cartethyia 2.5.4 → 2.5.7

package/src/config/spec.ts

@@ -165,8 +165,7 @@ export const CONFIG_SPEC = {
    * Age at which a request's detail is described as no longer stored.
    *
    * Retention itself is `CARTETHYIA_TELEMETRY_RETENTION_DAYS`; this only words
-   * the message shown when a request that old is asked for. Kept because the
-   * message is operator-facing and was written against this knob.
+   * the operator-facing message shown when a request that old is asked for.
    */
   CARTETHYIA_TELEMETRY_COMPACT_AFTER_DAYS: { kind: "int", default: 7, min: 1, max: 365 },
   /**
@@ -183,27 +182,6 @@ export const CONFIG_SPEC = {
     min: 5,
     max: 1440,
   },
-  /**
-   * Inert. Accepted so existing deployments keep booting; nothing reads it.
-   *
-   * It sized the one-file-per-window scheme — events were written to a file
-   * per this many minutes, 96 a day at the default. Events now append to one
-   * file per UTC day, so there is no window left to size.
-   */
-  CARTETHYIA_TELEMETRY_WINDOW_MINUTES: {
-    kind: "int",
-    default: 15,
-    min: 1,
-    max: 1440,
-  },
-  /**
-   * Inert. Accepted so existing deployments keep booting; nothing reads it.
-   *
-   * It capped how many window files one pass could fold. Folding is driven by
-   * a byte offset into the day file now and never deletes the file, so there
-   * is no per-pass batch to bound.
-   */
-  CARTETHYIA_TELEMETRY_COMPACT_MAX_FILES: { kind: "int", default: 48, min: 1, max: 10_000 },
   CARTETHYIA_TELEMETRY_PAYLOAD_MAX_BYTES: {
     kind: "int",
     default: 16 * 1024 * 1024,
@@ -246,10 +224,10 @@ export const CONFIG_SPEC = {
   /**
    * An unmapped upstream failure cools the account down for 15 minutes.
    *
-   * It used to be 60s, which put the account straight back into rotation and
-   * re-dialled an upstream that had just answered something this gateway does
-   * not understand — so the same unknown error was retried every minute, and
-   * an account that was actually broken contributed a steady stream of failed
+   * A shorter window puts the account straight back into rotation and re-dials
+   * an upstream that has just answered something this gateway does not
+   * understand — so the same unknown error is retried every minute, and an
+   * account that is actually broken contributes a steady stream of failed
    * attempts instead of one. Fifteen minutes is long enough for a transient
    * provider condition to clear on its own and short enough that no operator
    * action is needed to recover it. It is still a cooldown with a deadline,
@@ -279,6 +257,18 @@ export const CONFIG_SPEC = {
   CARTETHYIA_MODEL_STRIKE_THRESHOLD: { kind: "int", default: 10, min: 1, max: 100 },
   CARTETHYIA_MODEL_STRIKE_WINDOW_MS: { kind: "int", default: 1_800_000, min: 1_000, max: 86_400_000 },
   CARTETHYIA_MODEL_BAN_TTL_MS: { kind: "int", default: 21_600_000, min: 1_000, max: 604_800_000 },
+  /**
+   * The longest ban the console will record, however long a request asks for.
+   * The "Permanent" choice is a very long TTL rather than an unbounded one,
+   * and this is what keeps a typo in a duration from parking a caller for a
+   * decade.
+   */
+  CARTETHYIA_MODEL_BAN_MAX_TTL_MS: {
+    kind: "int",
+    default: 604_800_000,
+    min: 1_000,
+    max: 604_800_000,
+  },
   CARTETHYIA_ENCRYPTION_KEY: {
     kind: "required",
     error:
@@ -295,9 +285,9 @@ export const CONFIG_SPEC = {
   /**
    * Loopback port the browser-OAuth callback listener binds.
    *
-   * Configurable because the default is a fixed number and a busy port used to
-   * strand the operator: the login could not start and there was no way to move
-   * it. Codex's authorization server still expects 59653, so changing this
+   * Configurable because the default is a fixed number: a busy port would strand
+   * the operator, since the login could not start and there would be no way to
+   * move it. Codex's authorization server still expects 59653, so changing this
    * only helps the providers whose redirect URI is not allowlisted upstream.
    */
   CARTETHYIA_OAUTH_CALLBACK_PORT: { kind: "int", default: 59_653, min: 1_024, max: 65_535 },

package/src/config/telemetry.ts

@@ -44,24 +44,4 @@ export function resolveTelemetryCompactIntervalMs(): number {
   return minutes * 60_000;
 }
 
