feat: harden analytics dashboard

app/api/aggregation/route.ts

@@ -1,12 +1,17 @@
 import { NextRequest, NextResponse } from "next/server";
+import { jsonError, parseTimestampRange } from "@/lib/api-params";
 import { getUserRanking } from "@/lib/queries";
 
 export async function GET(req: NextRequest) {
-  const sp = req.nextUrl.searchParams;
-  const startTs = sp.get("start") ? Number(sp.get("start")) : undefined;
-  const endTs = sp.get("end") ? Number(sp.get("end")) : undefined;
+  try {
+    const range = parseTimestampRange(req.nextUrl.searchParams);
+    if (!range.ok) return jsonError(range.field);
 
-  // Get ALL users (no limit) for aggregation view
-  const data = await getUserRanking(startTs, endTs, 500);
-  return NextResponse.json(data);
+    // Get all visible users for aggregation view, capped by query-layer safeguards.
+    const data = await getUserRanking(range.value.startTs, range.value.endTs, 500);
+    return NextResponse.json(data);
+  } catch (error) {
+    console.error("Failed to load aggregation", error);
+    return jsonError(undefined, 500);
+  }
 }

app/api/date-range/route.ts

@@ -1,7 +1,13 @@
 import { NextResponse } from "next/server";
+import { jsonError } from "@/lib/api-params";
 import { getDateRange } from "@/lib/queries";
 
 export async function GET() {
-  const data = await getDateRange();
-  return NextResponse.json(data);
+  try {
+    const data = await getDateRange();
+    return NextResponse.json(data);
+  } catch (error) {
+    console.error("Failed to load date range", error);
+    return jsonError(undefined, 500);
+  }
 }

app/api/detail/[type]/[id]/route.ts

@@ -1,29 +1,38 @@
 import { NextRequest, NextResponse } from "next/server";
+import { jsonError, parseTimestampRange } from "@/lib/api-params";
 import { getUserDetail, getModelDetail, getChannelDetail } from "@/lib/queries";
 
 export async function GET(
   req: NextRequest,
   { params }: { params: Promise<{ type: string; id: string }> }
 ) {
-  const { type, id } = await params;
-  const sp = req.nextUrl.searchParams;
-  const startTs = sp.get("start") ? Number(sp.get("start")) : undefined;
-  const endTs = sp.get("end") ? Number(sp.get("end")) : undefined;
+  try {
+    const { type, id } = await params;
+    const range = parseTimestampRange(req.nextUrl.searchParams);
+    if (!range.ok) return jsonError(range.field);
 
-  let data;
-  switch (type) {
-    case "user":
-      data = await getUserDetail(decodeURIComponent(id), startTs, endTs);
-      break;
-    case "model":
-      data = await getModelDetail(decodeURIComponent(id), startTs, endTs);
-      break;
-    case "channel":
-      data = await getChannelDetail(Number(id), startTs, endTs);
-      break;
-    default:
-      return NextResponse.json({ error: "Invalid type" }, { status: 400 });
+    let data;
+    switch (type) {
+      case "user":
+        data = await getUserDetail(decodeURIComponent(id), range.value.startTs, range.value.endTs);
+        break;
+      case "model":
+        data = await getModelDetail(decodeURIComponent(id), range.value.startTs, range.value.endTs);
+        break;
+      case "channel": {
+        if (!/^\d+$/.test(id)) return jsonError("id");
+        const channelId = Number(id);
+        if (!Number.isSafeInteger(channelId) || channelId < 1) return jsonError("id");
+        data = await getChannelDetail(channelId, range.value.startTs, range.value.endTs);
+        break;
+      }
+      default:
+        return jsonError("type");
+    }
+
+    return NextResponse.json(data);
+  } catch (error) {
+    console.error("Failed to load detail", error);
+    return jsonError(undefined, 500);
   }
-
-  return NextResponse.json(data);
 }

