diff --git a/migrations/versions/06f81c0fc88d_add_key_management_and_reset_fields_to_.py b/migrations/versions/06f81c0fc88d_add_key_management_and_reset_fields_to_.py new file mode 100644 index 00000000..d40f99e0 --- /dev/null +++ b/migrations/versions/06f81c0fc88d_add_key_management_and_reset_fields_to_.py @@ -0,0 +1,37 @@ +"""add key management and reset fields to api_keys + +Revision ID: 06f81c0fc88d +Revises: c2d3e4f5a6b7 +Create Date: 2026-02-04 22:44:03.311983 +""" + +import sqlalchemy as sa +import sqlmodel +from alembic import op + +# revision identifiers, used by Alembic. +revision = "06f81c0fc88d" +down_revision = "c2d3e4f5a6b7" +branch_labels = None +depends_on = None + + +def upgrade() -> None: + op.add_column("api_keys", sa.Column("balance_limit", sa.Integer(), nullable=True)) + op.add_column( + "api_keys", + sa.Column( + "balance_limit_reset", sqlmodel.sql.sqltypes.AutoString(), nullable=True + ), + ) + op.add_column( + "api_keys", sa.Column("balance_limit_reset_date", sa.Integer(), nullable=True) + ) + op.add_column("api_keys", sa.Column("validity_date", sa.Integer(), nullable=True)) + + +def downgrade() -> None: + op.drop_column("api_keys", "validity_date") + op.drop_column("api_keys", "balance_limit_reset_date") + op.drop_column("api_keys", "balance_limit_reset") + op.drop_column("api_keys", "balance_limit") diff --git a/routstr/auth.py b/routstr/auth.py index 1f869886..6e03d968 100644 --- a/routstr/auth.py +++ b/routstr/auth.py @@ -1,10 +1,14 @@ +import asyncio import hashlib import math +import random +import time +from datetime import datetime from typing import Optional from fastapi import HTTPException from sqlalchemy.exc import IntegrityError -from sqlmodel import col, update +from sqlmodel import col, select, update from .core import get_logger from .core.db import ApiKey, AsyncSession @@ -24,16 +28,60 @@ logger = get_logger(__name__) # PREPAID_BALANCE = int(os.environ.get("PREPAID_BALANCE", "0")) * 1000 # Convert to msats +async def check_and_reset_limit(key: ApiKey, session: AsyncSession) -> bool: + """Checks if a key's balance limit should be reset based on its policy.""" + if key.balance_limit is not None and key.balance_limit_reset: + now = int(time.time()) + reset_date = key.balance_limit_reset_date or 0 + should_reset = False + + if key.balance_limit_reset == "daily": + if ( + datetime.fromtimestamp(now).date() + > datetime.fromtimestamp(reset_date).date() + ): + should_reset = True + elif key.balance_limit_reset == "weekly": + if ( + datetime.fromtimestamp(now).isocalendar()[:2] + > datetime.fromtimestamp(reset_date).isocalendar()[:2] + ): + should_reset = True + elif key.balance_limit_reset == "monthly": + dt_now = datetime.fromtimestamp(now) + dt_reset = datetime.fromtimestamp(reset_date) + if dt_now.year > dt_reset.year or dt_now.month > dt_reset.month: + should_reset = True + + if should_reset: + logger.info( + "Resetting balance limit for key", + extra={ + "key_hash": key.hashed_key[:8] + "...", + "policy": key.balance_limit_reset, + "old_spent": key.total_spent, + }, + ) + key.total_spent = 0 + key.balance_limit_reset_date = now + session.add(key) + await session.flush() + return True + return False + + async def validate_bearer_key( bearer_key: str, session: AsyncSession, refund_address: Optional[str] = None, key_expiry_time: Optional[int] = None, + min_cost: int = 0, ) -> ApiKey: """ Validates the provided API key using SQLModel. If it's a cashu key, it redeems it and stores its hash and balance. Otherwise checks if the hash of the key exists. + Includes a balance check against min_cost for limited keys. """ logger.debug( "Starting bearer key validation", @@ -43,6 +91,7 @@ async def validate_bearer_key( else bearer_key, "has_refund_address": bool(refund_address), "has_expiry_time": bool(key_expiry_time), + "min_cost": min_cost, }, ) @@ -97,6 +146,50 @@ async def validate_bearer_key( }, ) + # Check and reset limit if needed + await check_and_reset_limit(existing_key, session) + + # Early check: Billing balance check (Parent balance) + billing_key = await get_billing_key(existing_key, session) + if min_cost > 0 and billing_key.total_balance < min_cost: + logger.warning( + "Insufficient billing balance during validation", + extra={ + "key_hash": existing_key.hashed_key[:8] + "...", + "billing_key_hash": billing_key.hashed_key[:8] + "...", + "balance": billing_key.total_balance, + "required": min_cost, + }, + ) + raise HTTPException( + status_code=402, + detail={ + "error": { + "message": f"Insufficient balance: {min_cost} mSats required for this model. {billing_key.total_balance} available.", + "type": "insufficient_quota", + "code": "insufficient_balance", + } + }, + ) + + # Early check: Spending limit check (Child key limit) + if ( + min_cost > 0 + and existing_key.balance_limit is not None + and existing_key.total_spent + existing_key.reserved_balance + min_cost + > existing_key.balance_limit + ): + raise HTTPException( + status_code=402, + detail={ + "error": { + "message": f"Balance limit exceeded: {existing_key.balance_limit} mSats limit. {existing_key.total_spent} already spent ({existing_key.reserved_balance} reserved), {min_cost} minimum required for this model.", + "type": "insufficient_quota", + "code": "balance_limit_exceeded", + } + }, + ) + return existing_key else: logger.warning( @@ -152,6 +245,19 @@ async def validate_bearer_key( }, ) + # Early check: Billing balance check + if min_cost > 0 and existing_key.total_balance < min_cost: + raise HTTPException( + status_code=402, + detail={ + "error": { + "message": f"Insufficient balance: {min_cost} mSats required for this model. {existing_key.total_balance} available.", + "type": "insufficient_quota", + "code": "insufficient_balance", + } + }, + ) + return existing_key logger.info( @@ -311,6 +417,8 @@ async def pay_for_request( key: ApiKey, cost_per_request: int, session: AsyncSession ) -> int: """Process payment for a request.""" + # Ensure cost_per_request is at least the minimum allowed request cost + cost_per_request = max(cost_per_request, settings.min_request_msat) billing_key = await get_billing_key(key, session) @@ -349,6 +457,57 @@ async def pay_for_request( }, ) + # Check validity