aigetwey 1.1.0 → 1.2.0

package/src/middleware/auth.ts

@@ -15,15 +15,23 @@ function digest(s: string): Buffer {
   return createHash("sha256").update(s).digest();
 }
 
-/** Constant-time membership test over fixed-length digests. */
-export function isValidKey(presented: string, validKeys: string[]): boolean {
+/** Non-secret stable id for a client key: sha256 truncated to 8 hex chars. */
+export function clientKeyFingerprint(key: string): string {
+  return createHash("sha256").update(key).digest("hex").slice(0, 8);
+}
+
+/** Constant-time: returns the matching key (digest every candidate) or null. */
+export function matchKey(presented: string, validKeys: string[]): string | null {
   const p = digest(presented);
-  // compare against every key so timing can't reveal which one matched.
-  let ok = false;
+  let found: string | null = null;
   for (const k of validKeys) {
-    if (timingSafeEqual(p, digest(k))) ok = true;
+    if (timingSafeEqual(p, digest(k))) found = k;
   }
-  return ok;
+  return found;
+}
+
+export function isValidKey(presented: string, validKeys: string[]): boolean {
+  return matchKey(presented, validKeys) !== null;
 }
 
 export function extractKey(req: FastifyRequest): string | null {
@@ -40,14 +48,16 @@ export interface AuthResult {
   ok: boolean;
   status?: number;
   error?: string;
+  keyFp?: string;
 }
 
 export function checkAuth(req: FastifyRequest, validKeys: string[]): AuthResult {
   if (validKeys.length === 0) return { ok: true }; // auth disabled
   const key = extractKey(req);
   if (!key) return { ok: false, status: 401, error: "missing API key" };
-  if (!isValidKey(key, validKeys)) return { ok: false, status: 401, error: "invalid API key" };
-  return { ok: true };
+  const matched = matchKey(key, validKeys);
+  if (!matched) return { ok: false, status: 401, error: "invalid API key" };
+  return { ok: true, keyFp: clientKeyFingerprint(matched) };
 }
 
 /** Verifies a presented admin password (against the persisted hash store). */

package/src/routes/admin.ts

@@ -15,7 +15,7 @@ import { resolve } from "node:path";
 import type { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
 import type { GatewayState } from "../core/state.js";
 import type { UsageDB } from "../db.js";
-import { checkAdminAuth, type AdminVerifier } from "../middleware/auth.js";
+import { checkAdminAuth, clientKeyFingerprint, type AdminVerifier } from "../middleware/auth.js";
 import {
   maskKey,
   serializeConfig,
@@ -147,19 +147,21 @@ export function registerAdminRoutes(app: FastifyInstance, deps: AdminDeps): void
   app.get("/admin/quota", requireAdmin, (_req, reply) => {
     reply.send({
       quota: deps.state.quota.snapshot(deps.state.config.listProviders()),
-      budget: deps.state.budget.status(),
+      budgets: deps.state.budget.statuses(),
     });
   });
 
-  // set/replace the gateway-wide budget. Body = Budget; invalid shape -> 400.
-  app.put("/admin/budget", requireAdmin, (req, reply) => {
+  // add or replace a budget (keyed by scope). Body = Budget; invalid shape or an
+  // unknown provider scope -> 400 via zod / setBudget through state.reload().
+  app.put("/admin/budgets", requireAdmin, (req, reply) => {
     const b = (req.body ?? {}) as Budget;
     applyMutation(reply, (c) => setBudget(c, b));
   });
 
-  // remove the gateway-wide budget (feature off).
-  app.delete("/admin/budget", requireAdmin, (_req, reply) => {
-    applyMutation(reply, clearBudget);
+  // remove a budget by scope key: global | provider:<id> | model:<id>.
+  app.delete("/admin/budgets/:key", requireAdmin, (req, reply) => {
+    const key = decodeURIComponent((req.params as { key: string }).key);
+    applyMutation(reply, (c) => clearBudget(c, key));
   });
 
   // current config, secrets masked
@@ -443,11 +445,17 @@ export function registerAdminRoutes(app: FastifyInstance, deps: AdminDeps): void
 