-/**
- * Minutes of events per source file, before it is folded into the day summary.
- *
- * Defaults to the sweep interval so exactly one window closes per pass: a
- * window longer than the interval would leave files waiting several passes, and
- * a shorter one would let several close between passes.
- */
-export function resolveTelemetryWindowMinutes(): number {
-  return readInt(
-    "CARTETHYIA_TELEMETRY_WINDOW_MINUTES",
-    CONFIG_SPEC.CARTETHYIA_TELEMETRY_WINDOW_MINUTES,
-  );
-}
 
-/** Maximum hourly files folded in one compaction pass. */
-export function resolveTelemetryCompactMaxFiles(): number {
-  return readInt(
-    "CARTETHYIA_TELEMETRY_COMPACT_MAX_FILES",
-    CONFIG_SPEC.CARTETHYIA_TELEMETRY_COMPACT_MAX_FILES,
-  );
-}

package/src/config/timeouts.ts

@@ -51,12 +51,6 @@ let cachedUpstreamTimeoutMs: number | undefined;
 let cachedStreamStallTimeoutMs: number | undefined;
 let cachedInflightTtlSeconds: number | undefined;
 
-/** Clears the memoized timeout cache; tests that mutate env mid-process only. */
-export function resetTimeoutCacheForTests(): void {
-  cachedUpstreamTimeoutMs = undefined;
-  cachedStreamStallTimeoutMs = undefined;
-  cachedInflightTtlSeconds = undefined;
-}
 
 /**
  * Crash-recovery TTL, in seconds, for a distributed inflight slot.

package/src/console/admin/model-abuse/contracts.ts

@@ -1,16 +1,38 @@
-// Console surface for model-abuse bans: list active bans and lift one.
+// Console surface for model-abuse bans: list active bans, ban one, lift one.
 //
-// The strike layer (security/model-abuse.ts) bans a client address after
-// repeated invalid-model requests. A ban lapses on its own after its TTL, and
-// this is the escape hatch for lifting one early — a false positive (a shared
-// NAT, a client that genuinely mistyped) must be fixable without SQL. It is a
+// The strike layer (security/model-abuse.ts) bans a caller after repeated
+// invalid-model requests. A ban lapses on its own after its TTL, and this is
+// the escape hatch for lifting one early — a false positive (a shared NAT, a
+// client that genuinely mistyped) must be fixable without SQL. It is a
 // platform-admin surface: a ban is a security decision and the identity values
 // are cross-tenant.
 import type { AccessDecision } from "../../../security/access-control";
 import type { ModelStrikeService } from "../../../security/model-abuse";
 
+/**
+ * The ban durations the console offers, in whole minutes. `null` is the
+ * "Permanent" choice.
+ *
+ * Expressed in minutes rather than milliseconds because that is what an
+ * operator picks and what the label says — a millisecond constant here drifts
+ * from the copy the moment either changes.
+ */
+export const BAN_DURATION_CHOICES = [
+  { minutes: 60, label: "1 hour" },
+  { minutes: 6 * 60, label: "6 hours" },
+  { minutes: 12 * 60, label: "12 hours" },
+  { minutes: 24 * 60, label: "1 day" },
+  { minutes: 7 * 24 * 60, label: "7 days" },
+  { minutes: null, label: "Permanent" },
+] as const;
+
+/** The duration a bare "ban this user" click uses: the shortest one on offer. */
+export const DEFAULT_BAN_MINUTES = 60;
+
+/** Whole minutes the console accepts, or `null` for permanent. */
+export type BanDurationMinutes = (typeof BAN_DURATION_CHOICES)[number]["minutes"];
+
 export interface ModelAbuseRoutesConfig {
   readonly strikes: Pick<ModelStrikeService, "listBans" | "unban" | "ban">;
   readonly accessResolver: (request: Request) => AccessDecision | undefined;
 }
-

