ldrouter 1.5.1

package/dist/server/routes/admin/requests.js

@@ -0,0 +1,156 @@
+// Admin API: request logs + attempts (server-side paginated).
+import { and, desc, eq, gte, like, lte, sql } from 'drizzle-orm';
+import { getDb, schema } from '../../db/index.js';
+import { requireAdminAuth } from '../../auth/middleware.js';
+import { redactJsonString } from '../../security/redact.js';
+export async function registerRequestRoutes(app) {
+    app.addHook('preHandler', requireAdminAuth);
+    app.get('/api/admin/requests', async (req) => {
+        const q = req.query;
+        const db = getDb();
+        const limit = Math.min(Math.max(Number(q.limit ?? 50), 1), 200);
+        const offset = Math.max(Number(q.offset ?? 0), 0);
+        const conds = [];
+        if (q.from)
+            conds.push(gte(schema.requests.createdAt, q.from));
+        if (q.to)
+            conds.push(lte(schema.requests.createdAt, q.to));
+        if (q.success !== undefined)
+            conds.push(eq(schema.requests.success, q.success === 'true'));
+        if (q.protocol === 'openai' || q.protocol === 'anthropic')
+            conds.push(eq(schema.requests.protocol, q.protocol));
+        if (q.providerId)
+            conds.push(eq(schema.requests.finalModelId, q.providerId)); // best-effort filter via final model
+        if (q.requestedModel)
+            conds.push(like(schema.requests.requestedModel, `%${q.requestedModel}%`));
+        if (q.apiKeyId)
+            conds.push(eq(schema.requests.apiKeyId, q.apiKeyId));
+        if (q.ip)
+            conds.push(eq(schema.requests.clientIp, q.ip));
+        if (q.id)
+            conds.push(eq(schema.requests.id, q.id));
+        if (q.streaming !== undefined)
+            conds.push(eq(schema.requests.streaming, q.streaming === 'true'));
+        if (q.minStatus)
+            conds.push(gte(schema.requests.httpStatus, Number(q.minStatus)));
+        if (q.maxStatus)
+            conds.push(lte(schema.requests.httpStatus, Number(q.maxStatus)));
+        const whereExpr = conds.length ? and(...conds) : undefined;
+        const rows = db.select().from(schema.requests).where(whereExpr).orderBy(desc(schema.requests.createdAt)).limit(limit).offset(offset).all();
+        const totalRow = db.select({ c: sql `COUNT(*)` }).from(schema.requests).where(whereExpr).get();
+        const keys = db.select().from(schema.apiKeys).all();
+        const keyMap = new Map(keys.map((k) => [k.id, k]));
+        const models = db.select().from(schema.models).all();
+        const modelMap = new Map(models.map((m) => [m.id, m]));
+        return {
+            total: totalRow?.c ?? 0,
+            requests: rows.map((r) => {
+                const key = r.apiKeyId ? keyMap.get(r.apiKeyId) : null;
+                const finalModel = r.finalModelId ? modelMap.get(r.finalModelId) : null;
+                return {
+                    id: r.id,
+                    createdAt: r.createdAt,
+                    completedAt: r.completedAt,
+                    apiKeyName: key?.name ?? null,
+                    keyPrefix: r.keyPrefixSnapshot,
+                    clientIp: r.clientIp,
+                    protocol: r.protocol,
+                    endpoint: r.endpoint,
+                    requestedModel: r.requestedModel,
+                    resolvedTargetKind: r.resolvedTargetKind,
+                    finalModelPublicId: finalModel?.publicModelId ?? null,
+                    streaming: Boolean(r.streaming),
+                    httpStatus: r.httpStatus,
+                    success: Boolean(r.success),
+                    totalLatencyMs: r.totalLatencyMs,
+                    ttftMs: r.ttftMs,
+                    inputTokens: r.inputTokens,
+                    outputTokens: r.outputTokens,
+                    cacheReadTokens: r.cacheReadTokens,
+                    cacheWriteTokens: r.cacheWriteTokens,
+                    reasoningTokens: r.reasoningTokens,
+                    totalTokens: r.totalTokens,
+                    attemptsCount: r.attemptsCount,
+                    errorType: r.errorType,
