fix: make three console surfaces state what the deployment actually does

[sakibsadmanshajib]

Closes #1328
Closes #1331
Closes #1332

Three console-surface honesty defects from the quiet-window live walkthrough on 2026-08-29, all on the demo path, landed together because they are one class of problem: the console asserting something the deployment does not do.

#1328 A sign-up page this deployment refuses, reported as a server error

The refusal is deliberate and stays. deploy/docker/Caddyfile.supabase answers 404 for /auth/v1/signup on the public listener, and hive-supabase-auth-1 runs with GOTRUE_DISABLE_SIGNUP=true. Re-verified live while writing this: POST https://console-hive.scubed.co/auth/v1/signup returns HTTP/2 404 with content-length: 0 and via: 1.1 Caddy.

That empty body is the whole bug. auth-js parses the response as JSON, the parse throws, and the caller receives an AuthUnknownError whose message is a JSON parse error and whose status is undefined. The allow-list in lib/auth/auth-error.ts withheld it exactly as designed, so a stated policy reached the visitor as "Something went wrong on our end. Reference AUTH-...".

What changed:

• lib/auth/self-serve.ts reads NEXT_PUBLIC_DISABLE_SELF_SERVE_SIGNUP and fails closed. Unset and empty both mean disabled, because an unset build arg reaches next build as an empty string.
• The build arg is fed from ENTERPRISE_DISABLE_SIGNUP, the same variable that drives the GoTrue flag, in the same polarity. One value in one place, so the console cannot advertise what the auth service refuses.
• /auth/sign-up renders an invitation notice and a link to sign-in when self-serve is off, and the form is absent rather than disabled. The sign-in cross-link drops in the same state.
• toUserFacingSignUpMessage reports a policy refusal as a refusal: a 404 or 403 from the auth origin, GoTrue own "Signups not allowed for this instance" copy, and the status-free AuthUnknownError shape that the bare 404 actually produces. Everything else keeps the existing allow-list behaviour, including the generic message plus support reference for a real 500.

Not changed, deliberately: the Caddy refusal and the GoTrue flag. Re-enabling self-serve signup is still the two-part change the Caddyfile comment describes, gated on the tenant provisioning path in .wolf/decisions.md D-023.

Turnstile was ruled out before this work and is not involved: NEXT_PUBLIC_TURNSTILE_SITE_KEY is empty on the console container and TURNSTILE_SECRET_KEY is unset on control-plane.

#1331 Rotate is a dead link

/console/api-keys/[id]/rotate does not exist; the only child route is [id]/limits. The link and the word "rotate" in the page header are gone, and the header now names the path that does work: create a replacement, revoke the old one.

The route was not built instead, on purpose. The control-plane endpoint exists (POST /api/v1/accounts/current/api-keys/{id}/rotate), but shipping a new credential-issuing surface with its own secret-reveal step belongs in its own change with its own review, not bundled into a three-defect honesty PR. Worth knowing for whoever picks that up: the rotateApiKey helper in lib/control-plane/client.ts was dead AND wrong, decoding the top-level payload with decodeApiKey when the handler answers {"old_key_id": ..., "new_key": {..., "secret": ...}}, so it would have thrown "Failed to parse API key response" for its first caller. It is deleted here rather than left as a trap.

#1332 Credits shown as a bare integer on one page, dollars on another

The dashboard rendered 99,996,364,207 with the unit only in the card title, while the API keys table rendered the same quantity as $0.000662. Settled on dollars, which is what the rest of the console already puts in front of a customer.

One CreditBalance component now draws the balance on both the dashboard and the billing page: dollars as the headline, posted and reserved in the same denomination, and the credit figure with the conversion stated beside it, so the two surfaces reconcile by eye. Credits are kept because the ledger, invoices and per-key caps are denominated in them.

Balances truncate toward zero rather than rounding (formatUsdBalanceFromCredits), so 99,996,364,207 credits reads $99.99 and never $100.00. Precision grows until the figure is non-zero, so a sub-cent balance reads $0.000662 rather than an empty-looking $0.00. Currency presentation to BD customers is an unconstrained product decision per the owner ruling of 2026-08-08 (.wolf/decisions.md D-035); no constraint is reintroduced here.

Out of scope, worth a follow-up: the ledger, usage-log and invoice tables still print raw credit deltas.

