1. 1//! Provider-side account diagnostics that are safe to expose to operators.
2. 2//!
3. 3//! Credentials are used only for the request and are never included in the
4. 4//! returned status or error text.
5. 5
6. 6use serde::Serialize;
7. 7use std::time::Duration;
8. 8
9. 9use crate::error::LlmError;
10. 10use crate::registry::ProviderAuth;
11. 11
12. 12#[derive(Debug, Clone, Serialize)]
13. 13pub struct ProviderStatus {
14. 14 pub provider: String,
15. 15 pub reachable: bool,
16. 16 pub authenticated: bool,
17. 17 pub key_kind: Option<String>,
18. 18 pub is_free_tier: Option<bool>,
19. 19 pub usage_usd: Option<f64>,
20. 20 pub usage_daily_usd: Option<f64>,
21. 21 pub usage_monthly_usd: Option<f64>,
22. 22 pub limit_usd: Option<f64>,
23. 23 pub limit_remaining_usd: Option<f64>,
24. 24 pub credits_usd: Option<f64>,
25. 25 pub rate_limit_requests: Option<i64>,
26. 26 pub rate_limit_interval: Option<String>,
27. 27}
28. 28
29. 29fn client() -> Result<reqwest::Client, LlmError> {
30. 30 reqwest::Client::builder()
31. 31 .timeout(Duration::from_secs(15))
32. 32 .build()
33. 33 .map_err(|e| LlmError::Network(e.to_string()))
34. 34}
35. 35
36. 36async fn json(response: reqwest::Response) -> Result<(u16, serde_json::Value), LlmError> {
37. 37 let status = response.status().as_u16();
38. 38 let body = response
39. 39 .text()
40. 40 .await
41. 41 .map_err(|e| LlmError::Network(e.to_string()))?;
42. 42 let value = serde_json::from_str(&body).map_err(|e| LlmError::Parse(e.to_string()))?;
43. 43 Ok((status, value))
44. 44}
45. 45
46. 46fn status_error(status: u16, value: &serde_json::Value, secret: &str) -> LlmError {
47. 47 let message = value
48. 48 .get("error")
49. 49 .and_then(|error| error.get("message"))
50. 50 .and_then(serde_json::Value::as_str)
51. 51 .unwrap_or("provider status request failed")
52. 52 .chars()
53. 53 .take(400)
54. 54 .collect::<String>();
55. 55 let message = if secret.is_empty() {
56. 56 message
57. 57 } else {
58. 58 message.replace(secret, "[redacted]")
59. 59 };
60. 60 match status {
61. 61 401 | 403 => LlmError::Auth(message),
62. 62 429 => LlmError::RateLimit {
63. 63 message,
64. 64 retry_after_secs: None,
65. 65 },
66. 66 _ => LlmError::Api { status, message },
67. 67 }
68. 68}
69. 69
70. 70fn number(value: Option<&serde_json::Value>) -> Option<f64> {
71. 71 value.and_then(serde_json::Value::as_f64)
72. 72}
73. 73
74. 74/// Inspect provider account metadata when the provider publishes it.
75. 75/// OpenRouter is currently the only built-in provider with a documented
76. 76/// authenticated key and credit introspection endpoint.