package/src/console/admin/model-abuse/routes.ts

@@ -1,16 +1,64 @@
 import { Elysia, t } from "elysia";
-import type { ModelAbuseBan } from "../../../security/model-abuse";
+import { PERMANENT_BAN_TTL_MS, type ModelAbuseBan } from "../../../security/model-abuse";
 import { ConsoleDomainError, errorResponse, requireGlobalAdmin } from "../../shared/errors";
-import type { ModelAbuseRoutesConfig } from "./contracts";
+import {
+  BAN_DURATION_CHOICES,
+  DEFAULT_BAN_MINUTES,
+  type ModelAbuseRoutesConfig,
+} from "./contracts";
 
 const unbanBody = t.Object({
+  /** The opaque member the listing reports, so a scoped ban lifts exactly it. */
   identity: t.String({ minLength: 1 }),
 });
 
 const banBody = t.Object({
   ip: t.String({ minLength: 1, maxLength: 45 }),
+  /**
+   * The key this ban is scoped to. Omitted or null is the blunt instrument:
+   * every key used from this address. That is a real choice an operator makes
+   * when the address is the problem, not a fallback for a missing value — so it
+   * is explicit in the body rather than inferred from an empty string.
+   */
+  apiKeyId: t.Optional(t.Union([t.String({ minLength: 1 }), t.Null()])),
+  /** Whole minutes, or null for permanent. Default one hour. */
+  minutes: t.Optional(t.Union([t.Number({ minimum: 1 }), t.Null()])),
+  /**
+   * Bans the address outright, whatever `apiKeyId` says. Kept as its own flag
+   * so "no key supplied" cannot quietly widen into "every key" — the two read
+   * the same in a body that only had the one field.
+   */
+  addressOnly: t.Optional(t.Boolean()),
 });
 
+/** The durations the route accepts, as whole minutes. `null` is permanent. */
+const ALLOWED_MINUTES = new Set<number | null>(
+  BAN_DURATION_CHOICES.map((choice) => choice.minutes),
+);
+
+/**
+ * How long a requested ban lasts, in milliseconds.
+ *
+ * `null` means permanent, which is a very long TTL rather than an unbounded
+ * ban: both stores lapse a ban by comparing an expiry to now, so a genuinely
+ * infinite ban would need a second mechanism and a second way to get it wrong.
+ *
+ * Anything not on the offered list is rejected rather than clamped. Clamping
+ * would answer a request for 90 days with a week and report success, and an
+ * operator who asked for the longer ban would believe they got it.
+ */
+function banTtlMs(minutes: number | null | undefined): number {
+  const chosen = minutes === undefined ? DEFAULT_BAN_MINUTES : minutes;
+  if (!ALLOWED_MINUTES.has(chosen)) {
+    throw new ConsoleDomainError(
+      "invalid_request",
+      400,
+      "Unsupported ban duration. Choose one of the offered durations.",
+    );
+  }
+  return chosen === null ? PERMANENT_BAN_TTL_MS : chosen * 60_000;
+}
+
 export function createModelAbuseRoutes(config: ModelAbuseRoutesConfig): Elysia {
   return new Elysia()
     .get("/model-bans", async ({ request, set }) => {
@@ -25,7 +73,12 @@ export function createModelAbuseRoutes(config: ModelAbuseRoutesConfig): Elysia {
     .post("/model-bans", { body: banBody }, async ({ request, body, set }) => {
       try {
         requireGlobalAdmin(config.accessResolver(request));
-        const ban = await config.strikes.ban(body.ip);
+        const ban = await config.strikes.ban({
+          ip: body.ip,
+          ...(body.apiKeyId === undefined ? {} : { apiKeyId: body.apiKeyId }),
+          ttlMs: banTtlMs(body.minutes),
+          ...(body.addressOnly === undefined ? {} : { addressOnly: body.addressOnly }),
+        });
         return { ban };
       } catch (e) {
         return errorResponse(e, set, "Model ban failed");