Tests

New, and each one was checked against a mutated copy of the code it covers before being trusted:

• lib/auth/self-serve.test.ts: the default matters most here, so unset, empty and unrecognized values all assert disabled.
• lib/auth/auth-error.test.ts: the three refusal shapes map to the refusal copy, an allow-listed message still renders verbatim, and a 500 still degrades to the generic message rather than being dressed up as a policy.
• __tests__/sign-up-next-redirect.test.tsx: no form when self-serve is off, the invitation copy and sign-in link render, the next param survives on the gated page, and a submitted signup that hits the refusal shows the refusal copy and not the outage copy.
• __tests__/sign-in-next-redirect.test.tsx: the cross-link appears when signup is open and is replaced by the invitation sentence when it is not.
• tests/unit/api-keys-list-actions.test.tsx: no rotate link, and no anchor pointing at a /rotate href at all, with revoke still present.
• tests/unit/credit-balance.test.tsx: the headline metric is dollars and not a bare integer, and the credits plus conversion line is present.
• lib/format/format.test.ts: the balance formatter truncates, keeps sub-cent balances visible, and renders a single credit.

Updated because the behaviour they pinned changed: tests/e2e/unauth.spec.ts now asserts the gated page (the CI stack builds with the flag unset, so it is disabled there), tests/interaction/route-floors.json requires the sign-in link on that route instead of the removed form controls, and tests/e2e/demo-walkthrough.mjs reports the invitation posture as PASS rather than timing out on fields that are deliberately absent.

Mutation check, all four together: the six touched suites produced 15 failures across every new group, then went green again on revert.

Verification

Run in Docker against a private image tag so the shared hive-web-console:ci was not rebuilt under other agents, and with --build every time, since the service mounts no volume:

• npm run test:unit: 832 passed, 76 files. The one failed file is tests/unit/ci-web-e2e-secret-free.test.ts, which reads .github/workflows/ci.yml from the repo root; Dockerfile.web-console does not copy .github, so that file cannot pass inside this image on any branch. Pre-existing, unrelated to this diff.
• npm run build: green.

Buglog entry

To be appended to .wolf/buglog.jsonl on main after this merges, per the buglog protocol:

{"date":"2026-08-29","area":"web-console","error_message":"Sign-up shows Something went wrong on our end. Reference AUTH-... after POST /auth/v1/signup returns a bare 404","root_cause":"The console shipped a sign-up route on deployments that refuse account creation at the gateway (Caddyfile.supabase 404) and at the GoTrue flag. The empty 404 body makes auth-js raise AuthUnknownError with no status, which the allow-list in lib/auth/auth-error.ts correctly withheld, so a deliberate policy rendered as an outage","fix":"Gate the sign-up route and its cross-links on NEXT_PUBLIC_DISABLE_SELF_SERVE_SIGNUP, fed from ENTERPRISE_DISABLE_SIGNUP so one variable drives GoTrue and the UI, and add toUserFacingSignUpMessage to report a 404, a 403, GoTrue signups-not-allowed copy, or the status-free AuthUnknownError shape as a policy refusal","tags":["web-console","auth","signup","issue-1328"]}

{"date":"2026-08-29","area":"web-console","error_message":"Rotate on /console/api-keys opens This page could not be found","root_cause":"api-key-list.tsx linked every active key to /console/api-keys/[id]/rotate, a route that was never built; the page header also promised rotation. The rotateApiKey client helper was dead and decoded the wrong response shape","fix":"Remove the link and the promise, name the working path (create a replacement, revoke the old) in the header, and delete the broken helper","tags":["web-console","api-keys","issue-1331"]}

{"date":"2026-08-29","area":"web-console","error_message":"Available credits renders 99,996,364,207 with no unit while the API keys table renders the same quantity as $0.000662","root_cause":"Two surfaces rendered the same credit quantity in different denominations, with no conversion shown on either","fix":"One CreditBalance component on the dashboard and the billing page, dollars as the headline with the credit figure and the conversion beneath, and a truncating formatUsdBalanceFromCredits so a balance never rounds up","tags":["web-console","billing","credits","issue-1332"]}

Update after review

Rebased onto main to clear a conflict in apps/web-console/lib/format/format.test.ts, which main had also touched. Worth recording why that mattered: while the PR was conflicting, GitHub built no merge ref, so the whole CI workflow never ran and the page showed only CodeQL, GitGuardian and CodeRabbit. That is the same trap the buglog protocol documents in issue #873, reached from a different direction.

Three fixes landed after the first push, two of them from the review streams:

• The balance formatter truncates in credit space rather than dollar space. Truncating 8.29 * 100 printed $8.28.
• A non-finite credit value renders as an em dash rather than $0.00, so a failed read cannot look like an empty wallet.
• The refusal classifier keeps its rules, with the measurement that justifies them recorded beside it and asserted by the test.

Final verification. In Docker, private image tag, --build on every run: npm run test:unit 851 passed across 78 files, with the one pre-existing failure noted above (ci-web-e2e-secret-free.test.ts cannot read .github/workflows/ci.yml inside an image that does not copy .github). npm run build green. On CI, 24 checks pass, including Web E2E (full stack), which exercises the gated sign-up route against a real built console with the flag unset, and Interaction coverage (console controls), which enforces the updated floor for that route.

