[data-bot-coasys]

Stacked on #1167 (fix/user-token-node-operations). Only the last commit is this PR.

What was wrong

At e9dfb4e (the head of #1167), every AI billing path decoded the caller's token a second time to find the user:

• rust-executor/src/ai_service/mod.rs:1789 and :1811 — bill_prompt_if_authed / bill_embed_if_authed run after the model call and call user_email_from_token on the token they were handed.
• rust-executor/src/api/ai_ws.rs:23 — check_compute_credits_ws takes the token and decodes it.
• rust-executor/src/api/openai_compat/chat.rs:542 (the user_email helper used by chat, completions, the streaming path and native_tools.rs:57), embeddings.rs:40, audio.rs:99 and :125 — the /v1 handlers decode the token for their credit check.
• rust-executor/src/api/auth.rs:23 — AuthContext::to_request_context decoded once more.

An expired token does not decode. So when a token expires during a long prompt, the hook finds no user and charges nobody. And on a WS connection whose token expired after it opened, the credit check finds no user and lets a user with zero credits through to the model.

What changed

The user is resolved once, when the request is authenticated, and everything downstream reads that:

• api/auth.rs — AuthContext gets user_email, set in from_request_parts; to_request_context copies it instead of decoding again.
• ai_service/mod.rs — prompt, prompt_messages, prompt_messages_stream, prompt_with_tools, embed and bill_and_forward_stream_result take user_email: Option<String> instead of auth_token. The two hooks take Option<&str> and no longer touch user_email_from_token. None still means "bill nobody", so the internal callers that passed None are unchanged.
• api/ai_ws.rs — check_compute_credits_ws(ctx.user_email.as_deref()) at all four call sites; ai.prompt / ai.embed pass ctx.user_email.
• api/openai_compat/{chat,native_tools,embeddings,audio}.rs — the credit checks and the AI service calls use auth.user_email; the user_email(&auth) helper is gone.
• api/openai_compat/harness_bridge.rs + perspectives/interpretation/run.rs — the bridge carries the billed user. The WS harness path bills context.user_email when it was given a token; the auto-processor passes no token and still bills nobody.

Out of scope, left as is: the transcription stream (open_transcription_stream, transcribe_buffer, verify_stream_ownership) still takes the token, because it also uses it for stream ownership and the DID. Not in the issue's list.

Red before, green after

Both tests were written and run before the fix, on e9dfb4e + the tests only:

test api::ai_ws::credit_check_tests::a_session_whose_token_expired_is_still_credit_checked ... FAILED
test api::ai_ws::credit_check_tests::a_session_with_credits_passes_the_check ... ok
test api::openai_compat::tests::embeddings_credit_check_uses_the_session_user ... FAILED

---- api::ai_ws::credit_check_tests::a_session_whose_token_expired_is_still_credit_checked stdout ----
assertion `left == right` failed: got 500: Service not initialized
  left: 500
 right: 403

---- api::openai_compat::tests::embeddings_credit_check_uses_the_session_user stdout ----
assertion `left == right` failed: got 500 Internal Server Error: Service not initialized
  left: 500
 right: 429

500 "Service not initialized" is the model call: the zero-credit user got past the credit check. With the fix both return the credit error (403 on WS, 429 on /v1) before reaching the service.

The tests build a session the way the dispatcher does (user resolved, token since expired: test_utils::expired_user_token signs a JWT with the node's key and exp an hour in the past, and each test asserts the token no longer decodes). The control test in credit_check_tests shows the same session with credits passes the check.

The three existing streaming-billing tests in openai_compat/tests.rs now pass the user instead of minting a JWT; the JWT helper they used is removed.

How to verify

cargo test --release -p ad4m-executor --lib -- --test-threads=1 api::ai_ws api::openai_compat harness_bridge

141 tests pass locally. To see the red state: check out origin/fix/user-token-node-operations, cherry-pick only the test hunks of this commit (ai_ws.rs credit_check_tests, test_utils.rs, the embeddings_credit_check_uses_the_session_user test with the user_email field removed from its AuthContext literal), and run the same command.

Fixes #1175

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 20 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 86546e8d-a6f4-4df5-8ad5-12778ab201bd

---

📥 Commits

Reviewing files that changed from the base of the PR and between d3a5596 and 69ba850.

---

📒 Files selected for processing (11)

• rust-executor/src/ai_service/mod.rs
• rust-executor/src/api/ai_ws.rs
• rust-executor/src/api/auth.rs
• rust-executor/src/api/openai_compat/audio.rs
• rust-executor/src/api/openai_compat/chat.rs
• rust-executor/src/api/openai_compat/embeddings.rs
• rust-executor/src/api/openai_compat/harness_bridge.rs
• rust-executor/src/api/openai_compat/native_tools.rs
• rust-executor/src/api/openai_compat/tests.rs
• rust-executor/src/perspectives/interpretation/run.rs
• rust-executor/src/test_utils.rs

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}