@amir83nasr/10router 0.1.0

package/src/app/api/tunnel/tailscale-install/route.js

@@ -0,0 +1,98 @@
+"use server";
+
+import os from "os";
+import { execSync } from "child_process";
+import { installTailscale, loadState, generateShortId } from "@/lib/tunnel";
+import {
+  getCachedPassword,
+  loadEncryptedPassword,
+  setCachedPassword,
+  saveEncryptedPassword,
+  initSudoHooks as initDbHooks,
+} from "@/lib/tunnel/sudoPassword";
+import { getSettings, updateSettings } from "@/lib/localDb";
+
+initDbHooks(getSettings, updateSettings);
+
+const EXTENDED_PATH = `/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:${process.env.PATH || ""}`;
+
+function hasBrew() {
+  try {
+    execSync("which brew", {
+      stdio: "ignore",
+      windowsHide: true,
+      env: { ...process.env, PATH: EXTENDED_PATH },
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function POST(request) {
+  const body = await request.json().catch(() => ({}));
+  const platform = os.platform();
+  const isWindows = platform === "win32";
+  const isBrew = platform === "darwin" && hasBrew();
+  const needsPassword = !isWindows && !isBrew;
+
+  const sudoPassword =
+    body.sudoPassword || getCachedPassword() || (await loadEncryptedPassword()) || "";
+
+  if (sudoPassword) {
+    setCachedPassword(sudoPassword);
+    saveEncryptedPassword(sudoPassword).catch(() => {});
+  }
+
+  if (needsPassword && !sudoPassword.trim()) {
+    return new Response(JSON.stringify({ error: "Sudo password is required" }), {
+      status: 400,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const shortId = loadState()?.shortId || generateShortId();
+
+  const encoder = new TextEncoder();
+  const stream = new ReadableStream({
+    async start(controller) {
+      let closed = false;
+      const send = (event, data) => {
+        if (closed) return;
+        try {
+          controller.enqueue(encoder.encode(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`));
+        } catch {
+          closed = true;
+        }
+      };
+
+      try {
+        const result = await installTailscale(sudoPassword, shortId, (msg) => {
+          send("progress", { message: msg });
+        });
+        send("done", { success: true, authUrl: result?.authUrl || null });
+      } catch (error) {
+        console.error("Tailscale install error:", error);
+        const msg =
+          error.message?.includes("incorrect password") || error.message?.includes("Sorry")
+            ? "Wrong sudo password"
+            : error.message;
+        send("error", { error: msg });
+      } finally {
+        if (!closed) {
+          try {
+            controller.close();
+          } catch {}
+        }
+      }
+    },
+  });
+
+  return new Response(stream, {
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+    },
+  });
+}