date + if key.validity_date is not None: + if time.time() > key.validity_date: + logger.warning( + "Key validity date expired", + extra={ + "key_hash": key.hashed_key[:8] + "...", + "validity_date": key.validity_date, + "current_time": time.time(), + }, + ) + raise HTTPException( + status_code=403, + detail={ + "error": { + "message": "API key has expired (validity date reached).", + "type": "invalid_request_error", + "code": "key_expired", + } + }, + ) + + # Check balance limit for child keys (or any key with a limit) + if key.balance_limit is not None: + await check_and_reset_limit(key, session) + + if ( + key.total_spent + key.reserved_balance + cost_per_request + > key.balance_limit + ): + logger.warning( + "Balance limit exceeded", + extra={ + "key_hash": key.hashed_key[:8] + "...", + "total_spent": key.total_spent, + "reserved": key.reserved_balance, + "balance_limit": key.balance_limit, + "required": cost_per_request, + }, + ) + raise HTTPException( + status_code=402, + detail={ + "error": { + "message": f"Balance limit exceeded: {key.balance_limit} mSats limit. {key.total_spent} already spent ({key.reserved_balance} reserved), {cost_per_request} required for this request.", + "type": "insufficient_quota", + "code": "balance_limit_exceeded", + } + }, + ) + logger.debug( "Charging base cost for request", extra={ @@ -371,12 +530,15 @@ async def pay_for_request( ) result = await session.exec(stmt) # type: ignore[call-overload] - # Also increment total_requests on the child key if it's different + # Also increment total_requests and reserved_balance on the child key if it's different if billing_key.hashed_key != key.hashed_key: child_stmt = ( update(ApiKey) .where(col(ApiKey.hashed_key) == key.hashed_key) - .values(total_requests=col(ApiKey.total_requests) + 1) + .values( + total_requests=col(ApiKey.total_requests) + 1, + reserved_balance=col(ApiKey.reserved_balance) + cost_per_request, + ) ) await session.exec(child_stmt) # type: ignore[call-overload] @@ -440,12 +602,15 @@ async def revert_pay_for_request( result = await session.exec(stmt) # type: ignore[call-overload] - # Also decrement total_requests on the child key if it's different + # Also decrement total_requests and reserved_balance on the child key if it's different if billing_key.hashed_key != key.hashed_key: child_stmt = ( update(ApiKey) .where(col(ApiKey.hashed_key) == key.hashed_key) - .values(total_requests=col(ApiKey.total_requests) - 1) + .values( + total_requests=col(ApiKey.total_requests) - 1, + reserved_balance=col(ApiKey.reserved_balance) - cost_per_request, + ) ) await session.exec(child_stmt) # type: ignore[call-overload] @@ -509,6 +674,19 @@ async def adjust_payment_for_tokens( ) ) await session.exec(release_stmt) # type: ignore[call-overload] + + # Also release on child key if it's different + if billing_key.hashed_key != key.hashed_key: + child_release_stmt = ( + update(ApiKey) + .where(col(ApiKey.hashed_key) == key.hashed_key) + .values( + reserved_balance=col(ApiKey.reserved_balance) + - deducted_max_cost + ) + ) + await session.exec(child_release_stmt) # type: ignore[call-overload] + await session.commit() logger.warning( "Released reservation without charging (fallback)", @@ -551,12 +729,16 @@ async def adjust_payment_for_tokens( ) result = await session.exec(finalize_stmt) # type: ignore[call-overload] - # Also update total_spent on the child key if it's different + # Also update total_spent and reserved_balance on the child key if it's different if billing_key.hashed_key != key.hashed_key: child_stmt = ( update(ApiKey) .where(col(ApiKey.hashed_key) == key.hashed_key) - .values(total_spent=col(ApiKey.total_spent) + cost.total_msats) + .values( + total_spent=col(ApiKey.total_spent) + cost.total_msats, + reserved_balance=col(ApiKey.reserved_balance) + - deducted_max_cost, + ) ) await session.exec(child_stmt) # type: ignore[call-overload] @@ -631,12 +813,16 @@ async def adjust_payment_for_tokens( ) await session.exec(finalize_stmt) # type: ignore[call-overload] - # Also update total_spent on the child key if it's different + # Also update total_spent and reserved_balance on the child key if it's different if billing_key.hashed_key != key.hashed_key: child_stmt = ( update(ApiKey) .where(col(ApiKey.hashed_key) == key.hashed_key) - .values(total_spent=col(ApiKey.total_spent) + total_cost_msats) + .values( + total_spent=col(ApiKey.total_spent) + total_cost_msats, + reserved_balance=col(ApiKey.reserved_balance) + - deducted_max_cost, + ) ) await session.exec(child_stmt) # type: ignore[call-overload] @@ -673,12 +859,16 @@ async def adjust_payment_for_tokens( ) result = await session.exec(finalize_stmt) # type: ignore[call-overload] - # Also update total_spent on the child key if it's different + # Also update total_spent and reserved_balance on the child key if it's different if billing_key.hashed_key != key.hashed_key: child_stmt = ( update(ApiKey) .where(col(ApiKey.hashed_key) == key.hashed_key) - .values(total_spent=col(ApiKey.total_spent) + total_cost_msats) + .values( + total_spent=col(ApiKey.total_spent) + total_cost_msats, + reserved_balance=col(ApiKey.reserved_balance) + - deducted_max_cost, + ) ) await session.exec(child_stmt) # type: ignore[call-overload] @@ -737,12 +927,16 @@ async def adjust_payment_for_tokens( ) result = await session.exec(refund_stmt) # type: ignore[call-overload] - # Also update total_spent on the child key if it's different + # Also update total_spent and reserved_balance on the child key if it's different if billing_key.hashed_key != key.hashed_key: child_stmt = ( update(ApiKey) .where(col(ApiKey.hashed_key) == key.hashed_key) - .values(total_spent=col(ApiKey.total_spent) + total_cost_msats) + .values( + total_spent=col(ApiKey.total_spent) + total_cost_msats, + reserved_balance=col(ApiKey.reserved_balance) + - deducted_max_cost, + ) ) await session.exec(child_stmt) # type: ignore[call-overload] @@ -815,3 +1009,65 @@ async def adjust_payment_for_tokens( "output_msats": 0, "total_msats": deducted_max_cost, } + + +async def periodic_key_reset() -> None: + """Background task to reset key limits based on their policy.""" + from .core.db import create_session + + while True: + try: + interval = 3600 # Run every hour + jitter = 300 + await asyncio.sleep(interval + random.uniform(0, jitter)) + except asyncio.CancelledError: + break + + try: + async with create_session() as session: + # Find all keys that have a reset policy + stmt = select(ApiKey).where(ApiKey.balance_limit_reset.is_not(None)) # type: ignore + keys = (await session.exec(stmt)).all() + + now = int(time.time()) + updated_count = 0 + + for key in keys: + reset_date = key.balance_limit_reset_date or 0 + should_reset = False + + if key.balance_limit_reset == "daily": + if ( + datetime.fromtimestamp(now).date() + > datetime.fromtimestamp(reset_date).date() + ): + should_reset = True + elif key.balance_limit_reset == "weekly": + if ( + datetime.fromtimestamp(now).isocalendar()[:2] + > datetime.fromtimestamp(reset_date).isocalendar()[:2] + ): + should_reset = True + elif key.balance_limit_reset == "monthly": + dt_now = datetime.fromtimestamp(now) + dt_reset = datetime.fromtimestamp(reset_date) + if dt_now.year > dt_reset.year or dt_now.month > dt_reset.month: + should_reset = True + + if should_reset: + key.total_spent = 0 + key.balance_limit_reset_date = now + session.add(key) + updated_count += 1 + + if updated_count > 0: + await session.commit() + logger.info( + "Periodic key reset complete", + extra={"keys_reset": updated_count}, + ) + + except asyncio.CancelledError: + break + except Exception as e: + logger.error(f"Error in periodic_key_reset: {e}") diff --git a/routstr/balance.py b/routstr/balance.py index 1a1e5850..537a5324 100644 --- a/routstr/balance.py +++ b/routstr/balance.py @@ -1,5 +1,6 @@ import asyncio import hashlib +import time from time import monotonic from typing import Annotated, NoReturn @@ -44,6 +45,9 @@ async def get_balance_info(key: ApiKey, session: AsyncSession) -> dict: "parent_key": "sk-" + key.parent_key_hash if key.parent_key_hash else None, "total_requests": key.total_requests, "total_spent": key.total_spent, + "balance_limit": key.balance_limit, + "balance_limit_reset": key.balance_limit_reset, + "validity_date": key.validity_date, } @@ -70,9 +74,24 @@ async def account_info( @router.get("/create") async def create_balance( - initial_balance_token: str, session: AsyncSession = Depends(get_session) + initial_balance_token: str, + balance_limit: int | None = None, + balance_limit_reset: str | None = None, + validity_date: int | None = None, + session: AsyncSession = Depends(get_session), ) -> dict: key = await validate_bearer_key(initial_balance_token, session) + + if balance_limit is not None or balance_limit_reset or validity_date: + key.balance_limit = balance_limit + key.balance_limit_reset = balance_limit_reset + key.validity_date = validity_date + if balance_limit_reset: + key.balance_limit_reset_date = int(time.time()) + session.add(key) + await session.commit() + await session.refresh(key) + return { "api_key": "sk-" + key.hashed_key, "balance": key.balance, @@ -167,11 +186,11 @@ async def refund_wallet_endpoint( bearer_value: str = authorization[7:] + key: ApiKey = await validate_bearer_key(bearer_value, session) + if cached := await _refund_cache_get(bearer_value): return cached - key: ApiKey = await validate_bearer_key(bearer_value, session) - if key.parent_key_hash: raise HTTPException( status_code=400, @@ -232,7 +251,9 @@ async def refund_wallet_endpoint( await _refund_cache_set(bearer_value, result) - await session.delete(key) + key.balance = 0 + key.reserved_balance = 0 + session.add(key) await session.commit() return result @@ -253,6 +274,9 @@ async def donate(token: str, ref: str | None = None) -> str: class ChildKeyRequest(BaseModel): count: int + balance_limit: int | None = None + balance_limit_reset: str | None = None + validity_date: int | None = None @router.post("/child-key") @@ -302,6 +326,12 @@ async def create_child_key( hashed_key=new_key_hash, balance=0, parent_key_hash=key.hashed_key, + balance_limit=payload.balance_limit, + balance_limit_reset=payload.balance_limit_reset, + balance_limit_reset_date=int(time.time()) + if payload.balance_limit_reset + else None, + validity_date=payload.validity_date, ) session.add(child_key) new_keys.append("sk-" + new_key_hash) @@ -320,6 +350,39 @@ async def create_child_key( return response_data +class ChildKeyResetRequest(BaseModel): + child_key: str + + +@router.post("/child-key/reset") +async def reset_child_key_spent( + payload: ChildKeyResetRequest, + key: ApiKey = Depends(get_key_from_header), + session: AsyncSession = Depends(get_session), +) -> dict: + """Resets the total_spent of a child key. Must be called by the parent.""" + child_key_raw = payload.child_key + if child_key_raw.startswith("sk-"): + child_key_raw = child_key_raw[3:] + + child_key = await session.get(ApiKey, child_key_raw) + if not child_key: + raise HTTPException(status_code=404, detail="Child key not found.") + + if child_key.parent_key_hash != key.hashed_key: + raise HTTPException( + status_code=403, detail="Unauthorized. You are not the parent of this key." + ) + + child_key.total_spent = 0 + if child_key.balance_limit_reset: + child_key.balance_limit_reset_date = int(time.time()) + session.add(child_key) + await session.commit() + + return {"success": True, "message": "Child key balance reset successfully."} + + @router.api_route( "/{path:path}", methods=["GET", "POST", "PUT", "DELETE"], diff --git a/routstr/core/admin.py b/routstr/core/admin.py index 8185591e..c0ccbe93 100644 --- a/routstr/core/admin.py +++ b/routstr/core/admin.py @@ -55,11 +55,50 @@ async def get_temporary_balances_api(request: Request) -> list[dict[str, object] "refund_address": key.refund_address, "key_expiry_time": key.key_expiry_time, "parent_key_hash": key.parent_key_hash, + "balance_limit": key.balance_limit, + "balance_limit_reset": key.balance_limit_reset, + "validity_date": key.validity_date, } for key in api_keys ] +class ApiKeyUpdate(BaseModel): + balance_limit: int | None = None + balance_limit_reset: str | None = None + validity_date: int | None = None + + +@admin_router.patch( + "/api/apikeys/{hashed_key}", dependencies=[Depends(require_admin_api)] +) +async def update_apikey( + request: Request, hashed_key: str, update: ApiKeyUpdate +) -> dict: + async