wyxrouter 0.4.71

package/src/app/(dashboard)/dashboard/usage/components/UsageTable.js

@@ -0,0 +1,247 @@
+"use client";
+
+import { useState, useEffect, useCallback, useMemo, Fragment } from "react";
+import PropTypes from "prop-types";
+import Card from "@/shared/components/Card";
+import Badge from "@/shared/components/Badge";
+
+const fmt = (n) => new Intl.NumberFormat().format(n || 0);
+const fmtCost = (n) => `$${(n || 0).toFixed(2)}`;
+
+function fmtTime(iso) {
+  if (!iso) return "Never";
+  const diffMins = Math.floor((Date.now() - new Date(iso)) / 60000);
+  if (diffMins < 1) return "Just now";
+  if (diffMins < 60) return `${diffMins}m ago`;
+  if (diffMins < 1440) return `${Math.floor(diffMins / 60)}h ago`;
+  return new Date(iso).toLocaleDateString();
+}
+
+function SortIcon({ field, currentSort, currentOrder }) {
+  if (currentSort !== field) return <span className="ml-1 opacity-20">↕</span>;
+  return <span className="ml-1">{currentOrder === "asc" ? "↑" : "↓"}</span>;
+}
+
+SortIcon.propTypes = {
+  field: PropTypes.string.isRequired,
+  currentSort: PropTypes.string.isRequired,
+  currentOrder: PropTypes.string.isRequired,
+};
+
+/**
+ * Render 3 token or cost cells based on viewMode
+ */
+function ValueCells({ item, viewMode, isSummary = false }) {
+  if (viewMode === "tokens") {
+    return (
+      <>
+        <td className="px-6 py-3 text-right text-text-muted">
+          {isSummary && item.promptTokens === undefined ? "—" : fmt(item.promptTokens)}
+        </td>
+        <td className="px-6 py-3 text-right text-text-muted">
+          {isSummary && item.completionTokens === undefined ? "—" : fmt(item.completionTokens)}
+        </td>
+        <td className="px-6 py-3 text-right font-medium">
+          {fmt(item.totalTokens)}
+        </td>
+      </>
+    );
+  }
+  return (
+    <>
+      <td className="px-6 py-3 text-right text-text-muted">
+        {isSummary && item.inputCost === undefined ? "—" : fmtCost(item.inputCost)}
+      </td>
+      <td className="px-6 py-3 text-right text-text-muted">
+        {isSummary && item.outputCost === undefined ? "—" : fmtCost(item.outputCost)}
+      </td>
+      <td className="px-6 py-3 text-right font-medium text-warning">
+        {fmtCost(item.totalCost || item.cost)}
+      </td>
+    </>
+  );
+}
+
+ValueCells.propTypes = {
+  item: PropTypes.object.isRequired,
+  viewMode: PropTypes.string.isRequired,
+  isSummary: PropTypes.bool,
+};
+
+/**
+ * Reusable sortable usage table with expandable group rows.
+ *
+ * @param {object} props
+ * @param {string} props.title - Table title
+ * @param {Array} props.columns - Column definitions [{field, label}]
+ * @param {Array} props.groupedData - Grouped data from groupDataByKey
+ * @param {string} props.tableType - Table type key for sort URL params
+ * @param {string} props.sortBy - Current sort field
+ * @param {string} props.sortOrder - Current sort order
+ * @param {function} props.onToggleSort - Sort toggle handler
+ * @param {string} props.viewMode - "tokens" or "costs"
+ * @param {string} props.storageKey - localStorage key for expanded state
+ * @param {function} props.renderGroupLabel - Render group summary first cell content
+ * @param {function} props.renderDetailCells - Render detail row custom cells (before value cells)
+ * @param {function} props.renderSummaryCells - Render summary row cells after group label (placeholder cols)
+ * @param {string} props.emptyMessage - Empty state message
+ */
+export default function UsageTable({
+  title,
+  columns,
+  groupedData,
+  tableType,
+  sortBy,
+  sortOrder,
+  onToggleSort,
+  viewMode,
+  storageKey,
+  renderDetailCells,
+  renderSummaryCells,
+  emptyMessage,
+}) {
+  const [expanded, setExpanded] = useState(new Set());
+
+  // Load expanded state from localStorage
+  useEffect(() => {
+    try {
+      const saved = localStorage.getItem(storageKey);
+      if (saved) setExpanded(new Set(JSON.parse(saved)));
+    } catch (e) {
+      console.error(`Failed to load ${storageKey}:`, e);
+    }
+  }, [storageKey]);
+
+  // Save expanded state to localStorage
+  useEffect(() => {
+    try {
+      localStorage.setItem(storageKey, JSON.stringify([...expanded]));
+    } catch (e) {
+      console.error(`Failed to save ${storageKey}:`, e);
+    }
+  }, [expanded, storageKey]);
+
+  const toggleGroup = useCallback((groupKey) => {
+    setExpanded((prev) => {
+      const next = new Set(prev);
+      next.has(groupKey) ? next.delete(groupKey) : next.add(groupKey);
+      return next;
+    });
+  }, []);
+
+  const valueColumns = useMemo(() => {
+    if (viewMode === "tokens") {
