Audit remediation: security, correctness, billing, UX (Phases 0–5)

.github/workflows/build.yml

@@ -103,7 +103,8 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
-          context: apps/gateway
+          context: .
+          file: apps/gateway/Dockerfile
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -138,7 +139,8 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
-          context: apps/cloud-gateway
+          context: .
+          file: apps/cloud-gateway/Dockerfile
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

.github/workflows/ci.yml

@@ -74,15 +74,15 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Build Docker image
-        run: docker build -t routebox-gateway apps/gateway
+        run: docker build -t routebox-gateway -f apps/gateway/Dockerfile .
 
       - name: Smoke test container
         run: |
           docker run -d --name gw -p 3001:3001 \
             -e ROUTEBOX_TOKEN=test \
             -e OPENAI_API_KEY=sk-fake \
             routebox-gateway
-          sleep 2
+          sleep 3
           curl -sf http://localhost:3001/health | grep -q '"status":"ok"'
           docker stop gw
 
@@ -93,7 +93,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Build Docker image
-        run: docker build -t routebox-cloud-gateway apps/cloud-gateway
+        run: docker build -t routebox-cloud-gateway -f apps/cloud-gateway/Dockerfile .
 
       - name: Smoke test container
         run: |

apps/cloud-gateway/Dockerfile

@@ -1,3 +1,8 @@
+# Build context is the REPO ROOT (so packages/llm-core is available).
+# CI: docker build -f apps/cloud-gateway/Dockerfile .
+# The monorepo layout is preserved in the image so the runtime resolves
+# @routebox/llm-core via tsconfig paths (../../packages/llm-core/src).
+
 FROM oven/bun:1-alpine
 
 # Install curl for Docker health checks
@@ -7,19 +12,21 @@ RUN apk add --no-cache curl
 RUN addgroup -g 1001 -S routebox && \
     adduser -S routebox -u 1001 -G routebox
 
-WORKDIR /app
+WORKDIR /repo
 
 # Install deps
-COPY package.json bun.lock* ./
-RUN bun install --frozen-lockfile --production
+COPY apps/cloud-gateway/package.json apps/cloud-gateway/bun.lock* apps/cloud-gateway/
+RUN cd apps/cloud-gateway && bun install --frozen-lockfile --production
 
-# Copy source
-COPY . .
+# Copy source + the shared workspace package (preserve relative layout)
+COPY apps/cloud-gateway apps/cloud-gateway
+COPY packages packages
 
 # Fix permissions and switch to non-root user
-RUN chown -R routebox:routebox /app
+RUN chown -R routebox:routebox /repo
 USER routebox
 
+WORKDIR /repo/apps/cloud-gateway
 EXPOSE 3001
 
 CMD ["bun", "run", "src/index.ts"]

apps/cloud-gateway/admin.html

@@ -110,6 +110,26 @@
     .mt-2 { margin-top: 8px; }
     .mb-2 { margin-bottom: 8px; }
     .flex-between { display: flex; align-items: center; justify-content: space-between; }
+
+    /* Mobile responsive (<=768px). Desktop (>768px) unchanged. */
+    @media (max-width: 768px) {
+      .app { display: block; }
+      /* Sidebar becomes a horizontal top bar instead of a fixed 220px column. */
+      .sidebar { position: static; width: 100%; height: auto; bottom: auto; padding: 12px 0; display: flex; flex-wrap: wrap; align-items: center; }
+      .sidebar h1 { width: 100%; padding: 0 16px 12px; }
+      .nav-group { display: flex; flex-wrap: wrap; padding: 4px 8px; }
+      .nav-group + .nav-group { margin-top: 0; border-top: none; padding-top: 4px; }
+      .nav-section { width: 100%; padding: 8px 16px 4px; }
+      .nav-item { margin-right: 0; border-radius: 6px; padding: 7px 12px; }
+      .nav-item.active { border-left: none; padding-left: 12px; }
+      /* Main content no longer offset by the fixed sidebar. */
+      .main { margin-left: 0; padding: 16px; }
+      /* Modals and fixed-width boxes fit the viewport. */
+      .modal { width: calc(100vw - 24px); max-width: 480px; }
+      .auth-box { width: calc(100vw - 24px); max-width: 380px; }
+      /* Wide tables scroll horizontally instead of overflowing. */
+      table { display: block; overflow-x: auto; }
+    }
   </style>
   <script src="https://cdn.jsdelivr.net/npm/chart.js@4/dist/chart.umd.min.js" onerror="window.__chartJsFailed=true"></script>
 </head>