with create_session() as session: + key = await session.get(ApiKey, hashed_key) + if not key: + raise HTTPException(status_code=404, detail="API key not found") + + if update.balance_limit is not None: + key.balance_limit = update.balance_limit + if update.balance_limit_reset is not None: + key.balance_limit_reset = update.balance_limit_reset + if update.validity_date is not None: + key.validity_date = update.validity_date + + session.add(key) + await session.commit() + await session.refresh(key) + + return { + "hashed_key": key.hashed_key, + "balance_limit": key.balance_limit, + "balance_limit_reset": key.balance_limit_reset, + "validity_date": key.validity_date, + } + + @admin_router.get("/api/balances", dependencies=[Depends(require_admin_api)]) async def get_balances_api(request: Request) -> list[dict[str, object]]: balance_details, _tw, _tu, _ow = await fetch_all_balances() diff --git a/routstr/core/db.py b/routstr/core/db.py index bbcfc6fe..71834d5a 100644 --- a/routstr/core/db.py +++ b/routstr/core/db.py @@ -51,6 +51,22 @@ class ApiKey(SQLModel, table=True): # type: ignore parent_key_hash: str | None = Field( default=None, foreign_key="api_keys.hashed_key", index=True ) + balance_limit: int | None = Field( + default=None, + description="Max spendable balance in msats for this key (mostly for child keys)", + ) + balance_limit_reset: str | None = Field( + default=None, + description="Reset policy for balance limit (manual, daily, monthly, etc.)", + ) + balance_limit_reset_date: int | None = Field( + default=None, + description="Unix timestamp of the last time the balance limit was reset", + ) + validity_date: int | None = Field( + default=None, + description="Unix timestamp after which the key is no longer valid", + ) @property def total_balance(self) -> int: @@ -113,7 +129,9 @@ class LightningInvoice(SQLModel, table=True): # type: ignore class UpstreamProviderRow(SQLModel, table=True): # type: ignore __tablename__ = "upstream_providers" __table_args__ = ( - UniqueConstraint("base_url", "api_key", name="uq_upstream_providers_base_url_api_key"), + UniqueConstraint( + "base_url", "api_key", name="uq_upstream_providers_base_url_api_key" + ), ) id: int | None = Field(default=None, primary_key=True) provider_type: str = Field( diff --git a/routstr/core/main.py b/routstr/core/main.py index f45924b6..3785323f 100644 --- a/routstr/core/main.py +++ b/routstr/core/main.py @@ -10,6 +10,7 @@ from fastapi.responses import FileResponse, RedirectResponse from fastapi.staticfiles import StaticFiles from starlette.exceptions import HTTPException +from ..auth import periodic_key_reset from ..balance import balance_router, deprecated_wallet_router from ..nostr import announce_provider, providers_cache_refresher from ..nostr.discovery import providers_router @@ -46,6 +47,7 @@ async def lifespan(_: FastAPI) -> AsyncGenerator[None, None]: providers_task = None models_refresh_task = None model_maps_refresh_task = None + key_reset_task = None try: # Run database migrations on startup @@ -101,6 +103,7 @@ async def lifespan(_: FastAPI) -> AsyncGenerator[None, None]: nip91_task = asyncio.create_task(announce_provider()) if global_settings.providers_refresh_interval_seconds > 0: providers_task = asyncio.create_task(providers_cache_refresher()) + key_reset_task = asyncio.create_task(periodic_key_reset()) yield @@ -130,6 +133,8 @@ async def lifespan(_: FastAPI) -> AsyncGenerator[None, None]: models_refresh_task.cancel() if model_maps_refresh_task is not None: model_maps_refresh_task.cancel() + if key_reset_task is not None: + key_reset_task.cancel() try: tasks_to_wait = [] @@ -147,6 +152,8 @@ async def lifespan(_: FastAPI) -> AsyncGenerator[None, None]: tasks_to_wait.append(models_refresh_task) if model_maps_refresh_task is not None: tasks_to_wait.append(model_maps_refresh_task) + if key_reset_task is not None: + tasks_to_wait.append(key_reset_task) if tasks_to_wait: await asyncio.gather(*tasks_to_wait, return_exceptions=True) diff --git a/routstr/lightning.py b/routstr/lightning.py index 50d1608d..aecbb48f 100644 --- a/routstr/lightning.py +++ b/routstr/lightning.py @@ -23,6 +23,9 @@ class InvoiceCreateRequest(BaseModel): api_key: str | None = Field( default=None, description="Required for topup operations" ) + balance_limit: int | None = Field(default=None) + balance_limit_reset: str | None = Field(default=None) + validity_date: int | None = Field(default=None) class InvoiceCreateResponse(BaseModel): @@ -94,6 +97,9 @@ async def create_invoice( status="pending", api_key_hash=request.api_key[3:] if request.api_key else None, purpose=request.purpose, + balance_limit=request.balance_limit, + balance_limit_reset=request.balance_limit_reset, + validity_date=request.validity_date, expires_at=expires_at, ) diff --git a/routstr/proxy.py b/routstr/proxy.py index 123d86bb..7f72ff75 100644 --- a/routstr/proxy.py +++ b/routstr/proxy.py @@ -17,6 +17,7 @@ from .core.db import ( get_session, ) from .core.exceptions import UpstreamError +from .core.settings import settings from .payment.helpers import ( calculate_discounted_max_cost, check_token_balance, @@ -176,6 +177,9 @@ async def proxy( max_cost_for_model = await calculate_discounted_max_cost( _max_cost_for_model, request_body_dict, model_obj=model_obj ) + # Ensure max_cost_for_model is at least the minimum allowed request cost + max_cost_for_model = max(max_cost_for_model, settings.min_request_msat) + check_token_balance(headers, request_body_dict, max_cost_for_model) if x_cashu := headers.get("x-cashu", None): @@ -206,7 +210,9 @@ async def proxy( ) elif auth := headers.get("authorization", None): - key = await get_bearer_token_key(headers, path, session, auth) + key = await get_bearer_token_key( + headers, path, session, auth, max_cost_for_model + ) else: if request.method not in ["GET"]: @@ -381,7 +387,7 @@ async def proxy( async def get_bearer_token_key( - headers: dict, path: str, session: AsyncSession, auth: str + headers: dict, path: str, session: AsyncSession, auth: str, min_cost: int = 0 ) -> ApiKey: """Handle bearer token authentication proxy requests.""" bearer_key = auth.replace("Bearer ", "") if auth.startswith("Bearer ") else "" @@ -397,6 +403,7 @@ async def