@k2b/cloud 0.42.0 → 0.44.0

package/src/api/accounts-entities.ts

@@ -10,12 +10,15 @@ import {
   PaginationQuerySchema,
   PaginationResponseSchema,
   parsePagination,
+  ServiceAccountKindSchema,
+  ServiceAccountStatusSchema,
   UserProfileSchema,
   UserProviderSchema,
 } from "../contracts";
-import { type AuthContext, auth, expectUserBackedActor, jsonResponse, requiresAuth, respond, v } from "../server";
+import { type AuthContext, auth, jsonResponse, requiresAuth, respond, userFromActor, v } from "../server";
 import { noTransform } from "../server/middleware/no-transform";
 import { accountsAppService as accountsService } from "../services";
+import { directoryShares } from "../services/accounts/directory-shares";
 
 const EntitiesListResponseSchema = z.object({
   items: z.array(EntityListItemSchema),
@@ -33,6 +36,8 @@ const QuerySchema = z
     profile: UserProfileSchema.optional(),
     user_ids: z.string().optional(),
     group_ids: z.string().optional(),
+    service_account_kinds: z.string().optional(),
+    service_account_status: ServiceAccountStatusSchema.optional(),
     exclude_user_ids: z.string().optional(),
     exclude_group_ids: z.string().optional(),
     exclude_service_account_ids: z.string().optional(),
@@ -72,6 +77,14 @@ const parseKinds = (value?: string) => {
   return { ok: false as const, message: "Invalid kinds query parameter." };
 };
 
+const parseServiceAccountKinds = (value?: string) => {
+  const kinds = parseCsv(value);
+  if (kinds.length === 0) return { ok: true as const, value: undefined };
+  const parsed = z.array(ServiceAccountKindSchema).safeParse([...new Set(kinds)]);
+  if (parsed.success) return { ok: true as const, value: parsed.data };
+  return { ok: false as const, message: "Invalid service_account_kinds query parameter." };
+};
+
 const parseUuidList = (value: string | undefined, label: string) => {
   const ids = parseCsv(value);
   if (ids.length === 0) return { ok: true as const, value: undefined };
@@ -87,30 +100,30 @@ const parseUuidList = (value: string | undefined, label: string) => {
 
 type AccountsEntitiesRouteDependencies = {
   authenticate?: MiddlewareHandler<AuthContext>;
-  requireUser?: MiddlewareHandler<AuthContext>;
   listEntities?: typeof accountsService.entity.list;
+  searchShares?: typeof directoryShares.search;
 };
 
