@linxin666/dsh-usage 0.4.8 → 0.4.10

package/src/host/loopback.ts

@@ -16,6 +16,11 @@
  * request. Forwarding headers are the signal that a hop stands in between: a
  * request that carries CF-Connecting-IP or X-Forwarded-For is answered through
  * a proxy and is never treated as a local one (issue #1906).
+ *
+ * An operator who runs that proxy or tunnel themselves can opt into the
+ * narrower case: isForwardedLoopbackRequest describes a forwarded request that
+ * still landed on this machine's loopback upstream, and a route family admits
+ * it only behind its own default-off switch (issue #1918).
  * @module dsh-web-shared/host/loopback
  */
 
@@ -85,3 +90,30 @@ export function isLoopbackRequest(request: IncomingMessage): boolean {
     return false
   }
 }
+
+/**
+ * Whether a forwarded request landed on this machine's loopback upstream: a
+ * forwarding header (the proxy's own stamp), a loopback socket address (the
+ * proxy dials 127.0.0.1:<port>), and a loopback Host header (the proxy rewrote
+ * the authority to its upstream literal).
+ *
+ * This is a fact about the route, not a trust decision. A public request to a
+ * tunnel satisfies all three by construction, because the proxy is the client
+ * of this process: only a caller that operates the proxy can decide it stands
+ * for the browser, which is why every consumer keeps this behind an explicit
+ * default-off switch and its own browser markers. isLoopbackRequest is
+ * unchanged and still refuses a forwarded request (issue #1906).
+ * @param request - node HTTP request.
+ * @returns true when a forwarding header, a loopback socket, and a loopback Host all hold.
+ */
+export function isForwardedLoopbackRequest(request: IncomingMessage): boolean {
+  if (!isProxiedRequest(request)) return false
+  if (!isLoopbackAddress(request.socket.remoteAddress)) return false
+  const host = request.headers.host
+  if (typeof host !== 'string') return false
+  try {
+    return isLoopbackHostname(new URL('http://' + host).hostname)
+  } catch {
+    return false
+  }
+}

package/src/host/pair-access.ts

@@ -37,9 +37,32 @@ interface LookupCtx {
  */
 export function isPairedOrLoopbackAllowed(ctx: LookupCtx, request: IncomingMessage): boolean {
   if (isLoopbackRequest(request)) return true
-  const fromGet = typeof ctx.get === 'function' ? ctx.get('remoteWebUiPairing', false) : undefined
-  const pairing = (isPairingAccess(fromGet) ? fromGet : ctx.remoteWebUiPairing)
-  return pairing?.isPairedDevice(request) === true
+  return lookupPairing(ctx)?.isPairedDevice(request) === true
+}
+
+/**
+ * The pairing service, or undefined when this composition does not expose it.
+ *
+ * Two lookups exist because the fence is shared with test harnesses that hand
+ * over a bare object: a real cordis context resolves services through `get`, a
+ * harness may carry the property directly. `get(name, false)` is the
+ * non-strict form, so an unloaded service answers undefined rather than
+ * throwing. Reading an un-injected service as a PROPERTY throws instead
+ * (`cannot get property "remoteWebUiPairing" without inject`); a trust fence
+ * must answer "not paired" in that case, never leak the error into the route
+ * handler, where the host web server turns it into an empty-body 400 (#1942).
+ */
+function lookupPairing(ctx: LookupCtx): PairingAccess | undefined {
+  if (typeof ctx.get === 'function') {
+    const viaGet = ctx.get('remoteWebUiPairing', false)
+    return isPairingAccess(viaGet) ? viaGet : undefined
+  }
+  try {
+    const viaProperty = ctx.remoteWebUiPairing
+    return isPairingAccess(viaProperty) ? viaProperty : undefined
+  } catch {
+    return undefined
+  }
 }
 
 function isPairingAccess(value: unknown): value is PairingAccess {

package/src/host/usage-service.ts

@@ -22,6 +22,7 @@ import { deepseekModelSpend } from '../core/pricing.ts'
 import { createLedgerDocument, deserializeLedger, foldUsage, ledgerDayKeys, localDateKey, pruneLedger, summarizeDays, totalTokens } from '../core/ledger.ts'
 import type { BalanceView, CredentialKind, ObservedSpendView, PlanView, ProviderSnapshotState, ProviderSnapshotView, UsageDayView, UsageLedgerDocument, UsageOverviewView, UsageTokenTotals } from '../core/types.ts'
 import { addTotals, emptyTotals } from '../core/types.ts'
+import { resolveSpendDisplay, type SpendDisplay } from '../core/spend.ts'
 
