@xuda.io/account_module 1.2.2291 → 1.2.2292

package/index.mjs

@@ -2287,7 +2287,10 @@ export const ops_deploy_server = async function (req = {}) {
       return { code: -1, data: `enqueue write to orchestrator couch failed: ${e.message}` };
     }
 
-    _ops_notify_ops(`Server deploy queued (${mode}): ${server_id}`, [['Server', server_id], ['Mode', mode], ['By', req.uid], ['State', 'queued'], ['Orchestrator', 'dev.xuda.ai']], 'OPS-DEPLOY-' + server_id);
+    // No ops notification for the 'queued' state: it is immediate feedback on a button
+    // the operator just clicked (the queued state is returned to the dashboard below and
+    // pollable via ops_server_deploy_status), so the email/banner was pure noise. The
+    // audit log is kept for traceability. Deploy done/failed notifications are unaffected.
     logs_msa.add_account_log({ uid: req.uid, method: 'ops_deploy_server', source: 'ops dashboard', response_status_code: 200, response_data: `queued ${mode} deploy for ${server_id} by ${req.uid}` });
 
     return { code: 1, data: { enqueued: true, server_id, mode, state: 'queued', orchestrator: 'dev.xuda.ai', poll: 'ops_server_deploy_status' } };
@@ -2789,6 +2792,34 @@ export const get_active_account_profile_info = async function (uid, profile_id)
     // (e.g. interrupted Google signup flow), instead of throwing on every chat-widget poll.
     let active_account_profile_id = profile_id || acc_obj.account_info?.active_account_profile_id || acc_obj.account_profile_id;
 
+    if (!active_account_profile_id) {
+      // Lazy self-heal: an interrupted signup can leave an orphan account_profile doc in the
+      // project db while the account itself was never linked (account_profile_id unset). Rather
+      // than return null forever, adopt an existing profile here, on the very read path the chat
+      // widget polls, and persist the link so it is a one-time repair. Gated by the same dedup set
+      // as the warning below, so a truly profile-less account is queried at most once per process.
+      if (!_warned_no_profile_id.has(acc_obj._id)) {
+        try {
+          const existing = await db_module.find_app_couch_query(acc_obj.account_project_id, {
+            selector: { docType: 'account_profile', uid },
+            limit: 50,
+          });
+          const docs = (existing && existing.docs) || [];
+          if (docs.length) {
+            const chosen = docs.find((d) => d.main) || docs.slice().sort((a, b) => (b.date_created_ts || 0) - (a.date_created_ts || 0))[0];
+            active_account_profile_id = chosen._id;
+            acc_obj.account_profile_id = chosen._id;
+            acc_obj.account_info = acc_obj.account_info || {};
+            acc_obj.account_info.active_account_profile_id = chosen._id;
+            await db_module.save_couch_doc('xuda_accounts', acc_obj); // conflict-safe (retry loop)
+            console.log(`[get_active_account_profile_info] self-healed acc ${acc_obj._id}: adopted orphan profile ${chosen._id}`);
+          }
+        } catch (heal_err) {
+          /* fall through to the soft-fail below on any heal error */
+        }
+      }
+    }
+
     if (!active_account_profile_id) {
       // Soft-fail: log once PER ACCOUNT and return a degraded response. Callers that need a real
       // profile should null-check `account_profile_obj`. The chat widget treats this as an anonymous
@@ -6644,12 +6675,20 @@ export const evaluate_credit_gate = async function (req) {
       return { block: over, scope: over ? 'pool' : null, reason: over ? _SCOPE_REASON.ledger : '', hard_breached: over ? [{ scope: 'pool', key: 'ledger' }] : [], soft_breached: [], account_id: owner };
     }
 
+    // The MAIN profile is not sharable, so per-profile credit control has no
+    // meaning on it: there is no member to scope it to, and the pool cap already
+    // covers the owner. Ignore any rule stored against it, including legacy docs
+    // written before the editor stopped offering it, so it can never gate the
+    // owner's own profile.
+    const main_apid = account_doc?.account_profile_id;
+    const profile_rule = apid && apid !== main_apid ? rules.profiles?.[apid] : null;
+
     // Freeze (hard stop, no usage lookup needed).
-    if (apid && rules.profiles?.[apid]?.frozen) return _block(owner, 'freeze', 'This profile is paused.', { scope: 'profile', key: apid, kind: 'frozen' });
+    if (apid && profile_rule?.frozen) return _block(owner, 'freeze', 'This profile is paused.', { scope: 'profile', key: apid, kind: 'frozen' });
     if (member_uid && rules.users?.[member_uid]?.frozen) return _block(owner, 'freeze', 'This member is paused.', { scope: 'user', key: member_uid, kind: 'frozen' });
 
     // Model access (allow/deny): profile rule then user rule.
-    if (_model_access_blocks(rules.profiles?.[apid]?.model_access, model_code)) return _block(owner, 'model_access', 'This model is not allowed for this profile.', { scope: 'model', key: model_code, kind: 'model_access' });
+    if (_model_access_blocks(profile_rule?.model_access, model_code)) return _block(owner, 'model_access', 'This model is not allowed for this profile.', { scope: 'model', key: model_code, kind: 'model_access' });
     if (_model_access_blocks(rules.users?.[member_uid]?.model_access, model_code)) return _block(owner, 'model_access', 'This model is not allowed for this member.', { scope: 'model', key: model_code, kind: 'model_access' });
 