app/api/logs/route.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, mock, test } from "bun:test";
+import type { NextRequest } from "next/server";
+
+const getLogsMock = mock(async () => ({ logs: [], total: 0, page: 1, page_size: 100 }));
+const getUserRankingMock = mock(async () => []);
+const getModelRankingMock = mock(async () => []);
+const getChannelRankingMock = mock(async () => []);
+
+mock.module("@/lib/queries", () => ({
+  getLogs: getLogsMock,
+  getUserRanking: getUserRankingMock,
+  getModelRanking: getModelRankingMock,
+  getChannelRanking: getChannelRankingMock,
+}));
+
+const { GET } = await import("./route");
+
+function request(path: string) {
+  return { nextUrl: new URL(`http://localhost${path}`) } as NextRequest;
+}
+
+describe("/api/logs", () => {
+  test("rejects reversed date ranges", async () => {
+    const res = await GET(request("/api/logs?start=200&end=100"));
+
+    expect(res.status).toBe(400);
+    expect(await res.json()).toEqual({
+      error: "Invalid query parameter",
+      field: "range",
+    });
+  });
+
+  test("clamps page size before querying", async () => {
+    getLogsMock.mockClear();
+
+    const res = await GET(request("/api/logs?page=2&page_size=10000"));
+
+    expect(res.status).toBe(200);
+    expect(getLogsMock.mock.calls[0][0]).toMatchObject({
+      page: 2,
+      pageSize: 200,
+    });
+  });
+});

app/api/logs/route.ts

@@ -1,19 +1,46 @@
 import { NextRequest, NextResponse } from "next/server";
+import { jsonError, parseOptionalInt, parsePositiveInt, parseTimestampRange } from "@/lib/api-params";
 import { getLogs } from "@/lib/queries";
 
 export async function GET(req: NextRequest) {
-  const sp = req.nextUrl.searchParams;
+  try {
+    const sp = req.nextUrl.searchParams;
+    const range = parseTimestampRange(sp);
+    if (!range.ok) return jsonError(range.field);
 
-  const data = await getLogs({
-    page: sp.get("page") ? Number(sp.get("page")) : 1,
-    pageSize: sp.get("page_size") ? Number(sp.get("page_size")) : 100,
-    startTs: sp.get("start") ? Number(sp.get("start")) : undefined,
-    endTs: sp.get("end") ? Number(sp.get("end")) : undefined,
-    username: sp.get("username") || undefined,
-    model: sp.get("model") || undefined,
-    channelId: sp.get("channel_id") ? Number(sp.get("channel_id")) : undefined,
-    tokenName: sp.get("token_name") || undefined,
-  });
+    const page = parsePositiveInt(sp.get("page"), {
+      field: "page",
+      defaultValue: 1,
+      min: 1,
+    });
+    if (!page.ok) return jsonError(page.field);
 
-  return NextResponse.json(data);
+    const pageSize = parsePositiveInt(sp.get("page_size"), {
+      field: "page_size",
+      defaultValue: 100,
+      min: 1,
+      max: 200,
+    });
+    if (!pageSize.ok) return jsonError(pageSize.field);
+
+    const channelId = parseOptionalInt(sp.get("channel_id"), "channel_id");
+    if (!channelId.ok) return jsonError(channelId.field);
+    if (channelId.value === 0) return jsonError("channel_id");
+
+    const data = await getLogs({
+      page: page.value,
+      pageSize: pageSize.value,
+      startTs: range.value.startTs,
+      endTs: range.value.endTs,
+      username: sp.get("username") || undefined,
+      model: sp.get("model") || undefined,
+      channelId: channelId.value,
+      tokenName: sp.get("token_name") || undefined,
+    });
+
+    return NextResponse.json(data);
+  } catch (error) {
+    console.error("Failed to load logs", error);
+    return jsonError(undefined, 500);
+  }
 }

app/api/overview/route.ts

@@ -1,11 +1,16 @@
 import { NextRequest, NextResponse } from "next/server";
+import { jsonError, parseTimestampRange } from "@/lib/api-params";
 import { getOverview } from "@/lib/queries";
 
 export async function GET(req: NextRequest) {
-  const sp = req.nextUrl.searchParams;
-  const startTs = sp.get("start") ? Number(sp.get("start")) : undefined;
-  const endTs = sp.get("end") ? Number(sp.get("end")) : undefined;
+  try {
+    const range = parseTimestampRange(req.nextUrl.searchParams);
+    if (!range.ok) return jsonError(range.field);
 