+                    errorMessage: r.errorMessage ?? null,
+                    gatewayCacheHit: Boolean(r.gatewayCacheHit),
+                };
+            }),
+        };
+    });
+    app.get('/api/admin/requests/:id', async (req, reply) => {
+        const { id } = req.params;
+        const db = getDb();
+        const r = db.select().from(schema.requests).where(eq(schema.requests.id, id)).get();
+        if (!r) {
+            reply.code(404).send({ error: { type: 'not_found', message: 'Request not found' } });
+            return;
+        }
+        const attempts = db.select().from(schema.requestAttempts).where(eq(schema.requestAttempts.requestId, id)).orderBy(schema.requestAttempts.attemptNumber).all();
+        const providers = db.select().from(schema.providers).all();
+        const providerMap = new Map(providers.map((p) => [p.id, p]));
+        const models = db.select().from(schema.models).all();
+        const modelMap = new Map(models.map((m) => [m.id, m]));
+        const keys = db.select().from(schema.apiKeys).all();
+        const keyMap = new Map(keys.map((k) => [k.id, k]));
+        const key = r.apiKeyId ? keyMap.get(r.apiKeyId) : null;
+        const finalModel = r.finalModelId ? modelMap.get(r.finalModelId) : null;
+        return {
+            request: {
+                id: r.id,
+                createdAt: r.createdAt,
+                completedAt: r.completedAt,
+                apiKeyName: key?.name ?? null,
+                keyPrefix: r.keyPrefixSnapshot,
+                clientIp: r.clientIp,
+                protocol: r.protocol,
+                endpoint: r.endpoint,
+                requestedModel: r.requestedModel,
+                resolvedTargetKind: r.resolvedTargetKind,
+                finalModelPublicId: finalModel?.publicModelId ?? null,
+                streaming: Boolean(r.streaming),
+                httpStatus: r.httpStatus,
+                success: Boolean(r.success),
+                totalLatencyMs: r.totalLatencyMs,
+                ttftMs: r.ttftMs,
+                inputTokens: r.inputTokens,
+                outputTokens: r.outputTokens,
+                cacheReadTokens: r.cacheReadTokens,
+                cacheWriteTokens: r.cacheWriteTokens,
+                reasoningTokens: r.reasoningTokens,
+                totalTokens: r.totalTokens,
+                attemptsCount: r.attemptsCount,
+                errorType: r.errorType,
+                errorMessage: r.errorMessage,
+                requestPayload: redactJsonString(r.requestPayloadJson),
+                responsePayload: redactJsonString(r.responsePayloadJson),
+                gatewayCacheHit: Boolean(r.gatewayCacheHit),
+            },
+            attempts: attempts.map((a) => ({
+                id: a.id,
+                attemptNumber: a.attemptNumber,
+                providerId: a.providerId,
+                providerName: providerMap.get(a.providerId)?.name ?? '',
+                modelId: a.modelId,
+                modelPublicId: modelMap.get(a.modelId)?.publicModelId ?? '',
+                startedAt: a.startedAt,
+                completedAt: a.completedAt,
+                statusCode: a.statusCode,
+                success: Boolean(a.success),
+                latencyMs: a.latencyMs,
+                ttftMs: a.ttftMs,
+                inputTokens: a.inputTokens,
+                outputTokens: a.outputTokens,
+                cacheReadTokens: a.cacheReadTokens,
+                cacheWriteTokens: a.cacheWriteTokens,
+                reasoningTokens: a.reasoningTokens,
+                streamStarted: Boolean(a.streamStarted),
+                partialResponse: Boolean(a.partialResponse),
+                selectionReason: a.selectionReason,
+                failureReason: a.failureReason,
+                sanitizedError: a.errorMessage,
+                upstreamRequestId: a.upstreamRequestId,
+            })),
+        };
+    });
+}

package/dist/server/routes/admin/settings.js

@@ -0,0 +1,197 @@
+// Admin API: app settings + password + TOTP + maintenance.
