@xuda.io/account_module 1.2.2272 → 1.2.2274

package/index.mjs

@@ -37,11 +37,7 @@ const account_info_properties = [
   'public_profile_disabled',
 ];
 
-global._conf = (
-  await import(path.join(process.env.XUDA_HOME, process.env.XUDA_CONFIG), {
-    with: { type: 'json' },
-  })
-).default;
+global._conf = (await import(path.join(process.env.XUDA_HOME, "common", "load_conf.mjs"))).loadConf();
 
 const _common = await import(path.join(process.env.XUDA_HOME, 'common', 'xuda_node_common.mjs'));
 const _utils = await import(path.join(process.env.XUDA_HOME, 'common', 'xuda-cpi-utils.mjs'));
@@ -1516,6 +1512,7 @@ export const get_cpu = async function (req) {
 };
 
 const get_account_log_object = function (body, status, service, source, response_data, ip, headers, security) {
+  const is_key = !!(body.api_key || body.api_pk || body.api_sk);
   return {
     uid: body.uid,
     ip,
@@ -1525,7 +1522,12 @@ const get_account_log_object = function (body, status, service, source, response
     security: _conf.cpi_methods?.[service]?.log,
     api_pk: body.api_pk,
     api_sk: body.api_sk,
-    dashboard: !body.api_pk && !body.api_sk,
+    // Developer API keys (xuda_api_keys) ride req.api_key; `channel` says HOW
+    // the call arrived — 'mcp' (tagged by mcp_module's executor via the
+    // xu-channel header), 'api' (a key over plain REST) or 'dashboard'.
+    api_key: body.api_key,
+    channel: headers?.['xu-channel'] === 'mcp' ? 'mcp' : is_key ? 'api' : 'dashboard',
+    dashboard: !is_key,
     response_status_code: status,
     response_data,
     source,
@@ -1542,7 +1544,10 @@ export const add_account_log_util = async function (body, status, service, sourc
   if (_conf.cpi_methods?.[service]?.private) return;
   const security = _conf.cpi_methods?.[service].security;
   if (!security) {
-    if (service.substr(0, 4) === 'get_' && !body.api_pk && !body.api_sk) return;
+    // Interactive dashboard reads are noise, but reads made with a developer
+    // key (api_key / api_pk / api_sk) ARE the product — log them so the
+    // Developers overview reflects real API/MCP traffic.
+    if (service.substr(0, 4) === 'get_' && !body.api_pk && !body.api_sk && !body.api_key) return;
   }
 
   logs_msa.add_account_log(get_account_log_object(body, status, service, source, response_data, ip, headers, security));