@k2b/cloud 0.43.0 → 0.45.0

package/src/api/admin-ai-quotas.ts

@@ -1,15 +1,11 @@
+import { sql } from "bun";
 import { Hono, type MiddlewareHandler } from "hono";
-import { describeRoute } from "hono-openapi";
-import { z } from "zod";
 import { AiBackgroundCostError, backgroundCostState, releaseBackgroundCostStop } from "../ai/inference-calls";
-import { setAiModelPricing } from "../ai/model-pricing";
-import { AiModelRequestSettingsInvalid, getAiModelRequestSettings, setAiModelRequestSettings } from "../ai/model-request-settings";
 import { quotaAdminConfig, quotaReport } from "../ai/quota-report";
 import { AiQuotaError, aiQuotas } from "../ai/quotas";
 import { readAiSettingsState } from "../ai/settings";
-import { type AuthContext, auth, jsonResponse, requiresAdmin, v } from "../server";
-import { AiModelPricingSchema, hasBillableAiPricing } from "../shared/ai-costs";
-import { AiModelRequestSettingsSchema, AiModelRequestSettingsUpdateSchema } from "../shared/ai-model-request-settings";
+import { type AuthContext, auth, v } from "../server";
+import { hasBillableAiPricing } from "../shared/ai-costs";
 import {
   AiQuotaConfigSchema,
   AiQuotaIdentitySchema,
@@ -23,8 +19,22 @@ const subject = (p: { type: "user" | "service_account"; id: string }) =>
 export const createAdminAiQuotaRoutes = (authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin")) =>
   new Hono<AuthContext>()
     .use("*", authenticate)
-    .onError((error, c) => {
-      if (error instanceof AiModelRequestSettingsInvalid) return c.json({ message: error.message }, 400);
+    .onError(async (error, c) => {
+      if (error instanceof AiQuotaError && error.code === "quota_conflict") {
+        const current = await quotaAdminConfig();
+        const [change] = await sql<
+          { id: string | null; name: string | null; changedAt: string }[]
+        >`SELECT u.id,COALESCE(NULLIF(u.display_name,''),u.uid) AS name,to_char(c.created_at AT TIME ZONE 'UTC','YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS "changedAt" FROM ai.cost_changes c LEFT JOIN auth.users u ON u.id=c.actor_id WHERE c.revision=${current.revision} ORDER BY c.created_at DESC LIMIT 1`;
+        return c.json(
+          {
+            code: "conflict",
+            current,
+            changedBy: change?.id ? { id: change.id, name: change.name ?? change.id } : null,
+            changedAt: change?.changedAt ?? new Date(0).toISOString(),
+          },
+          409,
+        );
+      }
       if (error instanceof AiQuotaError || error instanceof AiBackgroundCostError)
         return c.json({ error: error.code, message: error.message }, 409);
       throw error;
@@ -33,54 +43,22 @@ export const createAdminAiQuotaRoutes = (authenticate: MiddlewareHandler<AuthCon
     .get("/models", async (c) =>
       c.json({
         unit: (await aiQuotas.config()).unit ?? "EUR",
-        models: (await readAiSettingsState()).profiles.map((m) => ({
-          id: m.id,
-          label: m.label,
-          pricing: m.pricing,
-          enabled: m.enabled,
-          capabilities: m.capabilities,
-        })),
+        models: (await readAiSettingsState()).profiles
+          .filter((m, index, profiles) => {
+            const representative =
+              profiles.find((candidate) => candidate.modelId === m.modelId && hasBillableAiPricing(candidate.pricing)) ??
+              profiles.find((candidate) => candidate.modelId === m.modelId);
+            return profiles.indexOf(representative!) === index;
+          })
+          .map((m) => ({
+            id: m.modelId,
+            label: m.label,
+            pricing: m.pricing,
+            enabled: m.enabled,
+            capabilities: m.capabilities,
+          })),
       }),
     )
-    .put(
-      "/models/:id/pricing",
-      v("json", z.object({ pricing: AiModelPricingSchema.nullable(), expected: AiModelPricingSchema.nullable() }).strict()),
-      async (c) => {
-        const data = c.req.valid("json");
-        return c.json(await setAiModelPricing(c.req.param("id")!, data.pricing, data.expected, c.get("user")!.id));
-      },
-    )
-    .get(
-      "/models/:id/settings",
-      describeRoute({
-        tags: ["Administration"],
-        summary: "Read masked model request settings",
-        ...requiresAdmin,
-        responses: { 200: jsonResponse(AiModelRequestSettingsSchema, "Model request settings (header names only)") },
-      }),
-      async (c) => {
-        c.header("Cache-Control", "no-store");
-        return c.json(await getAiModelRequestSettings(c.req.param("id")!));
-      },
-    )
-    .put(
-      "/models/:id/settings",
-      describeRoute({
-        tags: ["Administration"],
-        summary: "Patch model request settings with a revision guard",
-        ...requiresAdmin,
-        responses: {
-          200: jsonResponse(AiModelRequestSettingsSchema, "Updated model request settings (header names only)"),
-          400: jsonResponse(z.object({ message: z.string() }), "Invalid model request settings"),
-          409: jsonResponse(z.object({ message: z.string(), error: z.string() }), "Model request settings changed"),
-        },
-      }),
-      v("json", AiModelRequestSettingsUpdateSchema),
-      async (c) => {
-        c.header("Cache-Control", "no-store");
-        return c.json(await setAiModelRequestSettings(c.req.param("id")!, c.req.valid("json"), c.get("user")!.id));
-      },
-    )
     .get("/background", async (c) => c.json(await backgroundCostState()))
     .post("/background/release", async (c) => c.json(await releaseBackgroundCostStop(c.get("user")!.id)))
     .get("/report", v("query", AiQuotaReportQuerySchema), async (c) => c.json(await quotaReport(c.req.valid("query"))))
@@ -92,7 +70,7 @@ export const createAdminAiQuotaRoutes = (authenticate: MiddlewareHandler<AuthCon
         previous = await aiQuotas.config();
       if (
         config.rules.some(
-          (r) => r.scope !== "*" && !models.some((m) => m.id === r.scope) && !previous.rules.some((old) => old.scope === r.scope),
+          (r) => r.scope !== "*" && !models.some((m) => m.modelId === r.scope) && !previous.rules.some((old) => old.scope === r.scope),
         )
       )
         return c.json({ message: "Select an enabled chat model with nonzero prices or all chat models." }, 400);

