refactor: purge Node.js, Rust is the one true backend

- Moved boosapi-rs/* to repo root
- Deleted all Node.js source (src/server/, src/web/, scripts/)
- Deleted node_modules, package.json, tsconfig, vite.config
- Updated .gitignore and AGENTS.md for Rust-only stack
- Fixed static file path for frontend dist/web/
- Dockerfile stays the same (already Rust-only)
- Kept dist/web/ for Rust static serving

src/routes/proxy/mod.rs

@@ -0,0 +1,679 @@
+// Proxy routes — OpenAI-compatible /v1/ endpoints
+//
+// These routes handle:
+//   POST /v1/chat/completions   — streaming and non-streaming
+//   POST /v1/images/generations — image generation
+//   GET  /v1/models             — list available models
+
+use crate::{
+    auth::api_key::{authorize_downstream_token, DownstreamAuthResult},
+    error::{AppError, AppResult},
+    proxy::conductor::{
+        AttemptResult, ExecuteInput, ExecuteResult, ProxyConductor, SelectedChannel,
+    },
+    proxy::executors::{self, UpstreamRoute},
+    proxy::token_router::TokenRouter,
+    AppState,
+};
+use axum::{
+    extract::State,
+    http::HeaderMap,
+    response::{IntoResponse, Response, Sse},
+    routing::{get, post},
+    Json, Router,
+};
+use futures::{stream, FutureExt, StreamExt};
+use serde_json::{json, Value};
+use std::{convert::Infallible, sync::Arc};
+use tracing::info;
+
+// ── Auth types ────────────────────────────────────────────────────────
+
+#[derive(Clone)]
+pub struct ProxyAuth {
+    pub token: String,
+    pub key_id: Option<i64>,
+    pub source: DownstreamSource,
+}
+
+#[derive(Clone, PartialEq)]
+pub enum DownstreamSource {
+    Managed { key_id: i64 },
+    Global,
+}
+
+// ── Route definitions ─────────────────────────────────────────────────
+
+/// Build the /v1/ proxy router
+pub fn routes() -> Router<AppState> {
+    Router::new()
+        .route("/v1/chat/completions", post(chat_completions))
+        .route("/v1/completions", post(completions_handler))
+        .route("/v1/embeddings", post(embeddings_handler))
+        .route("/v1/audio/transcriptions", post(audio_transcriptions))
+        .route("/v1/audio/translations", post(audio_translations))
+        .route("/v1/audio/speech", post(audio_speech))
+        .route("/v1/images/generations", post(images_generations))
+        .route("/v1/videos", post(videos_handler))
+        .route("/v1/models", get(list_models))
+}
+
+// ── Handlers ───────────────────────────────────────────────────────────
+
+/// POST /v1/chat/completions
+async fn chat_completions(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Json(body): Json<Value>,
+) -> Result<Response, AppError> {
+    info!("POST /v1/chat/completions");
+
+    check_auth(&state, &headers).await?;
+
+    let model = body
+        .get("model")
+        .and_then(|m| m.as_str())
+        .ok_or_else(|| AppError::BadRequest("model is required".into()))?
+        .to_string();
+
+    let stream = body
+        .get("stream")
+        .and_then(|s| s.as_bool())
+        .unwrap_or(false);
+
+    if stream {
+        let chunks = execute_chat_completions_stream_with_conductor(state, model, body).await?;
+        let sse =
+            Sse::new(stream::iter(chunks).map(|chunk| {
+                Ok::<_, Infallible>(axum::response::sse::Event::default().data(chunk))
+            }));
+        Ok(sse.into_response())
+    } else {
+        let result = execute_chat_completions_with_conductor(state, model, body).await?;
+        Ok(Json(result).into_response())
+    }
+}
+
+/// POST /v1/completions
+async fn completions_handler(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Json(body): Json<Value>,
+) -> AppResult<Json<Value>> {
+    info!("POST /v1/completions");
+
+    check_auth(&state, &headers).await?;
+
+    let model = body
+        .get("model")
+        .and_then(|m| m.as_str())
+        .ok_or_else(|| AppError::BadRequest("model is required".into()))?