apps/cloud-gateway/landing.html

@@ -562,7 +562,7 @@ <h2 class="headline text-[32px] mb-2">Simple, transparent</h2>
                   500 req/min rate limit
                 </li>
               </ul>
-              <a href="https://api.routebox.dev" class="btn-ember-primary w-full justify-center text-sm py-2.5">Get Pro</a>
+              <a href="#download" title="Download the app, then upgrade in the Account tab" class="btn-ember-primary w-full justify-center text-sm py-2.5">Get Pro</a>
             </div>
           </div>
 
@@ -592,7 +592,7 @@ <h2 class="headline text-[32px] mb-2">Simple, transparent</h2>
                 Maximum savings
               </li>
             </ul>
-            <a href="https://api.routebox.dev" class="btn-primary w-full justify-center text-sm py-2.5">Get Max</a>
+            <a href="#download" title="Download the app, then upgrade in the Account tab" class="btn-primary w-full justify-center text-sm py-2.5">Get Max</a>
           </div>
         </div>
 

apps/cloud-gateway/migrations/025_transaction_idempotency.sql

@@ -0,0 +1,70 @@
+-- ---------------------------------------------------------------------------
+-- Migration 025: Transaction idempotency hardening
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE transactions
+  ADD COLUMN IF NOT EXISTS idempotency_key TEXT;
+
+-- Clear legacy duplicate payment refs before enforcing uniqueness. Keep the
+-- earliest ledger row for each ref and preserve later rows for audit history.
+WITH duplicate_payment_refs AS (
+  SELECT id
+  FROM (
+    SELECT
+      id,
+      ROW_NUMBER() OVER (PARTITION BY payment_ref ORDER BY created_at, id) AS rn
+    FROM transactions
+    WHERE payment_ref IS NOT NULL
+  ) ranked
+  WHERE rn > 1
+)
+UPDATE transactions
+SET payment_ref = NULL,
+    description = concat_ws(
+      ' ',
+      NULLIF(transactions.description, ''),
+      '[duplicate payment_ref cleared before idempotency index]'
+    )
+FROM duplicate_payment_refs
+WHERE transactions.id = duplicate_payment_refs.id;
+
+-- Preserve historical payment references as idempotency keys where possible.
+UPDATE transactions
+SET idempotency_key = payment_ref
+WHERE idempotency_key IS NULL
+  AND payment_ref IS NOT NULL;
+
+-- Clear legacy duplicate bonus idempotency keys before enforcing uniqueness.
+-- Keep the earliest bonus row per user/key and preserve later rows for audit.
+WITH duplicate_bonus_idempotency AS (
+  SELECT id
+  FROM (
+    SELECT
+      id,
+      ROW_NUMBER() OVER (PARTITION BY user_id, type, idempotency_key ORDER BY created_at, id) AS rn
+    FROM transactions
+    WHERE type = 'bonus'
+      AND idempotency_key IS NOT NULL
+  ) ranked
+  WHERE rn > 1
+)
+UPDATE transactions
+SET idempotency_key = NULL,
+    description = concat_ws(
+      ' ',
+      NULLIF(transactions.description, ''),
+      '[duplicate bonus idempotency_key cleared before idempotency index]'
+    )
+FROM duplicate_bonus_idempotency
+WHERE transactions.id = duplicate_bonus_idempotency.id;
+
+-- Prevent concurrent duplicate deposits for the same provider payment/session.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_transactions_payment_ref_unique
+  ON transactions (payment_ref)
+  WHERE payment_ref IS NOT NULL;
+
+-- Prevent duplicate bonus application for the same user/reason key while still
+-- allowing shared promo names across different users when callers choose that.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_transactions_bonus_idempotency_unique
+  ON transactions (user_id, type, idempotency_key)
+  WHERE type = 'bonus' AND idempotency_key IS NOT NULL;