+import { z } from 'zod';
+import argon2 from 'argon2';
+import { eq, sql } from 'drizzle-orm';
+import { getDb, schema } from '../../db/index.js';
+import { requireAdminAuth } from '../../auth/middleware.js';
+import { recordAudit } from '../../db/repositories/audit.js';
+import { getSettings, updateSettings } from '../../db/repositories/settings.js';
+import { uuid } from '../../auth/ids.js';
+import { isMasterKeyConfigured, encryptSecret, decryptSecret } from '../../auth/crypto.js';
+import { GatewayError } from '../../errors.js';
+import { runRetentionCleanup } from '../../maintenance/retention.js';
+const UpdateBody = z.object({
+    retentionDays: z.number().int().min(1).max(3650).optional(),
+    contentLogMode: z.enum(['off', 'metadata', 'prompt', 'prompt_and_response']).optional(),
+    dbSizeLimitMb: z.number().int().min(64).max(1048576).optional(),
+    trustProxyHops: z.number().int().min(0).max(8).optional(),
+    gatewayCacheEnabled: z.boolean().optional(),
+    gatewayCacheDefaultTtlSeconds: z.number().int().min(1).max(86400).optional(),
+    gatewayCacheMaxSizeMb: z.number().int().min(1).max(10240).optional(),
+});
+const PasswordChange = z.object({
+    currentPassword: z.string().min(1),
+    newPassword: z.string().min(12).max(256),
+    totp: z.string().optional(),
+    recoveryCode: z.string().optional(),
+});
+const TotpEnableBegin = z.object({});
+void TotpEnableBegin;
+const TotpEnableVerify = z.object({ code: z.string().regex(/^\d{6}$/) });
+export async function registerSettingsRoutes(app) {
+    app.addHook('preHandler', requireAdminAuth);
+    app.get('/api/admin/settings', async () => {
+        const s = getSettings();
+        return { settings: { ...s, masterKeyConfigured: s.masterKeyConfigured || isMasterKeyConfigured() } };
+    });
+    app.patch('/api/admin/settings', async (req) => {
+        const body = UpdateBody.parse(req.body);
+        updateSettings(body);
+        recordAudit({ action: 'settings.update', success: true, ip: req.ip, metadata: body });
+        return { ok: true };
+    });
+    app.post('/api/admin/settings/cleanup', async (req) => {
+        const result = runRetentionCleanup();
+        recordAudit({ action: 'retention.run', success: true, ip: req.ip, metadata: { result } });
+        return { ok: true, result };
+    });
+    app.post('/api/admin/settings/cache/clear', async (req) => {
+        const { clearAllCache } = await import('../../caching/store.js');
+        const n = clearAllCache();
+        recordAudit({ action: 'cache.clear', success: true, ip: req.ip, metadata: { deleted: n } });
+        return { ok: true, deleted: n };
+    });
+    // Password change
+    app.post('/api/admin/account/password', async (req) => {
+        const body = PasswordChange.parse(req.body);
+        const account = req.adminAccount;
+        const db = getDb();
+        const ok = await argon2.verify(account.passwordHash, body.currentPassword);
+        if (!ok) {
+            recordAudit({ action: 'admin.password_change', success: false, ip: req.ip, metadata: { reason: 'wrong_current' } });
+            throw new GatewayError('authentication_error', 'Current password incorrect', { status: 401 });
+        }
+        if (account.totpEnabled && !body.totp && !body.recoveryCode) {
+            throw new GatewayError('invalid_request_error', 'TOTP or recovery code required', { status: 400 });
+        }
+        if (account.totpEnabled && body.totp) {
+            const secret = decryptSecret({ ciphertext: account.totpSecretEncrypted, nonce: account.totpSecretNonce, version: 1 });
+            const speakeasy = await import('speakeasy');
+            if (!speakeasy.authenticator.verify({ token: body.totp, secret, window: 1 })) {
+                recordAudit({ action: 'admin.password_change', success: false, ip: req.ip, metadata: { reason: 'bad_totp' } });
+                throw new GatewayError('authentication_error', 'Invalid TOTP', { status: 401 });
+            }
+        }
+        const newHash = await argon2.hash(body.newPassword, { type: argon2.argon2id, memoryCost: 64 * 1024, timeCost: 3, parallelism: 1 });
+        db.update(schema.adminAccount).set({ passwordHash: newHash, updatedAt: new Date().toISOString() }).where(eq(schema.adminAccount.id, account.id)).run();
+        // Invalidate all other sessions
+        db.delete(schema.adminSessions).where(sql `id != ${req.adminSessionId}`).run();
+        recordAudit({ action: 'admin.password_change', success: true, ip: req.ip });
+        return { ok: true };
+    });
+    // TOTP setup
+    app.post('/api/admin/account/totp/begin', async (req) => {
+        if (!isMasterKeyConfigured())
