feat: Eng 1849 track spent credits

apps/agent/pkg/clickhouse/schema/requests.go

@@ -15,12 +15,14 @@ type ApiRequestV1 struct {
 }
 
 type KeyVerificationRequestV1 struct {
-	RequestID   string `ch:"request_id"`
-	Time        int64  `ch:"time"`
-	WorkspaceID string `ch:"workspace_id"`
-	KeySpaceID  string `ch:"key_space_id"`
-	KeyID       string `ch:"key_id"`
-	Region      string `ch:"region"`
-	Outcome     string `ch:"outcome"`
-	IdentityID  string `ch:"identity_id"`
+	RequestID    string   `ch:"request_id"`
+	Time         int64    `ch:"time"`
+	WorkspaceID  string   `ch:"workspace_id"`
+	KeySpaceID   string   `ch:"key_space_id"`
+	KeyID        string   `ch:"key_id"`
+	Region       string   `ch:"region"`
+	Outcome      string   `ch:"outcome"`
+	IdentityID   string   `ch:"identity_id"`
+	SpentCredits int64    `ch:"spent_credits"`
+	Tags         []string `ch:"tags"`
 }

apps/api/src/pkg/analytics.ts

@@ -72,6 +72,7 @@ export class Analytics {
         outcome: string;
         identity_id?: string;
         tags?: string[];
+        spent_credits?: number;
       }) => {
         return await wrap(
           // biome-ignore lint/style/noNonNullAssertion: proxyClient existence verified above

apps/api/src/pkg/auth/root_key.ts

@@ -63,6 +63,7 @@ export async function rootKeyAuth(c: Context<HonoEnv>, permissionQuery?: Permiss
       region: c.req.cf?.region,
       request_id: c.get("requestId"),
       tags: [],
+      spent_credits: 0, // Root key verifications don't consume credits
     }),
   );
 

apps/api/src/pkg/clickhouse-proxy.ts

@@ -25,6 +25,7 @@ export class ClickHouseProxyClient {
       outcome: string;
       identity_id?: string;
       tags?: string[];
+      spent_credits?: number;
     }>,
   ): Promise<void> {
     await this.sendEvents("/_internal/chproxy/verifications", events);

apps/api/src/pkg/keys/service.ts

@@ -56,6 +56,7 @@ type NotFoundResponse = {
   api?: never;
   ratelimit?: never;
   remaining?: never;
+  spentCredits?: number;
 };
 
 type InvalidResponse = {
@@ -84,6 +85,7 @@ type InvalidResponse = {
   permissions: string[];
   roles: string[];
   message?: string;
+  spentCredits?: number;
 };
 
 type ValidResponse = {
@@ -109,6 +111,7 @@ type ValidResponse = {
   authorizedWorkspaceId: string;
   permissions: string[];
   roles: string[];
+  spentCredits?: number;
 };
 type VerifyKeyResult = NotFoundResponse | InvalidResponse | ValidResponse;
 
@@ -396,7 +399,7 @@ export class KeyService {
     }
 
     if (!data) {
-      return Ok({ valid: false, code: "NOT_FOUND" });
+      return Ok({ valid: false, code: "NOT_FOUND", spentCredits: 0 });
     }
 
     // Quick fix
@@ -436,6 +439,7 @@ export class KeyService {
         permissions: data.permissions,
         roles: data.roles,
         message: "the key is disabled",
+        spentCredits: 0,
       });
     }
 
@@ -449,6 +453,7 @@ export class KeyService {
         permissions: data.permissions,
         roles: data.roles,
         message: `the key does not belong to ${req.apiId}`,
+        spentCredits: 0,
       });
     }
 
@@ -469,6 +474,7 @@ export class KeyService {
           permissions: data.permissions,
           roles: data.roles,
           message: `the key has expired on ${new Date(expires).toISOString()}`,
+          spentCredits: 0,
         });
       }
     }
@@ -485,6 +491,7 @@ export class KeyService {
           code: "FORBIDDEN",
           permissions: data.permissions,
           roles: data.roles,
+          spentCredits: 0,
         });
       }
 