-  const data = await getOverview(startTs, endTs);
-  return NextResponse.json(data);
+    const data = await getOverview(range.value.startTs, range.value.endTs);
+    return NextResponse.json(data);
+  } catch (error) {
+    console.error("Failed to load overview", error);
+    return jsonError(undefined, 500);
+  }
 }

app/api/rankings/route.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, mock, test } from "bun:test";
+import type { NextRequest } from "next/server";
+
+const getUserRankingMock = mock(async () => []);
+const getModelRankingMock = mock(async () => []);
+const getChannelRankingMock = mock(async () => []);
+const getLogsMock = mock(async () => ({ logs: [], total: 0, page: 1, page_size: 100 }));
+
+mock.module("@/lib/queries", () => ({
+  getUserRanking: getUserRankingMock,
+  getModelRanking: getModelRankingMock,
+  getChannelRanking: getChannelRankingMock,
+  getLogs: getLogsMock,
+}));
+
+const { GET } = await import("./route");
+
+function request(path: string) {
+  return { nextUrl: new URL(`http://localhost${path}`) } as NextRequest;
+}
+
+describe("/api/rankings", () => {
+  test("rejects invalid limit", async () => {
+    const res = await GET(request("/api/rankings?limit=abc"));
+
+    expect(res.status).toBe(400);
+    expect(await res.json()).toEqual({
+      error: "Invalid query parameter",
+      field: "limit",
+    });
+  });
+
+  test("clamps oversized limit before querying", async () => {
+    getUserRankingMock.mockClear();
+
+    const res = await GET(request("/api/rankings?limit=500"));
+
+    expect(res.status).toBe(200);
+    expect(getUserRankingMock.mock.calls[0]).toEqual([undefined, undefined, 100]);
+  });
+});

app/api/rankings/route.ts

@@ -1,24 +1,37 @@
 import { NextRequest, NextResponse } from "next/server";
+import { jsonError, parsePositiveInt, parseTimestampRange } from "@/lib/api-params";
 import { getUserRanking, getModelRanking, getChannelRanking } from "@/lib/queries";
 
 export async function GET(req: NextRequest) {
-  const sp = req.nextUrl.searchParams;
-  const type = sp.get("type") || "user";
-  const startTs = sp.get("start") ? Number(sp.get("start")) : undefined;
-  const endTs = sp.get("end") ? Number(sp.get("end")) : undefined;
-  const limit = sp.get("limit") ? Number(sp.get("limit")) : 50;
+  try {
+    const sp = req.nextUrl.searchParams;
+    const type = sp.get("type") || "user";
+    const range = parseTimestampRange(sp);
+    if (!range.ok) return jsonError(range.field);
 
-  let data;
-  switch (type) {
-    case "model":
-      data = await getModelRanking(startTs, endTs, limit);
-      break;
-    case "channel":
-      data = await getChannelRanking(startTs, endTs, limit);
-      break;
-    default:
-      data = await getUserRanking(startTs, endTs, limit);
+    const limit = parsePositiveInt(sp.get("limit"), {
+      field: "limit",
+      defaultValue: 50,
+      min: 1,
+      max: 100,
+    });
+    if (!limit.ok) return jsonError(limit.field);
+
+    let data;
+    switch (type) {
+      case "model":
+        data = await getModelRanking(range.value.startTs, range.value.endTs, limit.value);
+        break;
+      case "channel":
+        data = await getChannelRanking(range.value.startTs, range.value.endTs, limit.value);
+        break;
+      default:
+        data = await getUserRanking(range.value.startTs, range.value.endTs, limit.value);
+    }
+
+    return NextResponse.json(data);
+  } catch (error) {
+    console.error("Failed to load rankings", error);
+    return jsonError(undefined, 500);
   }
-
-  return NextResponse.json(data);
 }

app/api/trends/route.ts

@@ -1,22 +1,31 @@
 import { NextRequest, NextResponse } from "next/server";
+import { jsonError, parseOptionalInt, parseTimestampRange } from "@/lib/api-params";
 import { getTrends, type TrendGranularity } from "@/lib/queries";
 
 const GRANULARITIES: TrendGranularity[] = ["hour", "day", "week", "month"];
 