+            throw new GatewayError('gateway_error', 'Master key required to enable TOTP', { status: 503 });
+        const speakeasy = await import('speakeasy');
+        const qrcode = (await import('qrcode'));
+        const auth = speakeasy.authenticator;
+        const secret = auth.generateSecret({ name: 'LateDev Router', length: 20 });
+        const enc = encryptSecret(secret.base32);
+        const db = getDb();
+        db.update(schema.adminAccount).set({ totpSecretEncrypted: enc.ciphertext, totpSecretNonce: enc.nonce, updatedAt: new Date().toISOString() }).where(eq(schema.adminAccount.id, req.adminAccount.id)).run();
+        const otpauth = auth.keyuri('admin', 'LateDev Router', secret.base32);
+        const qr = await qrcode.toDataURL(otpauth);
+        recordAudit({ action: 'totp.begin', success: true, ip: req.ip });
+        return { secret: secret.base32, otpauth, qr };
+    });
+    app.post('/api/admin/account/totp/verify', async (req) => {
+        const body = TotpEnableVerify.parse(req.body);
+        const account = req.adminAccount;
+        if (!account.totpSecretEncrypted)
+            throw new GatewayError('invalid_request_error', 'Begin TOTP setup first', { status: 400 });
+        const speakeasy = await import('speakeasy');
+        const auth = speakeasy.authenticator;
+        const secret = decryptSecret({ ciphertext: account.totpSecretEncrypted, nonce: account.totpSecretNonce, version: 1 });
+        if (!auth.verify({ token: body.code, secret, window: 1 })) {
+            recordAudit({ action: 'totp.verify', success: false, ip: req.ip });
+            throw new GatewayError('invalid_request_error', 'Invalid code', { status: 400 });
+        }
+        // Generate recovery codes
+        const { generateRecoveryCodes } = await import('../../auth/recovery.js');
+        const db = getDb();
+        db.delete(schema.adminRecoveryCodes).where(eq(schema.adminRecoveryCodes.adminId, account.id)).run();
+        const codes = generateRecoveryCodes(8);
+        for (const c of codes) {
+            const codeHash = await argon2.hash(c, { type: argon2.argon2id, memoryCost: 64 * 1024, timeCost: 3, parallelism: 1 });
+            db.insert(schema.adminRecoveryCodes).values({ id: uuid(), adminId: account.id, codeHash }).run();
+        }
+        db.update(schema.adminAccount).set({ totpEnabled: true, updatedAt: new Date().toISOString() }).where(eq(schema.adminAccount.id, account.id)).run();
+        recordAudit({ action: 'totp.enable', success: true, ip: req.ip, metadata: { recoveryCodes: codes.length } });
+        return { ok: true, recoveryCodes: codes };
+    });
+    app.post('/api/admin/account/totp/disable', async (req) => {
+        const body = z.object({ password: z.string().min(1), totp: z.string().optional(), recoveryCode: z.string().optional() }).parse(req.body);
+        const account = req.adminAccount;
+        const ok = await argon2.verify(account.passwordHash, body.password);
+        if (!ok) {
+            recordAudit({ action: 'totp.disable', success: false, ip: req.ip, metadata: { reason: 'wrong_password' } });
+            throw new GatewayError('authentication_error', 'Invalid password', { status: 401 });
+        }
+        if (account.totpEnabled && !body.totp && !body.recoveryCode) {
+            throw new GatewayError('invalid_request_error', 'TOTP or recovery code required', { status: 400 });
+        }
+        if (account.totpEnabled && body.totp) {
+            const secret = decryptSecret({ ciphertext: account.totpSecretEncrypted, nonce: account.totpSecretNonce, version: 1 });
+            const speakeasy = await import('speakeasy');
+            const auth = speakeasy.authenticator;
+            if (!auth.verify({ token: body.totp, secret, window: 1 })) {
+                recordAudit({ action: 'totp.disable', success: false, ip: req.ip, metadata: { reason: 'bad_totp' } });
+                throw new GatewayError('authentication_error', 'Invalid TOTP', { status: 401 });
+            }
+        }
+        const db = getDb();
+        db.update(schema.adminAccount).set({ totpEnabled: false, totpSecretEncrypted: null, totpSecretNonce: null, updatedAt: new Date().toISOString() }).where(eq(schema.adminAccount.id, account.id)).run();
+        db.delete(schema.adminRecoveryCodes).where(eq(schema.adminRecoveryCodes.adminId, account.id)).run();
+        recordAudit({ action: 'totp.disable', success: true, ip: req.ip });
+        return { ok: true };
+    });
+    app.post('/api/admin/account/totp/recovery/regenerate', async (req) => {
+        const body = z.object({ password: z.string().min(1), totp: z.string().regex(/^\d{6}$/) }).parse(req.body);
