3 Commits

Author	SHA1	Message	Date
Diego Rodrigues de Sa e Souza	d86ea99713	feat(radar): referral links — free-credits tab + default provider link (#9697) ... * feat(radar): client-side schema + accessor for referral links (D28) Server already publishes a signed `referrals` section on the Radar feed ({fixed, campaigns}); this adds the client mirror: RadarFeedSchema gains a `.default()`-backed `referrals` field (old cached feeds without it stay valid) with https-only url validation, and src/lib/radar/index.ts exposes getRadarReferrals()/getDefaultReferralFor() (never throw: flag off, no cache, or a corrupt/old payload all resolve to the empty shape). The provider-default lookup itself lives in a new DB-free src/lib/radar/ referrals.ts so it stays safe to import from a "use client" component. * feat(radar): add GET /api/radar/referrals route (D28) Local-only route mirroring the /api/radar/catalog gate order: RADAR_ENABLED off => 404 before any auth check (byte-identical flag-off inertia), unauthenticated => 401, otherwise 200 with {fixed, campaigns, tier} read straight from the local cache. Never proxies the private feed server. * feat(dashboard): add "free credits" tab to the Radar page (D28) Reuses the existing /dashboard/radar page instead of a new route (less routing/i18n surface): a second tab lists fixed referral links (grouped by provider, with requiredAction + an external-link button) and temporary campaigns (with validUntil). When campaigns is empty and the served tier is community, shows a soft upsell note — never gates the fixed links list, which stays fully populated on every tier. Adds 10 new radarPage i18n keys (English fallback) to all 43 locale files to avoid dropping i18n-ui-coverage below threshold. * feat(providers): use Radar default referral link on the provider name (D28) ProviderPageHeader already linked the provider name to providerInfo.website with a precedent for a monetized link (the Kimi partner-link note); this lets a Radar default referral override that URL, reusing the exact same discreet note instead of a new visual treatment. Loose coupling: resolveProviderHeaderLink() in providerPageUtils.ts is a pure function with no @/lib/radar or @/lib/db/* import (asserted by the new test), so the providers dashboard never depends on the DB-touching Radar module to render. ProviderDetailPageClient (a "use client" component) is the only place that fetches Radar data, via the local /api/radar/referrals route (same pattern the Radar page itself uses) and the DB-free findDefaultReferral() helper. With RADAR_ENABLED off, no cache, or no default referral for the provider, the header renders byte-identical to before this feature existed. * docs(radar): document referral links / free credits (D28) Adds a "Referral links (free credits)" section covering the referrals feed shape, the getRadarReferrals()/getDefaultReferralFor() accessors, the new GET /api/radar/referrals route, the Radar page's "Free credits" tab, and the loosely-coupled referral link on the provider-name header. Also corrects the local-routes count (four -> five) now that /api/radar/ referrals exists. --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>	2026-08-07 10:17:46 -03:00
Diego Rodrigues de Sa e Souza	1e15583f29	fix(radar): close audit gaps (auth, feed fields, opt-in state, sidebar gate, size cap) + daily sync scheduler (#9686) ... * fix(radar): preserve extended feed fields and honor local enable override applyFeed()'s MergedEntry shape omitted contextWindow/capabilities/limits/ setup even though FeedModel always carries them, so the dashboard's setup link, Context column, and capability badges never rendered and the setup page's provider lookup always failed. Both merge paths (mergeOne and feedModelToMerged) now copy the four fields through, respecting rule 1 (local override wins) same as every other field. feedModelToMerged() also unconditionally forced enabled:false when the feed disabled a feed-only entry, even when the operator had locally overridden enabled:true — mergeOne() already applies overrides after the disable rule and got this right. feedModelToMerged() now only force-disables when there is no local `enabled` override, matching mergeOne()'s semantics. * fix(radar): cap feed sync response body at 10MB syncRadar() buffered the entire feed response via Buffer.from(await res.arrayBuffer()) with no size limit, so a misconfigured or hostile RADAR_FEED_URL (or an upstream serving garbage) could force an unbounded in-memory buffer. Enforcement is two-layered: a Content-Length preflight skips reading an already-oversized body entirely, and a running-total check while reading the stream enforces the cap even when Content-Length is absent or understates the real size — concatenating the accumulated chunks preserves the exact bytes the signature check needs. Exceeding the cap returns a new { status: "too_large" } SyncStatus and leaves the cache