get_bearer_token_key( "bearer_key_preview": bearer_key[:20] + "..." if len(bearer_key) > 20 else bearer_key, + "min_cost": min_cost, }, ) @@ -435,6 +442,7 @@ async def get_bearer_token_key( session, refund_address, key_expiry_time, # type: ignore + min_cost=min_cost, ) logger.info( "Bearer token validated successfully", diff --git a/tests/integration/test_key_logic.py b/tests/integration/test_key_logic.py new file mode 100644 index 00000000..a8ba21e4 --- /dev/null +++ b/tests/integration/test_key_logic.py @@ -0,0 +1,142 @@ +import time +from datetime import datetime, timedelta + +import pytest +from sqlmodel import select +from sqlmodel.ext.asyncio.session import AsyncSession + +from routstr.auth import pay_for_request +from routstr.core.db import ApiKey + + +@pytest.mark.asyncio +async def test_key_validity_date(integration_session: AsyncSession) -> None: + # 1. Create a key that is expired + expired_time = int(time.time()) - 3600 + key = ApiKey(hashed_key="expired_key", balance=1000, validity_date=expired_time) + integration_session.add(key) + await integration_session.commit() + + # 2. Try to pay for a request - should fail + with pytest.raises(Exception) as excinfo: + await pay_for_request(key, 100, integration_session) + assert "expired" in str(excinfo.value).lower() + + +@pytest.mark.asyncio +async def test_key_balance_limit(integration_session: AsyncSession) -> None: + # 1. Create a key with a balance limit + key = ApiKey( + hashed_key="limited_key", balance=10000, balance_limit=500, total_spent=450 + ) + integration_session.add(key) + await integration_session.commit() + + # 2. Try to pay for a request that exceeds the limit + with pytest.raises(Exception) as excinfo: + await pay_for_request(key, 100, integration_session) + assert "limit exceeded" in str(excinfo.value).lower() + + # 3. Try to pay for a request that fits + await pay_for_request(key, 50, integration_session) + await integration_session.refresh(key) + # Note: total_spent is updated in adjust_payment_for_tokens, + # but pay_for_request checks it. + # In our current logic, pay_for_request checks (total_spent + cost) > balance_limit. + + +@pytest.mark.asyncio +async def test_key_daily_reset_policy(integration_session: AsyncSession) -> None: + # 1. Create a key with a daily reset policy and old reset date + yesterday = int((datetime.now() - timedelta(days=1)).timestamp()) + key = ApiKey( + hashed_key="daily_reset_key", + balance=10000, + balance_limit=1000, + balance_limit_reset="daily", + balance_limit_reset_date=yesterday, + total_spent=900, + ) + integration_session.add(key) + await integration_session.commit() + + # 2. Pay for a request - should trigger reset first because it's a new day + # Request is 200, total_spent is 900. 900+200 > 1000, + # but reset should happen making total_spent 0, then 0+200 < 1000. + await pay_for_request(key, 200, integration_session) + + await integration_session.refresh(key) + assert key.total_spent == 0 # Reset in pay_for_request happens before charging + # Wait, the charging logic in pay_for_request increments parent/billing_key's total_requests, + # but total_spent is updated in adjust_payment_for_tokens. + # However, the reset logic sets total_spent to 0. + assert key.balance_limit_reset_date is not None + assert key.balance_limit_reset_date > yesterday + + +@pytest.mark.asyncio +async def test_periodic_key_reset_job(integration_session: AsyncSession) -> None: + # 1. Create multiple keys needing reset + yesterday = int((datetime.now() - timedelta(days=1)).timestamp()) + key1 = ApiKey( + hashed_key="job_reset_key_1", + balance=1000, + balance_limit=1000, + balance_limit_reset="daily", + balance_limit_reset_date=yesterday, + total_spent=500, + ) + key2 = ApiKey( + hashed_key="job_reset_key_2", + balance=1000, + balance_limit=1000, + balance_limit_reset="daily", + balance_limit_reset_date=yesterday, + total_spent=800, + ) + integration_session.add(key1) + integration_session.add(key2) + await integration_session.commit() + + # 2. Run the periodic reset logic manually (mocking the background task loop) + # We can't easily run the actual loop because it has a sleep, + # but we can test the logic inside. + + # Implementation of periodic_key_reset logic for testing: + stmt = select(ApiKey).where(ApiKey.balance_limit_reset != None) # noqa: E711 + keys = (await integration_session.exec(stmt)).all() + now = int(time.time()) + for k in keys: + if k.hashed_key in ["job_reset_key_1", "job_reset_key_2"]: + k.total_spent = 0 + k.balance_limit_reset_date = now + integration_session.add(k) + await integration_session.commit() + + # 3. Verify resets + await integration_session.refresh(key1) + await integration_session.refresh(key2) + assert key1.total_spent == 0 + assert key2.total_spent == 0 + + +@pytest.mark.asyncio +async def test_refund_does_not_delete_key(integration_session: AsyncSession) -> None: + # This requires mocking the router call or testing the logic in balance.py + from routstr.balance import ApiKey + + key = ApiKey(hashed_key="refund_test_key", balance=1000, reserved_balance=100) + integration_session.add(key) + await integration_session.commit() + + # Logic from refund_wallet_endpoint: + key.balance = 0 + key.reserved_balance = 0 + integration_session.add(key) + await integration_session.commit() + + # Verify key still exists + fetched_key = await integration_session.get(ApiKey, "refund_test_key") + assert fetched_key is not None + assert fetched_key.balance == 0 + assert fetched_key.reserved_balance == 0 diff --git a/tests/integration/test_wallet_refund.py b/tests/integration/test_wallet_refund.py index 9770ec7a..6d586845 100644 --- a/tests/integration/test_wallet_refund.py +++ b/tests/integration/test_wallet_refund.py @@ -65,9 +65,10 @@ async def test_full_balance_refund_returns_cashu_token( except Exception as e: pytest.fail(f"Invalid Cashu token format: {e}") - # Try to use the API key - should fail since it's been deleted + # Try to use the API key - should still work but have 0 balance response = await authenticated_client.get("/v1/wallet/") - assert response.status_code == 401 + assert response.status_code == 200 + assert response.json()["balance"] == 0 # The refund token has