+        const account = req.adminAccount;
+        if (!account.totpEnabled)
+            throw new GatewayError('invalid_request_error', 'TOTP not enabled', { status: 400 });
+        const ok = await argon2.verify(account.passwordHash, body.password);
+        if (!ok)
+            throw new GatewayError('authentication_error', 'Invalid password', { status: 401 });
+        const speakeasy = await import('speakeasy');
+        const auth = speakeasy.authenticator;
+        const secret = decryptSecret({ ciphertext: account.totpSecretEncrypted, nonce: account.totpSecretNonce, version: 1 });
+        if (!auth.verify({ token: body.totp, secret, window: 1 }))
+            throw new GatewayError('authentication_error', 'Invalid TOTP', { status: 401 });
+        const { generateRecoveryCodes } = await import('../../auth/recovery.js');
+        const db = getDb();
+        db.delete(schema.adminRecoveryCodes).where(eq(schema.adminRecoveryCodes.adminId, account.id)).run();
+        const codes = generateRecoveryCodes(8);
+        for (const c of codes) {
+            const codeHash = await argon2.hash(c, { type: argon2.argon2id, memoryCost: 64 * 1024, timeCost: 3, parallelism: 1 });
+            db.insert(schema.adminRecoveryCodes).values({ id: uuid(), adminId: account.id, codeHash }).run();
+        }
+        recordAudit({ action: 'totp.recovery_regenerate', success: true, ip: req.ip });
+        return { ok: true, recoveryCodes: codes };
+    });
+    // Health-test endpoint
+    app.get('/api/admin/settings/system', async () => {
+        const { loadConfig } = await import('../../config/index.js');
+        const cfg = loadConfig();
+        return {
+            appVersion: cfg.appVersion,
+            dataDir: cfg.dataDir,
+            masterKeyConfigured: isMasterKeyConfigured(),
+            masterKeyVersion: getSettings().masterKeyVersion,
+            environment: cfg.env,
+        };
+    });
+    // Self-update: check the npm registry and (optionally) install + restart.
+    app.get('/api/admin/update/check', async (req) => {
+        const { getSelfUpdater } = await import('../../selfupdate/index.js');
+        const u = getSelfUpdater();
+        const force = req.query.force === '1';
+        const result = await u.check(force);
+        return { ...result, status: u.status() };
+    });
+    app.post('/api/admin/update/run', async () => {
+        const { getSelfUpdater } = await import('../../selfupdate/index.js');
+        return getSelfUpdater().run();
+    });
+}

package/dist/server/routes/admin/setup.js

@@ -0,0 +1,80 @@
+import { z } from 'zod';
+import fs from 'node:fs';
+import path from 'node:path';
+import argon2 from 'argon2';
+import { getDb, schema } from '../../db/index.js';
+import { getSettings, markSetupComplete, updateSettings } from '../../db/repositories/settings.js';
+import { recordAudit } from '../../db/repositories/audit.js';
+import { loadConfig, setConfigMasterKey } from '../../config/index.js';
+import { GatewayError } from '../../errors.js';
+import { uuid } from '../../auth/ids.js';
+import { isMasterKeyConfigured, parseMasterKey } from '../../auth/crypto.js';
+const SetupBody = z.object({
+    username: z.string().min(3).max(64).regex(/^[a-zA-Z0-9_.-]+$/),
+    password: z.string().min(12).max(256),
+    setupMasterKey: z.string().trim().min(32, 'Master key must be at least 32 characters').max(256).optional(),
+});
+const PasswordPolicy = z.string().min(12, 'Password must be at least 12 characters').max(256);
+export async function registerSetupRoutes(app) {
+    app.get('/api/admin/setup/status', async () => {
+        const s = getSettings();
+        return {
+            setupComplete: s.setupComplete,
+            masterKeyConfigured: s.masterKeyConfigured || isMasterKeyConfigured(),
+        };
+    });
+    app.post('/api/admin/setup', async (req, _reply) => {
+        const s = getSettings();
+        if (s.setupComplete) {
+            throw new GatewayError('invalid_request_error', 'Setup already complete', { status: 400 });
+        }
+        const body = SetupBody.parse(req.body);
+        PasswordPolicy.parse(body.password); // throws if too short
+        // Resolve the master encryption key BEFORE writing any rows: provider
+        // credentials are encrypted with it, and a rejected setup must never leave
+        // a half-created admin account behind. Priority: LATEDEV_MASTER_KEY env →
+        // existing master.key file (re-setup) → key entered during setup. There is
+        // NO auto-generation: losing this key makes stored provider API keys
+        // unrecoverable, so the admin must hold a copy.