Visual proof was recaptured at the reviewed head so it shows the final code, and now covers the billing surface as well as the dashboard.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

Next included review available in 39 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fc1ddbeb-1823-44aa-9a8c-6dc41a58274e

📥 Commits

Reviewing files that changed from the base of the PR and between 3b2bffd and 363cbcf.

📒 Files selected for processing (26)

• .env.example
• apps/web-console/__tests__/sign-in-next-redirect.test.tsx
• apps/web-console/__tests__/sign-up-next-redirect.test.tsx
• apps/web-console/app/auth/sign-in/page.tsx
• apps/web-console/app/auth/sign-up/page.tsx
• apps/web-console/app/console/api-keys/page.tsx
• apps/web-console/app/console/page.tsx
• apps/web-console/components/api-keys/api-key-list.tsx
• apps/web-console/components/billing/billing-overview.tsx
• apps/web-console/components/billing/credit-balance.tsx
• apps/web-console/lib/auth/auth-error.test.ts
• apps/web-console/lib/auth/auth-error.ts
• apps/web-console/lib/auth/self-serve.test.ts
• apps/web-console/lib/auth/self-serve.ts
• apps/web-console/lib/control-plane/client.ts
• apps/web-console/lib/format/credits.ts
• apps/web-console/lib/format/format.test.ts
• apps/web-console/lib/format/model-pricing.ts
• apps/web-console/tests/e2e/demo-walkthrough.mjs
• apps/web-console/tests/e2e/unauth.spec.ts
• apps/web-console/tests/interaction/route-floors.json
• apps/web-console/tests/unit/api-keys-list-actions.test.tsx
• apps/web-console/tests/unit/credit-balance.test.tsx
• deploy/docker/Dockerfile.web-console.prod
• deploy/docker/docker-compose.yml
• docs/proof/console-honest-surfaces-2026-08-29/capture-log.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sakibsadmanshajib]

Visual proof

Captured against the demo box on 2026-08-29, with this branch built into its own image (hive-web-console-prod:proof1336) and run beside the live stack on the same compose network, reading live control-plane data as demo@hive-demo.invalid. The sign-up gate here comes from the box own ENTERPRISE_DISABLE_SIGNUP=true, not from a value chosen for the capture. 1: the balance reads $99.99 with the credit figure and the conversion beneath, where it used to read 99,996,364,207 with no unit (#1332). 2: the active key row offers Revoke only, zero anchors point at a rotate href, and the header names the path that works (#1331). 3: the route this deployment refuses says so and offers sign-in, instead of the AUTH-reference server error (#1328). 4: sign-in no longer links to that page at all (#1328). Full capture log: docs/proof/console-honest-surfaces-2026-08-29/capture-log.md

[sakibsadmanshajib]

Adversarial review

Streams

• Antigravity (agy, gemini-3.1-pro-high, effort high): RAN. Five findings, all answered below. The first attempt timed out at twenty minutes with no output; the second, scoped to the changed files, returned.
• CodeRabbit CLI: SKIPPED. coderabbit review --agent --base main returned rate_limit, "You have used all 3 included reviews currently available". Not a pass.
• CodeRabbit bot on this PR: SKIPPED for now. It posted "Review limit reached, next included review available in 38 minutes". I will re-trigger it once the window opens.
• Codex: SKIPPED. The connector replied "You have reached your Codex usage limits for code reviews", which matches the known exhaustion until 2026-09-10.