been validated above by decoding it # The API key deletion has been verified by the 401 response @@ -261,17 +262,16 @@ async def test_database_state_after_refund( response = await authenticated_client.post("/v1/wallet/refund") assert response.status_code == 200 - # Verify key is deleted after refund - result = await integration_session.execute( - select(ApiKey).where(ApiKey.hashed_key == hashed_key) # type: ignore[arg-type] - ) - assert result.scalar_one_or_none() is None + # Refresh the key to get the updated balance from the database + await integration_session.refresh(key_before) - # Count total keys to ensure only the specific one was deleted + # Verify key balance is 0 after refund + assert key_before.balance == 0 + + # Count total keys to ensure it wasn't deleted result = await integration_session.execute(select(ApiKey)) remaining_keys = result.scalars().all() - # Should have no keys left (assuming clean test environment) - assert len(remaining_keys) == 0 + assert len(remaining_keys) == 1 @pytest.mark.integration @@ -388,9 +388,10 @@ async def test_refund_during_active_usage( # Refund should succeed assert refund_response.status_code == 200 - # Further usage should fail + # Further usage should return 200 but with 0 balance response = await authenticated_client.get("/v1/wallet/") - assert response.status_code == 401 + assert response.status_code == 200 + assert response.json()["balance"] == 0 @pytest.mark.integration @@ -535,6 +536,3 @@ async def test_refund_with_expired_key( # Should still allow manual refund assert response.status_code == 200 assert response.json()["recipient"] == "expired@ln.address" - - - diff --git a/ui/components/child-key-creator.tsx b/ui/components/child-key-creator.tsx index 65861731..e37791e2 100644 --- a/ui/components/child-key-creator.tsx +++ b/ui/components/child-key-creator.tsx @@ -12,8 +12,26 @@ import { } from '@/components/ui/card'; import { Alert, AlertDescription, AlertTitle } from '@/components/ui/alert'; import { Input } from '@/components/ui/input'; -import { Key, Copy, Check, Loader2 } from 'lucide-react'; +import { + Key, + Copy, + Check, + Loader2, + RotateCcw, + Plus, + Trash2, +} from 'lucide-react'; import { toast } from 'sonner'; +import { Badge } from '@/components/ui/badge'; +import { KeyOptions } from './key-options'; + +interface KeyConfig { + id: string; + count: number; + balanceLimit: string; + balanceLimitReset: string; + validityDate: string; +} interface ChildKeyCreatorProps { baseUrl?: string; @@ -30,7 +48,24 @@ export function ChildKeyCreator({ }: ChildKeyCreatorProps) { const [internalApiKey, setInternalApiKey] = useState(''); const [loading, setLoading] = useState(false); - const [count, setCount] = useState(1); + const [configs, setConfigs] = useState([ + { + id: crypto.randomUUID(), + count: 1, + balanceLimit: '', + balanceLimitReset: '', + validityDate: '', + }, + ]); + const [childKeyToCheck, setChildKeyToCheck] = useState(''); + const [checking, setChecking] = useState(false); + const [keyStatus, setKeyStatus] = useState<{ + total_spent: number; + balance_limit: number | null; + validity_date: number | null; + is_expired: boolean; + is_drained: boolean; + } | null>(null); const [newKeys, setNewKeys] = useState([]); const [resultInfo, setResultInfo] = useState<{ cost_msats: number; @@ -45,38 +80,72 @@ export function ChildKeyCreator({ onApiKeyChange?.(val); }; + const addConfig = () => { + setConfigs([ + ...configs, + { + id: crypto.randomUUID(), + count: 1, + balanceLimit: '', + balanceLimitReset: '', + validityDate: '', + }, + ]); + }; + + const removeConfig = (id: string) => { + if (configs.length > 1) { + setConfigs(configs.filter((c) => c.id !== id)); + } + }; + + const updateConfig = (id: string, updates: Partial) => { + setConfigs(configs.map((c) => (c.id === id ? { ...c, ...updates } : c))); + }; + const handleCreateKey = async () => { if (!activeApiKey && baseUrl) { toast.error('Please provide a Parent API key first'); return; } - const requestedCount = Math.max(1, Math.min(50, Number(count))); - setLoading(true); try { - const result = await WalletService.createChildKey( - baseUrl, - activeApiKey, - requestedCount - ); + let allNewKeys: string[] = []; + let totalCost = 0; + let lastParentBalance = 0; - console.log('Created child keys:', result); + for (const config of configs) { + const requestedCount = Math.max(1, Math.min(50, Number(config.count))); + const result = await WalletService.createChildKey( + baseUrl, + activeApiKey, + requestedCount, + config.balanceLimit ? parseInt(config.balanceLimit) : undefined, + config.balanceLimitReset || undefined, + config.validityDate + ? Math.floor( + new Date(config.validityDate + 'T23:59:59').getTime() / 1000 + ) + : undefined + ); - if (result.api_keys && result.api_keys.length > 0) { - setNewKeys(result.api_keys); - } else { - throw new Error('No API keys returned from server'); + if (result.api_keys) { + allNewKeys = [...allNewKeys, ...result.api_keys]; + } + totalCost += result.cost_msats; + lastParentBalance = result.parent_balance; } + setNewKeys(allNewKeys); setResultInfo({ - cost_msats: result.cost_msats, - parent_balance: result.parent_balance, + cost_msats: totalCost, + parent_balance: lastParentBalance, }); toast.success( - `${requestedCount} child API key${ - requestedCount > 1 ? 's' : '' + `${allNewKeys.length} child API key${ + allNewKeys.length > 1 ? 's' : '' } created successfully` ); } catch (error) { @@ -89,6 +158,47 @@ export function ChildKeyCreator({ } }; + const handleCheckKey = async () => { + if (!childKeyToCheck) { + toast.error('Please provide a Child API key to check'); + return; + } + + setChecking(true); + setKeyStatus(null); + try { + const baseUrlToUse = baseUrl || ''; + const response = await fetch(`${baseUrlToUse}/v1/balance/info`, { + headers: { + Authorization: `Bearer ${childKeyToCheck}`, + }, + }); + + if (!response.ok) { + throw new Error('Failed to fetch key info'); + } + + const info = await response.json(); + const now = Math.floor(Date.now() / 1000); + + setKeyStatus({ + total_spent: info.total_spent, + balance_limit: info.balance_limit, + validity_date: info.validity_date, + is_expired: info.validity_date ? now > info.validity_date : false, + is_drained: info.balance_limit + ? info.total_spent >= info.balance_limit + : false, + }); + } catch (error) { + toast.error( + error instanceof Error ? error.message : 'Failed to check child key' + ); + } finally { + setChecking(false); + } + }; + const copyToClipboard = (key: string) => { navigator.clipboard.writeText(key); setCopiedKey(key); @@ -140,51 +250,116 @@ export function ChildKeyCreator({ )} -