+        const cfg = loadConfig();
+        const keyPath = path.join(cfg.dataDir, 'master.key');
+        let effectiveKey = cfg.masterKey ?? (fs.existsSync(keyPath) ? fs.readFileSync(keyPath, 'utf8').trim() || null : null);
+        if (!effectiveKey) {
+            if (!body.setupMasterKey) {
+                throw new GatewayError('invalid_request_error', 'Master encryption key is required (32+ characters). Set LATEDEV_MASTER_KEY or enter it during setup.', { status: 400 });
+            }
+            effectiveKey = body.setupMasterKey;
+        }
+        // Reject malformed keys up front: a key that cannot be parsed into 32 AES
+        // bytes would make every later provider encrypt/decrypt fail.
+        try {
+            parseMasterKey(effectiveKey);
+        }
+        catch (e) {
+            throw new GatewayError('invalid_request_error', e.message, { status: 400 });
+        }
+        const db = getDb();
+        const id = uuid();
+        const passwordHash = await argon2.hash(body.password, {
+            type: argon2.argon2id,
+            memoryCost: 64 * 1024,
+            timeCost: 3,
+            parallelism: 1,
+        });
+        const existing = db.select().from(schema.adminAccount).get();
+        if (existing) {
+            throw new GatewayError('invalid_request_error', 'Admin account already exists', { status: 400 });
+        }
+        db.insert(schema.adminAccount).values({ id, username: body.username, passwordHash }).run();
+        // Persist the resolved key for container restarts and set it into the
+        // running config (validated above, before any rows were written).
+        fs.mkdirSync(cfg.dataDir, { recursive: true });
+        fs.writeFileSync(keyPath, effectiveKey, { mode: 0o600, encoding: 'utf8' });
+        setConfigMasterKey(effectiveKey);
+        process.env.LATEDEV_MASTER_KEY = effectiveKey;
+        updateSettings({ masterKeyConfigured: true });
+        markSetupComplete();
+        recordAudit({ action: 'admin.setup', success: true, targetType: 'admin', targetId: id, targetName: body.username, ip: req.ip });
+        return { ok: true };
+    });
+}

package/dist/server/routes/admin/stats.js

@@ -0,0 +1,180 @@
+// Admin API: statistics (Today/7d/30d).
+import { and, eq, gte, lte, sql, desc } from 'drizzle-orm';
+import { getDb, schema } from '../../db/index.js';
+import { requireAdminAuth } from '../../auth/middleware.js';
+const PRESETS = {
+    today: () => {
+        const now = new Date();
+        const from = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
+        return { from, to: now, bucket: 'hour' };
+    },
+    '7d': () => {
+        const now = new Date();
+        return { from: new Date(now.getTime() - 7 * 24 * 3600 * 1000), to: now, bucket: 'day' };
+    },
+    '30d': () => {
+        const now = new Date();
+        return { from: new Date(now.getTime() - 30 * 24 * 3600 * 1000), to: now, bucket: 'day' };
+    },
+};
+function rangeFromQuery(q) {
+    if (q.preset && PRESETS[q.preset])
+        return PRESETS[q.preset]();
+    const from = q.from ? new Date(q.from) : new Date(Date.now() - 7 * 24 * 3600 * 1000);
+    const to = q.to ? new Date(q.to) : new Date();
+    return { from, to, bucket: q.bucket === 'hour' ? 'hour' : 'day' };
+}
+export async function registerStatsRoutes(app) {
+    app.addHook('preHandler', requireAdminAuth);
+    app.get('/api/admin/stats', async (req) => {
+        const q = req.query;
+        const { from, to, bucket } = rangeFromQuery(q);
+        const db = getDb();
+        const fromIso = from.toISOString();
+        const toIso = to.toISOString();
+        const conds = [gte(schema.requests.createdAt, fromIso), lte(schema.requests.createdAt, toIso)];
+        const summary = db
+            .select({
+            total: sql `COUNT(*)`,
+            success: sql `SUM(CASE WHEN success=1 THEN 1 ELSE 0 END)`,
+            failed: sql `SUM(CASE WHEN success=0 THEN 1 ELSE 0 END)`,
+            inputTokens: sql `COALESCE(SUM(input_tokens),0)`,