 export async function GET(req: NextRequest) {
-  const sp = req.nextUrl.searchParams;
-  const requestedGranularity = sp.get("granularity");
-  const granularity = GRANULARITIES.includes(requestedGranularity as TrendGranularity)
-    ? requestedGranularity as TrendGranularity
-    : "day";
-  const startTs = sp.get("start") ? Number(sp.get("start")) : undefined;
-  const endTs = sp.get("end") ? Number(sp.get("end")) : undefined;
-  const channelId = sp.get("channel_id") ? Number(sp.get("channel_id")) : undefined;
+  try {
+    const sp = req.nextUrl.searchParams;
+    const requestedGranularity = sp.get("granularity");
+    const granularity = GRANULARITIES.includes(requestedGranularity as TrendGranularity)
+      ? requestedGranularity as TrendGranularity
+      : "day";
+    const range = parseTimestampRange(sp);
+    if (!range.ok) return jsonError(range.field);
 
-  const data = await getTrends(granularity, startTs, endTs, {
-    username: sp.get("username") || undefined,
-    model: sp.get("model") || undefined,
-    channelId: Number.isFinite(channelId) ? channelId : undefined,
-  });
-  return NextResponse.json(data);
+    const channelId = parseOptionalInt(sp.get("channel_id"), "channel_id");
+    if (!channelId.ok) return jsonError(channelId.field);
+    if (channelId.value === 0) return jsonError("channel_id");
+
+    const data = await getTrends(granularity, range.value.startTs, range.value.endTs, {
+      username: sp.get("username") || undefined,
+      model: sp.get("model") || undefined,
+      channelId: channelId.value,
+    });
+    return NextResponse.json(data);
+  } catch (error) {
+    console.error("Failed to load trends", error);
+    return jsonError(undefined, 500);
+  }
 }

app/detail/[...slug]/page.tsx

@@ -12,6 +12,7 @@ import { buildQuery, formatNumber, formatTokens, formatUSD } from "@/lib/utils";
 import { sortDetailBreakdown, type DetailBreakdownItem, type DetailBreakdownSortKey } from "@/lib/detail-sort";
 import { getPrimaryModelNames, getSharePercent, getTokenDisplayName, getTokenRowKey, shouldShowTokenTab, sortTokenBreakdown, type TokenBreakdownItem } from "@/lib/token-breakdown";
 import { getDetailStats, type DetailStatKey } from "@/lib/detail-stats";
+import { quotaToUsd } from "@/lib/metrics";
 import { useTimeRange } from "@/lib/time-range-context";
 import { useI18n } from "@/lib/i18n";
 
@@ -170,7 +171,7 @@ export default function DetailPage() {
                   </td>
                   <td className="px-5 py-3 text-right tabular-nums font-[family-name:var(--font-geist-mono)] text-xs" style={{ color: "var(--text-secondary)" }}>{formatNumber(item.calls)}</td>
                   <td className="px-5 py-3 text-right tabular-nums font-[family-name:var(--font-geist-mono)]" style={{ color: "var(--text-primary)" }}>{formatTokens(item.total_tokens)}</td>
-                  <td className="px-5 py-3 text-right tabular-nums font-[family-name:var(--font-geist-mono)] text-xs" style={{ color: "var(--text-secondary)" }}>{formatUSD(item.quota / 500000)}</td>
+                  <td className="px-5 py-3 text-right tabular-nums font-[family-name:var(--font-geist-mono)] text-xs" style={{ color: "var(--text-secondary)" }}>{formatUSD(quotaToUsd(item.quota))}</td>
                   <td className="px-5 py-3 text-right tabular-nums font-[family-name:var(--font-geist-mono)] text-xs" style={{ color: "var(--text-muted)" }}>{userShare.toFixed(1)}%</td>
                   <td className="px-5 py-3 text-xs" style={{ color: "var(--text-muted)" }}>{getPrimaryModelNames(item.models) || t("common.noData")}</td>
                 </tr>
@@ -196,7 +197,7 @@ export default function DetailPage() {
                                   <td className="px-4 py-2 font-[family-name:var(--font-geist-mono)]" style={{ color: "var(--text-accent)", opacity: 0.75 }}>{model.name}</td>
                                   <td className="px-4 py-2 text-right tabular-nums font-[family-name:var(--font-geist-mono)]" style={{ color: "var(--text-secondary)" }}>{formatNumber(model.calls)}</td>
                                   <td className="px-4 py-2 text-right tabular-nums font-[family-name:var(--font-geist-mono)]" style={{ color: "var(--text-primary)" }}>{formatTokens(model.total_tokens)}</td>
-                                  <td className="px-4 py-2 text-right tabular-nums font-[family-name:var(--font-geist-mono)]" style={{ color: "var(--text-secondary)" }}>{formatUSD(model.quota / 500000)}</td>
+                                  <td className="px-4 py-2 text-right tabular-nums font-[family-name:var(--font-geist-mono)]" style={{ color: "var(--text-secondary)" }}>{formatUSD(quotaToUsd(model.quota))}</td>
                                   <td className="px-4 py-2 text-right tabular-nums font-[family-name:var(--font-geist-mono)]" style={{ color: "var(--text-muted)" }}>{modelShare.toFixed(1)}%</td>
                                 </tr>
                               );
@@ -311,7 +312,7 @@ export default function DetailPage() {
                         <td className="px-5 py-3" style={{ color: "var(--text-accent)", opacity: 0.8 }}>{item.name}</td>
                         <td className="px-5 py-3 text-right tabular-nums font-[family-name:var(--font-geist-mono)] text-xs" style={{ color: "var(--text-secondary)" }}>{formatNumber(item.calls)}</td>
                         <td className="px-5 py-3 text-right tabular-nums font-[family-name:var(--font-geist-mono)]" style={{ color: "var(--text-primary)" }}>{formatTokens(item.total_tokens)}</td>
-                        <td className="px-5 py-3 text-right tabular-nums font-[family-name:var(--font-geist-mono)] text-xs" style={{ color: "var(--text-secondary)" }}>{formatUSD(item.quota / 500000)}</td>
+                        <td className="px-5 py-3 text-right tabular-nums font-[family-name:var(--font-geist-mono)] text-xs" style={{ color: "var(--text-secondary)" }}>{formatUSD(quotaToUsd(item.quota))}</td>
                       </tr>
                     ))}
                   </tbody>