+      return [
+        { field: "promptTokens", label: "Input Tokens" },
+        { field: "completionTokens", label: "Output Tokens" },
+        { field: "totalTokens", label: "Total Tokens" },
+      ];
+    }
+    return [
+      { field: "promptTokens", label: "Input Cost" },
+      { field: "completionTokens", label: "Output Cost" },
+      { field: "cost", label: "Total Cost" },
+    ];
+  }, [viewMode]);
+
+  const totalColSpan = columns.length + valueColumns.length;
+
+  return (
+    <Card className="overflow-hidden">
+      <div className="p-4 border-b border-border bg-bg-subtle/50">
+        <h3 className="font-semibold">{title}</h3>
+      </div>
+      <div className="overflow-x-auto">
+        <table className="w-full text-sm text-left">
+          <thead className="bg-bg-subtle/30 text-text-muted uppercase text-xs">
+            <tr>
+              {columns.map((col) => (
+                <th
+                  key={col.field}
+                  className={`px-6 py-3 cursor-pointer hover:bg-bg-subtle/50 ${col.align === "right" ? "text-right" : ""}`}
+                  onClick={() => onToggleSort(tableType, col.field)}
+                >
+                  {col.label}{" "}
+                  <SortIcon field={col.field} currentSort={sortBy} currentOrder={sortOrder} />
+                </th>
+              ))}
+              {valueColumns.map((col) => (
+                <th
+                  key={col.field}
+                  className="px-6 py-3 text-right cursor-pointer hover:bg-bg-subtle/50"
+                  onClick={() => onToggleSort(tableType, col.field)}
+                >
+                  {col.label}{" "}
+                  <SortIcon field={col.field} currentSort={sortBy} currentOrder={sortOrder} />
+                </th>
+              ))}
+            </tr>
+          </thead>
+          <tbody className="divide-y divide-border">
+            {groupedData.map((group) => (
+              <Fragment key={group.groupKey}>
+                {/* Group summary row */}
+                <tr
+                  className="group-summary cursor-pointer hover:bg-bg-subtle/50 transition-colors"
+                  onClick={() => toggleGroup(group.groupKey)}
+                >
+                  <td className="px-6 py-3">
+                    <div className="flex items-center gap-2">
+                      <span className={`material-symbols-outlined text-[18px] text-text-muted transition-transform ${expanded.has(group.groupKey) ? "rotate-90" : ""}`}>
+                        chevron_right
+                      </span>
+                      <span className={`font-medium transition-colors ${group.summary.pending > 0 ? "text-primary" : ""}`}>
+                        {group.groupKey}
+                      </span>
+                    </div>
+                  </td>
+                  {renderSummaryCells(group)}
+                  <ValueCells item={group.summary} viewMode={viewMode} isSummary />
+                </tr>
+                {/* Detail rows */}
+                {expanded.has(group.groupKey) && group.items.map((item) => (
+                  <tr
+                    key={`detail-${item.key}`}
+                    className="group-detail hover:bg-bg-subtle/20 transition-colors"
+                  >
+                    {renderDetailCells(item)}
+                    <ValueCells item={item} viewMode={viewMode} />
+                  </tr>
+                ))}
+              </Fragment>
+            ))}
+            {groupedData.length === 0 && (
+              <tr>
+                <td colSpan={totalColSpan} className="px-6 py-8 text-center text-text-muted">
+                  {emptyMessage}
+                </td>
+              </tr>
+            )}
+          </tbody>
+        </table>
+      </div>
+    </Card>
+  );
+}
+
+UsageTable.propTypes = {
+  title: PropTypes.string.isRequired,
+  columns: PropTypes.arrayOf(PropTypes.shape({
+    field: PropTypes.string.isRequired,
+    label: PropTypes.string.isRequired,
+    align: PropTypes.string,
+  })).isRequired,
+  groupedData: PropTypes.array.isRequired,
+  tableType: PropTypes.string.isRequired,
+  sortBy: PropTypes.string.isRequired,
+  sortOrder: PropTypes.string.isRequired,
+  onToggleSort: PropTypes.func.isRequired,
+  viewMode: PropTypes.string.isRequired,
+  storageKey: PropTypes.string.isRequired,
+  renderDetailCells: PropTypes.func.isRequired,
+  renderSummaryCells: PropTypes.func.isRequired,
+  emptyMessage: PropTypes.string.isRequired,
+};
+
+// Re-export utilities for use in UsageStats orchestrator
+export { fmt, fmtCost, fmtTime };