 export const createAccountsEntitiesRoutes = (dependencies: AccountsEntitiesRouteDependencies = {}) =>
   new Hono<AuthContext>().use("/entities/*", noTransform()).get(
     "/entities",
     dependencies.authenticate ?? auth.requireRole("authenticated"),
-    dependencies.requireUser ?? auth.requireUser(),
     describeRoute({
       tags: ["Accounts"],
-      summary: "List mixed users and groups",
+      summary: "List visible directory entries",
       description:
-        "List visible users and groups with SQL-backed filtering and pagination. Guest accounts see only themselves and their effective groups; relation filters require a full user account. Personal Linux groups (a user's private primary group, flagged with `personalOwner`) are left out unless `include_personal=true`; exact `group_ids` lookups and relation filters always return them.",
+        "List visible users and groups with SQL-backed filtering and pagination. Guest accounts see only themselves and their effective groups; relation filters require a full user account. Standalone and agent accounts with read scope see only explicitly shared directory entries and cannot query relationships. Personal Linux groups (a user's private primary group, flagged with `personalOwner`) are left out unless `include_personal=true`; exact `group_ids` lookups and relation filters always return them.",
       ...requiresAuth,
       responses: {
         200: jsonResponse(EntitiesListResponseSchema, "Paginated mixed entity list"),
         401: jsonResponse(ErrorResponseSchema, "Authentication required"),
-        403: jsonResponse(ErrorResponseSchema, "User-backed account required; relation filters require a full account"),
+        403: jsonResponse(ErrorResponseSchema, "Directory read access required; relation filters require a full user account"),
       },
     }),
     v("query", QuerySchema),
     async (c) => {
-      const user = expectUserBackedActor(c);
+      const actor = c.get("actor");
+      const user = userFromActor(actor);
       const query = c.req.valid("query");
       const usesRelationFilter = Boolean(
         query.user_member_of_group_ids ||
@@ -119,12 +132,14 @@ export const createAccountsEntitiesRoutes = (dependencies: AccountsEntitiesRoute
           query.parent_group_id ||
           query.managed_by_user_id,
       );
-      if (!user.roles.includes("user") && usesRelationFilter) {
+      if (user && !user.roles.includes("user") && usesRelationFilter) {
         return respond(c, fail(err.forbidden("Guest accounts cannot use entity relation filters")));
       }
       const params = parsePagination(query);
       const kinds = parseKinds(query.kinds);
       if (!kinds.ok) return respond(c, fail(err.badInput(kinds.message)));
+      const serviceAccountKinds = parseServiceAccountKinds(query.service_account_kinds);
+      if (!serviceAccountKinds.ok) return respond(c, fail(err.badInput(serviceAccountKinds.message)));
       const excludeUserIds = parseUuidList(query.exclude_user_ids, "exclude_user_ids");
       if (!excludeUserIds.ok) return respond(c, fail(err.badInput(excludeUserIds.message)));
       const excludeGroupIds = parseUuidList(query.exclude_group_ids, "exclude_group_ids");
@@ -138,20 +153,15 @@ export const createAccountsEntitiesRoutes = (dependencies: AccountsEntitiesRoute
       const groupIds = parseUuidList(query.group_ids, "group_ids");
       if (!groupIds.ok) return respond(c, fail(err.badInput(groupIds.message)));
 
-      const result = await (dependencies.listEntities ?? accountsService.entity.list)({
-        actor: {
-          userId: user.id,
-          uid: user.uid,
-          roles: user.roles,
-          provider: user.provider,
-        },
-        pagination: { page: params.page, perPage: params.perPage },
+      const filters = {
         search: query.search,
         kinds: kinds.value,
         provider: query.provider,
         profile: query.profile,
         userIds: userIds.value,
         groupIds: groupIds.value,
+        serviceAccountKinds: serviceAccountKinds.value,
+        serviceAccountStatus: query.service_account_status,
         excludeUserIds: excludeUserIds.value,
         excludeGroupIds: excludeGroupIds.value,
         excludeServiceAccountIds: excludeServiceAccountIds.value,
@@ -162,6 +172,20 @@ export const createAccountsEntitiesRoutes = (dependencies: AccountsEntitiesRoute
         managedByUserId: query.managed_by_user_id,
         recursive: query.recursive === "true",
         includePersonal: query.include_personal === "true",
+      };
+      if (!user) {
+        const result = await (dependencies.searchShares ?? directoryShares.search)({
+          actor,
+          requestId: c.req.header("x-request-id"),
+          query: { ...filters, page: params.page, perPage: params.perPage },
+        });
+        if (!result.ok) return respond(c, result);
+        return c.json({ items: result.data.items, pagination: createPagination(params, result.data.total) });
+      }
+      const result = await (dependencies.listEntities ?? accountsService.entity.list)({
+        actor: { userId: user.id, uid: user.uid, roles: user.roles, provider: user.provider },
+        pagination: { page: params.page, perPage: params.perPage },
+        ...filters,
       });
 