untouched, following the same non-destructive pattern as every other sync failure (invalid_signature/invalid_schema/stale). * fix(radar): gate the sidebar radar item behind RADAR_ENABLED The "radar" sidebar item was registered unconditionally in sidebarVisibility/sections.ts, but Sidebar.tsx has no feature-flag awareness (it's a client component), so the link stayed visible and clickable with RADAR_ENABLED off, landing on a 404 dashboard page. Sidebar items gain an opt-in `featureFlagKey` field plus a pure isSidebarItemVisibleForFlags() filter (fails open when a flag isn't in the map, so a missing/not-yet-loaded key never hides an unrelated item). The resolved flag value piggy-backs on the /api/settings response the sidebar already fetches on mount (new `radarEnabled` field) rather than adding a dedicated round trip. * fix(radar): require auth on management routes, add GET settings GET /api/radar/catalog, POST /api/radar/sync, and POST /api/radar/settings had zero authentication — any client that could reach the local server could read the merged catalog, trigger a sync, or flip the opt-in/set the supporter key. All three (plus the new GET below) now call isAuthenticated() from the shared apiAuth guard, same gate as the rest of /api/settings/*. The RADAR_ENABLED flag-off 404 check keeps running FIRST so flag-off inertia stays byte-identical (no auth prompt just to learn the surface doesn't exist); auth runs after it, before any DB access. Adds GET /api/radar/settings, returning { optIn, hasSupporterKey, supporterKeyMasked } — the raw key never leaves the server on either verb. The dashboard page's fetchSettings() now calls this endpoint instead of inferring opt-in state from the catalog response (which always defaulted to unknown/null), so an already-activated operator no longer sees the activation screen on every reload. handleSync() also handles the new too_large sync status introduced by the response-cap fix, reusing the existing generic sync-failed copy (no new UI strings). * docs(radar): fix stale feed URL, document tier header/auth/size cap - RADAR_FEED_URL default was documented as radar.omniroute.dev in ENVIRONMENT.md; the actual default (src/lib/radar/sync.ts) and every other reference use radar.omniroute.online — fix the one stale spot. - Correct the FREE_MODEL_BUDGETS source path: it's declared in freeModelCatalog.data.ts, not freeModelCatalog.ts (which only re-exports it). - Document that the signed feed body's `tier` is always "live" (one signed artifact per version) and the actually-served tier comes from the `x-omniroute-feed-tier` response header, resolved with a Zod parse + fallback to the body field. - Document that all four /api/radar/* routes now require auth (isAuthenticated(), same gate as /api/settings/*), the new GET /api/radar/settings route, and the new too_large sync status from the 10MB response cap. * feat(radar): daily sync scheduler + auto-sync on page open Spec asks for a 1x/day sync while opted in and fresh data on every page open. The scheduler only arms itself when RADAR_ENABLED AND the opt-in are already on (boot) or right after the user opts in (settings route) — a flag-off install never creates the timer, preserving the inertia contract. The page auto-syncs once per mount when the cached feed is older than 6h. --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>	2026-08-07 08:26:18 -03:00
Diego Rodrigues de Sa e Souza	e7f6b1d130	feat(radar): flag-gated signed free-model catalog overlay (#9515) ... * feat(dashboard): add RADAR_ENABLED flag (default off) * feat(db): radar feed cache + settings with encrypted supporter key * feat(radar): signed feed sync with pinned key and version floor - feedSchema.ts: Zod v4 schema mirroring the server feed format (discriminated union on budget.kind, enum constraints, etc.) - pinnedKeys.ts: Ed25519 SPKI-DER pinned key + env override for forks - verify.ts: signature verification over exact wire bytes, never throws - sync.ts: full download/verify/validate/cache pipeline with injectable deps, feature-flag gate, opt-in gate, version floor (numeric compare), and sanitized error reasons (no stack traces) - 40 tests covering: contract hash, key handling, sig verification, schema validation, version compare, all sync paths (disabled, opt_out, invalid_signature, invalid_schema, stale, updated, error), auth header injection, and cache-untouched assertions for every failure mode * feat(radar): read-time overlay merge rules over the free catalog Pure function applyFeed() merges the cached Radar feed over the static baseline catalog at read time, honoring 4 rules: 1. Feed never overwrites a local override field. 2. enabled:false disables the entry with disabledBy:"radar" provenance. 3. User-added entry NOT in the feed survives untouched. 