+            outputTokens: sql `COALESCE(SUM(output_tokens),0)`,
+            cacheRead: sql `COALESCE(SUM(cache_read_tokens),0)`,
+            cacheWrite: sql `COALESCE(SUM(cache_write_tokens),0)`,
+            reasoning: sql `COALESCE(SUM(reasoning_tokens),0)`,
+            gatewayCacheHits: sql `SUM(CASE WHEN gateway_cache_hit=1 THEN 1 ELSE 0 END)`,
+            fallbacks: sql `SUM(CASE WHEN attempts_count > 1 THEN 1 ELSE 0 END)`,
+        })
+            .from(schema.requests)
+            .where(and(...conds))
+            .get();
+        const latRows = db
+            .select({ v: schema.requests.totalLatencyMs })
+            .from(schema.requests)
+            .where(and(...conds, eq(schema.requests.success, true)))
+            .all();
+        const latencies = latRows.map((r) => r.v).filter((v) => v > 0).sort((a, b) => a - b);
+        const avg = latencies.length ? latencies.reduce((a, b) => a + b, 0) / latencies.length : 0;
+        const p95 = percentile(latencies, 95);
+        const ttftRows = db
+            .select({ v: schema.requests.ttftMs })
+            .from(schema.requests)
+            .where(and(...conds, sql `ttft_ms IS NOT NULL`))
+            .all();
+        const ttfts = ttftRows.map((r) => r.v).filter((v) => v !== null).sort((a, b) => a - b);
+        const avgTtft = ttfts.length ? ttfts.reduce((a, b) => a + b, 0) / ttfts.length : null;
+        const p95Ttft = ttfts.length ? percentile(ttfts, 95) : null;
+        const total = Number(summary?.total ?? 0);
+        const success = Number(summary?.success ?? 0);
+        const failed = Number(summary?.failed ?? 0);
+        const statsSummary = {
+            totalRequests: total,
+            successfulRequests: success,
+            failedRequests: failed,
+            successRate: total ? success / total : 0,
+            inputTokens: Number(summary?.inputTokens ?? 0),
+            outputTokens: Number(summary?.outputTokens ?? 0),
+            totalTokens: Number(summary?.inputTokens ?? 0) + Number(summary?.outputTokens ?? 0),
+            cacheReadTokens: Number(summary?.cacheRead ?? 0),
+            cacheWriteTokens: Number(summary?.cacheWrite ?? 0),
+            reasoningTokens: Number(summary?.reasoning ?? 0),
+            averageLatencyMs: avg,
+            p95LatencyMs: p95,
+            averageTtftMs: avgTtft,
+            p95TtftMs: p95Ttft,
+            cacheHitRate: success ? Number(summary?.cacheRead ?? 0) > 0 ? Number(summary?.cacheRead ?? 0) / Math.max(1, Number(summary?.inputTokens ?? 0) + Number(summary?.cacheRead ?? 0)) : 0 : 0,
+            gatewayCacheHitRate: total ? Number(summary?.gatewayCacheHits ?? 0) / total : 0,
+            fallbackRate: total ? Number(summary?.fallbacks ?? 0) / total : 0,
+        };
+        // Time-bucketed series
+        const bucketExpr = bucket === 'hour' ? sql `strftime('%Y-%m-%dT%H:00:00Z', created_at)` : sql `strftime('%Y-%m-%dT00:00:00Z', created_at)`;
+        const seriesRows = db
+            .select({
+            t: bucketExpr,
+            requests: sql `COUNT(*)`,
+            errors: sql `SUM(CASE WHEN success=0 THEN 1 ELSE 0 END)`,
+            inputTokens: sql `COALESCE(SUM(input_tokens),0)`,
+            outputTokens: sql `COALESCE(SUM(output_tokens),0)`,
+        })
+            .from(schema.requests)
+            .where(and(...conds))
+            .groupBy(bucketExpr)
+            .orderBy(bucketExpr)
+            .all();
+        // Top models
+        const topModels = db
+            .select({
+            modelId: schema.requests.finalModelId,
+            c: sql `COUNT(*)`,
+            err: sql `SUM(CASE WHEN success=0 THEN 1 ELSE 0 END)`,
+            tokens: sql `COALESCE(SUM(total_tokens),0)`,
+        })
+            .from(schema.requests)
+            .where(and(...conds))
+            .groupBy(schema.requests.finalModelId)
+            // Order by the aggregate expression itself: SQLite rejects ORDER BY on a
+            // quoted select alias ("no such column: c").