       return respond(c, {

package/src/api/admin-ai-quotas.ts

@@ -1,15 +1,11 @@
+import { sql } from "bun";
 import { Hono, type MiddlewareHandler } from "hono";
-import { describeRoute } from "hono-openapi";
-import { z } from "zod";
 import { AiBackgroundCostError, backgroundCostState, releaseBackgroundCostStop } from "../ai/inference-calls";
-import { setAiModelPricing } from "../ai/model-pricing";
-import { AiModelRequestSettingsInvalid, getAiModelRequestSettings, setAiModelRequestSettings } from "../ai/model-request-settings";
 import { quotaAdminConfig, quotaReport } from "../ai/quota-report";
 import { AiQuotaError, aiQuotas } from "../ai/quotas";
 import { readAiSettingsState } from "../ai/settings";
-import { type AuthContext, auth, jsonResponse, requiresAdmin, v } from "../server";
-import { AiModelPricingSchema, hasBillableAiPricing } from "../shared/ai-costs";
-import { AiModelRequestSettingsSchema, AiModelRequestSettingsUpdateSchema } from "../shared/ai-model-request-settings";
+import { type AuthContext, auth, v } from "../server";
+import { hasBillableAiPricing } from "../shared/ai-costs";
 import {
   AiQuotaConfigSchema,
   AiQuotaIdentitySchema,
@@ -23,8 +19,22 @@ const subject = (p: { type: "user" | "service_account"; id: string }) =>
 export const createAdminAiQuotaRoutes = (authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin")) =>
   new Hono<AuthContext>()
     .use("*", authenticate)
-    .onError((error, c) => {
-      if (error instanceof AiModelRequestSettingsInvalid) return c.json({ message: error.message }, 400);
+    .onError(async (error, c) => {
+      if (error instanceof AiQuotaError && error.code === "quota_conflict") {
+        const current = await quotaAdminConfig();
+        const [change] = await sql<
+          { id: string | null; name: string | null; changedAt: string }[]
+        >`SELECT u.id,COALESCE(NULLIF(u.display_name,''),u.uid) AS name,to_char(c.created_at AT TIME ZONE 'UTC','YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS "changedAt" FROM ai.cost_changes c LEFT JOIN auth.users u ON u.id=c.actor_id WHERE c.revision=${current.revision} ORDER BY c.created_at DESC LIMIT 1`;
+        return c.json(
+          {
+            code: "conflict",
+            current,
+            changedBy: change?.id ? { id: change.id, name: change.name ?? change.id } : null,
+            changedAt: change?.changedAt ?? new Date(0).toISOString(),
+          },
+          409,
+        );
+      }
       if (error instanceof AiQuotaError || error instanceof AiBackgroundCostError)
         return c.json({ error: error.code, message: error.message }, 409);
       throw error;
@@ -33,54 +43,22 @@ export const createAdminAiQuotaRoutes = (authenticate: MiddlewareHandler<AuthCon
     .get("/models", async (c) =>
       c.json({
         unit: (await aiQuotas.config()).unit ?? "EUR",
-        models: (await readAiSettingsState()).profiles.map((m) => ({
-          id: m.id,
-          label: m.label,
-          pricing: m.pricing,
-          enabled: m.enabled,
-          capabilities: m.capabilities,
-        })),
+        models: (await readAiSettingsState()).profiles
+          .filter((m, index, profiles) => {
+            const representative =
+              profiles.find((candidate) => candidate.modelId === m.modelId && hasBillableAiPricing(candidate.pricing)) ??
+              profiles.find((candidate) => candidate.modelId === m.modelId);
+            return profiles.indexOf(representative!) === index;
+          })
+          .map((m) => ({
+            id: m.modelId,
+            label: m.label,
+            pricing: m.pricing,
+            enabled: m.enabled,
+            capabilities: m.capabilities,
+          })),
       }),
     )
-    .put(
-      "/models/:id/pricing",
-      v("json", z.object({ pricing: AiModelPricingSchema.nullable(), expected: AiModelPricingSchema.nullable() }).strict()),
-      async (c) => {
-        const data = c.req.valid("json");
-        return c.json(await setAiModelPricing(c.req.param("id")!, data.pricing, data.expected, c.get("user")!.id));
-      },
-    )
-    .get(
-      "/models/:id/settings",
-      describeRoute({
-        tags: ["Administration"],
-        summary: "Read masked model request settings",
-        ...requiresAdmin,
-        responses: { 200: jsonResponse(AiModelRequestSettingsSchema, "Model request settings (header names only)") },
-      }),
-      async (c) => {
-        c.header("Cache-Control", "no-store");
-        return c.json(await getAiModelRequestSettings(c.req.param("id")!));
-      },
-    )
-    .put(
-      "/models/:id/settings",
-      describeRoute({
-        tags: ["Administration"],
-        summary: "Patch model request settings with a revision guard",
-        ...requiresAdmin,
-        responses: {
-          200: jsonResponse(AiModelRequestSettingsSchema, "Updated model request settings (header names only)"),
-          400: jsonResponse(z.object({ message: z.string() }), "Invalid model request settings"),
-          409: jsonResponse(z.object({ message: z.string(), error: z.string() }), "Model request settings changed"),
-        },
-      }),
-      v("json", AiModelRequestSettingsUpdateSchema),
-      async (c) => {
-        c.header("Cache-Control", "no-store");
-        return c.json(await setAiModelRequestSettings(c.req.param("id")!, c.req.valid("json"), c.get("user")!.id));
-      },
-    )
     .get("/background", async (c) => c.json(await backgroundCostState()))
     .post("/background/release", async (c) => c.json(await releaseBackgroundCostStop(c.get("user")!.id)))
     .get("/report", v("query", AiQuotaReportQuerySchema), async (c) => c.json(await quotaReport(c.req.valid("query"))))
@@ -92,7 +70,7 @@ export const createAdminAiQuotaRoutes = (authenticate: MiddlewareHandler<AuthCon
         previous = await aiQuotas.config();
       if (
         config.rules.some(
-          (r) => r.scope !== "*" && !models.some((m) => m.id === r.scope) && !previous.rules.some((old) => old.scope === r.scope),
+          (r) => r.scope !== "*" && !models.some((m) => m.modelId === r.scope) && !previous.rules.some((old) => old.scope === r.scope),
         )
       )
         return c.json({ message: "Select an enabled chat model with nonzero prices or all chat models." }, 400);