package/src/app/(dashboard)/dashboard/usage/page.js

@@ -0,0 +1,75 @@
+"use client";
+
+import { Suspense, useState } from "react";
+import { useSearchParams, useRouter } from "next/navigation";
+import { UsageStats, RequestLogger, CardSkeleton, SegmentedControl } from "@/shared/components";
+import RequestDetailsTab from "./components/RequestDetailsTab";
+
+const PERIODS = [
+  { value: "today", label: "Today" },
+  { value: "24h", label: "24h" },
+  { value: "7d", label: "7D" },
+  { value: "30d", label: "30D" },
+  { value: "60d", label: "60D" },
+];
+
+export default function UsagePage() {
+  return (
+    <Suspense fallback={<CardSkeleton />}>
+      <UsageContent />
+    </Suspense>
+  );
+}
+
+function UsageContent() {
+  const searchParams = useSearchParams();
+  const router = useRouter();
+
+  const [period, setPeriod] = useState("today");
+
+  const tabFromUrl = searchParams.get("tab");
+  const activeTab = tabFromUrl && ["overview", "logs", "details"].includes(tabFromUrl)
+    ? tabFromUrl
+    : "overview";
+
+  const handleTabChange = (value) => {
+    if (value === activeTab) return;
+    const params = new URLSearchParams(searchParams);
+    params.set("tab", value);
+    router.push(`/dashboard/usage?${params.toString()}`, { scroll: false });
+  };
+
+  return (
+    <div className="flex min-w-0 flex-col gap-6 px-1 sm:px-0">
+      {/* Tabs + period selector on same row */}
+      <div className="flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between">
+        <SegmentedControl
+          options={[
+            { value: "overview", label: "Overview" },
+            { value: "details", label: "Details" },
+          ]}
+          value={activeTab}
+          onChange={handleTabChange}
+          className="w-full sm:w-auto"
+        />
+        {activeTab === "overview" && (
+          <SegmentedControl
+            options={PERIODS}
+            value={period}
+            onChange={setPeriod}
+            size="sm"
+            className="w-full sm:w-auto"
+          />
+        )}
+      </div>
+
+      {activeTab === "overview" && (
+        <Suspense fallback={<CardSkeleton />}>
+          <UsageStats period={period} setPeriod={setPeriod} hidePeriodSelector />
+        </Suspense>
+      )}
+      {activeTab === "logs" && <RequestLogger />}
+      {activeTab === "details" && <RequestDetailsTab />}
+    </div>
+  );
+}

package/src/app/(dashboard)/layout.js

@@ -0,0 +1,6 @@
+import { DashboardLayout } from "@/shared/components";
+
+export default function DashboardRootLayout({ children }) {
+  return <DashboardLayout>{children}</DashboardLayout>;
+}
+

