feat: add GLM Coding usage/quota tracking with Z.AI session quota (#698)

* feat: add GLM Coding usage/quota tracking with Z.AI session quota Add GLM to the usage tracking pipeline: usage API route, Z.AI quota fetcher (TOKENS_LIMIT percentage-based), quota parser, and Provider Limits UI. Adds API region dropdown (International/China) to Add/Edit connection modals. Displays session quota with plan level. * fix: address PR review feedback for GLM usage tracking - Remove explicit `any` types from getGlmUsage (fix lint budget) - Fix empty string fallback for plan level - Remove duplicate `case "glm"` in quota parser (identical to default) - Skip OAuth refresh flow for GLM (API key auth) in usage route * fix: upgrade path-to-regexp to fix ReDoS vulnerability (GHSA-j3q9-mxjg-w52f, GHSA-27v5-c462-wpq7) --------- Co-authored-by: Chris Staley <christopher-s@users.noreply.github.com>
2026-08-02 21:32:10 +03:00 · 2026-03-28 17:39:24 -06:00
parent e6f0a780b7
commit 877cfa0071
7 changed files with 122 additions and 11 deletions
--- a/open-sse/services/usage.ts
+++ b/open-sse/services/usage.ts
@@ -100,13 +100,66 @@ function shouldDisplayGitHubQuota(quota: UsageQuota | null): quota is UsageQuota
  return quota.total > 0 || quota.remainingPercentage !== undefined;
 }

+// GLM (Z.AI) quota API config
+const GLM_QUOTA_URLS: Record<string, string> = {
+  international: "https://api.z.ai/api/monitor/usage/quota/limit",
+  china: "https://open.bigmodel.cn/api/monitor/usage/quota/limit",
+};
+
+async function getGlmUsage(apiKey: string, providerSpecificData?: Record<string, unknown>) {
+  const region = providerSpecificData?.apiRegion || "international";
+  const quotaUrl = GLM_QUOTA_URLS[region] || GLM_QUOTA_URLS.international;
+
+  const res = await fetch(quotaUrl, {
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      Accept: "application/json",
+    },
+  });
+
+  if (!res.ok) {
+    if (res.status === 401) throw new Error("Invalid API key");
+    throw new Error(`GLM quota API error (${res.status})`);
+  }
+
+  const json = await res.json();
+  const data = toRecord(json.data);
+  const limits: unknown[] = Array.isArray(data.limits) ? data.limits : [];
+  const quotas: Record<string, UsageQuota> = {};
+
+  for (const limit of limits) {
+    const src = toRecord(limit);
+    if (src.type !== "TOKENS_LIMIT") continue;
+
+    const usedPercent = toNumber(src.percentage, 0);
+    const resetMs = toNumber(src.nextResetTime, 0);
+    const remaining = Math.max(0, 100 - usedPercent);
+
+    quotas["session"] = {
+      used: usedPercent,
+      total: 100,
+      remaining,
+      remainingPercentage: remaining,
+      resetAt: resetMs > 0 ? new Date(resetMs).toISOString() : null,
+      unlimited: false,
+    };
+  }
+
+  const levelRaw = typeof data.level === "string" ? data.level : "";
+  const plan = levelRaw
+    ? levelRaw.charAt(0).toUpperCase() + levelRaw.slice(1).toLowerCase()
+    : "Unknown";
+
+  return { plan, quotas };
+}
+
 /**
 * Get usage data for a provider connection
 * @param {Object} connection - Provider connection with accessToken
 * @returns {Promise<unknown>} Usage data with quotas
 */
 export async function getUsageForProvider(connection) {
-  const { provider, accessToken, providerSpecificData } = connection;
+  const { provider, accessToken, apiKey, providerSpecificData } = connection;