apps/cloud-gateway/src/index.ts

@@ -46,8 +46,9 @@ app.use(
   "*",
   cors({
     origin: (origin) => {
-      // Non-browser requests (Tauri desktop, curl, server-to-server)
-      if (!origin) return "*";
+      // H3-sec: 非浏览器请求(无 Origin)不下发 ACAO —— CORS 仅约束浏览器,
+      // 浏览器请求必带 Origin,故无需通配
+      if (!origin) return null;
       return ALLOWED_ORIGINS.includes(origin) ? origin : null;
     },
     allowHeaders: ["Content-Type", "Authorization"],
@@ -146,7 +147,9 @@ app.get("/static/*", async (c) => {
   const fileName = c.req.path.replace("/static/", "");
   const result = serveStaticFile(fileName);
   if (!result) return c.notFound();
-  return new Response(result.data, {
+  // result.data is a Uint8Array; cast to satisfy TS 5.7's generic-TypedArray
+  // BodyInit typing (valid BodyInit at runtime).
+  return new Response(result.data as BodyInit, {
     status: 200,
     headers: { "Content-Type": result.contentType, "Cache-Control": "public, max-age=86400, immutable" },
   });
@@ -156,7 +159,9 @@ app.get("/static/*", async (c) => {
 app.get("/favicon.ico", async (c) => {
   const result = serveStaticFile("favicon.ico");
   if (!result) return c.notFound();
-  return new Response(result.data, {
+  // result.data is a Uint8Array; cast to satisfy TS 5.7's generic-TypedArray
+  // BodyInit typing (valid BodyInit at runtime).
+  return new Response(result.data as BodyInit, {
     status: 200,
     headers: { "Content-Type": result.contentType, "Cache-Control": "public, max-age=86400, immutable" },
   });

apps/cloud-gateway/src/lib/credits.test.ts

@@ -25,6 +25,28 @@ beforeEach(() => {
   globalThis.__dbMockTxResults = [];
   // @ts-ignore
   globalThis.__dbMockSqlCalls = [];
+  // @ts-ignore
+  globalThis.__dbMockTxCalls = [];
+});
+
+// ── ledger idempotency migration ───────────────────────────────────────────
+
+describe("transaction idempotency migration", () => {
+  test("adds idempotency_key and unique partial indexes", async () => {
+    const migration = await Bun.file(
+      new URL("../../migrations/025_transaction_idempotency.sql", import.meta.url),
+    ).text();
+
+    expect(migration).toContain("ADD COLUMN IF NOT EXISTS idempotency_key");
+    expect(migration).toContain("ROW_NUMBER() OVER (PARTITION BY payment_ref");
+    expect(migration).toContain("duplicate payment_ref cleared before idempotency index");
+    expect(migration).toContain("idx_transactions_payment_ref_unique");
+    expect(migration).toContain("WHERE payment_ref IS NOT NULL");
+    expect(migration).toContain("ROW_NUMBER() OVER (PARTITION BY user_id, type, idempotency_key");
+    expect(migration).toContain("duplicate bonus idempotency_key cleared before idempotency index");
+    expect(migration).toContain("idx_transactions_bonus_idempotency_unique");
+    expect(migration).toContain("WHERE type = 'bonus' AND idempotency_key IS NOT NULL");
+  });
 });
 