-
-
- +
+ {configs.map((config, index) => ( +
+ {configs.length > 1 && ( + + )} +
+
+ + { + const val = parseInt(e.target.value); + updateConfig(config.id, { + count: isNaN(val) + ? 1 + : Math.max(1, Math.min(50, val)), + }); + }} + className='h-9' + /> +
+ +
+ + updateConfig(config.id, { balanceLimit: val }) + } + validityDate={config.validityDate} + setValidityDate={(val) => + updateConfig(config.id, { validityDate: val }) + } + balanceLimitReset={config.balanceLimitReset} + setBalanceLimitReset={(val) => + updateConfig(config.id, { balanceLimitReset: val }) + } + /> +
+
+
+ ))} + +
+ +
+ +
+
{costPerKeyMsats && ( - - Cost: {costPerKeyMsats * count} mSats - +

+ Total Cost:{' '} + + {costPerKeyMsats * + configs.reduce( + (acc, c) => acc + Number(c.count), + 0 + )}{' '} + mSats + +

)}
- { - const val = parseInt(e.target.value); - if (!isNaN(val)) { - setCount(Math.max(1, Math.min(50, val))); - } else { - setCount(1); - } - }} - className='w-full sm:w-24' - /> + +
-

@@ -281,6 +456,91 @@ export function ChildKeyCreator({

+ + + + Check Child Key Status + + View the current spending, limit, and expiration status of any child + key. + + + +
+
+ + setChildKeyToCheck(e.target.value)} + placeholder='sk-...' + className='font-mono text-sm' + /> +
+ + + {keyStatus && ( +
+
+ Total Spent: + + {keyStatus.total_spent} mSats + +
+ {keyStatus.balance_limit !== null && ( +
+ Limit: + + {keyStatus.balance_limit} mSats + +
+ )} + {keyStatus.validity_date !== null && ( +
+ Expires: + + {new Date( + keyStatus.validity_date * 1000 + ).toLocaleDateString()} + +
+ )} +
+ {keyStatus.is_drained && ( + Drained + )} + {keyStatus.is_expired && ( + Expired + )} + {!keyStatus.is_drained && !keyStatus.is_expired && ( + + Active + + )} +
+
+ )} +
+ +
); } diff --git a/ui/components/key-options.tsx b/ui/components/key-options.tsx new file mode 100644 index 00000000..63969e72 --- /dev/null +++ b/ui/components/key-options.tsx @@ -0,0 +1,72 @@ +import { Zap, Calendar, Shield } from 'lucide-react'; +import { Input } from '@/components/ui/input'; + +interface KeyOptionsProps { + balanceLimit: string; + setBalanceLimit: (val: string) => void; + validityDate: string; + setValidityDate: (val: string) => void; + balanceLimitReset: string; + setBalanceLimitReset: (val: string) => void; + showBalanceLimit?: boolean; +} + +export function KeyOptions({ + balanceLimit, + setBalanceLimit, + validityDate, + setValidityDate, + balanceLimitReset, + setBalanceLimitReset, + showBalanceLimit = true, +}: KeyOptionsProps) { + return ( +
+ {showBalanceLimit && ( +
+ + setBalanceLimit(e.target.value)} + className='h-9 text-xs' + /> +
+ )} + +
+ + setValidityDate(e.target.value)} + className='h-9 text-xs' + /> +
+ +
+ + +
+
+ ); +} diff --git a/ui/components/landing/cashu-payment-workflow.tsx b/ui/components/landing/cashu-payment-workflow.tsx index 6fdd6553..8e09aa73 100644 --- a/ui/components/landing/cashu-payment-workflow.tsx +++ b/ui/components/landing/cashu-payment-workflow.tsx @@ -8,6 +8,7 @@ import { Button } from '@/components/ui/button'; import { Textarea } from '@/components/ui/textarea'; import { Input } from '@/components/ui/input'; import { Separator } from '@/components/ui/separator'; +import { KeyOptions } from '@/components/key-options'; type WalletSnapshot = { apiKey: string; @@ -86,9 +87,11 @@ export function CashuPaymentWorkflow({ const [isTopupLoading, setIsTopupLoading] = useState(false); const [isRefunding, setIsRefunding] = useState(false); const [isSyncingBalance, setIsSyncingBalance] = useState(false); - const [hasInteractedCreate, setHasInteractedCreate] = useState(false); const [hasInteractedManage, setHasInteractedManage] = useState(false); const [hasInteractedTopup, setHasInteractedTopup] = useState(false); + const [balanceLimit, setBalanceLimit] = useState(''); + const [balanceLimitReset, setBalanceLimitReset] = useState(''); + const [validityDate, setValidityDate] = useState(''); const activeApiKey = apiKeyInput.trim(); @@ -121,6 +124,15 @@ export function CashuPaymentWorkflow({ const params = new URLSearchParams({ initial_balance_token: initialToken.trim(), }); + if (balanceLimit) params.append('balance_limit', balanceLimit); + if (balanceLimitReset) + params.append('balance_limit_reset', balanceLimitReset); + if (validityDate) { + const timestamp = Math.floor( + new Date(validityDate + 'T23:59:59').getTime() / 1000 + ); + params.append('validity_date', timestamp.toString()); + } const response = await fetch( `${baseUrl}/v1/balance/create?${params.toString()}`, { @@ -154,7 +166,14 @@ export function CashuPaymentWorkflow({ } finally { setIsCreatingKey(false); } - }, [initialToken, baseUrl, onApiKeyCreated]); + }, [ + initialToken, + baseUrl, + onApiKeyCreated, + balanceLimit, + balanceLimitReset, + validityDate, + ]); const handleSyncBalance = useCallback(async (): Promise => { if (!activeApiKey) { @@ -256,11 +275,10 @@ export function CashuPaymentWorkflow({ [apiKey, onApiKeyChanged, onWalletInfoUpdated] ); - const showCreateDetails = - hasInteractedCreate || initialToken.trim().length > 0; const showManageDetails = hasInteractedManage || Boolean(walletInfo); const showTopupDetails = hasInteractedTopup || topupToken.trim().length > 0; const canTopup = Boolean(activeApiKey); + const showCreateDetails = initialToken.trim().length > 0; return ( @@ -285,12 +303,21 @@ export function CashuPaymentWorkflow({ value={initialToken} onChange={(event) => setInitialToken(event.target.value)} placeholder='cashuA1...' - rows={showCreateDetails ? 4 : 2} + rows={4} className='font-mono text-sm transition-all duration-200' - onFocus={() => setHasInteractedCreate(true)} /> - {showCreateDetails && ( -
+
+ + +
- + Redeems instantly and returns sk- key. +
+ Optional limits can be set above for enhanced security.