4. User deletion tombstone prevents feed resurrection. getRadarCatalog() accessor in index.ts: flag off / no cache / corrupt payload all fall back to baseline. Valid cache applies the overlay and returns feed metadata (version, tier, fetchedAt). TDD: 19 tests (4 rules + dedup + origin + accessor flag/cache/corrupt/ valid/bad-feed + baselineToMergedEntries converter). * feat(dashboard): radar catalog and guided setup screens - API routes: GET /api/radar/catalog, POST /api/radar/sync, POST /api/radar/settings - All gated on RADAR_ENABLED flag (404 when off) - Error responses via buildErrorBody(), never raw stack/message - Settings never echoes clear supporter key (masked omr_****<last4>) - Sync delegates to syncRadar() server-side, never proxies feed URL - Dashboard pages: - /dashboard/radar: 4 states (flag off, opt-in pending, empty, populated) - /dashboard/radar/setup?provider=X: guided setup with steps, key URL, test connection - Uses existing Card component and next-intl patterns - Sidebar: radar entry in costs group with icon - i18n: pt-BR and en keys for radarPage and radarSetupPage namespaces - Tests: - radar-api-routes.test.ts: 11 tests (flag-off 404, flag-on shape, error sanitization) - radar-page-state.test.ts: 5 tests (pure state logic) - All 90 radar tests pass (including prior 74) * docs(radar): module doc and flag-off inertia test Add docs/frameworks/RADAR.md covering the flag gate, the separate data-sync opt-in and privacy promise, the Ed25519 signature/pinned-key security model, tiers, the read-time overlay merge rules, and the self-hosting env vars — plus index entries in CLAUDE.md/AGENTS.md/docs/README.md/REPOSITORY_MAP.md. Document RADAR_FEED_URL and RADAR_FEED_PUBKEY in .env.example and docs/reference/ENVIRONMENT.md to satisfy check:env-doc-sync, which was failing on this branch since the sync.ts commit added the reads. Add tests/unit/radar-inertia.test.ts as the single canonical place asserting the "RADAR_ENABLED off => zero behavioral delta" claim end to end: the three /api/radar/* routes 404, the flag resolves to the definition default with no override, getRadarCatalog() returns exactly the baseline without touching the cache, and computeFreeModelTotals() keeps its pinned values with the Radar module imported alongside it. * fix(db): renumber radar migration to 135 after collision with 134 The base branch introduced 134_proxy_logs_egress_ip while this branch carried 134_radar_cache_settings; the migration runner rejects duplicate numeric prefixes. This migration has never been applied to a real database (the PR is unmerged), so no retroactive isSchemaAlreadyApplied guard is needed. * i18n(radar): translate radar catalog and setup strings to all locales The UI-coverage ratchet measures (present - placeholder) / total_en, so the __MISSING__ sentinels that i18n:sync-ui writes do not count as covered — only real translations restore the metric. Scoped to this PR's namespaces (radarPage, radarSetupPage, sidebar.radar*) instead of a bulk sync, which would have pulled ~978 unrelated pending keys into this diff. Placeholders and code identifiers verified preserved across all 1682 strings. * fix(radar): trust the served-tier header instead of the signed body field The signed feed body always carries tier:"live" by design (one signed artifact per version — rewriting the field server-side per request would break the exact-bytes Ed25519 signature). The server now returns the tier ACTUALLY served via the x-omniroute-feed-tier response header, so free users on a delayed community snapshot no longer see "Ao vivo (tempo real)" in the UI. sync.ts now reads and validates that header (falling back to the body's tier only when the header is absent or holds an unrecognized value) and stores the served tier in the cache; index.ts already surfaces cache.tier to the UI unchanged. * test(combo): shorten an assert message that exceeded the line limit The assertion added by #9507 was 104 chars, so prettier reformatted it into five lines on the next commit that touched the file, pushing it past its frozen size (3449) and failing check:file-size. The message is shortened (the issue reference stays in the comment directly above); the assertion itself is unchanged, and the file is back to 3448 lines and prettier-clean. * i18n(radar): use the canonical zh-TW glossary terms The machine translation produced retired renderings the glossary gate blocks: 供應商 for provider (canonical 提供者) and 文檔 for documentation (canonical 文件). Fixed across the 11 affected radar strings; tests/unit/i18n-glossary-consistency-check.test.ts is back to 17/17. * fix(radar): point the default feed URL at the domain that exists radar.omniroute.dev was a placeholder for a domain that was never registered, so an out-of-the-box sync would fail DNS resolution for every user. The live feed is served from radar.omniroute.online (the subdomain the design always specified), now behind Cloudflare TLS. Forks still override it via RADAR_FEED_URL. --------- Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>	2026-08-06 05:58:58 -03:00