 // ── getBalance ──────────────────────────────────────────────────────────────
@@ -105,20 +127,26 @@ describe("addCredits", () => {
   test("adds credits and returns new balance", async () => {
     // @ts-ignore
     globalThis.__dbMockTxResults = [
-      [],                                // Check duplicate session
-      [{ balance_cents: 2500 }],         // UPDATE RETURNING
-      [],                                // INSERT transaction
+      [{ id: "tx-claim" }],        // INSERT deposit claim
+      [{ balance_cents: 2500 }],   // UPDATE credits RETURNING
+      [],                          // UPDATE transaction balance_after_cents
     ];
 
     const newBalance = await credits.addCredits("user-1", 1000, "cs_test_123", "Top up");
     expect(newBalance).toBe(2500);
+
+    // @ts-ignore
+    const txCalls = globalThis.__dbMockTxCalls as unknown[][];
+    expect(txCalls[0]).toContain("cs_test_123");
+    expect(txCalls[2]).toContain("tx-claim");
+    expect(txCalls[2]).toContain(2500);
   });
 
   test("returns existing balance for duplicate payment ref", async () => {
     // @ts-ignore
     globalThis.__dbMockTxResults = [
-      [{ id: "existing-tx" }],
-      [{ balance_cents: 1500 }],
+      [],                         // INSERT claim hit ON CONFLICT DO NOTHING
+      [{ balance_cents: 1500 }],  // Current balance lookup
     ];
 
     const newBalance = await credits.addCredits("user-1", 1000, "cs_duplicate");

apps/cloud-gateway/src/lib/credits.ts

@@ -96,14 +96,21 @@ export async function addCredits(
   description?: string,
 ): Promise<number> {
   const result = await withTx(async (tx) => {
-    // Check for duplicate payment_ref to prevent double-crediting
-    const [existing] = await tx`
-      SELECT id FROM transactions
-      WHERE payment_ref = ${paymentRef}
+    const desc = description ?? "Credit purchase";
+
+    const [claim] = await tx`
+      INSERT INTO transactions (user_id, type, amount_cents, balance_after_cents,
+        description, payment_ref, idempotency_key)
+      VALUES (${userId}, 'deposit', ${amountCents}, 0, ${desc}, ${paymentRef}, ${paymentRef})
+      ON CONFLICT (payment_ref) WHERE payment_ref IS NOT NULL DO NOTHING
+      RETURNING id
     `;
-    if (existing) {
-      const [row] = await tx`SELECT balance_cents FROM credits WHERE user_id = ${userId}`;
-      return (row?.balance_cents as number) ?? 0;
+
+    if (!claim) {
+      const [current] = await tx`
+        SELECT balance_cents FROM credits WHERE user_id = ${userId}
+      `;
+      return (current?.balance_cents as number) ?? 0;
     }
 
     const [row] = await tx`
@@ -115,13 +122,12 @@ export async function addCredits(
       RETURNING balance_cents
     `;
 
-    const newBalance = row.balance_cents as number;
+    const newBalance = (row?.balance_cents as number) ?? 0;
 
     await tx`
-      INSERT INTO transactions (user_id, type, amount_cents, balance_after_cents,
-        description, payment_ref)
-      VALUES (${userId}, 'deposit', ${amountCents}, ${newBalance},
-        ${description ?? 'Credit purchase'}, ${paymentRef})
+      UPDATE transactions
+      SET balance_after_cents = ${newBalance}
+      WHERE id = ${claim.id}
     `;
 
     return newBalance;

apps/cloud-gateway/src/lib/crypto.test.ts

@@ -0,0 +1,28 @@
+import { test, expect, beforeEach } from "bun:test";
+
+const KEY_HEX = "a".repeat(64);
+
+beforeEach(() => {
+  process.env.PROVIDER_KEY_ENCRYPTION_KEY = KEY_HEX;
+});
+
+test("encrypt then decrypt round-trips", async () => {
+  const { encryptSecret, decryptSecret } = await import("./crypto");
+  const plain = "sk-cloud-secret-001";
+  const enc = encryptSecret(plain);
+  expect(enc.startsWith("enc:v1:")).toBe(true);
+  expect(enc).not.toContain(plain);
+  expect(decryptSecret(enc)).toBe(plain);
+});
+
+test("decrypt passes through legacy plaintext", async () => {
+  const { decryptSecret } = await import("./crypto");
+  expect(decryptSecret("sk-legacy")).toBe("sk-legacy");
+});
+
+test("sha256Hex still works", async () => {
+  const { sha256Hex } = await import("./crypto");
+  expect(await sha256Hex("abc")).toBe(
+    "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
+  );
+});