  switch (provider) {
    case "github":
@@ -127,6 +180,8 @@ export async function getUsageForProvider(connection) {
      return await getQwenUsage(accessToken, providerSpecificData);
    case "iflow":
      return await getIflowUsage(accessToken);
+    case "glm":
+      return await getGlmUsage(apiKey, providerSpecificData);
    default:
      return { message: `Usage API not implemented for ${provider}` };
  }
--- a/package-lock.json
+++ b/package-lock.json
@@ -6346,9 +6346,9 @@
      }
    },
    "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.4",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.4.tgz",
-      "integrity": "sha512-h+DEnpVvxmfVefa4jFbCf5HdH5YMDXRsmKflpf1pILZWRFlTbJpxeU55nJl4Smt5HQaGzg1o6RHFPJaOqnmBDg==",
+      "version": "5.0.5",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
+      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -7574,9 +7574,9 @@
      "license": "MIT"
    },
    "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
--- a/src/app/(dashboard)/dashboard/providers/[id]/page.tsx
+++ b/src/app/(dashboard)/dashboard/providers/[id]/page.tsx
@@ -4289,6 +4289,7 @@ function AddApiKeyModal({
  const defaultBailianUrl = "https://coding-intl.dashscope.aliyuncs.com/apps/anthropic/v1";
  const isVertex = provider === "vertex";
  const defaultRegion = "us-central1";
+  const isGlm = provider === "glm";

  const [formData, setFormData] = useState({
    name: "",
@@ -4296,6 +4297,7 @@ function AddApiKeyModal({
    priority: 1,
    baseUrl: isBailian ? defaultBailianUrl : "",
    region: isVertex ? defaultRegion : "",
+    apiRegion: "international",
    validationModelId: "",
  });
  const [validating, setValidating] = useState(false);
@@ -4385,6 +4387,10 @@ function AddApiKeyModal({
        payload.providerSpecificData = {
          region: formData.region,
        };
+      } else if (isGlm) {
+        payload.providerSpecificData = {
+          apiRegion: formData.apiRegion,
+        };
      }

      const error = await onSave(payload);
@@ -4484,6 +4490,22 @@ function AddApiKeyModal({
            hint="ex: us-central1 ou europe-west4. Partner models usam a região global automaticamente."
          />
        )}
+        {isGlm && (
+          <div>
+            <label className="text-sm font-medium text-text-main mb-1 block">API Region</label>
+            <select
+              value={formData.apiRegion}
+              onChange={(e) => setFormData({ ...formData, apiRegion: e.target.value })}
+              className="w-full px-3 py-2 text-sm border border-border rounded-lg bg-background focus:outline-none focus:border-primary"
+            >
+              <option value="international">International (api.z.ai)</option>
+              <option value="china">China Mainland (open.bigmodel.cn)</option>
+            </select>
+            <p className="text-xs text-text-muted mt-1">
+              Select the endpoint region for API access and quota tracking.
+            </p>
+          </div>
+        )}
        <div className="flex gap-2">
          <Button
            onClick={handleSubmit}
@@ -4533,6 +4555,7 @@ function EditConnectionModal({ isOpen, connection, onSave, onClose }: EditConnec
    healthCheckInterval: 60,
    baseUrl: "",
    region: "",
+    apiRegion: "international",
    validationModelId: "",
    tag: "",
  });
@@ -4548,6 +4571,7 @@ function EditConnectionModal({ isOpen, connection, onSave, onClose }: EditConnec
  const isBailian = connection?.provider === "bailian-coding-plan";
  const defaultBailianUrl = "https://coding-intl.dashscope.aliyuncs.com/apps/anthropic/v1";
  const isVertex = connection?.provider === "vertex";
+  const isGlm = connection?.provider === "glm";
  const defaultRegion = "us-central1";