package/src/api/admin-ai-usage.ts

@@ -25,7 +25,7 @@ export const createAdminAiUsageRoutes = (
     .get(
       "/facets",
       describeRoute({ summary: "Find AI usage filter values", tags: ["Admin AI usage"] }),
-      v("query", AiUsageQuerySchema.extend({ field: z.enum(["userId", "modelProfileId", "providerModel", "appId", "task"]) }).strict()),
+      v("query", AiUsageQuerySchema.extend({ field: z.enum(["userId", "modelId", "providerModel", "appId", "task"]) }).strict()),
       async (c) => {
         const q = c.req.valid("query");
         return respond(c, ok({ items: await service.facets(q.field, q.search ?? "", q) }));

package/src/api/admin-ai.ts

@@ -0,0 +1,173 @@
+import { sql } from "bun";
+import { Hono, type MiddlewareHandler } from "hono";
+import { z } from "zod";
+import { setAiCredential } from "../ai/credentials";
+import { AiModelAccessDraftSchema } from "../ai/model-access";
+import { AiConfigError, aiModelCatalog, assertAiRevision, lockAiModelCatalog } from "../ai/model-catalog";
+import { deleteAiCatalogEntry } from "../ai/model-delete";
+import { readAiAdminOverview } from "../ai/model-overview";
+import { aiModelUsage } from "../ai/model-usage";
+import {
+  AiProviderListError,
+  listProviderModels,
+  recordAiProviderStatus,
+  storedProviderConnection,
+  testAiProvider,
+} from "../ai/provider-connections";
+import { getAiRequestHeaders, setAiRequestHeaders } from "../ai/request-headers";
+import { type AuthContext, auth, v } from "../server";
+import { ConfigConflict } from "../services/config-conflict";
+import { ImageMetadataError } from "../services/image-metadata";
+import {
+  AI_MODEL_SLOTS,
+  AiDeleteModelSchema,
+  AiModelInputSchema,
+  AiModelPatchSchema,
+  AiProviderInputSchema,
+  AiProviderPatchSchema,
+  AiVariantInputSchema,
+  AiVariantPatchSchema,
+} from "../shared/ai-models";
+import { AiRequestHeadersSchema, patchAiRequestHeaders, providerSupportsRequestHeaders } from "../shared/ai-request-options";
+
+const revision = { revision: z.number().int().positive() };
+const providerPatch = AiProviderPatchSchema.extend(revision).strict();
+const modelPatch = AiModelPatchSchema.extend({ ...revision, access: AiModelAccessDraftSchema.optional() }).strict();
+const variantPatch = AiVariantPatchSchema.extend(revision).strict();
+const draftConnection = AiProviderInputSchema.omit({ id: true, label: true, dataBoundary: true, enabled: true, logo: true })
+  .extend({ apiKey: z.string().optional(), headers: AiRequestHeadersSchema.optional() })
+  .strict();
+export const createAdminAiRoutes = (authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin")) =>
+  new Hono<AuthContext>()
+    .use("*", authenticate)
+    .onError((error, c) => {
+      if (error instanceof ImageMetadataError) return c.json({ code: error.code, message: error.message }, 422);
+      if (error instanceof ConfigConflict)
+        return c.json({ code: error.code, current: error.current, changedBy: error.changedBy, changedAt: error.changedAt }, 409);
+      if (error instanceof AiConfigError)
+        return c.json({ code: error.code, message: error.message }, error.code === "model_not_found" ? 404 : 400);
+      if (error instanceof AiProviderListError) return c.json({ code: error.code, message: error.message }, 502);
