fix: /api/usage accepts session cookies and derives quota from D1 tier

Two bugs in the Portal dashboard:
1. /api/usage required a Bearer API key, silently returning 401 for session
   users → frontend fell back to quota:0. Dashboard showed "0 / 0 credits".
2. Quota was computed from AuthContext.quotaLimit which, for session users,
   was 0. Now reads account.tier from D1 and maps via TIER_QUOTAS[tier].

handleUsageForAccount() is the session-safe entry point; handleUsage() stays
as the Bearer-auth entry point and delegates. Route tries session first, then
falls back to Bearer for SDK/CLI callers.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Digidai

src/handlers/usage.ts

@@ -5,7 +5,8 @@
  * Best-effort: Worker crash loses unflushed counts.
  */
 
-import type { AuthContext, Env } from "../types";
+import type { AuthContext, Env, Tier } from "../types";
+import { TIER_QUOTAS } from "../types";
 import { CORS_HEADERS } from "../config";
 
 // ─── In-memory usage buffer ─────────────────────────────────
@@ -104,17 +105,16 @@ export function shouldFlush(): boolean {
 
 // ─── GET /api/usage endpoint ────────────────────────────────
 
-export async function handleUsage(
-  auth: AuthContext,
+/**
+ * Return usage data for an account.
+ *
+ * Accepts EITHER a Bearer API key (for SDK/CLI usage) OR a portal session
+ * cookie (for Dashboard). Callers must resolve the accountId before calling.
+ */
+export async function handleUsageForAccount(
   env: Env,
+  accountId: string,
 ): Promise<Response> {
-  if (!auth.keyId || !auth.accountId) {
-    return Response.json(
-      { error: "Unauthorized", message: "Valid API key required for /api/usage" },
-      { status: 401, headers: CORS_HEADERS },
-    );
-  }
-
   if (!env.AUTH_DB) {
     return Response.json(
       { error: "Service Unavailable", message: "Usage tracking is not configured" },
@@ -128,34 +128,46 @@ export async function handleUsage(
 
     const account = await env.AUTH_DB.prepare(
       `SELECT tier, monthly_credits_used, monthly_credits_reset_at FROM accounts WHERE id = ?`
-    ).bind(auth.accountId).first<{
+    ).bind(accountId).first<{
       tier: string;
       monthly_credits_used: number;
       monthly_credits_reset_at: string;
     }>();
 
+    if (!account) {
+      return Response.json(
+        { error: "Not Found", message: "Account not found" },
+        { status: 404, headers: CORS_HEADERS },
+      );
+    }
+
     const dailyRows = await env.AUTH_DB.prepare(`
       SELECT date, requests, credits, browser_calls, cache_hits
       FROM usage_daily
       WHERE key_id IN (SELECT id FROM api_keys WHERE account_id = ?)
         AND date >= ?
       ORDER BY date ASC
-    `).bind(auth.accountId, monthStart).all<{
+    `).bind(accountId, monthStart).all<{
       date: string;
       requests: number;
       credits: number;
       browser_calls: number;
       cache_hits: number;
     }>();
 
+    // Derive quota from the authoritative tier in D1, not from stale AuthContext
+    const tier = (account.tier === "pro" ? "pro" : account.tier === "enterprise" ? "pro" : "free") as Tier;
+    const quota = TIER_QUOTAS[tier];
+    const used = account.monthly_credits_used ?? 0;
+
     return Response.json({
-      tier: account?.tier || auth.tier,
-      quota: auth.quotaLimit,
-      used: account?.monthly_credits_used ?? auth.quotaUsed,
-      remaining: Math.max(0, auth.quotaLimit - (account?.monthly_credits_used ?? auth.quotaUsed)),
+      tier: account.tier,
+      quota,
+      used,
+      remaining: Math.max(0, quota - used),
       period: {
         start: monthStart,
-        reset_at: account?.monthly_credits_reset_at,
+        reset_at: account.monthly_credits_reset_at,
       },
       daily: dailyRows.results || [],
     }, { headers: CORS_HEADERS });
@@ -167,3 +179,17 @@ export async function handleUsage(
     );
   }
 }
+
+/** Bearer-auth entry point (API key users) */
+export async function handleUsage(
+  auth: AuthContext,
+  env: Env,
+): Promise<Response> {
+  if (!auth.accountId) {
+    return Response.json(
+      { error: "Unauthorized", message: "Valid API key required for /api/usage" },
+      { status: 401, headers: CORS_HEADERS },
+    );
+  }
+  return handleUsageForAccount(env, auth.accountId);
+}

src/index.ts

@@ -36,7 +36,7 @@ import { isAuthorizedByToken } from "./middleware/auth";
 import { resolveAuth } from "./middleware/auth-d1";
 import { buildPolicy, checkPolicy, policyHeaders } from "./middleware/tier-gate";
 import { consumeRateLimit, rateLimitedResponse } from "./middleware/rate-limit";
-import { recordUsage, flushUsage, shouldFlush, handleUsage } from "./handlers/usage";
+import { recordUsage, flushUsage, shouldFlush, handleUsage, handleUsageForAccount } from "./handlers/usage";
 import { resolveSession } from "./middleware/session";
 import {
   handleCreateKey,
@@ -346,8 +346,15 @@ export default {
       return handleOgImage(url, host);
     }
 
-    // GET /api/usage — per-key usage data
+    // GET /api/usage — per-account usage data
+    // Accepts EITHER Bearer API key (SDK/CLI) OR portal session cookie (dashboard)
     if (path === "/api/usage" && request.method === "GET") {
+      // Try session cookie first (Portal dashboard case)
+      const session = await resolveSession(request, env);
+      if (session) {
+        return handleUsageForAccount(env, session.accountId);
+      }
+      // Fall back to Bearer API key (SDK/CLI case)
       const auth = await resolveAuth(request, env);
       return handleUsage(auth, env);
     }