package/src/api/admin-ai-skills.ts

@@ -94,7 +94,10 @@ export const createAdminAiSkillsRoutes = (authenticate: MiddlewareHandler<AuthCo
     .get("/:skillId/projects", async (c) => {
       const skill = await aiSkills.admin.getByShortId(c.req.param("skillId")!);
       if (!skill) return notFound(c, "Skill");
-      const projects = await aiSkills.admin.linkedProjects(skill.id, c.get("accessSubject") ?? null);
+      const projects = await aiSkills.admin.linkedProjects(skill.id, {
+        actor: c.get("actor"),
+        accessSubject: c.get("accessSubject"),
+      });
       return respond(c, ok({ projects: projects.map((project) => ({ id: project.shortId, name: project.name })) }));
     })
     .get("/:skillId/access", async (c) => {

package/src/api/admin-ai-usage.ts

@@ -25,7 +25,7 @@ export const createAdminAiUsageRoutes = (
     .get(
       "/facets",
       describeRoute({ summary: "Find AI usage filter values", tags: ["Admin AI usage"] }),
-      v("query", AiUsageQuerySchema.extend({ field: z.enum(["userId", "modelProfileId", "providerModel", "appId", "task"]) }).strict()),
+      v("query", AiUsageQuerySchema.extend({ field: z.enum(["userId", "modelId", "providerModel", "appId", "task"]) }).strict()),
       async (c) => {
         const q = c.req.valid("query");
         return respond(c, ok({ items: await service.facets(q.field, q.search ?? "", q) }));

