 
 export interface UpdateFleetProviderRequest {