@@ -498,6 +505,7 @@ export class KeyService {
           code: "FORBIDDEN",
           permissions: data.permissions,
           roles: data.roles,
+          spentCredits: 0,
         });
       }
     }
@@ -542,6 +550,7 @@ export class KeyService {
           permissions: data.permissions,
           roles: data.roles,
           message: rbacResp.val.message,
+          spentCredits: 0,
         });
       }
     }
@@ -612,10 +621,13 @@ export class KeyService {
         ratelimit,
         permissions: data.permissions,
         roles: data.roles,
+        spentCredits: 0,
       });
     }
 
     let remaining: number | undefined = undefined;
+    let spentCredits = 0;
+
     if (data.key.remaining !== null) {
       const t0 = performance.now();
       const cost = req.remaining?.cost ?? DEFAULT_REMAINING_COST;
@@ -636,7 +648,10 @@ export class KeyService {
       });
 
       remaining = limited.remaining;
-      if (!limited.valid) {
+      if (limited.valid) {
+        // Credits were successfully spent
+        spentCredits = cost;
+      } else {
         return Ok({
           key: data.key,
           api: data.api,
@@ -653,6 +668,7 @@ export class KeyService {
           authorizedWorkspaceId: data.key.forWorkspaceId ?? data.key.workspaceId,
           permissions: data.permissions,
           roles: data.roles,
+          spentCredits: 0, // No credits spent if usage exceeded
         });
       }
     }
@@ -672,6 +688,7 @@ export class KeyService {
       authorizedWorkspaceId: data.key.forWorkspaceId ?? data.key.workspaceId,
       permissions: data.permissions,
       roles: data.roles,
+      spentCredits,
     });
   }
 

apps/api/src/routes/v1_keys_verifyKey.ts

@@ -2,6 +2,7 @@ import { UnkeyApiError, openApiErrorResponses } from "@/pkg/errors";
 import type { App } from "@/pkg/hono/app";
 import { DisabledWorkspaceError, MissingRatelimitError } from "@/pkg/keys/service";
 import { createRoute, z } from "@hono/zod-openapi";
+
 import { SchemaError } from "@unkey/error";
 import { permissionQuerySchema } from "@unkey/rbac";
 
@@ -331,7 +332,6 @@ export const registerV1KeysVerifyKey = (app: App) =>
   app.openapi(route, async (c) => {
     const req = c.req.valid("json");
     const { keyService, analytics, logger } = c.get("services");
-
     const { val, err } = await keyService.verifyKey(c, {
       key: req.key,
       apiId: req.apiId,
@@ -340,7 +340,6 @@ export const registerV1KeysVerifyKey = (app: App) =>
       ratelimits: req.ratelimits,
       remaining: req.remaining,
     });
-
     if (err) {
       switch (true) {
         case err instanceof SchemaError || err instanceof MissingRatelimitError:
@@ -409,6 +408,7 @@ export const registerV1KeysVerifyKey = (app: App) =>
           outcome: val.code,
           identity_id: val.identity?.id,
           tags: req.tags ?? [],
+          spent_credits: val.spentCredits ?? 0,
         })
         .then(({ err }) => {
           if (!err) {
@@ -419,6 +419,5 @@ export const registerV1KeysVerifyKey = (app: App) =>
           });
         }),
     );
-
     return c.json(responseBody);
   });

apps/dashboard/app/(app)/apis/[apiId]/_overview/components/charts/bar-chart/hooks/use-fetch-timeseries.ts

@@ -159,6 +159,7 @@ export const useFetchVerificationTimeseries = (apiId: string | null) => {
       return {
         ...result,
         ...outcomeFields,
+        spent_credits: ts.y.spent_credits ?? 0,
       };
     });
   }, [data]);

apps/dashboard/app/(app)/apis/[apiId]/_overview/components/charts/credit-spend-chart/hooks/use-fetch-timeseries.ts