package/src/api/admin-ai.ts

@@ -0,0 +1,173 @@
+import { sql } from "bun";
+import { Hono, type MiddlewareHandler } from "hono";
+import { z } from "zod";
+import { setAiCredential } from "../ai/credentials";
+import { AiModelAccessDraftSchema } from "../ai/model-access";
+import { AiConfigError, aiModelCatalog, assertAiRevision, lockAiModelCatalog } from "../ai/model-catalog";
+import { deleteAiCatalogEntry } from "../ai/model-delete";
+import { readAiAdminOverview } from "../ai/model-overview";
+import { aiModelUsage } from "../ai/model-usage";
+import {
+  AiProviderListError,
+  listProviderModels,
+  recordAiProviderStatus,
+  storedProviderConnection,
+  testAiProvider,
+} from "../ai/provider-connections";
+import { getAiRequestHeaders, setAiRequestHeaders } from "../ai/request-headers";
+import { type AuthContext, auth, v } from "../server";
+import { ConfigConflict } from "../services/config-conflict";
+import { ImageMetadataError } from "../services/image-metadata";
+import {
+  AI_MODEL_SLOTS,
+  AiDeleteModelSchema,
+  AiModelInputSchema,
+  AiModelPatchSchema,
+  AiProviderInputSchema,
+  AiProviderPatchSchema,
+  AiVariantInputSchema,
+  AiVariantPatchSchema,
+} from "../shared/ai-models";
+import { AiRequestHeadersSchema, patchAiRequestHeaders, providerSupportsRequestHeaders } from "../shared/ai-request-options";
+
+const revision = { revision: z.number().int().positive() };
+const providerPatch = AiProviderPatchSchema.extend(revision).strict();
+const modelPatch = AiModelPatchSchema.extend({ ...revision, access: AiModelAccessDraftSchema.optional() }).strict();
+const variantPatch = AiVariantPatchSchema.extend(revision).strict();
+const draftConnection = AiProviderInputSchema.omit({ id: true, label: true, dataBoundary: true, enabled: true, logo: true })
+  .extend({ apiKey: z.string().optional(), headers: AiRequestHeadersSchema.optional() })
+  .strict();
+export const createAdminAiRoutes = (authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin")) =>
+  new Hono<AuthContext>()
+    .use("*", authenticate)
+    .onError((error, c) => {
+      if (error instanceof ImageMetadataError) return c.json({ code: error.code, message: error.message }, 422);
+      if (error instanceof ConfigConflict)
+        return c.json({ code: error.code, current: error.current, changedBy: error.changedBy, changedAt: error.changedAt }, 409);
+      if (error instanceof AiConfigError)
+        return c.json({ code: error.code, message: error.message }, error.code === "model_not_found" ? 404 : 400);
+      if (error instanceof AiProviderListError) return c.json({ code: error.code, message: error.message }, 502);
+      if (error instanceof z.ZodError) return c.json({ code: "invalid_configuration", message: z.prettifyError(error) }, 400);
+      throw error;
+    })
+    .get("/overview", async (c) => c.json(await readAiAdminOverview()))
+    .get("/providers", async (c) => c.json({ providers: await aiModelCatalog.providers() }))
+    .post("/providers", v("json", AiProviderInputSchema), async (c) =>
+      c.json(await aiModelCatalog.createProvider(c.req.valid("json"), c.get("user").id), 201),
+    )
+    .post("/providers/test", v("json", draftConnection), async (c) => {
+      const data = c.req.valid("json");
+      return c.json(await testAiProvider({ ...data, headers: patchAiRequestHeaders({}, data.headers ?? {}) }, c.req.raw.signal));
+    })
+    .get("/providers/:id", async (c) => {
+      return c.json(await aiModelCatalog.providerDetail(c.req.param("id")!));
+    })
+    .patch("/providers/:id", v("json", providerPatch), async (c) => {
+      const { revision, ...patch } = c.req.valid("json");
+      return c.json(await aiModelCatalog.updateProvider(c.req.param("id")!, patch, revision, c.get("user").id));
+    })
+    .put("/providers/:id/credential", v("json", z.object({ ...revision, apiKey: z.string() }).strict()), async (c) => {
+      const id = c.req.param("id")!,
+        data = c.req.valid("json");
+      const saved = await sql.begin(async (db) => {
+        await lockAiModelCatalog(db);
+        const current = await aiModelCatalog.providerDetail(id, db);
+        await assertAiRevision(current, data.revision, db);
+        await setAiCredential(id, data.apiKey, db);
+        await db`UPDATE ai.providers SET revision=revision+1,updated_by=${c.get("user").id}::uuid,updated_at=clock_timestamp(),status='unknown',status_code=NULL,status_message=NULL,status_checked_at=NULL WHERE id=${id}`;
+        return aiModelCatalog.provider(id, db);
+      });
+      return c.json(saved);
+    })
+    .put("/providers/:id/headers", v("json", z.object({ ...revision, headers: AiRequestHeadersSchema }).strict()), async (c) => {