app/page.tsx

@@ -8,6 +8,7 @@ import { TimeRangeSelector } from "@/components/TimeRangeSelector";
 import { TrendChart } from "@/components/charts/TrendChart";
 import { RankingBar } from "@/components/charts/RankingBar";
 import { buildQuery } from "@/lib/utils";
+import { quotaToUsd } from "@/lib/metrics";
 import { useTimeRange } from "@/lib/time-range-context";
 import { useI18n } from "@/lib/i18n";
 
@@ -82,19 +83,19 @@ export default function DashboardPage() {
         <div className="grid grid-cols-2 gap-4 md:grid-cols-5">
           <StatsCard title={t("dash.totalCalls")} value={overview.total_calls} icon={Hash} delay={0} />
           <StatsCard title={t("dash.tokenUsage")} value={overview.total_tokens} format="tokens" icon={Zap} delay={0.05} />
-          <StatsCard title={t("dash.totalCost")} value={overview.total_quota / 500000} format="usd" icon={DollarSign} delay={0.1} />
+          <StatsCard title={t("dash.totalCost")} value={quotaToUsd(overview.total_quota)} format="usd" icon={DollarSign} delay={0.1} />
           <StatsCard title={t("dash.activeUsers")} value={overview.active_users} icon={Users} delay={0.15} />
           <StatsCard title={t("dash.activeModels")} value={overview.active_models} icon={Cpu} delay={0.2} />
         </div>
       )}
 
       <motion.div initial={{ opacity: 0, y: 20 }} animate={{ opacity: 1, y: 0 }} transition={{ delay: 0.15 }} className="glass p-5">
-        <div className="mb-4 flex items-center justify-between">
+        <div className="mb-4 flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
           <div className="flex items-center gap-2">
             <TrendingUp className="h-4 w-4" style={{ color: "var(--accent)", opacity: 0.6 }} />
             <h2 className="text-sm font-semibold" style={{ color: "var(--text-primary)" }}>{t("dash.trend")}</h2>
           </div>
-          <div className="flex gap-3">
+          <div className="flex max-w-full flex-wrap gap-2 sm:gap-3">
             <div className="flex gap-1 rounded-md p-0.5" style={{ background: "var(--row-hover)", border: "1px solid var(--surface-border)" }}>
               {grans.map(g => (
                 <button key={g.key} onClick={() => setGranularity(g.key)}