package/src/app/api/auth/login/route.js

@@ -0,0 +1,76 @@
+import { NextResponse } from "next/server";
+import { getSettings } from "@/lib/localDb";
+import bcrypt from "bcryptjs";
+import { cookies } from "next/headers";
+import { setDashboardAuthCookie } from "@/lib/auth/dashboardSession";
+import { isOidcConfigured } from "@/lib/auth/oidc";
+import { checkLock, recordFail, recordSuccess, getClientIp } from "@/lib/auth/loginLimiter";
+
+const RESET_HINT = "Forgot password? Reset to default via 9Router CLI → Settings → Reset Password to Default.";
+
+function isTunnelRequest(request, settings) {
+  const host = (request.headers.get("host") || "").split(":")[0].toLowerCase();
+  const tunnelHost = settings.tunnelUrl ? new URL(settings.tunnelUrl).hostname.toLowerCase() : "";
+  const tailscaleHost = settings.tailscaleUrl ? new URL(settings.tailscaleUrl).hostname.toLowerCase() : "";
+  return (tunnelHost && host === tunnelHost) || (tailscaleHost && host === tailscaleHost);
+}
+
+export async function POST(request) {
+  try {
+    const ip = getClientIp(request);
+    const lock = checkLock(ip);
+    if (lock.locked) {
+      return NextResponse.json(
+        { error: `Too many failed attempts. Try again in ${lock.retryAfter}s. ${RESET_HINT}`, retryAfter: lock.retryAfter, resetHint: RESET_HINT },
+        { status: 429, headers: { "Retry-After": String(lock.retryAfter) } }
+      );
+    }
+
+    const { password } = await request.json();
+    const settings = await getSettings();
+
+    // Block login via tunnel/tailscale if dashboard access is disabled
+    if (isTunnelRequest(request, settings) && settings.tunnelDashboardAccess !== true) {
+      return NextResponse.json({ error: "Dashboard access via tunnel is disabled" }, { status: 403 });
+    }
+
+    // Default password is '123456' if not set
+    const storedHash = settings.password;
+
+    if (settings.authMode === "oidc" && isOidcConfigured(settings)) {
+      return NextResponse.json({ error: "Password login is disabled. Use OIDC sign in." }, { status: 403 });
+    }
+
+    let isValid = false;
+    if (storedHash) {
+      isValid = await bcrypt.compare(password, storedHash);
+    } else {
+      // Use env var or default
+      const initialPassword = process.env.INITIAL_PASSWORD || "123456";
+      isValid = password === initialPassword;
+    }
+
+    if (isValid) {
+      recordSuccess(ip);
+      const cookieStore = await cookies();
+      await setDashboardAuthCookie(cookieStore, request);
+
+      return NextResponse.json({ success: true });
+    }
+
+    const { remainingBeforeLock } = recordFail(ip);
+    const postLock = checkLock(ip);
+    if (postLock.locked) {
+      return NextResponse.json(
+        { error: `Too many failed attempts. Try again in ${postLock.retryAfter}s. ${RESET_HINT}`, retryAfter: postLock.retryAfter, resetHint: RESET_HINT },
+        { status: 429, headers: { "Retry-After": String(postLock.retryAfter) } }
+      );
+    }
+    return NextResponse.json(
+      { error: `Invalid password. ${remainingBeforeLock} attempt(s) left before lockout.`, remainingBeforeLock },
+      { status: 401 }
+    );
+  } catch (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+}

package/src/app/api/auth/logout/route.js

@@ -0,0 +1,12 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import { clearDashboardAuthCookie } from "@/lib/auth/dashboardSession";
+
+export async function POST() {
+  const cookieStore = await cookies();
+  clearDashboardAuthCookie(cookieStore);
+  cookieStore.delete("oidc_state");
+  cookieStore.delete("oidc_nonce");
+  cookieStore.delete("oidc_code_verifier");
+  return NextResponse.json({ success: true });
+}

