Successful upstream billing probes already persist the upstream-declared
rate as a display-only snapshot. Add a per-account opt-in that writes
that declared rate back to the account's rate_multiplier, so the account
cost basis follows upstream repricing automatically instead of drifting
until an operator notices.
- new per-account flag upstream_billing_rate_sync_enabled stored next to
the probe flag in account extra: enabling sync force-enables the
probe, disabling the probe cascades sync off, and eligibility follows
IsUpstreamBillingProbeIdentity (tightened from any non-empty platform
to an explicit whitelist of the five supported API-key platforms so
future platforms do not silently inherit probe/sync semantics)
- only a successful probe whose declared rate survives validation
(finite, within bounds, not rounded to zero at the rate_multiplier
decimal(10,4) scale) writes back; failed/unsupported/invalid probes
leave rate_multiplier unchanged
- the writeback rides the existing snapshot CAS transaction:
UpdateUpstreamBillingProbeSnapshot takes an optional rateMultiplier
and applies it atomically with the snapshot under the same
identity/snapshot compare-and-swap, so a probe result observed on a
stale account cannot clobber a concurrent admin edit
- admin edit goes through UpdateWithAccountBillingSettings, which
applies the form without overwriting a rate that a probe synchronized
after the edit form was loaded (nil rateMultiplier = not edited);
once sync is enabled the edit form shows the rate as managed
- bulk update rejects a manual rate_multiplier change when any target
account has rate sync enabled (whole batch fails with a dedicated
error so partial writes cannot bypass the sync ownership)
- frontend: sync toggle with hints in the edit modal (probe/sync
enable/disable coupling enforced in the form), synced-rate tooltip on
the rate cell, bulk edit modal warns and blocks rate edits that hit
sync-enabled accounts; en/zh copy updated
- tests: service unit tests for sync gating/validation/cascade, sqlmock
repo tests for the extended CAS, real-PostgreSQL integration tests
(rate written only for successful+enabled accounts, manual rate
protected after sync disabled, admin edit preserved across concurrent
probe sync), handler/API contract updates, frontend specs for modal
coupling, bulk rejection and rate cell
/v1/sub2api/billing is a key-scoped sub2api convention: any API-key
account whose base_url points at a sub2api-compatible upstream answers
it regardless of the account platform. Widen probe eligibility from
platform=openai to every API-key account (OAuth/Bedrock stay excluded:
no static key to present).
- central predicate exported as IsUpstreamBillingProbeIdentity; runner,
manual probe, SetAccountEnabled, admin create/update/bulk validation
and CRS reconcile all follow it
- probe target resolution reads credentials.api_key/base_url directly.
OpenAI keeps its official-default base URL and openai transport
profile. Other platforms whose base_url is empty or points at an
official provider API domain (anthropic.com, googleapis.com, x.ai,
grok.com, openai.com - matched on the normalized hostname, port and
trailing dot stripped, as the exact host or any subdomain) persist
"unsupported" without sending a request: the create form fills empty
base_url with official defaults and offers official regional presets
(e.g. us-east-1.api.x.ai), and official APIs cannot answer
/v1/sub2api/billing, so probing would only send the account key to a
nonexistent official path
- due-scan SQL, BulkUpdate probe WHERE, UpdateCredentials stale-snapshot
CASE and proxy-change invalidation drop their platform filters
(type='apikey' retained)
- frontend: rate cell, edit/create/bulk modals gate on type==='apikey';
the antigravity upstream create flow (its own helper and form section)
shows the auto-probe toggle and passes upstream_billing_probe_enabled;
bulk WS-mode section stays OpenAI-only; settings copy de-scoped
- tests: multiplatform service unit tests (relay success, official/empty
base_url unsupported without request, normalized official-host matrix,
OpenAI defaults preserved), real-PostgreSQL due-scan coverage for
openai/anthropic/grok plus oauth/disabled exclusion, updated
sqlmock/CRS/frontend specs; probe stays opt-in per account
Brisbanehuang