     // Usage-based caps.
@@ -6670,12 +6709,12 @@ export const evaluate_credit_gate = async function (req) {
     // Pool: ledger safety (remaining below zero) plus the configured pool guardrail.
     if (su.credits_total - su.total < -0.5) hard.push({ scope: 'pool', key: 'ledger' });
     consider('pool', 'pool', rules.pool, su.total);
-    if (apid) consider('profile', apid, rules.profiles?.[apid], su.by_profile[apid] || 0);
+    if (apid) consider('profile', apid, profile_rule, su.by_profile[apid] || 0);
     if (member_uid) consider('user', member_uid, rules.users?.[member_uid], su.by_user[member_uid] || 0);
     if (model_code) consider('model', model_code, rules.models?.[model_code], su.by_model[model_code] || 0);
     if (source) {
       consider('source', source, rules.sources?.[source], su.by_source[source] || 0);
-      if (apid) consider('source', `${apid}:${source}`, rules.profiles?.[apid]?.sources?.[source], su.by_source[source] || 0);
+      if (apid) consider('source', `${apid}:${source}`, profile_rule?.sources?.[source], su.by_source[source] || 0);
     }
 
     if (hard.length) {
@@ -6694,11 +6733,17 @@ export const evaluate_credit_gate = async function (req) {
 };
 
 // Originals only (not shared copies) belonging to the owner.
-const _list_owner_profiles = async function (owner_uid, app_id) {
+const _list_owner_profiles = async function (owner_uid, app_id, main_profile_id) {
   if (!app_id) return [];
   try {
     const ret = await db_module.find_app_couch_query(app_id, { selector: { docType: 'account_profile', uid: owner_uid, stat: 3 }, fields: ['_id', 'profile_name', 'share_item_id'], limit: 500 });
-    return (ret?.docs || []).filter((d) => !d.share_item_id).map((d) => ({ account_profile_id: d._id, profile_name: d.profile_name || 'Profile' }));
+    // Drop the MAIN profile: it is not sharable, so there is no member to scope
+    // credit control to and the pool cap already covers the owner. Leaving it in
+    // this list is what made the editor offer per-profile limits and model
+    // restrictions that could only ever gate the owner themselves.
+    return (ret?.docs || [])
+      .filter((d) => !d.share_item_id && d._id !== main_profile_id)
+      .map((d) => ({ account_profile_id: d._id, profile_name: d.profile_name || 'Profile' }));
   } catch (e) {
     console.error('[credit] list profiles', e?.message || e);
     return [];
@@ -6758,7 +6803,7 @@ export const get_credit_management = async function (req) {
     }
 
     const app_id = account_doc?.account_project_id;
-    const profiles = await _list_owner_profiles(uid, app_id);
+    const profiles = await _list_owner_profiles(uid, app_id, account_doc?.account_profile_id);
     const members = await _list_owner_members(uid, profiles);
 
     return { code: 1, data: { rules, can_edit, plan, entitlements, usage_breakdown, model_catalog, profiles, members } };
@@ -6800,7 +6845,7 @@ const _normalize_sources = function (src) {
   }
   return out;
 };
-const _normalize_credit_rules = function (input, uid) {
+const _normalize_credit_rules = function (input, uid, main_profile_id) {
   const d = _default_credit_rules();
   const r = input && typeof input === 'object' ? input : {};
   const out = {
@@ -6821,6 +6866,10 @@ const _normalize_credit_rules = function (input, uid) {
   };
   if (r.profiles && typeof r.profiles === 'object') {
     for (const [apid, pv] of Object.entries(r.profiles)) {
+      // Never persist a rule for the MAIN profile: it is not sharable, so credit
+      // control there could only gate the owner. Dropping it here also cleans up
+      // any legacy entry the moment the rules are next saved.
+      if (main_profile_id && apid === main_profile_id) continue;
       out.profiles[apid] = { ..._normalize_softhard(pv, true), frozen: !!pv?.frozen, model_access: _normalize_model_access(pv?.model_access), sources: _normalize_sources(pv?.sources) };
     }
   }
@@ -6851,7 +6900,7 @@ export const set_credit_rules = async function (req) {
     if (acc_ret.code < 0) return acc_ret;
     const account_doc = acc_ret.data;
     if (!_is_team_tier(account_doc?.membership_plan)) return { code: -1, data: 'Credit management is available on the Team plan.' };
-    account_doc.credit_rules = _normalize_credit_rules(req.rules, uid);
+    account_doc.credit_rules = _normalize_credit_rules(req.rules, uid, account_doc?.account_profile_id);
     await db_module.save_couch_doc('xuda_accounts', account_doc);
     delete _scoped_usage_cache[uid];
     broadcast_credits(uid);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/account_module",
-  "version": "1.2.2291",
+  "version": "1.2.2292",
   "description": "Xuda Account Server Module",
   "main": "index.mjs",
   "dependencies": {