77. 77pub async fn inspect(provider: &str, auth: &ProviderAuth) -> Result<ProviderStatus, LlmError> {
78. 78 if provider != "openrouter" {
79. 79 return Err(LlmError::InvalidRequest(format!(
80. 80 "provider '{provider}' does not expose supported account metadata"
81. 81 )));
82. 82 }
83. 83 let base = auth
84. 84 .base_url
85. 85 .as_deref()
86. 86 .filter(|url| !url.trim().is_empty())
87. 87 .unwrap_or("https://openrouter.ai/api/v1")
88. 88 .trim_end_matches('/');
89. 89 let client = client()?;
90. 90 let key_response = client
91. 91 .get(format!("{base}/key"))
92. 92 .bearer_auth(&auth.api_key)
93. 93 .send()
94. 94 .await
95. 95 .map_err(|e| LlmError::Network(e.to_string()))?;
96. 96 let (key_status, key_json) = json(key_response).await?;
97. 97 if !(200..300).contains(&key_status) {
98. 98 return Err(status_error(key_status, &key_json, &auth.api_key));
99. 99 }
100. 100 let key = key_json.get("data").unwrap_or(&key_json);
101. 101
102. 102 let credits_response = client
103. 103 .get(format!("{base}/credits"))
104. 104 .bearer_auth(&auth.api_key)
105. 105 .send()
106. 106 .await
107. 107 .map_err(|e| LlmError::Network(e.to_string()))?;
108. 108 let (credits_status, credits_json) = json(credits_response).await?;
109. 109 if !(200..300).contains(&credits_status) {
110. 110 return Err(status_error(credits_status, &credits_json, &auth.api_key));
111. 111 }
112. 112 let credits = credits_json.get("data").unwrap_or(&credits_json);
113. 113 let rate_limit = key.get("rate_limit");
114. 114 Ok(ProviderStatus {
115. 115 provider: provider.to_string(),
116. 116 reachable: true,
117. 117 authenticated: true,
118. 118 key_kind: Some(
119. 119 if key
120. 120 .get("is_management_key")
121. 121 .and_then(serde_json::Value::as_bool)
122. 122 == Some(true)
123. 123 {
124. 124 "openrouter-management-key".into()
125. 125 } else {
126. 126 "openrouter-api-key".into()
127. 127 },
128. 128 ),
129. 129 is_free_tier: key.get("is_free_tier").and_then(serde_json::Value::as_bool),
130. 130 usage_usd: number(key.get("usage")),
131. 131 usage_daily_usd: number(key.get("usage_daily")),
132. 132 usage_monthly_usd: number(key.get("usage_monthly")),
133. 133 limit_usd: number(key.get("limit")),
134. 134 limit_remaining_usd: number(key.get("limit_remaining")),
135. 135 credits_usd: number(credits.get("total_credits")),
136. 136 rate_limit_requests: rate_limit
137. 137 .and_then(|value| value.get("requests"))
138. 138 .and_then(serde_json::Value::as_i64),
139. 139 rate_limit_interval: rate_limit
140. 140 .and_then(|value| value.get("interval"))
141. 141 .and_then(serde_json::Value::as_str)
142. 142 .map(str::to_string),
143. 143 })
144. 144}
145. 145
146. 146#[cfg(test)]
147. 147mod tests {
148. 148 use super::*;
149. 149
150. 150 #[test]
151. 151 fn status_error_never_echoes_a_credential() {
152. 152 let error = status_error(
153. 153 401,
154. 154 &serde_json::json!({"error": {"message": "invalid key"}}),
155. 155 "secret",
156. 156 );
157. 157 assert_eq!(error.to_string(), "authentication failed: invalid key");
158. 158 }
159. 159
160. 160 #[test]
161. 161 fn status_error_redacts_an_echoed_credential() {
162. 162 let error = status_error(
163. 163 401,
164. 164 &serde_json::json!({"error": {"message": "rejected secret-token"}}),
165. 165 "secret-token",
166. 166 );
167. 167 assert!(!error.to_string().contains("secret-token"));
168. 168 assert!(error.to_string().contains("[redacted]"));
169. 169 }
170. 170
171. 171 #[test]
172. 172 fn unsupported_provider_is_explicit() {
173. 173 let result = futures::executor::block_on(inspect(
174. 174 "ollama",
175. 175 &ProviderAuth {
176. 176 api_key: "not-a-secret".into(),
177. 177 base_url: None,
178. 178 credential_id: None,
179. 179 options: Default::default(),
180. 180 },
181. 181 ));
182. 182 assert!(matches!(result, Err(LlmError::InvalidRequest(_))));
183. 183 }
184. 184}
185. 185