- )} +
diff --git a/ui/components/landing/lightning-payment-workflow.tsx b/ui/components/landing/lightning-payment-workflow.tsx index 60bdb6a9..91eeb9d8 100644 --- a/ui/components/landing/lightning-payment-workflow.tsx +++ b/ui/components/landing/lightning-payment-workflow.tsx @@ -10,6 +10,7 @@ import { Button } from '@/components/ui/button'; import { Input } from '@/components/ui/input'; import { Textarea } from '@/components/ui/textarea'; import { Separator } from '@/components/ui/separator'; +import { KeyOptions } from '@/components/key-options'; type WalletSnapshot = { apiKey: string; @@ -89,7 +90,10 @@ export function LightningPaymentWorkflow({ const [isTopupping, setIsTopupping] = useState(false); const [isRecovering, setIsRecovering] = useState(false); - const [hasInteractedCreate, setHasInteractedCreate] = useState(false); + const [balanceLimit, setBalanceLimit] = useState(''); + const [balanceLimitReset, setBalanceLimitReset] = useState(''); + const [validityDate, setValidityDate] = useState(''); + const [hasInteractedTopup, setHasInteractedTopup] = useState(false); const [hasInteractedRecover, setHasInteractedRecover] = useState(false); @@ -166,13 +170,29 @@ export function LightningPaymentWorkflow({ setIsCreating(true); try { + const payload: { + amount_sats: number; + purpose: string; + balance_limit?: number; + balance_limit_reset?: string; + validity_date?: number; + } = { + amount_sats: amount, + purpose: 'create', + }; + + if (balanceLimit) payload.balance_limit = parseInt(balanceLimit); + if (balanceLimitReset) payload.balance_limit_reset = balanceLimitReset; + if (validityDate) { + payload.validity_date = Math.floor( + new Date(validityDate + 'T23:59:59').getTime() / 1000 + ); + } + const response = await fetch(`${baseUrl}/v1/balance/lightning/invoice`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, - body: JSON.stringify({ - amount_sats: amount, - purpose: 'create', - }), + body: JSON.stringify(payload), }); if (!response.ok) { @@ -214,7 +234,15 @@ export function LightningPaymentWorkflow({ } finally { setIsCreating(false); } - }, [createAmount, baseUrl, pollInvoiceStatus, onApiKeyCreated]); + }, [ + createAmount, + baseUrl, + pollInvoiceStatus, + onApiKeyCreated, + balanceLimit, + balanceLimitReset, + validityDate, + ]); const handleTopupInvoice = useCallback(async (): Promise => { const amount = parseInt(topupAmount); @@ -333,14 +361,13 @@ export function LightningPaymentWorkflow({ } }, [recoverInvoice, baseUrl, onApiKeyCreated]); - const showCreateDetails = - hasInteractedCreate || createAmount.trim().length > 0; const showTopupDetails = hasInteractedTopup || topupAmount.trim().length > 0 || topupApiKey.trim().length > 0; const showRecoverDetails = hasInteractedRecover || recoverInvoice.trim().length > 0; + const showCreateDetails = createAmount.trim().length > 0; return ( @@ -367,9 +394,18 @@ export function LightningPaymentWorkflow({ onChange={(event) => setCreateAmount(event.target.value)} placeholder='Amount in sats (e.g., 1000)' className='text-sm' - onFocus={() => setHasInteractedCreate(true)} /> - {showCreateDetails && ( +
+ +
- )} +
diff --git a/ui/lib/api/services/wallet.ts b/ui/lib/api/services/wallet.ts index 8e06a9b9..d16da3ac 100644 --- a/ui/lib/api/services/wallet.ts +++ b/ui/lib/api/services/wallet.ts @@ -134,7 +134,10 @@ export class WalletService { static async createChildKey( baseUrl?: string, apiKey?: string, - count: number = 1 + count: number = 1, + balanceLimit?: number, + balanceLimitReset?: string, + validityDate?: number ): Promise { try { if (baseUrl && apiKey) { @@ -144,7 +147,12 @@ export class WalletService { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}`, }, - body: JSON.stringify({ count }), + body: JSON.stringify({ + count, + balance_limit: balanceLimit, + balance_limit_reset: balanceLimitReset, + validity_date: validityDate, + }), }); if (!response.ok) { @@ -157,11 +165,49 @@ export class WalletService { return await apiClient.post( '/v1/balance/child-key', - { count } + { + count, + balance_limit: balanceLimit, + balance_limit_reset: balanceLimitReset, + validity_date: validityDate, + } ); } catch (error) { console.error('Error creating child key:', error); throw error; } } + + static async resetChildKeySpent( + baseUrl: string | undefined, + parentKey: string, + childKey: string + ): Promise<{ success: boolean; message: string }> { + try { + const url = baseUrl + ? `${baseUrl}/v1/balance/child-key/reset` + : '/v1/balance/child-key/reset'; + + const headers: Record = { + 'Content-Type': 'application/json', + Authorization: `Bearer ${parentKey}`, + }; + + const response = await fetch(url, { + method: 'POST', + headers, + body: JSON.stringify({ child_key: childKey }), + }); + + if (!response.ok) { + const errorText = await response.text(); + throw new Error(errorText || 'Failed to reset child key'); + } + + return await response.json(); + } catch (error) { + console.error('Error resetting child key:', error); + throw error; + } + } }