package/src/app/api/auth/oidc/callback/route.js

@@ -0,0 +1,87 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import {
+  exchangeOidcCode,
+  fetchOidcDiscovery,
+  getOidcRuntimeConfig,
+  getPublicOrigin,
+  pickOidcDisplayName,
+  pickOidcEmail,
+  verifyOidcIdToken,
+} from "@/lib/auth/oidc";
+import { setDashboardAuthCookie } from "@/lib/auth/dashboardSession";
+
+function clearOidcCookies(cookieStore) {
+  cookieStore.delete("oidc_state");
+  cookieStore.delete("oidc_nonce");
+  cookieStore.delete("oidc_code_verifier");
+}
+
+export async function GET(request) {
+  const url = new URL(request.url);
+  const error = url.searchParams.get("error");
+  if (error) {
+    return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(error)}`, getPublicOrigin(request)));
+  }
+
+  const code = url.searchParams.get("code");
+  const state = url.searchParams.get("state");
+  if (!code || !state) {
+    return NextResponse.redirect(new URL("/login?error=oidc_missing_code", getPublicOrigin(request)));
+  }
+
+  const cookieStore = await cookies();
+  const storedState = cookieStore.get("oidc_state")?.value;
+  const storedNonce = cookieStore.get("oidc_nonce")?.value;
+  const codeVerifier = cookieStore.get("oidc_code_verifier")?.value;
+
+  if (!storedState || !storedNonce || !codeVerifier || storedState !== state) {
+    clearOidcCookies(cookieStore);
+    return NextResponse.redirect(new URL("/login?error=oidc_invalid_state", getPublicOrigin(request)));
+  }
+
+  try {
+    const config = await getOidcRuntimeConfig();
+    if (!config) {
+      clearOidcCookies(cookieStore);
+      return NextResponse.redirect(new URL("/login?error=oidc_not_configured", getPublicOrigin(request)));
+    }
+
+    const discovery = await fetchOidcDiscovery(config.issuerUrl);
+    const discoveredIssuer = discovery.issuer || config.issuerUrl;
+    const redirectUri = `${getPublicOrigin(request)}/api/auth/oidc/callback`;
+    const tokenData = await exchangeOidcCode({
+      tokenEndpoint: discovery.token_endpoint,
+      clientId: config.clientId,
+      clientSecret: config.clientSecret,
+      code,
+      redirectUri,
+      codeVerifier,
+    });
+
+    if (!tokenData.id_token) {
+      throw new Error("OIDC provider did not return an id_token");
+    }
+
+    const payload = await verifyOidcIdToken({
+      idToken: tokenData.id_token,
+      issuer: discoveredIssuer,
+      audience: config.clientId,
+      jwksUri: discovery.jwks_uri,
+      nonce: storedNonce,
+    });
+
+    clearOidcCookies(cookieStore);
+    await setDashboardAuthCookie(cookieStore, request, {
+      oidc: true,
+      oidcSub: payload.sub || null,
+      oidcEmail: pickOidcEmail(payload) || null,
+      oidcName: pickOidcDisplayName(payload),
+    });
+
+    return NextResponse.redirect(new URL("/dashboard", getPublicOrigin(request)));
+  } catch (error) {
+    clearOidcCookies(cookieStore);
+    return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(error.message || "oidc_callback_failed")}`, getPublicOrigin(request)));
+  }
+}

package/src/app/api/auth/oidc/start/route.js

@@ -0,0 +1,52 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import {
+  buildOidcAuthorizationUrl,
+  createOidcNonce,
+  createOidcState,
+  createPkcePair,
+  fetchOidcDiscovery,
+  getOidcRuntimeConfig,
+  getPublicOrigin,
+} from "@/lib/auth/oidc";
+import { shouldUseSecureCookie } from "@/lib/auth/dashboardSession";
+
+export async function GET(request) {
+  try {
+    const config = await getOidcRuntimeConfig();
+    if (!config) {
+      return NextResponse.redirect(new URL("/login?error=oidc_not_configured", getPublicOrigin(request)));
+    }
+
+    const discovery = await fetchOidcDiscovery(config.issuerUrl);
+    const state = createOidcState();
+    const nonce = createOidcNonce();
+    const { verifier, challenge } = createPkcePair();
+    const redirectUri = `${getPublicOrigin(request)}/api/auth/oidc/callback`;
+    const authUrl = buildOidcAuthorizationUrl({
+      authorizationEndpoint: discovery.authorization_endpoint,
+      clientId: config.clientId,
+      redirectUri,
+      scopes: config.scopes,
+      state,
+      nonce,
+      codeChallenge: challenge,
+    });
+
+    const cookieStore = await cookies();
+    const baseOptions = {
+      httpOnly: true,
+      secure: shouldUseSecureCookie(request),
+      sameSite: "lax",
+      path: "/",
+      maxAge: 10 * 60,
+    };
+    cookieStore.set("oidc_state", state, baseOptions);
+    cookieStore.set("oidc_nonce", nonce, baseOptions);
+    cookieStore.set("oidc_code_verifier", verifier, baseOptions);
+
+    return NextResponse.redirect(authUrl);
+  } catch (error) {
+    return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(error.message || "oidc_start_failed")}`, getPublicOrigin(request)));
+  }
+}