+      if (error instanceof z.ZodError) return c.json({ code: "invalid_configuration", message: z.prettifyError(error) }, 400);
+      throw error;
+    })
+    .get("/overview", async (c) => c.json(await readAiAdminOverview()))
+    .get("/providers", async (c) => c.json({ providers: await aiModelCatalog.providers() }))
+    .post("/providers", v("json", AiProviderInputSchema), async (c) =>
+      c.json(await aiModelCatalog.createProvider(c.req.valid("json"), c.get("user").id), 201),
+    )
+    .post("/providers/test", v("json", draftConnection), async (c) => {
+      const data = c.req.valid("json");
+      return c.json(await testAiProvider({ ...data, headers: patchAiRequestHeaders({}, data.headers ?? {}) }, c.req.raw.signal));
+    })
+    .get("/providers/:id", async (c) => {
+      return c.json(await aiModelCatalog.providerDetail(c.req.param("id")!));
+    })
+    .patch("/providers/:id", v("json", providerPatch), async (c) => {
+      const { revision, ...patch } = c.req.valid("json");
+      return c.json(await aiModelCatalog.updateProvider(c.req.param("id")!, patch, revision, c.get("user").id));
+    })
+    .put("/providers/:id/credential", v("json", z.object({ ...revision, apiKey: z.string() }).strict()), async (c) => {
+      const id = c.req.param("id")!,
+        data = c.req.valid("json");
+      const saved = await sql.begin(async (db) => {
+        await lockAiModelCatalog(db);
+        const current = await aiModelCatalog.providerDetail(id, db);
+        await assertAiRevision(current, data.revision, db);
+        await setAiCredential(id, data.apiKey, db);
+        await db`UPDATE ai.providers SET revision=revision+1,updated_by=${c.get("user").id}::uuid,updated_at=clock_timestamp(),status='unknown',status_code=NULL,status_message=NULL,status_checked_at=NULL WHERE id=${id}`;
+        return aiModelCatalog.provider(id, db);
+      });
+      return c.json(saved);
+    })
+    .put("/providers/:id/headers", v("json", z.object({ ...revision, headers: AiRequestHeadersSchema }).strict()), async (c) => {
+      const id = c.req.param("id")!,
+        data = c.req.valid("json");
+      return c.json(
+        await sql.begin(async (db) => {
+          await lockAiModelCatalog(db);
+          const current = await aiModelCatalog.providerDetail(id, db);
+          await assertAiRevision(current, data.revision, db);
+          if (!providerSupportsRequestHeaders(current.type))
+            throw new AiConfigError("invalid_configuration", "Extra headers require vLLM or an OpenAI-compatible provider.");
+          await setAiRequestHeaders(id, patchAiRequestHeaders(await getAiRequestHeaders(id, db), data.headers), db);
+          await db`UPDATE ai.providers SET revision=revision+1,updated_by=${c.get("user").id}::uuid,updated_at=clock_timestamp(),status='unknown',status_code=NULL,status_message=NULL,status_checked_at=NULL WHERE id=${id}`;
+          return aiModelCatalog.provider(id, db);
+        }),
+      );
+    })
+    .post("/providers/:id/test", async (c) => {
+      const provider = await aiModelCatalog.provider(c.req.param("id")!);
+      const result = await testAiProvider(await storedProviderConnection(provider), c.req.raw.signal);
+      await recordAiProviderStatus(provider.id, result, true);
+      return c.json(result);
+    })
+    .get("/providers/:id/available-models", async (c) =>