Findings and dispositions

1. NEXT_PUBLIC_DISABLE_SELF_SERVE_SIGNUP is baked into the bundle at build time, so a prebuilt image cannot be flipped at runtime. Major. Rebutted, with a note. This is true of the mechanism and it is the same mechanism every other browser-visible setting in this image already uses: NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY, NEXT_PUBLIC_APP_URL and NEXT_PUBLIC_TURNSTILE_SITE_KEY are all build args on the same Dockerfile. It also costs nothing operationally here: this repo ships no prebuilt console image, every deploy path runs docker compose up -d --build, and re-enabling self-serve signup is not a one-variable change in the first place. It also needs the @selfserve refusal lifted in deploy/docker/Caddyfile.supabase, which is a repo edit and therefore a rebuild regardless. Moving the read to a server component would additionally force dynamic = "force-dynamic" on two auth pages that are otherwise static shells, to buy an operation nobody performs.
2. isSignUpRefusal misclassifies outages as policy. Major. Rebutted with a measurement, and the measurement is now recorded in the code. Driving supabase.auth.signUp against a stubbed fetch on @supabase/auth-js 2.x, 2026-08-29: 500, 502, 503 and 504 with an HTML body all produce AuthRetryableFetchError with the status preserved, and a dead transport produces the same class with status 0. Only a non-5xx status with a body that is not JSON produces AuthUnknownError, which is exactly the empty-bodied 404 this gateway returns (content-length: 0, verified live against the deployed origin). No outage shape auth-js recognises can reach that branch. The test now asserts the real AuthRetryableFetchError shapes rather than an invented one, so the claim is pinned rather than argued.
3. A non-finite balance renders as $0.00, so a failed read looks like an empty wallet. Major. Accepted and fixed in 661febe. formatUsdBalanceFromCredits now returns the em dash for a non-finite value, matching formatPercent in the same module, which exists for exactly this reason. Zero still renders as $0.00, because zero is a real balance. The upstream decode still collapses a missing field to 0 (readNumberField(...) ?? 0 in lib/control-plane/client.ts), which is pre-existing and out of scope here.
4. Float truncation shaves a cent off exact values. Major. Accepted, and already fixed in b29fdd7 before this stream returned; found independently in self review. 8,290,000,000 credits is 8.29 dollars and 8.29 * 100 is 828.9999999999999, so truncating in dollar space printed $8.28. The truncation now happens in credit space, where CREDITS_PER_USD / 10 ** digits is an exact integer. The regression test fails on the old implementation, which was verified by reverting it.
5. The client boundary sits at the top of the route. Minor. Rebutted. app/auth/sign-up/page.tsx was already a client component before this change, and the same is true of sign-in. Moving the boundary is a refactor of both auth pages that this diff has no reason to carry, and it would not change where the flag is read, since NEXT_PUBLIC_* is inlined at build time either way. See finding 1.

Mutation checks. Every new assertion was run against a deliberately broken copy of the code it covers, and every group went red: the flag forced open, the refusal classifier disabled, the balance headline reverted to a bare integer, the rotate link restored, and the dollar-space truncation restored. Fifteen failures across six suites, then green again on revert.

[sakibsadmanshajib]

Visual proof

Recaptured at ba3bc21, the reviewed head, so this supersedes the earlier comment which predates the credit-space truncation fix and the em dash for an unreadable balance. Same substrate: this branch built into hive-web-console-prod:proof1336 and run beside the live stack on the demo box compose network, reading live control-plane data as demo@hive-demo.invalid, with the sign-up gate coming from the box own ENTERPRISE_DISABLE_SIGNUP=true. 1 and 2: the same balance on the dashboard and on billing, drawn by one shared component, $99.99 with the credit figure and the conversion beneath (#1332). 3: Revoke only on the active key row, zero anchors at a rotate href, and a header that names the path that works (#1331). 4: the refused route says so and offers sign-in, instead of the AUTH-reference server error (#1328). 5: sign-in no longer links to it at all (#1328). Capture log: docs/proof/console-honest-surfaces-2026-08-29/capture-log.md

[sakibsadmanshajib]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 10 minutes.

[sakibsadmanshajib]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 39 minutes.

[sakibsadmanshajib]

Review status, final

Streams

• Antigravity (agy, gemini-3.1-pro-high): RAN, five findings, all answered in the comment above. Two accepted and fixed, three rebutted with reasons.
• CodeRabbit: SKIPPED, and not a pass. Three separate attempts: the CLI answered rate_limit ("all 3 included reviews currently available" used), and the bot answered "Review limit reached" at 02:12, again at 02:54 after the first @coderabbitai full review, and again at 03:25 after the second. It has posted no inline comment on this PR at any point.
• Codex: SKIPPED, and not a pass. "You have reached your Codex usage limits for code reviews", the known exhaustion.

Two more fixes since that comment, both from my own re-read of the final diff

• Math.floor rather than Math.trunc when rounding a balance. available_credits is posted minus reserved, so a workspace whose holds exceed its posted credits reads negative, and rounding toward zero showed less of the hole than was there. Identical for every positive balance, conservative for a negative one, with a test.
• The docstring now states the rounding direction rather than "toward zero", so the comment cannot drift from the code.

Threads. There are no inline review comments on this PR (GET /pulls/1336/comments returns an empty list), so there is nothing to resolve. Every finding that was raised, was raised in a stream summary and is answered in this thread.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@sakibsadmanshajib, thanks for the final status.

The Math.floor change correctly preserves the full negative balance after denomination rounding. The updated docstring now matches that behavior.

No CodeRabbit inline review thread requires resolution.

🐇

---

✏️ Learnings added

Learnt from: sakibsadmanshajib
URL: https://github.com/sakibsadmanshajib/hive/pull/1336

Timestamp: 2026-08-29T03:38:00.885Z
Learning: In `apps/web-console/lib/format/format.ts`, `formatUsdBalanceFromCredits` must use `Math.floor` when it truncates a USD balance. `available_credits` can be negative when reserved credits exceed posted credits. `Math.trunc` would round a negative balance toward zero and understate the deficit. Positive balances have identical results with `Math.floor`.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

_{You are interacting with an AI system.}