+        .to_string();
+
+    let route = resolve_route(&state, &model).await?;
+    let result = executors::execute_proxy_request(state, route, "/completions", body).await?;
+    Ok(Json(result))
+}
+
+/// POST /v1/embeddings
+async fn embeddings_handler(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Json(body): Json<Value>,
+) -> AppResult<Json<Value>> {
+    info!("POST /v1/embeddings");
+
+    check_auth(&state, &headers).await?;
+
+    let model = body
+        .get("model")
+        .and_then(|m| m.as_str())
+        .ok_or_else(|| AppError::BadRequest("model is required".into()))?
+        .to_string();
+
+    let route = resolve_route(&state, &model).await?;
+    let result = executors::execute_proxy_request(state, route, "/embeddings", body).await?;
+    Ok(Json(result))
+}
+
+/// POST /v1/audio/speech
+async fn audio_speech(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Json(body): Json<Value>,
+) -> AppResult<Json<Value>> {
+    info!("POST /v1/audio/speech");
+
+    check_auth(&state, &headers).await?;
+
+    let model = body
+        .get("model")
+        .and_then(|m| m.as_str())
+        .ok_or_else(|| AppError::BadRequest("model is required".into()))?
+        .to_string();
+
+    let route = resolve_route(&state, &model).await?;
+    let result = executors::execute_proxy_request(state, route, "/audio/speech", body).await?;
+    Ok(Json(result))
+}
+
+/// POST /v1/audio/transcriptions — proxy to upstream
+async fn audio_transcriptions(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Json(body): Json<Value>,
+) -> AppResult<Json<Value>> {
+    info!("POST /v1/audio/transcriptions");
+
+    check_auth(&state, &headers).await?;
+
+    let model = body
+        .get("model")
+        .and_then(|m| m.as_str())
+        .ok_or_else(|| AppError::BadRequest("model is required".into()))?
+        .to_string();
+
+    let route = resolve_route(&state, &model).await?;
+    let result =
+        executors::execute_proxy_request(state, route, "/audio/transcriptions", body).await?;
+    Ok(Json(result))
+}
+
+/// POST /v1/audio/translations — proxy to upstream
+async fn audio_translations(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Json(body): Json<Value>,
+) -> AppResult<Json<Value>> {
+    info!("POST /v1/audio/translations");
+
+    check_auth(&state, &headers).await?;
+
+    let model = body
+        .get("model")
+        .and_then(|m| m.as_str())
+        .ok_or_else(|| AppError::BadRequest("model is required".into()))?
+        .to_string();
+
+    let route = resolve_route(&state, &model).await?;
+    let result =
+        executors::execute_proxy_request(state, route, "/audio/translations", body).await?;
+    Ok(Json(result))
+}
+
+/// POST /v1/videos — list/create video generation tasks
+async fn videos_handler(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Json(body): Json<Value>,
+) -> AppResult<Json<Value>> {
+    info!("POST /v1/videos");
+
+    check_auth(&state, &headers).await?;
+
+    let model = body
+        .get("model")
+        .and_then(|m| m.as_str())
+        .unwrap_or("default");
+
+    let route = resolve_route(&state, model).await?;
+    let result = executors::execute_proxy_request(state, route, "/videos", body).await?;
+    Ok(Json(result))
+}
+
+/// POST /v1/images/generations
+async fn images_generations(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Json(body): Json<Value>,
+) -> AppResult<Json<Value>> {
+    info!("POST /v1/images/generations");
+
+    check_auth(&state, &headers).await?;
+
+    let model = body
+        .get("model")
+        .and_then(|m| m.as_str())
+        .ok_or_else(|| AppError::BadRequest("model is required".into()))?