package/src/app/api/auth/oidc/test/route.js

@@ -0,0 +1,84 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import { getSettings } from "@/lib/localDb";
+import { fetchOidcDiscovery, getPublicOrigin, probeOidcClientSecret } from "@/lib/auth/oidc";
+import { verifyDashboardAuthToken } from "@/lib/auth/dashboardSession";
+
+async function canAccessTestRoute() {
+  const settings = await getSettings();
+  if (settings.requireLogin === false) return true;
+
+  const cookieStore = await cookies();
+  const token = cookieStore.get("auth_token")?.value;
+  return await verifyDashboardAuthToken(token);
+}
+
+export async function POST(request) {
+  try {
+    if (!(await canAccessTestRoute())) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const body = await request.json().catch(() => ({}));
+    const settings = await getSettings();
+
+    const issuerUrl = String(body.issuerUrl || settings.oidcIssuerUrl || "").trim();
+    const clientId = String(body.clientId || settings.oidcClientId || "").trim();
+    const scopes = String(body.scopes || settings.oidcScopes || "openid profile email").trim() || "openid profile email";
+    const clientSecret = String(
+      Object.prototype.hasOwnProperty.call(body, "clientSecret")
+        ? body.clientSecret
+        : settings.oidcClientSecret || ""
+    ).trim();
+
+    if (!issuerUrl) {
+      return NextResponse.json({ error: "Issuer URL is required" }, { status: 400 });
+    }
+    if (!clientId) {
+      return NextResponse.json({ error: "Client ID is required" }, { status: 400 });
+    }
+
+    const discovery = await fetchOidcDiscovery(issuerUrl);
+    const redirectUri = `${getPublicOrigin(request)}/api/auth/oidc/callback`;
+    const secretProbe = await probeOidcClientSecret({
+      tokenEndpoint: discovery.token_endpoint,
+      clientId,
+      clientSecret,
+      redirectUri,
+    });
+
+    if (secretProbe.tested && secretProbe.valid === false) {
+      return NextResponse.json({
+        ok: false,
+        discoveryOk: true,
+        clientSecretTested: true,
+        clientSecretValid: false,
+        issuerUrl,
+        clientId,
+        scopes,
+        redirectUri,
+        authorizationEndpoint: discovery.authorization_endpoint || "",
+        tokenEndpoint: discovery.token_endpoint || "",
+        jwksUri: discovery.jwks_uri || "",
+        error: `Discovery loaded, but the client secret is not valid: ${secretProbe.message}`,
+      });
+    }
+
+    return NextResponse.json({
+      ok: true,
+      discoveryOk: true,
+      clientSecretTested: secretProbe.tested,
+      clientSecretValid: secretProbe.valid,
+      issuerUrl,
+      clientId,
+      scopes,
+      redirectUri,
+      authorizationEndpoint: discovery.authorization_endpoint || "",
+      tokenEndpoint: discovery.token_endpoint || "",
+      jwksUri: discovery.jwks_uri || "",
+      message: secretProbe.message,
+    });
+  } catch (error) {
+    return NextResponse.json({ error: error.message || "OIDC test failed" }, { status: 500 });
+  }
+}

package/src/app/api/auth/status/route.js

@@ -0,0 +1,45 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import { getSettings } from "@/lib/localDb";
+import { isOidcConfigured } from "@/lib/auth/oidc";
+import { getDashboardAuthSession } from "@/lib/auth/dashboardSession";
+
+export async function GET() {
+  try {
+    const settings = await getSettings();
+    const cookieStore = await cookies();
+    const session = await getDashboardAuthSession(cookieStore.get("auth_token")?.value);
+    const requireLogin = settings.requireLogin !== false;
+    const authMode = settings.authMode || "password";
+    const oidcName = String(session?.oidcName || "").trim();
+    const oidcEmail = String(session?.oidcEmail || "").trim();
+    const displayName = oidcName || oidcEmail || (session?.oidc ? "OIDC user" : "Password user");
+    const loginMethod = session?.oidc ? "OIDC" : "Password";
+
+    return NextResponse.json({
+      requireLogin,
+      authMode,
+      oidcConfigured: isOidcConfigured(settings),
+      oidcLoginLabel: (settings.oidcLoginLabel || "Sign in with OIDC").trim() || "Sign in with OIDC",
+      hasPassword: !!settings.password,
+      displayName,
+      loginMethod,
+      oidcName: oidcName || null,
+      oidcEmail: oidcEmail || null,
+      oidcLogin: !!session?.oidc,
+    });
+  } catch {
+    return NextResponse.json({
+      requireLogin: true,
+      authMode: "password",
+      oidcConfigured: false,
+      oidcLoginLabel: "Sign in with OIDC",
+      hasPassword: false,
+      displayName: "Password user",
+      loginMethod: "Password",
+      oidcName: null,
+      oidcEmail: null,
+      oidcLogin: false,
+    });
+  }
+}