  useEffect(() => {
@@ -4563,6 +4587,7 @@ function EditConnectionModal({ isOpen, connection, onSave, onClose }: EditConnec
        healthCheckInterval: connection.healthCheckInterval ?? 60,
        baseUrl: existingBaseUrl || (isBailian ? defaultBailianUrl : ""),
        region: existingRegion || (isVertex ? defaultRegion : ""),
+        apiRegion: (connection.providerSpecificData?.apiRegion as string) || "international",
        validationModelId: (connection.providerSpecificData?.validationModelId as string) || "",
        tag: (connection.providerSpecificData?.tag as string) || "",
      });
@@ -4698,6 +4723,8 @@ function EditConnectionModal({ isOpen, connection, onSave, onClose }: EditConnec
          updates.providerSpecificData.baseUrl = validatedBailianBaseUrl;
        } else if (isVertex) {
          updates.providerSpecificData.region = formData.region;
+        } else if (isGlm) {
+          updates.providerSpecificData.apiRegion = formData.apiRegion;
        }
      } else {
        // Also persist tag for OAuth accounts
@@ -4832,6 +4859,23 @@ function EditConnectionModal({ isOpen, connection, onSave, onClose }: EditConnec
          />
        )}

+        {isGlm && (
+          <div>
+            <label className="text-sm font-medium text-text-main mb-1 block">API Region</label>
+            <select
+              value={formData.apiRegion}
+              onChange={(e) => setFormData({ ...formData, apiRegion: e.target.value })}
+              className="w-full px-3 py-2 text-sm border border-border rounded-lg bg-background focus:outline-none focus:border-primary"
+            >
+              <option value="international">International (api.z.ai)</option>
+              <option value="china">China Mainland (open.bigmodel.cn)</option>
+            </select>
+            <p className="text-xs text-text-muted mt-1">
+              Select the endpoint region for API access and quota tracking.
+            </p>
+          </div>
+        )}
+
        {/* T07: Extra API Keys for round-robin rotation */}
        {!isOAuth && (
          <div className="flex flex-col gap-2">
--- a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx
+++ b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/index.tsx
@@ -26,7 +26,7 @@ const PROVIDER_CONFIG = {
  kiro: { label: "Kiro AI", color: "#FF6B35" },
  codex: { label: "OpenAI Codex", color: "#10A37F" },
  claude: { label: "Claude Code", color: "#D97757" },
-  glm: { label: "GLM (Z.AI)", color: "#4A90D9" },
+  glm: { label: "GLM Coding", color: "#4A90D9" },
  "kimi-coding": { label: "Kimi Coding", color: "#1E3A8A" },
 };

--- a/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.tsx
+++ b/src/app/(dashboard)/dashboard/usage/components/ProviderLimits/utils.tsx
@@ -204,7 +204,6 @@ export function parseQuotaData(provider, data) {
        break;

      default:
-        // Generic fallback for unknown providers
        if (data.quotas) {
          Object.entries(data.quotas).forEach(([name, quota]: [string, any]) => {
            normalizedQuotas.push(normalizeQuotaEntry(name, quota));
--- a/src/app/api/usage/[connectionId]/route.ts
+++ b/src/app/api/usage/[connectionId]/route.ts
@@ -126,11 +126,23 @@ export async function GET(
      return Response.json({ error: "Connection not found" }, { status: 404 });
    }

-    // Only OAuth connections have usage APIs
-    if (connection.authType !== "oauth") {
+    // Only OAuth connections and specific API key providers have usage APIs
+    const apikeyUsageProviders = ["glm"];
+    if (connection.authType !== "oauth" && !apikeyUsageProviders.includes(connection.provider)) {
      return Response.json({ message: "Usage not available for API key connections" });
    }

+    // API key providers skip OAuth refresh — call usage fetcher directly
+    if (connection.authType !== "oauth") {
+      try {
+        const usageData = await getUsageForProvider(connection);
+        return Response.json(usageData);
+      } catch (error) {
+        console.error("[Usage API] Error fetching usage:", error);
+        return Response.json({ error: (error as any).message }, { status: 500 });
+      }
+    }
+
    // Resolve proxy for this connection FIRST (key → combo → provider → global → direct)
    // so that both credential refresh AND usage fetch go through the proxy.
    const proxyInfo = await resolveProxyForConnection(connectionId);
--- a/src/shared/constants/providers.ts
+++ b/src/shared/constants/providers.ts
@@ -661,6 +661,7 @@ export const USAGE_SUPPORTED_PROVIDERS = [
  "codex",
  "claude",
  "kimi-coding",
+  "glm",
 ];

 // ── Zod validation at module load (Phase 7.2) ──