+        .to_string();
+
+    let route = resolve_route(&state, &model).await?;
+    let result = executors::execute_image_generation(state, route, body).await?;
+    Ok(Json(result))
+}
+
+/// GET /v1/models
+async fn list_models(State(state): State<AppState>, headers: HeaderMap) -> AppResult<Json<Value>> {
+    info!("GET /v1/models");
+
+    check_auth(&state, &headers).await?;
+
+    let rows: Vec<(String, String)> = sqlx::query_as(
+        "SELECT tr.model_pattern, COALESCE(tr.model_mapping, tr.model_pattern) FROM token_routes tr WHERE tr.enabled = 1 ORDER BY tr.id",
+    )
+    .fetch_all(&*state.db)
+    .await?;
+
+    let models: Vec<Value> = rows
+        .into_iter()
+        .map(|(name, model)| {
+            json!({
+                "id": model,
+                "object": "model",
+                "created": 0,
+                "owned_by": name,
+            })
+        })
+        .collect();
+
+    Ok(Json(json!({
+        "object": "list",
+        "data": models,
+    })))
+}
+
+// ── Auth helper ───────────────────────────────────────────────────────
+
+async fn check_auth(state: &AppState, headers: &HeaderMap) -> Result<(), AppError> {
+    let auth = headers
+        .get("Authorization")
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.strip_prefix("Bearer "))
+        .and_then(|v| v.trim().split_whitespace().next())
+        .ok_or_else(|| AppError::Unauthorized("Missing Authorization header".into()))?;
+
+    let result = authorize_downstream_token(auth, &state.db)
+        .await
+        .map_err(|e| AppError::Unauthorized(e))?;
+
+    match result {
+        DownstreamAuthResult::Managed { key, .. } => {
+            if !key.enabled.unwrap_or(true) {
+                return Err(AppError::Forbidden("API key is disabled".into()));
+            }
+            Ok(())
+        }
+        DownstreamAuthResult::Global { .. } => Ok(()),
+    }
+}
+
+// ── Route Resolution ──────────────────────────────────────────────────
+
+/// Resolve upstream endpoint + API key for a given model.
+async fn resolve_route(state: &AppState, model: &str) -> AppResult<UpstreamRoute> {
+    let selected = TokenRouter::new(state.db.clone())
+        .resolve_selected(model)
+        .await?;
+    Ok(selected_channel_to_route(selected))
+}
+
+fn selected_channel_to_route(selected: SelectedChannel) -> UpstreamRoute {
+    UpstreamRoute {
+        base_url: selected.base_url,
+        api_key: selected.api_key,
+        model: selected.actual_model,
+    }
+}
+
+fn body_with_selected_model(mut body: Value, selected: &SelectedChannel) -> Value {
+    if let Some(object) = body.as_object_mut() {
+        object.insert(
+            "model".to_string(),
+            Value::String(selected.actual_model.clone()),
+        );
+    }
+    body
+}
+
+fn build_conductor(state: &AppState) -> ProxyConductor {
+    let db = state.db.clone();
+    let select_db = db.clone();
+    let select_next_db = db.clone();
+    let success_db = db.clone();
+    let failure_db = db;
+
+    ProxyConductor {
+        select_channel: Arc::new(move |model, _policy| {
+            let router = TokenRouter::new(select_db.clone());
+            async move { router.resolve_selected(&model).await.ok() }.boxed()
+        }),
+        select_next_channel: Arc::new(move |model, excluded, _policy| {
+            let router = TokenRouter::new(select_next_db.clone());
+            async move { router.resolve_next_selected(&model, &excluded).await.ok() }.boxed()
+        }),
+        record_success: Arc::new(move |channel_id, metrics| {
+            let router = TokenRouter::new(success_db.clone());
+            async move {
+                if let Err(err) = router.record_success(channel_id, metrics).await {
+                    tracing::warn!(%err, channel_id, "failed to record proxy success");
+                }
+            }
+            .boxed()
+        }),
+        record_failure: Arc::new(move |channel_id, info| {
+            let router = TokenRouter::new(failure_db.clone());
+            async move {
+                if let Err(err) = router.record_failure(channel_id, info).await {
+                    tracing::warn!(%err, channel_id, "failed to record proxy failure");
+                }
+            }
+            .boxed()
+        }),
+        refresh_auth: None,
+    }
+}
+
+async fn execute_chat_completions_with_conductor(
+    state: AppState,
+    model: String,
+    body: Value,
+) -> AppResult<Value> {
+    let conductor = build_conductor(&state);
+    let result = conductor
+        .execute(ExecuteInput {
+            requested_model: model,
+            downstream_policy: None,
+            attempt_fn: Box::new(move |ctx| {
+                let state = state.clone();
+                let body = body_with_selected_model(body.clone(), &ctx.selected);
+                async move {
+                    match executors::execute_chat_completions(
+                        state,
+                        selected_channel_to_route(ctx.selected),
+                        body,
+                    )
+                    .await