package/src/app/api/usage/[connectionId]/codex-reset-credits/route.js

@@ -0,0 +1,196 @@
+// Ensure proxyFetch is loaded to patch globalThis.fetch
+import "open-sse/index.js";
+
+import { getProviderConnectionById } from "@/lib/localDb";
+import {
+  consumeCodexRateLimitResetCredit,
+  getCodexRateLimitResetCredits,
+} from "open-sse/services/usage.js";
+import { resolveConnectionProxyConfig } from "@/lib/network/connectionProxy";
+import { refreshAndUpdateCredentials } from "../route.js";
+
+const AUTH_EXPIRED_PATTERNS = ["expired", "authentication", "unauthorized", "401", "re-authorize"];
+
+function isAuthExpiredResult(result) {
+  const values = [result?.message, result?.code, result?.raw?.detail, result?.raw?.error]
+    .filter(Boolean)
+    .map((value) => String(value).toLowerCase());
+  return values.some((value) => AUTH_EXPIRED_PATTERNS.some((pattern) => value.includes(pattern)));
+}
+
+function isAuthExpiredError(error) {
+  return isAuthExpiredResult({ message: error?.message });
+}
+
+function getResponseForConsumeResult(result, redeemRequestId) {
+  if (result.ok) {
+    return Response.json({
+      code: result.code,
+      reset: true,
+      windows_reset: result.windowsReset,
+      redeemRequestId,
+      credit: result.raw?.credit || null,
+    });
+  }
+
+  if (result.noCredit) {
+    return Response.json(
+      {
+        code: "no_credit",
+        reset: false,
+        windows_reset: result.windowsReset,
+        message: "No Codex reset credits available.",
+      },
+      { status: 409 },
+    );
+  }
+
+  return Response.json(
+    {
+      code: result.code || "unknown_response",
+      reset: false,
+      windows_reset: result.windowsReset,
+      message: result.message || "Codex reset credit consume returned an unexpected response.",
+    },
+    { status: result.status >= 400 && result.status < 500 ? result.status : 502 },
+  );
+}
+
+async function getCodexConnection(connectionId) {
+  const connection = await getProviderConnectionById(connectionId);
+  if (!connection) {
+    return { response: Response.json({ error: "Connection not found" }, { status: 404 }) };
+  }
+
+  if (connection.provider !== "codex") {
+    return {
+      response: Response.json(
+        { error: "Codex reset credits are only available for Codex connections." },
+        { status: 400 },
+      ),
+    };
+  }
+
+  const isOAuth = connection.authType === "oauth";
+  const isAccessToken = connection.authType === "access_token";
+  if (!isOAuth && !isAccessToken) {
+    return {
+      response: Response.json(
+        { error: "Codex reset credits require an OAuth or access-token connection." },
+        { status: 400 },
+      ),
+    };
+  }
+
+  const proxyConfig = await resolveConnectionProxyConfig(connection.providerSpecificData);
+  const proxyOptions = {
+    connectionProxyEnabled: proxyConfig.connectionProxyEnabled === true,
+    connectionProxyUrl: proxyConfig.connectionProxyUrl || "",
+    connectionNoProxy: proxyConfig.connectionNoProxy || "",
+    vercelRelayUrl: proxyConfig.vercelRelayUrl || "",
+    strictProxy: false,
+  };
+
+  return { connection, isOAuth, proxyOptions };
+}
+
+async function refreshCodexConnection(connection, proxyOptions) {
+  try {
+    const result = await refreshAndUpdateCredentials(connection, false, proxyOptions);
+    return { connection: result.connection };
+  } catch (refreshError) {
+    console.error("[Codex Reset Credits API] Credential refresh failed:", refreshError);
+    return {
+      response: Response.json(
+        { error: `Credential refresh failed: ${refreshError.message}` },
+        { status: 401 },
+      ),
+    };
+  }
+}
+
+export async function GET(_request, { params }) {
+  let connection;
+  try {
+    const { connectionId } = await params;
+    const resolved = await getCodexConnection(connectionId);
+    if (resolved.response) return resolved.response;
+    ({ connection } = resolved);
+    const { isOAuth, proxyOptions } = resolved;
+
+    if (isOAuth) {
+      const refreshed = await refreshCodexConnection(connection, proxyOptions);
+      if (refreshed.response) return refreshed.response;
+      connection = refreshed.connection;
+    }
+
+    let result;
+    try {
+      result = await getCodexRateLimitResetCredits(
+        connection.accessToken,
+        proxyOptions,
+        connection.providerSpecificData,
+      );
+    } catch (fetchError) {
+      if (!isOAuth || !connection.refreshToken || !isAuthExpiredError(fetchError)) throw fetchError;
+      const retryResult = await refreshAndUpdateCredentials(connection, true, proxyOptions);
+      connection = retryResult.connection;
+      result = await getCodexRateLimitResetCredits(
+        connection.accessToken,
+        proxyOptions,
+        connection.providerSpecificData,
+      );
+    }
+
+    return Response.json(result);
+  } catch (error) {
+    const provider = connection?.provider ?? "unknown";
+    console.warn(`[Codex Reset Credits] ${provider}: ${error.message}`);
+    return Response.json({ error: error.message }, { status: 500 });
+  }
+}
+
+export async function POST(request, { params }) {
+  let connection;
+  try {
+    const { connectionId } = await params;
+    const resolved = await getCodexConnection(connectionId);
+    if (resolved.response) return resolved.response;
+    ({ connection } = resolved);
+    const { isOAuth, proxyOptions } = resolved;
+
+    if (isOAuth) {
+      const refreshed = await refreshCodexConnection(connection, proxyOptions);
+      if (refreshed.response) return refreshed.response;
+      connection = refreshed.connection;
+    }
+
+    // Server-generated redeem id prevents client-controlled replay
+    const redeemRequestId = crypto.randomUUID();
+    let consumeResult = await consumeCodexRateLimitResetCredit(
+      connection.accessToken,
+      redeemRequestId,
+      proxyOptions,
+    );
+
+    if (isOAuth && isAuthExpiredResult(consumeResult) && connection.refreshToken) {
+      try {
+        const retryResult = await refreshAndUpdateCredentials(connection, true, proxyOptions);
+        connection = retryResult.connection;
+        consumeResult = await consumeCodexRateLimitResetCredit(
+          connection.accessToken,
+          redeemRequestId,
+          proxyOptions,
+        );
+      } catch (retryError) {
+        console.warn(`[Codex Reset Credits] force refresh failed: ${retryError.message}`);
+      }
+    }
+
+    return getResponseForConsumeResult(consumeResult, redeemRequestId);
+  } catch (error) {
+    const provider = connection?.provider ?? "unknown";
+    console.warn(`[Codex Reset Credits] ${provider}: ${error.message}`);
+    return Response.json({ error: error.message }, { status: 500 });
+  }
+}