+      const id = c.req.param("id")!,
+        data = c.req.valid("json");
+      return c.json(
+        await sql.begin(async (db) => {
+          await lockAiModelCatalog(db);
+          const current = await aiModelCatalog.providerDetail(id, db);
+          await assertAiRevision(current, data.revision, db);
+          if (!providerSupportsRequestHeaders(current.type))
+            throw new AiConfigError("invalid_configuration", "Extra headers require vLLM or an OpenAI-compatible provider.");
+          await setAiRequestHeaders(id, patchAiRequestHeaders(await getAiRequestHeaders(id, db), data.headers), db);
+          await db`UPDATE ai.providers SET revision=revision+1,updated_by=${c.get("user").id}::uuid,updated_at=clock_timestamp(),status='unknown',status_code=NULL,status_message=NULL,status_checked_at=NULL WHERE id=${id}`;
+          return aiModelCatalog.provider(id, db);
+        }),
+      );
+    })
+    .post("/providers/:id/test", async (c) => {
+      const provider = await aiModelCatalog.provider(c.req.param("id")!);
+      const result = await testAiProvider(await storedProviderConnection(provider), c.req.raw.signal);
+      await recordAiProviderStatus(provider.id, result, true);
+      return c.json(result);
+    })
+    .get("/providers/:id/available-models", async (c) =>
+      c.json({
+        models: await listProviderModels(
+          await storedProviderConnection(await aiModelCatalog.provider(c.req.param("id")!)),
+          c.req.raw.signal,
+        ),
+      }),
+    )
+    .post("/providers/:id/models", v("json", z.union([AiModelInputSchema, z.array(AiModelInputSchema).min(1)])), async (c) => {
+      const data = c.req.valid("json");
+      return c.json(
+        { models: await aiModelCatalog.createModels(c.req.param("id")!, Array.isArray(data) ? data : [data], c.get("user").id) },
+        201,
+      );
+    })
+    .get("/models", async (c) => c.json({ models: await aiModelCatalog.models() }))
+    .get("/models/:id", async (c) => {
+      return c.json(await aiModelCatalog.modelDetail(c.req.param("id")!));
+    })
+    .patch("/models/:id", v("json", modelPatch), async (c) => {
+      const { revision, access, ...patch } = c.req.valid("json");
+      const model = await aiModelCatalog.updateModel(c.req.param("id")!, patch, revision, c.get("user").id, access);
+      return c.json(model);
+    })
+    .get("/models/:id/usage", async (c) => {
+      const model = await aiModelCatalog.model(c.req.param("id")!);
+      return c.json(
+        await aiModelUsage(
+          (await aiModelCatalog.variants()).filter((v) => v.modelId === model.id).map((v) => v.id),
+          [model.id],
+        ),
+      );
+    })
+    .post("/models/:id/variants", v("json", AiVariantInputSchema), async (c) =>
+      c.json(await aiModelCatalog.createVariant(c.req.param("id")!, c.req.valid("json"), c.get("user").id), 201),
+    )
+    .patch("/variants/:id", v("json", variantPatch), async (c) => {
+      const { revision, ...patch } = c.req.valid("json");
+      return c.json(await aiModelCatalog.updateVariant(c.req.param("id")!, patch, revision, c.get("user").id));
+    })
+    .get("/variants/:id/usage", async (c) => {
+      const variant = await aiModelCatalog.variant(c.req.param("id")!);
+      return c.json(await aiModelUsage([variant.id], [variant.modelId]));
+    })
+    .delete("/providers/:id", v("json", AiDeleteModelSchema), async (c) =>
+      c.json(await deleteAiCatalogEntry("provider", c.req.param("id")!, c.req.valid("json"), c.get("user").id)),
+    )
+    .delete("/models/:id", v("json", AiDeleteModelSchema), async (c) =>
+      c.json(await deleteAiCatalogEntry("model", c.req.param("id")!, c.req.valid("json"), c.get("user").id)),
+    )
+    .delete("/variants/:id", v("json", AiDeleteModelSchema), async (c) =>
+      c.json(await deleteAiCatalogEntry("variant", c.req.param("id")!, c.req.valid("json"), c.get("user").id)),
+    )
+    .get("/assignments", async (c) => c.json({ assignments: await aiModelCatalog.assignmentsForAdmin() }))
+    .put(
+      "/assignments/:slot",
+      v("param", z.object({ slot: z.enum(AI_MODEL_SLOTS) })),
+      v("json", z.object({ ...revision, variantId: z.string().nullable() }).strict()),
+      async (c) =>
+        c.json(
+          await aiModelCatalog.assign(
+            c.req.valid("param").slot,
+            c.req.valid("json").variantId,
+            c.req.valid("json").revision,
+            c.get("user").id,
+          ),
+        ),
+    );
+export default createAdminAiRoutes();
+export type AdminAiApi = ReturnType<typeof createAdminAiRoutes>;