+                    {
+                        Ok(response) => AttemptResult::Success {
+                            response,
+                            latency_ms: None,
+                            cost: None,
+                        },
+                        Err(err) => AttemptResult::Failure {
+                            action: crate::proxy::conductor::AttemptFailureAction::Failover,
+                            status: None,
+                            raw_error_text: Some(err.to_string()),
+                        },
+                    }
+                }
+                .boxed()
+            }),
+            on_terminal_failure: None,
+        })
+        .await;
+
+    conductor_result_to_app_result(result)
+}
+
+async fn execute_chat_completions_stream_with_conductor(
+    state: AppState,
+    model: String,
+    body: Value,
+) -> AppResult<Vec<String>> {
+    let conductor = build_conductor(&state);
+    let result = conductor
+        .execute(ExecuteInput {
+            requested_model: model,
+            downstream_policy: None,
+            attempt_fn: Box::new(move |ctx| {
+                let state = state.clone();
+                let body = body_with_selected_model(body.clone(), &ctx.selected);
+                async move {
+                    match executors::execute_chat_completions_stream(
+                        state,
+                        selected_channel_to_route(ctx.selected),
+                        body,
+                    )
+                    .await
+                    {
+                        Ok(chunks) => AttemptResult::Success {
+                            response: Value::Array(chunks.into_iter().map(Value::String).collect()),
+                            latency_ms: None,
+                            cost: None,
+                        },
+                        Err(err) => AttemptResult::Failure {
+                            action: crate::proxy::conductor::AttemptFailureAction::Failover,
+                            status: None,
+                            raw_error_text: Some(err.to_string()),
+                        },
+                    }
+                }
+                .boxed()
+            }),
+            on_terminal_failure: None,
+        })
+        .await;
+
+    match conductor_result_to_app_result(result)? {
+        Value::Array(chunks) => chunks
+            .into_iter()
+            .map(|chunk| {
+                chunk.as_str().map(str::to_string).ok_or_else(|| {
+                    AppError::UpstreamError("Invalid streaming response from conductor".into())
+                })
+            })
+            .collect(),
+        _ => Err(AppError::UpstreamError(
+            "Invalid streaming response from conductor".into(),
+        )),
+    }
+}
+
+fn conductor_result_to_app_result(result: ExecuteResult) -> AppResult<Value> {
+    match result {
+        ExecuteResult::Success { response, .. } => Ok(response),
+        ExecuteResult::Failure {
+            reason,
+            status,
+            raw_error_text,
+            attempts,
+            ..
+        } => Err(AppError::UpstreamError(format!(
+            "Proxy conductor failed after {attempts} attempts ({reason:?}, status: {:?}): {}",
+            status,
+            raw_error_text.unwrap_or_else(|| "no upstream error text".to_string())
+        ))),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::{AppConfig, AuthConfig, DbConfig, ProxyConfig, ServerConfig};
+    use axum::http::HeaderValue;
+    use serde_json::json;
+    use sqlx::sqlite::SqlitePoolOptions;
+
+    async fn test_state(upstream_base_url: String) -> AppState {
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect("sqlite::memory:")
+            .await
+            .unwrap();
+
+        sqlx::query(
+            "CREATE TABLE downstream_api_keys (
+                id INTEGER PRIMARY KEY,
+                name TEXT NOT NULL,
+                key TEXT NOT NULL,
+                description TEXT,
+                group_name TEXT,
+                tags TEXT,
+                enabled INTEGER DEFAULT 1,
+                expires_at TEXT,
+                max_cost REAL,
+                used_cost REAL DEFAULT 0,
+                max_requests INTEGER,
+                used_requests INTEGER DEFAULT 0,
+                supported_models TEXT,
+                allowed_route_ids TEXT,
+                site_weight_multipliers TEXT,
+                excluded_site_ids TEXT,
+                excluded_credential_refs TEXT,
+                last_used_at TEXT,
+                user_id INTEGER,
+                created_at TEXT DEFAULT (datetime('now')),
+                updated_at TEXT DEFAULT (datetime('now'))
+            )",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+        sqlx::query(
+            "CREATE TABLE sites (
+                id INTEGER PRIMARY KEY,
+                name TEXT NOT NULL,
+                url TEXT NOT NULL,
+                platform TEXT NOT NULL DEFAULT 'openai',
+                status TEXT NOT NULL DEFAULT 'active',