package/src/app/api/usage/[connectionId]/route.js

@@ -0,0 +1,192 @@
+// Ensure proxyFetch is loaded to patch globalThis.fetch
+import "open-sse/index.js";
+
+import { getProviderConnectionById, updateProviderConnection } from "@/lib/localDb";
+import { getUsageForProvider } from "open-sse/services/usage.js";
+import { getExecutor } from "open-sse/executors/index.js";
+import { resolveConnectionProxyConfig } from "@/lib/network/connectionProxy";
+import { USAGE_APIKEY_PROVIDERS } from "@/shared/constants/providers";
+
+// Detect auth-expired messages returned by usage providers instead of throwing
+const AUTH_EXPIRED_PATTERNS = ["expired", "authentication", "unauthorized", "401", "re-authorize"];
+function isAuthExpiredMessage(usage) {
+  if (!usage?.message) return false;
+  const msg = usage.message.toLowerCase();
+  return AUTH_EXPIRED_PATTERNS.some((p) => msg.includes(p));
+}
+
+/**
+ * Refresh credentials using executor and update database
+ * @param {boolean} force - Skip needsRefresh check and always attempt refresh
+ * @returns Promise<{ connection, refreshed: boolean }>
+ */
+export async function refreshAndUpdateCredentials(connection, force = false, proxyOptions = null) {
+  const executor = getExecutor(connection.provider);
+
+  // Build credentials object from connection
+  const credentials = {
+    accessToken: connection.accessToken,
+    refreshToken: connection.refreshToken,
+    idToken: connection.idToken,
+    expiresAt: connection.expiresAt || connection.tokenExpiresAt,
+    lastRefreshAt: connection.lastRefreshAt,
+    connectionId: connection.id,
+    providerSpecificData: connection.providerSpecificData,
+    // For GitHub
+    copilotToken: connection.providerSpecificData?.copilotToken,
+    copilotTokenExpiresAt: connection.providerSpecificData?.copilotTokenExpiresAt,
+  };
+
+  // Check if refresh is needed (skip when force=true)
+  const needsRefresh = force || executor.needsRefresh(credentials);
+
+  if (!needsRefresh) {
+    return { connection, refreshed: false };
+  }
+
+  // Use executor's refreshCredentials method (with optional proxy)
+  const refreshResult = await executor.refreshCredentials(credentials, console, proxyOptions);
+
+  if (!refreshResult) {
+    // Refresh failed but we still have an accessToken — try with existing token
+    if (connection.accessToken) {
+      return { connection, refreshed: false };
+    }
+    throw new Error("Failed to refresh credentials. Please re-authorize the connection.");
+  }
+
+  // Build update object
+  const now = new Date().toISOString();
+  const updateData = {
+    updatedAt: now,
+  };
+
+  // Update accessToken if present
+  if (refreshResult.accessToken) {
+    updateData.accessToken = refreshResult.accessToken;
+  }
+
+  // Update refreshToken if present
+  if (refreshResult.refreshToken) {
+    updateData.refreshToken = refreshResult.refreshToken;
+  }
+
+  if (refreshResult.idToken) {
+    updateData.idToken = refreshResult.idToken;
+  }
+
+  if (refreshResult.lastRefreshAt) {
+    updateData.lastRefreshAt = refreshResult.lastRefreshAt;
+  }
+
+  // Update token expiry
+  if (refreshResult.expiresIn) {
+    updateData.expiresAt = new Date(Date.now() + refreshResult.expiresIn * 1000).toISOString();
+    updateData.expiresIn = refreshResult.expiresIn;
+  } else if (refreshResult.expiresAt) {
+    updateData.expiresAt = refreshResult.expiresAt;
+  }
+
+  // Handle provider-specific data (copilotToken for GitHub, etc.)
+  const providerSpecificUpdates = {
+    ...(refreshResult.providerSpecificData || {}),
+    ...(refreshResult.copilotToken ? { copilotToken: refreshResult.copilotToken } : {}),
+    ...(refreshResult.copilotTokenExpiresAt
