@hivemagnus/hive-router 1.0.1 → 1.0.3

package/dist/src/admin/app.js

@@ -574,9 +574,12 @@ async function probeHiveService(key, name, role, internalUrl, publicUrl, healthP
         };
     }
 }
-async function buildHiveStatus(env, requestId) {
+export async function buildHiveStatus(env, requestId) {
     const tlsCertificate = inspectTlsCertificate({ publicUrl: env.PUBLIC_ADMIN_URL, ...(env.TLS_CERT_PATH ? { certPath: env.TLS_CERT_PATH } : {}) });
     const securityExporterJwks = getSecurityExporterJwksStatus(env.HIVE_ROUTER_IAM_JWKS_MAX_AGE_MS);
+    // Exporter keys load on demand; an unused cache is expected on a fresh install.
+    const exporterKeysDegraded = securityExporterJwks.state !== 'healthy'
+        && securityExporterJwks.state !== 'uninitialized';
     const [providerCount, enabledProviders, routeRuleCount, traceCount, failureCount, failoverCount] = await Promise.all([
         prisma.provider.count(),
         prisma.provider.count({ where: { enabled: true } }),
@@ -589,7 +592,7 @@ async function buildHiveStatus(env, requestId) {
         key: 'router',
         name: 'Hive Router',
         role: 'traffic routing and OpenAI-compatible gateway',
-        status: failureCount > 0 || tlsCertificate.status !== 'pass' || securityExporterJwks.state !== 'healthy' ? 'degraded' : 'online',
+        status: failureCount > 0 || tlsCertificate.status !== 'pass' || exporterKeysDegraded ? 'degraded' : 'online',
         summary: `${enabledProviders}/${providerCount} providers enabled`,
         internalUrl: env.PUBLIC_ADMIN_URL,
         publicUrl: env.PUBLIC_API_URL,
@@ -603,7 +606,7 @@ async function buildHiveStatus(env, requestId) {
                 name: 'security-exporter-jwks',
                 status: securityExporterJwks.state === 'healthy' ? 'pass' : securityExporterJwks.state === 'expired' ? 'fail' : 'warn',
                 message: securityExporterJwks.state === 'uninitialized'
-                    ? 'not cached yet'
+                    ? 'not cached yet; first exporter request will load IAM keys'
                     : `${Math.ceil(securityExporterJwks.remainingMs / 1_000)}s remaining (${securityExporterJwks.state})`,
             },
         ],

package/dist/src/security/api-auth.js

@@ -19,6 +19,12 @@ export async function requireApiKey(context, next) {
         return context.json({ error: 'Invalid API key' }, 401);
     }
     const metadata = safeJsonParse(match.metadataJson, {});
+    if (metadata.expiresAt !== undefined) {
+        const expiresAt = typeof metadata.expiresAt === 'string' ? Date.parse(metadata.expiresAt) : NaN;
+        if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) {
+            return context.json({ error: 'Invalid API key' }, 401);
+        }
+    }
     const permission = context.req.method === 'GET' ? 'models:read' : 'inference:write';
     if (Array.isArray(metadata.scopes) && !metadata.scopes.includes('*') && !metadata.scopes.includes(permission))
         return context.json({ error: 'Client key does not permit this operation' }, 403);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hivemagnus/hive-router",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Hive Router: OpenAI-compatible model gateway with routing, failover, quotas and traces, plus the admin API and the unified Hive console",
   "keywords": [
     "hive",