@@ -0,0 +1,149 @@
+import { formatTimestampForChart } from "@/components/logs/chart/utils/format-timestamp";
+import { HISTORICAL_DATA_WINDOW } from "@/components/logs/constants";
+import { trpc } from "@/lib/trpc/client";
+import { useQueryTime } from "@/providers/query-time-provider";
+import { useMemo } from "react";
+import { keysOverviewFilterFieldConfig } from "../../../../filters.schema";
+import { useFilters } from "../../../../hooks/use-filters";
+import type { KeysOverviewQueryTimeseriesPayload } from "../../bar-chart/query-timeseries.schema";
+
+export const useFetchCreditSpendTimeseries = (apiId: string | null) => {
+  const { filters } = useFilters();
+  const { queryTime: timestamp } = useQueryTime();
+
+  const queryParams = useMemo(() => {
+    const params: KeysOverviewQueryTimeseriesPayload = {
+      startTime: timestamp - HISTORICAL_DATA_WINDOW,
+      endTime: timestamp,
+      keyIds: { filters: [] },
+      outcomes: { filters: [] },
+      names: { filters: [] },
+      identities: { filters: [] },
+      tags: null,
+      apiId: apiId ?? "",
+      since: "",
+    };
+
+    if (!apiId) {
+      return params;
+    }
+
+    filters.forEach((filter) => {
+      if (!(filter.field in keysOverviewFilterFieldConfig)) {
+        return;
+      }
+
+      const fieldConfig = keysOverviewFilterFieldConfig[filter.field];
+      const validOperators = fieldConfig.operators;
+
+      const operator = validOperators.includes(filter.operator)
+        ? filter.operator
+        : validOperators[0];
+
+      switch (filter.field) {
+        case "startTime":
+        case "endTime": {
+          const numValue =
+            typeof filter.value === "number"
+              ? filter.value
+              : typeof filter.value === "string"
+                ? Number(filter.value)
+                : Number.NaN;
+
+          if (!Number.isNaN(numValue)) {
+            params[filter.field] = numValue;
+          }
+          break;
+        }
+
+        case "since": {
+          if (typeof filter.value === "string") {
+            params.since = filter.value;
+          }
+          break;
+        }
+
+        case "keyIds": {
+          if (typeof filter.value === "string" && filter.value.trim()) {
+            const keyIdOperator = operator === "is" || operator === "contains" ? operator : "is";
+
+            params.keyIds?.filters?.push({
+              operator: keyIdOperator,
+              value: filter.value,
+            });
+          }
+          break;
+        }
+
+        case "names":
+        case "identities": {
+          if (typeof filter.value === "string" && filter.value.trim()) {
+            params[filter.field]?.filters?.push({
+              operator,
+              value: filter.value,
+            });
+          }
+          break;
+        }
+
+        case "outcomes": {
+          // For credit spend, we might want to include all outcomes to show credit consumption patterns
+          if (typeof filter.value === "string") {
+            params.outcomes?.filters?.push({
+              operator: "is",
+              value: filter.value as
+                | "VALID"
+                | "INSUFFICIENT_PERMISSIONS"
+                | "RATE_LIMITED"
+                | "FORBIDDEN"
+                | "DISABLED"
+                | "EXPIRED"
+                | "USAGE_EXCEEDED"
+                | "",
+            });
+          }
+          break;
+        }
+
+        case "tags": {
+          if (typeof filter.value === "string" && filter.value.trim()) {
+            params.tags = {
+              operator,
+              value: filter.value,
+            };
+          }
+          break;
+        }
+      }
+    });
+
+    return params;
+  }, [filters, timestamp, apiId]);
+
+  const { data, isLoading, isError } = trpc.api.keys.timeseries.useQuery(queryParams, {
+    refetchInterval: queryParams.endTime === timestamp ? 10_000 : false,
+    enabled: Boolean(apiId),
+  });
+
+  const timeseries = useMemo(() => {
+    if (!data?.timeseries) {
+      return [];
+    }
+
+    return data.timeseries.map((ts) => {
+      return {
+        displayX: formatTimestampForChart(ts.x, data.granularity),
+        originalTimestamp: ts.x,
+        spent_credits: ts.y.spent_credits ?? 0,
+        total: ts.y.spent_credits ?? 0,
+      };
+    });
+  }, [data]);
+
+  return {
+    timeseries: timeseries || [],
+    isLoading,
+    isError,
+    granularity: data?.granularity,
+  };
+};