rollup: 2026-10-01 ctkm-1 admin usage, OpenAI verification, OAuth consent - #1723
Merged
Merged
Conversation
…ing (#1721) Admin Usage needed a selectable token total without double counting, immediately available filters and user details, and a visible data table that each panel can show directly or as an accordion. - Add a multi-select token picker to the dashboard and list. Total already includes Input and Output, so those selections are displayed but not added twice; selected cache-read and cache-write counts still add. An inline tooltip explains the overlap. - Add a per-panel Data table setting, defaulting to Always open with Accordion as the alternate mode. Persist and validate the field in the backend workspace contract. - Load Services, Billing accounts, and Acting users options when Usage opens. Preload visible user details in the background and cache usage and option queries for five minutes of freshness and ten minutes of retention. Source PR: #1721. Its rebased head 0e24c05 passed 24 CI checks with no failures, including the full backend, frontend, coverage, Rust feature, and CodeQL jobs. All 18 Admin Usage browser tests and 27 focused frontend tests passed locally. Deploy the backend workspace schema before the frontend because older backends reject the new table_display field.
📊 Code coverage
Gate: line coverage must stay at or above the threshold. Ratchet plan (W21): Backend → 55%, CLI → 50%, Frontend → 30% by quarter end. |
OpenAI's plugin portal verifies control of the MCP host by fetching /.well-known/openai-apps-challenge and expecting the plugin's token as bare plain text. The path returned 404, so submission showed "Domain not verified". Serve the token from the optional OPENAI_APPS_CHALLENGE_TOKEN env var on the public /.well-known router; return 404 when unset, which matches today's behavior. Existing discovery documents are unchanged. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ctkm-aelf
changed the title
ctkm-aelf
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rollup: 2026-10-01 ctkm-1
This rollup starts from
maincommit80a153d31200eaa8eafbf005cc13d3e3894181a9and integrates #1721 and
#1725.
After the #1721 squash landed,
mainadvanced through #1722 to479840e8. The rollup merged that commit as478b960a, preserving the latestmain history without conflicts or changes to the Admin Usage files. #1725 was
then raised against the rollup head
e09c7c8eand squashed on top of it.Admin Usage needed token counts that users can combine without double counting,
filter options and service details ready when opened, and data tables that can
stay visible or collapse per panel. The OpenAI plugin portal also needed to
verify control of the NyxID MCP host before the Codex/ChatGPT plugin can be
submitted.
Included changes
0e24c05eee93101f562c8a165ee5f53991822e715983b66537b724b057880a774dc45bd01484230fe70ba24bd4ad58735cfa83d3432f1c94d10c2886d85799bfb9a615b87256acd78e9674552051e1fbFor #1721, the source and landed commits have the same tree
(
a9914949583afb92fee83004879bc7886eaf17e3), so the squash contains thevalidated source exactly. The source PR was rebased onto this rollup's
mainbase before its final CI run; GitHub reported no merge conflicts.
For #1725, the source and landed commits have the same tree
(
ffb7e232c1edba00be67fb368dd67df06f181104). The PR was based on the currentrollup head, so no rebase was needed; GitHub reported it mergeable and clean.
Behavior
Cache-read, and Cache-write token views. Total already includes Input and
Output, so selecting them together displays those counts without adding
them twice. Selected cache counts still add. An inline tooltip explains
the overlap.
Accordion. The workspace API accepts and validates the persisted setting.
Visible user details preload in the background. React Query keeps these
results fresh for five minutes and cached for ten minutes.
GET /.well-known/openai-apps-challengereturns the optionalOPENAI_APPS_CHALLENGE_TOKENas baretext/plain, the format OpenAI'splugin portal requires for domain verification. When the variable is unset
the path returns 404, as before. The OIDC, OAuth authorization-server,
protected-resource, and JWKS discovery documents are unchanged.
Validation And Rollout
The rebased #1721 source head passed 24 CI checks with no failures, including
the frontend, backend tests, billing smoke, coverage, Rust feature builds, and
CodeQL. Locally, all 18 Admin Usage browser tests, 27 focused frontend tests,
TypeScript, lint, formatting, and backend
cargo checkpassed. The landedsource tree is identical to the tested head.
The #1725 source head passed 21 CI checks with no failures, including backend
tests, billing smoke, coverage, Clippy, formatting, Rust feature builds, and
CodeQL; frontend, CLI, and mobile jobs were skipped as unaffected. Locally, the
7 discovery handler tests (5 existing, 2 new) and
cargo clippy -D warningspassed. A local server run returned the exact token with
200 text/plainand noredirect, returned 404 with the variable unset, and served all four discovery
documents unchanged.
Deploy the backend workspace change before the frontend. An older backend
rejects the new
table_displayfield when saving panel settings.To complete OpenAI domain verification after deploying the backend, set
OPENAI_APPS_CHALLENGE_TOKENto the token shown in the portal, confirmhttps://nyx-api.chrono-ai.fun/.well-known/openai-apps-challengeprints onlythat token, then verify in the portal.
OAuth Consent Update
Direct rollup commit
9b4abe7cupdates the standard OAuth consent screen:roles,groups, andproxyhave readable descriptions, and every requested scope shows its exact value.Validation on the rollup branch: 50 standard and incremental consent tests, TypeScript, ESLint, and Prettier passed.