jpscott84/drinktracker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Give members their own budget-capped gateway key

Browse Source 
Members share the owner's AI budget, so each now gets a Switchboard key
minted on first use with a daily cap and a per-request ceiling. That
gives real spend limits and per-user attribution: the app's own rate
limiter lives in memory and resets on every deploy, so it could never be
a spend control. The gateway enforces the caps and answers 402
guardrail, which the error mapper already turns into a budget message.

Resolution order is the user's own key, then mint, then borrow the
owner's key for a single request if the gateway is unreachable - a
served request beats a hard failure, and the fallback logs loudly
because no per-user cap applies to it. The owner key is used only for
minting, never for inference.

API key management is now owner-only, enforced on GET, POST and DELETE.
GET matters as much as POST because it returns the masked key and the
gateway URL. Settings became a server component so the role is known
before first render: members never see the card and never issue the
request, rather than having it flash and disappear.

AiCall records one row per request from the gateway's own response
metadata, so member spend is queryable instead of a journald grep. The
write is fire-and-forget - tracking must never fail a working request.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
JP
2026-08-08 21:16:14 +00:00
parent c81d1eefb3
commit 34afc497f4
8 changed files with 679 additions and 443 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
src/app/api/settings/api-keys/route.ts
View File

@@ -1,15 +1,15 @@
import { NextResponse } from "next/server"
import { auth } from "@/lib/auth"
import { requireOwner } from "@/lib/authz"
import { prisma } from "@/lib/prisma"
import { encrypt, decrypt, maskApiKey } from "@/lib/encryption"
import { apiKeySchema } from "@/lib/validators"
import { switchboardBaseUrl } from "@/lib/ai/switchboard-provider"
export async function GET() {
const session = await auth()
if (!session?.user?.id) {
return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
}
// Owner only: members share the owner's gateway budget via a minted key and never
// manage one themselves. GET matters as much as POST - it returns the masked key.
const session = await requireOwner()
if (session instanceof NextResponse) return session
const apiKeys = await prisma.userApiKey.findMany({
where: { userId: session.user.id },
@@ -51,10 +51,10 @@ export async function GET() {
}
export async function POST(request: Request) {
const session = await auth()
if (!session?.user?.id) {
return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
}
// Owner only: members share the owner's gateway budget via a minted key and never
// manage one themselves. GET matters as much as POST - it returns the masked key.
const session = await requireOwner()
if (session instanceof NextResponse) return session
try {
const body = await request.json()
@@ -119,10 +119,10 @@ export async function POST(request: Request) {
}
export async function DELETE(request: Request) {
const session = await auth()
if (!session?.user?.id) {
return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
}
// Owner only: members share the owner's gateway budget via a minted key and never
// manage one themselves. GET matters as much as POST - it returns the masked key.
const session = await requireOwner()
if (session instanceof NextResponse) return session
const { searchParams } = new URL(request.url)
const provider = searchParams.get("provider")