+      c.json({
+        models: await listProviderModels(
+          await storedProviderConnection(await aiModelCatalog.provider(c.req.param("id")!)),
+          c.req.raw.signal,
+        ),
+      }),
+    )
+    .post("/providers/:id/models", v("json", z.union([AiModelInputSchema, z.array(AiModelInputSchema).min(1)])), async (c) => {
+      const data = c.req.valid("json");
+      return c.json(
+        { models: await aiModelCatalog.createModels(c.req.param("id")!, Array.isArray(data) ? data : [data], c.get("user").id) },
+        201,
+      );
+    })
+    .get("/models", async (c) => c.json({ models: await aiModelCatalog.models() }))
+    .get("/models/:id", async (c) => {
+      return c.json(await aiModelCatalog.modelDetail(c.req.param("id")!));
+    })
+    .patch("/models/:id", v("json", modelPatch), async (c) => {
+      const { revision, access, ...patch } = c.req.valid("json");
+      const model = await aiModelCatalog.updateModel(c.req.param("id")!, patch, revision, c.get("user").id, access);
+      return c.json(model);
+    })
+    .get("/models/:id/usage", async (c) => {
+      const model = await aiModelCatalog.model(c.req.param("id")!);
+      return c.json(
+        await aiModelUsage(
+          (await aiModelCatalog.variants()).filter((v) => v.modelId === model.id).map((v) => v.id),
+          [model.id],
+        ),
+      );
+    })
+    .post("/models/:id/variants", v("json", AiVariantInputSchema), async (c) =>
+      c.json(await aiModelCatalog.createVariant(c.req.param("id")!, c.req.valid("json"), c.get("user").id), 201),
+    )
+    .patch("/variants/:id", v("json", variantPatch), async (c) => {
+      const { revision, ...patch } = c.req.valid("json");
+      return c.json(await aiModelCatalog.updateVariant(c.req.param("id")!, patch, revision, c.get("user").id));
+    })
+    .get("/variants/:id/usage", async (c) => {
+      const variant = await aiModelCatalog.variant(c.req.param("id")!);
+      return c.json(await aiModelUsage([variant.id], [variant.modelId]));
+    })
+    .delete("/providers/:id", v("json", AiDeleteModelSchema), async (c) =>
+      c.json(await deleteAiCatalogEntry("provider", c.req.param("id")!, c.req.valid("json"), c.get("user").id)),
+    )
+    .delete("/models/:id", v("json", AiDeleteModelSchema), async (c) =>
+      c.json(await deleteAiCatalogEntry("model", c.req.param("id")!, c.req.valid("json"), c.get("user").id)),
+    )
+    .delete("/variants/:id", v("json", AiDeleteModelSchema), async (c) =>
+      c.json(await deleteAiCatalogEntry("variant", c.req.param("id")!, c.req.valid("json"), c.get("user").id)),
+    )
+    .get("/assignments", async (c) => c.json({ assignments: await aiModelCatalog.assignmentsForAdmin() }))
+    .put(
+      "/assignments/:slot",
+      v("param", z.object({ slot: z.enum(AI_MODEL_SLOTS) })),
+      v("json", z.object({ ...revision, variantId: z.string().nullable() }).strict()),
+      async (c) =>
+        c.json(
+          await aiModelCatalog.assign(
+            c.req.valid("param").slot,
+            c.req.valid("json").variantId,
+            c.req.valid("json").revision,
+            c.get("user").id,
+          ),
+        ),
+    );
+export default createAdminAiRoutes();
+export type AdminAiApi = ReturnType<typeof createAdminAiRoutes>;