+      ? { copilotTokenExpiresAt: refreshResult.copilotTokenExpiresAt }
+      : {}),
+  };
+  if (Object.keys(providerSpecificUpdates).length > 0) {
+    updateData.providerSpecificData = {
+      ...(connection.providerSpecificData || {}),
+      ...providerSpecificUpdates,
+    };
+  }
+
+  // Update database
+  await updateProviderConnection(connection.id, updateData);
+
+  // Return updated connection
+  const updatedConnection = {
+    ...connection,
+    ...updateData,
+    providerSpecificData: updateData.providerSpecificData || connection.providerSpecificData,
+  };
+
+  return {
+    connection: updatedConnection,
+    refreshed: true,
+  };
+}
+
+/**
+ * GET /api/usage/[connectionId] - Get usage data for a specific connection
+ */
+export async function GET(request, { params }) {
+  let connection;
+  try {
+    const { connectionId } = await params;
+    const force = new URL(request.url).searchParams.get("force") === "1";
+
+    // Get connection from database
+    connection = await getProviderConnectionById(connectionId);
+    if (!connection) {
+      return Response.json({ error: "Connection not found" }, { status: 404 });
+    }
+
+    // Allow OAuth connections, plus whitelisted apikey providers (glm/minimax/...)
+    const isOAuth = connection.authType === "oauth";
+    const isApikeyAuth = connection.authType === "apikey" || connection.authType === "api_key";
+    const isApikeyEligible = isApikeyAuth && USAGE_APIKEY_PROVIDERS.includes(connection.provider);
+
+    if (!isOAuth && !isApikeyEligible) {
+      return Response.json({ message: "Usage not available for this connection" });
+    }
+
+    // Resolve connection proxy config; force strictProxy=false so quota/refresh fall back to direct on failure
+    const proxyConfig = await resolveConnectionProxyConfig(connection.providerSpecificData);
+    const proxyOptions = {
+      connectionProxyEnabled: proxyConfig.connectionProxyEnabled === true,
+      connectionProxyUrl: proxyConfig.connectionProxyUrl || "",
+      connectionNoProxy: proxyConfig.connectionNoProxy || "",
+      vercelRelayUrl: proxyConfig.vercelRelayUrl || "",
+      strictProxy: false,
+    };
+
+    // Refresh credentials only for OAuth connections (apikey has no token refresh)
+    if (isOAuth) {
+      try {
+        const result = await refreshAndUpdateCredentials(connection, false, proxyOptions);
+        connection = result.connection;
+      } catch (refreshError) {
+        console.error("[Usage API] Credential refresh failed:", refreshError);
+        return Response.json(
+          {
+            error: `Credential refresh failed: ${refreshError.message}`,
+          },
+          { status: 401 },
+        );
+      }
+    }
+
+    // Fetch usage from provider API
+    let usage = await getUsageForProvider(connection, proxyOptions, { force });
+
+    // If provider returned an auth-expired message instead of throwing,
+    // force-refresh token and retry once (OAuth only)
+    if (isOAuth && isAuthExpiredMessage(usage) && connection.refreshToken) {
+      try {
+        const retryResult = await refreshAndUpdateCredentials(connection, true, proxyOptions);
+        connection = retryResult.connection;
+        usage = await getUsageForProvider(connection, proxyOptions, { force });
+      } catch (retryError) {
+        console.warn(`[Usage] ${connection.provider}: force refresh failed: ${retryError.message}`);
+      }
+    }
+
+    return Response.json(usage);
+  } catch (error) {
+    const provider = connection?.provider ?? "unknown";
+    console.warn(`[Usage] ${provider}: ${error.message}`);
+    return Response.json({ error: error.message }, { status: 500 });
+  }
+}