+                api_key TEXT
+            )",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+        sqlx::query(
+            "CREATE TABLE token_routes (
+                id INTEGER PRIMARY KEY,
+                model_pattern TEXT NOT NULL,
+                model_mapping TEXT,
+                route_mode TEXT,
+                enabled INTEGER DEFAULT 1
+            )",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+        sqlx::query(
+            "CREATE TABLE accounts (
+                id INTEGER PRIMARY KEY,
+                site_id INTEGER NOT NULL,
+                access_token TEXT NOT NULL,
+                api_token TEXT,
+                status TEXT NOT NULL DEFAULT 'active'
+            )",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+        sqlx::query(
+            "CREATE TABLE account_tokens (
+                id INTEGER PRIMARY KEY,
+                account_id INTEGER NOT NULL,
+                name TEXT NOT NULL,
+                token TEXT NOT NULL,
+                enabled INTEGER DEFAULT 1
+            )",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+        sqlx::query(
+            "CREATE TABLE route_channels (
+                id INTEGER PRIMARY KEY,
+                route_id INTEGER NOT NULL,
+                account_id INTEGER NOT NULL,
+                token_id INTEGER,
+                source_model TEXT,
+                priority INTEGER DEFAULT 0,
+                weight INTEGER DEFAULT 10,
+                enabled INTEGER DEFAULT 1,
+                consecutive_fail_count INTEGER NOT NULL DEFAULT 0,
+                cooldown_level INTEGER NOT NULL DEFAULT 0,
+                cooldown_until TEXT,
+                last_selected_at TEXT,
+                success_count INTEGER DEFAULT 0,
+                fail_count INTEGER DEFAULT 0,
+                total_latency_ms INTEGER DEFAULT 0,
+                total_cost REAL DEFAULT 0,
+                last_used_at TEXT,
+                last_fail_at TEXT
+            )",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+
+        sqlx::query("INSERT INTO downstream_api_keys (id, name, key, enabled) VALUES (1, 'test', 'sk-test', 1)")
+            .execute(&pool)
+            .await
+            .unwrap();
+        sqlx::query(
+            "INSERT INTO sites (id, name, url, api_key) VALUES (1, 'OpenAI', ?, 'site-key')",
+        )
+        .bind(upstream_base_url)
+        .execute(&pool)
+        .await
+        .unwrap();
+        sqlx::query("INSERT INTO accounts (id, site_id, access_token, api_token) VALUES (1, 1, 'access-key', NULL)")
+            .execute(&pool)
+            .await
+            .unwrap();
+        sqlx::query("INSERT INTO token_routes (id, model_pattern, model_mapping, route_mode, enabled) VALUES (1, 'gpt-test', 'upstream-test', 'exact', 1)")
+            .execute(&pool)
+            .await
+            .unwrap();
+        sqlx::query("INSERT INTO route_channels (id, route_id, account_id) VALUES (1, 1, 1)")
+            .execute(&pool)
+            .await
+            .unwrap();
+
+        AppState::new(
+            AppConfig {
+                server: ServerConfig {
+                    host: "127.0.0.1".into(),
+                    port: 0,
+                    log_level: "info".into(),
+                    cors_origins: vec![],
+                },
+                db: DbConfig {
+                    url: "sqlite::memory:".into(),
+                    max_connections: 1,
+                    ssl: false,
+                    runtime_db_url: None,
+                    runtime_db_dialect: None,
+                    runtime_db_ssl: None,
+                },
+                auth: AuthConfig {
+                    jwt_secret: "secret".into(),
+                    jwt_expiry_hours: 1,
+                    auth_token: "auth".into(),
+                    proxy_token: "proxy".into(),
+                },
+                proxy: ProxyConfig {
+                    upstream_timeout_secs: 30,
+                    first_byte_timeout_secs: 30,
+                    max_retries: 3,
+                    proxy_log_retention_days: 7,
+                },
+            },
+            pool,
+        )
+    }
+
+    #[tokio::test]
+    async fn chat_route_uses_token_router_and_conductor() {
+        let state = test_state("http://127.0.0.1:1".to_string()).await;
+        let db = state.db.clone();
+        let mut headers = HeaderMap::new();
+        headers.insert("Authorization", HeaderValue::from_static("Bearer sk-test"));
+
+        let result = chat_completions(
+            State(state),
+            headers,
+            Json(json!({
+                "model": "gpt-test",
+                "messages": [{"role": "user", "content": "hello"}]
+            })),
+        )
+        .await;
+
+        assert!(matches!(result, Err(AppError::UpstreamError(_))));
+        let fail_count: i64 =
+            sqlx::query_scalar("SELECT fail_count FROM route_channels WHERE id = 1")
+                .fetch_one(&*db)
+                .await
+                .unwrap();
+        assert!(fail_count > 0);
+    }
+}