 /**
  * Persisted accrual state for the official DeepSeek family's real spend:
@@ -60,6 +61,12 @@ interface ProviderRoute {
 export interface UsageServiceOptions {
   pollIntervalSec: number
   retainDays: number
+  /**
+   * How the browser halves should read the stored CNY costs. Optional so a
+   * caller that predates the display setting keeps the CNY rendering (issue
+   * #1937); the overview stamps the resolved value on every document.
+   */
+  display?: SpendDisplay
 }
 
 /** Probe timeout per HTTP call. */
@@ -336,6 +343,8 @@ export class UsageService {
     const all = summarizeDays(allKeys.map((key) => this.ledger.days[key] ?? {}))
     return {
       updatedAt: Date.now(),
+      // Display only: costs stay stored in CNY (issue #1937).
+      display: resolveSpendDisplay(this.options.display),
       providers,
       current: this.currentView(),
       usage: {

package/src/index.ts

@@ -4,6 +4,7 @@ import type { SettingsNamespace } from '@deepseek-ai/dsh-settings'
 import z from '@deepseek-ai/schemastery'
 import { mountOnce } from './mount-once.ts'
 import { UsageService, type UsageServiceOptions } from './host/usage-service.ts'
+import { DEFAULT_CNY_PER_USD, resolveSpendDisplay, type SpendDisplay } from './core/spend.ts'
 import { makeUsageDayRoute, makeUsageOverviewRoute, makeUsageRefreshRoute } from './host/routes.ts'
 
 declare module '@deepseek-ai/cordis' {
@@ -46,6 +47,10 @@ export interface UsageConfigFields {
   pollIntervalSec?: ConfigField<number>
   /** Ledger retention in local days. */
   retainDays?: ConfigField<number>
+  /** Currency the spend figures are DISPLAYED in; the ledger itself stays CNY. */
+  spendCurrency?: ConfigField<'CNY' | 'USD'>
+  /** CNY per USD, consulted only while the display currency is USD. */
+  cnyPerUsd?: ConfigField<number>
 }
 
 /**
@@ -66,10 +71,18 @@ export const Config = z.object({
   enabled: z.boolean().default(true).volatile(),
   pollIntervalSec: z.number().min(30).max(3600).default(60).volatile(),
   retainDays: z.number().min(7).max(730).default(180).volatile(),
+  // Display only: the ledger keeps every cost estimate in CNY, and switching
+  // this field never rewrites history (issue #1937). The plugin fetches no live
+  // rate, so an unset or unusable rate renders with the documented default
+  // instead of failing the card.
+  spendCurrency: z.union(['CNY', 'USD'] as const).default('CNY').volatile(),
+  cnyPerUsd: z.number().min(0.01).max(1000).default(DEFAULT_CNY_PER_USD).volatile(),
 })
 
 export interface ResolvedConfig extends UsageServiceOptions {
   enabled: boolean
+  /** The resolved spend display; always present, unlike the optional service option. */
+  display: SpendDisplay
 }
 
 /** Read one config field, following the live reference the schema produces. */
@@ -99,6 +112,10 @@ export function resolveConfig(config?: UsageConfigFields): ResolvedConfig {
     enabled: readConfigField(config?.enabled) ?? true,
     pollIntervalSec: readNumber(config?.pollIntervalSec, 60),
     retainDays: readNumber(config?.retainDays, 180),
+    display: resolveSpendDisplay({
+      currency: readConfigField(config?.spendCurrency),
+      cnyPerUsd: readNumber(config?.cnyPerUsd, DEFAULT_CNY_PER_USD),
+    }),
   }
 }