package/src/app/api/usage/chart/route.js

@@ -0,0 +1,21 @@
+import { NextResponse } from "next/server";
+import { getChartData } from "@/lib/usageDb";
+
+const VALID_PERIODS = new Set(["today", "24h", "7d", "30d", "60d"]);
+
+export async function GET(request) {
+  try {
+    const { searchParams } = new URL(request.url);
+    const period = searchParams.get("period") || "7d";
+
+    if (!VALID_PERIODS.has(period)) {
+      return NextResponse.json({ error: "Invalid period" }, { status: 400 });
+    }
+
+    const data = await getChartData(period);
+    return NextResponse.json(data);
+  } catch (error) {
+    console.error("[API] Failed to get chart data:", error);
+    return NextResponse.json({ error: "Failed to fetch chart data" }, { status: 500 });
+  }
+}

package/src/app/api/usage/history/route.js

@@ -0,0 +1,12 @@
+import { NextResponse } from "next/server";
+import { getUsageStats } from "@/lib/usageDb";
+
+export async function GET() {
+  try {
+    const stats = await getUsageStats();
+    return NextResponse.json(stats);
+  } catch (error) {
+    console.error("Error fetching usage stats:", error);
+    return NextResponse.json({ error: "Failed to fetch usage stats" }, { status: 500 });
+  }
+}

package/src/app/api/usage/logs/route.js

@@ -0,0 +1,12 @@
+import { NextResponse } from "next/server";
+import { getRecentLogs } from "@/lib/usageDb";
+
+export async function GET() {
+  try {
+    const logs = await getRecentLogs(200);
+    return NextResponse.json(logs);
+  } catch (error) {
+    console.error("Error fetching logs:", error);
+    return NextResponse.json({ error: "Failed to fetch logs" }, { status: 500 });
+  }
+}

package/src/app/api/usage/providers/route.js

@@ -0,0 +1,38 @@
+import { NextResponse } from "next/server";
+import { getDistinctProviders } from "@/lib/db/index.js";
+import { getProviderNodes } from "@/lib/localDb";
+import { AI_PROVIDERS, getProviderByAlias } from "@/shared/constants/providers";
+
+/**
+ * GET /api/usage/providers
+ * Returns list of unique providers from request details
+ */
+export async function GET() {
+  try {
+    // Query DISTINCT provider column directly — avoids parsing every row's
+    // full JSON blob (can be hundreds of MB), which previously caused OOM.
+    const providerIds = await getDistinctProviders();
+
+    const providerNodes = await getProviderNodes();
+    const nodeMap = {};
+    for (const node of providerNodes) {
+      nodeMap[node.id] = node.name;
+    }
+
+    const providers = providerIds.map((providerId) => {
+      let name = providerId;
+      if (nodeMap[providerId]) {
+        name = nodeMap[providerId];
+      } else {
+        const providerConfig = getProviderByAlias(providerId) || AI_PROVIDERS[providerId];
+        if (providerConfig?.name) name = providerConfig.name;
+      }
+      return { id: providerId, name };
+    });
+
+    return NextResponse.json({ providers });
+  } catch (error) {
+    console.error("[API] Failed to get providers:", error);
+    return NextResponse.json({ error: "Failed to fetch providers" }, { status: 500 });
+  }
+}