   // every callable model: provider/model catalog entries + routing aliases.
   app.get("/admin/models", requireAdmin, (_req, reply) => {
-    const providers = deps.state.config.listProviders().map((p) => ({
-      id: p.id,
-      format: p.format,
-      models: p.models.map((m) => ({ id: m.id, ref: `${p.id}/${m.id}`, price_in: m.price_in, price_out: m.price_out })),
-    }));
+    // disabled providers are skipped in routing, so their models must not be
+    // selectable anywhere this catalog feeds (combos, CLI-tool setup, budget
+    // scopes) — drop them here at the single source.
+    const providers = deps.state.config
+      .listProviders()
+      .filter((p) => !p.disabled)
+      .map((p) => ({
+        id: p.id,
+        format: p.format,
+        models: p.models.map((m) => ({ id: m.id, ref: `${p.id}/${m.id}`, price_in: m.price_in, price_out: m.price_out })),
+      }));
     const routes = deps.state.config.listRoutes();
     reply.send({ providers, routes });
   });
@@ -563,6 +571,19 @@ export function registerAdminRoutes(app: FastifyInstance, deps: AdminDeps): void
     applyMutation(reply, (c) => removeServerKey(c, i));
   });
 
+  // server keys with a non-secret fingerprint + display name, for the budget
+  // key-scope picker. Never returns the raw key.
+  app.get("/admin/keys", requireAdmin, (_req, reply) => {
+    const s = deps.state.config.raw.server;
+    reply.send(
+      s.api_keys.map((k) => ({
+        fingerprint: clientKeyFingerprint(k),
+        name: s.key_names?.[k] ?? maskKey(k),
+        masked: maskKey(k),
+      })),
+    );
+  });
+
   // reveal ONE raw gateway key (the "show key" button on the Endpoint page).
   app.get("/admin/endpoint/keys/:index/reveal", requireAdmin, (req, reply) => {
     const { index } = req.params as { index: string };

package/src/routes/v1.ts

@@ -1,5 +1,5 @@
 import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
-import { checkAuth } from "../middleware/auth.js";
+import { checkAuth, extractKey, clientKeyFingerprint } from "../middleware/auth.js";
 import type { GatewayState } from "../core/state.js";
 import { handle, GatewayError, type HandleDeps } from "../core/handler.js";
 import type { WireFormat } from "../core/canonical.js";
@@ -23,17 +23,21 @@ export function registerV1Routes(app: FastifyInstance, state: GatewayState, db?:
   };
 
   // build deps from the live holder per request (never close over config/pool).
-  const depsNow = (): HandleDeps => ({
-    config: state.config,
-    pool: state.pool,
-    quota: state.quota,
-    budget: state.budget,
-    db,
-    log: (msg) => app.log.info(msg),
-  });
+  const depsNow = (req: FastifyRequest): HandleDeps => {
+    const presented = extractKey(req);
+    return {
+      config: state.config,
+      pool: state.pool,
+      quota: state.quota,
+      budget: state.budget,
+      db,
+      clientKeyFp: presented ? clientKeyFingerprint(presented) : undefined,
+      log: (msg) => app.log.info(msg),
+    };
+  };
 
-  app.post("/v1/chat/completions", requireAuth, (req, reply) => dispatch(depsNow(), "openai", req, reply));
-  app.post("/v1/messages", requireAuth, (req, reply) => dispatch(depsNow(), "anthropic", req, reply));
+  app.post("/v1/chat/completions", requireAuth, (req, reply) => dispatch(depsNow(req), "openai", req, reply));
+  app.post("/v1/messages", requireAuth, (req, reply) => dispatch(depsNow(req), "anthropic", req, reply));
 }
 
 const SSE_HEADERS = {

package/src/server.ts

@@ -78,6 +78,10 @@ async function main(): Promise<void> {
       prefix: "/",
       // forward the whole HTTP surface the dashboard needs (pages + its API).
       httpMethods: ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"],
+      // forward WebSocket upgrades too, so `next dev`'s HMR socket works when the
+      // dashboard is proxied — this is what lets dev run single-URL on the gateway
+      // port like production. Harmless for the prebuilt prod dashboard (no socket).
+      websocket: true,
       // keep the ORIGINAL Host so Next builds redirects (e.g. → /login) against
       // the gateway's address, not the internal dashboard port.
       replyOptions: {