+            .orderBy(desc(sql `COUNT(*)`))
+            .limit(10)
+            .all();
+        const models = db.select().from(schema.models).all();
+        const modelMap = new Map(models.map((m) => [m.id, m]));
+        const topKeys = db
+            .select({
+            apiKeyId: schema.requests.apiKeyId,
+            c: sql `COUNT(*)`,
+            tokens: sql `COALESCE(SUM(total_tokens),0)`,
+        })
+            .from(schema.requests)
+            .where(and(...conds))
+            .groupBy(schema.requests.apiKeyId)
+            .orderBy(desc(sql `COUNT(*)`))
+            .limit(10)
+            .all();
+        const keys = db.select().from(schema.apiKeys).all();
+        const keyMap = new Map(keys.map((k) => [k.id, k]));
+        const topProviders = db
+            .select({
+            providerId: schema.requestAttempts.providerId,
+            c: sql `COUNT(*)`,
+            err: sql `SUM(CASE WHEN success=0 THEN 1 ELSE 0 END)`,
+        })
+            .from(schema.requestAttempts)
+            .where(and(gte(schema.requestAttempts.startedAt, fromIso), lte(schema.requestAttempts.startedAt, toIso)))
+            .groupBy(schema.requestAttempts.providerId)
+            .orderBy(desc(sql `COUNT(*)`))
+            .all();
+        const providers = db.select().from(schema.providers).all();
+        const providerMap = new Map(providers.map((p) => [p.id, p]));
+        const range = { from: fromIso, to: toIso, bucket };
+        return {
+            range,
+            summary: statsSummary,
+            series: seriesRows.map((r) => ({ t: r.t, requests: Number(r.requests), errors: Number(r.errors), inputTokens: Number(r.inputTokens), outputTokens: Number(r.outputTokens) })),
+            topModels: topModels.map((r) => ({
+                publicId: r.modelId ? modelMap.get(r.modelId)?.publicModelId ?? r.modelId : 'unknown',
+                requests: Number(r.c),
+                errorRate: Number(r.c) > 0 ? Number(r.err) / Number(r.c) : 0,
+                totalTokens: Number(r.tokens),
+            })),
+            topApiKeys: topKeys.map((r) => ({
+                name: r.apiKeyId ? keyMap.get(r.apiKeyId)?.name ?? 'deleted' : 'unknown',
+                requests: Number(r.c),
+                totalTokens: Number(r.tokens),
+            })),
+            topProviders: topProviders.map((r) => ({
+                name: providerMap.get(r.providerId)?.name ?? r.providerId,
+                slug: providerMap.get(r.providerId)?.slug ?? '',
+                requests: Number(r.c),
+                errorRate: Number(r.c) > 0 ? Number(r.err) / Number(r.c) : 0,
+            })),
+        };
+    });
+}
+function percentile(sorted, p) {
+    if (sorted.length === 0)
+        return 0;
+    const idx = Math.min(sorted.length - 1, Math.floor((p / 100) * sorted.length));
+    return sorted[idx];
+}

package/dist/server/routes/admin.js

@@ -0,0 +1,39 @@
+// Admin API routes (mounted at /api/admin/*). All require admin session auth.
+import { registerSetupRoutes } from './admin/setup.js';
+import { registerAuthRoutes } from './admin/auth.js';
+import { registerProviderRoutes } from './admin/providers.js';
+import { registerModelRoutes } from './admin/models.js';
+import { registerComboRoutes } from './admin/combos.js';
+import { registerAliasRoutes } from './admin/aliases.js';
+import { registerApiKeyRoutes } from './admin/api-keys.js';
+import { registerRequestRoutes } from './admin/requests.js';
+import { registerStatsRoutes } from './admin/stats.js';
+import { registerAuditRoutes } from './admin/audit.js';
+import { registerSettingsRoutes } from './admin/settings.js';
+import { registerBackupRoutes } from './admin/backup.js';
+import { registerDashboardRoutes } from './admin/dashboard.js';
+export async function registerAdminRoutes(app) {
+    // Setup routes are always reachable (used on first run).
+    await app.register(async (instance) => {
+        await registerSetupRoutes(instance);
+    });
+    // Auth routes (login/logout) are public and must NOT inherit the
+    // requireAdminAuth hook that the authenticated scope below adds.
+    await app.register(async (instance) => {
+        await registerAuthRoutes(instance);
+    });
+    // Authenticated admin routes
+    await app.register(async (instance) => {
+        await registerProviderRoutes(instance);
+        await registerModelRoutes(instance);
+        await registerComboRoutes(instance);
+        await registerAliasRoutes(instance);
+        await registerApiKeyRoutes(instance);
+        await registerRequestRoutes(instance);
+        await registerStatsRoutes(instance);
+        await registerAuditRoutes(instance);
+        await registerSettingsRoutes(instance);
+        await registerBackupRoutes(instance);
+        await registerDashboardRoutes(instance);
+    });
+}