package/src/app/api/usage/request-details/route.js

@@ -0,0 +1,65 @@
+import { NextResponse } from "next/server";
+import { getRequestDetails } from "@/lib/usageDb";
+
+/**
+ * GET /api/usage/request-details
+ * Query parameters: page, pageSize (1-100), provider, model, connectionId, status, startDate, endDate
+ */
+export async function GET(request) {
+  try {
+    const { searchParams } = new URL(request.url);
+
+    const pageRaw = parseInt(searchParams.get("page"));
+    const page = Number.isNaN(pageRaw) ? 1 : pageRaw;
+    const pageSizeRaw = parseInt(searchParams.get("pageSize"));
+    const pageSize = Number.isNaN(pageSizeRaw) ? 20 : pageSizeRaw;
+    const provider = searchParams.get("provider");
+    const model = searchParams.get("model");
+    const connectionId = searchParams.get("connectionId");
+    const status = searchParams.get("status");
+    const startDate = searchParams.get("startDate");
+    const endDate = searchParams.get("endDate");
+
+    if (page < 1) {
+      return NextResponse.json({ error: "Page must be >= 1" }, { status: 400 });
+    }
+
+    if (pageSize < 1 || pageSize > 100) {
+      return NextResponse.json({ error: "PageSize must be between 1 and 100" }, { status: 400 });
+    }
+
+    const filter = {
+      page,
+      pageSize,
+    };
+
+    if (provider) filter.provider = provider;
+    if (model) filter.model = model;
+    if (connectionId) filter.connectionId = connectionId;
+    if (status) filter.status = status;
+    if (startDate) filter.startDate = startDate;
+    if (endDate) filter.endDate = endDate;
+
+    const result = await getRequestDetails(filter);
+
+    // Redact conversation payloads: the stored details include full request
+    // bodies (user prompts, tool calls) and provider responses. Returning them
+    // wholesale lets any dashboard-authenticated user (or, if requireLogin is
+    // disabled, anyone) read every user's conversation history. Keep the
+    // metadata (model, tokens, latency, status) but drop message content.
+    const redactedDetails = (result.details || []).map((d) => {
+      const redacted = { ...d };
+      for (const key of ["request", "providerRequest", "providerResponse", "response"]) {
+        if (redacted[key] !== undefined) {
+          redacted[key] = { redacted: true };
+        }
+      }
+      return redacted;
+    });
+
+    return NextResponse.json({ ...result, details: redactedDetails });
+  } catch (error) {
+    console.error("[API] Failed to get request details:", error);
+    return NextResponse.json({ error: "Failed to fetch request details" }, { status: 500 });
+  }
+}

package/src/app/api/usage/request-logs/route.js

@@ -0,0 +1,13 @@
+import { NextResponse } from "next/server";
+import { getRecentLogs } from "@/lib/usageDb";
+
+export async function GET() {
+  try {
+    const logs = await getRecentLogs(200);
+    return NextResponse.json(logs);
+  } catch (error) {
+    console.error("[API ERROR] /api/usage/logs failed:", error);
+    console.error("[API ERROR] Stack:", error?.stack);
+    return NextResponse.json({ error: "Failed to fetch logs" }, { status: 500 });
+  }
+}

package/src/app/api/usage/stats/route.js

@@ -0,0 +1,23 @@
+import { NextResponse } from "next/server";
+import { getUsageStats } from "@/lib/usageDb";
+
+const VALID_PERIODS = new Set(["today", "24h", "7d", "30d", "60d", "all"]);
+
+export const dynamic = "force-dynamic";
+
+export async function GET(request) {
+  try {
+    const { searchParams } = new URL(request.url);
+    const period = searchParams.get("period") || "7d";
+
+    if (!VALID_PERIODS.has(period)) {
+      return NextResponse.json({ error: "Invalid period" }, { status: 400 });
+    }
+
+    const stats = await getUsageStats(period);
+    return NextResponse.json(stats);
+  } catch (error) {
+    console.error("[API] Failed to get usage stats:", error);
+    return NextResponse.json({ error: "Failed to fetch usage stats" }, { status: 500 });
+  }
+}