package/src/upstream/client.ts

@@ -68,6 +68,15 @@ function buildBody(
   const adapter = adapterFor(provider.format);
   const upstreamReq: CanonicalRequest = { ...req, model, stream };
   const out = adapter.requestFromCanonical(upstreamReq) as Record<string, unknown>;
+  // OpenAI-compatible streams omit usage entirely unless you opt in — without this
+  // every streamed call through an openai-format provider logs 0 tokens in/out
+  // (anthropic/gemini report usage inline, so they're unaffected). Ask for the
+  // final usage chunk; the handler taps it for accounting. Preserve a usage opt-in
+  // the client already set.
+  if (stream && provider.format === "openai") {
+    const existing = (out.stream_options ?? {}) as Record<string, unknown>;
+    out.stream_options = { ...existing, include_usage: true };
+  }
   // Normalize thinking into THIS provider's native format, keyed by the upstream
   // model's capabilities. No-op for non-reasoning models. Runs per-attempt so each
   // provider in a fallback chain gets the right shape.

package/dashboard/src/components/BudgetEditor.tsx

@@ -1,97 +0,0 @@
-"use client";
-
-import { useState } from "react";
-import { adminApi } from "@/lib/client";
-import { Button, Input, Select, Field } from "@/components/Button";
-import type { BudgetStatus } from "@/lib/gateway";
-
-const WINDOWS = ["5h", "daily", "weekly", "monthly"] as const;
-
-export function BudgetEditor({
-  initial,
-  onSaved,
-  onCancel,
-}: {
-  initial: BudgetStatus | null;
-  onSaved: () => void;
-  onCancel: () => void;
-}) {
-  const [unit, setUnit] = useState<"usd" | "tokens">(initial?.unit ?? "usd");
-  const [limit, setLimit] = useState(String(initial?.limit ?? ""));
-  const [window, setWindow] = useState<(typeof WINDOWS)[number]>(initial?.window ?? "monthly");
-  const [alertAt, setAlertAt] = useState("80");
-  const [error, setError] = useState("");
-  const [saving, setSaving] = useState(false);
-
-  async function save() {
-    const limitNum = Number(limit);
-    if (!Number.isFinite(limitNum) || limitNum <= 0) {
-      setError("limit must be a positive number");
-      return;
-    }
-    const alertPct = Number(alertAt);
-    if (!Number.isFinite(alertPct) || alertPct <= 0 || alertPct > 100) {
-      setError("alert % must be 1–100");
-      return;
-    }
-    setSaving(true);
-    try {
-      const r = await adminApi.setBudget({ unit, limit: limitNum, window, alert_at: alertPct / 100 });
-      if (!r.ok) {
-        setError(r.error ?? "could not save budget");
-        return;
-      }
-      onSaved();
-    } finally {
-      setSaving(false);
-    }
-  }
-
-  return (
-    <div className="space-y-3">
-      <div className="flex gap-2">
-        <button
-          type="button"
-          onClick={() => setUnit("usd")}
-          className={`rounded-brand px-2.5 py-1 text-[13px] font-medium transition-colors ${unit === "usd" ? "bg-accent/12 text-accent" : "text-text-muted hover:text-text"}`}
-        >
-          USD
-        </button>
-        <button
-          type="button"
-          onClick={() => setUnit("tokens")}
-          className={`rounded-brand px-2.5 py-1 text-[13px] font-medium transition-colors ${unit === "tokens" ? "bg-accent/12 text-accent" : "text-text-muted hover:text-text"}`}
-        >
-          Tokens
-        </button>
-      </div>
-
-      <Field label="Limit" hint={unit === "usd" ? "$" : "tokens"}>
-        <Input value={limit} onChange={(e) => setLimit(e.target.value)} inputMode="decimal" placeholder={unit === "usd" ? "50.00" : "1000000"} />
-      </Field>
-
-      <Field label="Window">
-        <Select value={window} onChange={(e) => setWindow(e.target.value as (typeof WINDOWS)[number])}>
-          {WINDOWS.map((w) => (
-            <option key={w} value={w}>{w}</option>
-          ))}
-        </Select>
-      </Field>
-
-      <Field label="Alert at" hint="%">
-        <Input value={alertAt} onChange={(e) => setAlertAt(e.target.value)} inputMode="numeric" placeholder="80" />
-      </Field>
-
-      {error ? <p className="text-[12px] text-danger">{error}</p> : null}
-
-      <div className="flex items-center gap-2 pt-1">
-        <Button disabled={saving} onClick={save}>
-          {saving ? "Saving…" : "Save"}
-        </Button>
-        <Button variant="ghost" onClick={onCancel}>
-          Cancel
-        </Button>
-      </div>
-    </div>
-  );
-}