merge(main): sync latest main into security branch

apps/aether-gateway/src/handlers/admin/provider/oauth/quota/shared.rs

@@ -606,6 +606,50 @@ pub(crate) async fn reserve_codex_account_reset(
     Ok(None)
 }
 
+fn record_locally_consumed_codex_reset_credit(
+    codex: &mut serde_json::Map<String, serde_json::Value>,
+    observed_at_unix_secs: u64,
+) {
+    let Some(reset_credits) = codex
+        .get_mut("reset_credits")
+        .and_then(serde_json::Value::as_object_mut)
+    else {
+        return;
+    };
+    let Some(available_count) = reset_credits
+        .get("available_count")
+        .and_then(admin_provider_quota_pure::coerce_json_u64)
+    else {
+        return;
+    };
+
+    reset_credits.insert(
+        "available_count".to_string(),
+        serde_json::json!(available_count.saturating_sub(1)),
+    );
+    reset_credits.insert(
+        "updated_at".to_string(),
+        serde_json::json!(observed_at_unix_secs),
+    );
+    reset_credits.insert(
+        "detail_source".to_string(),
+        serde_json::json!("local_consume"),
+    );
+    reset_credits.insert(
+        "detail_status".to_string(),
+        serde_json::json!("pending_refresh"),
+    );
+    reset_credits.remove("detail_error");
+    if let Some(credits) = reset_credits
+        .get_mut("credits")
+        .and_then(serde_json::Value::as_array_mut)
+    {
+        if !credits.is_empty() {
+            credits.remove(0);
+        }
+    }
+}
+
 pub(crate) async fn complete_codex_account_reset(
     state: &AdminAppState<'_>,
     key_id: &str,
@@ -671,6 +715,9 @@ pub(crate) async fn complete_codex_account_reset(
             generation: reservation.generation,
             outcome: outcome.to_string(),
         };
+        if outcome == "reset" {
+            record_locally_consumed_codex_reset_credit(&mut codex, fence_unix_ms / 1_000);
+        }
         codex_reset_write_bounded_history(&mut codex, &terminal);
         if codex_reset_reservation_from_object(&codex).as_ref() == Some(reservation) {
             codex.remove(admin_provider_quota_pure::CODEX_QUOTA_ACCOUNT_RESET_RESERVATION_KEY);
@@ -1972,7 +2019,19 @@ mod tests {
         .expect("key should build");
         key.encrypted_auth_config = Some(encrypted_auth_config.clone());
         key.upstream_metadata = Some(json!({
-            "codex": {"credential_generation": "credential-v1"}
+            "codex": {
+                "credential_generation": "credential-v1",
+                "reset_credits": {
+                    "available_count": 2,
+                    "updated_at": 100u64,
+                    "detail_source": "wham_readonly",
+                    "detail_status": "available",
+                    "credits": [
+                        {"id": "credit-1", "expires_at": 20_000u64},
+                        {"id": "credit-2", "expires_at": 30_000u64}
+                    ]
+                }
+            }
         }));
         let credential_fence = ProviderTransportCredentialFence {
             encrypted_auth_config,
@@ -2070,6 +2129,13 @@ mod tests {
         let key_id = "key-codex-reset-credential-generation";
         let (app, repository, credential) = codex_reset_state_machine_test_state(key_id);
         let admin_state = AdminAppState::new(&app);
+        let original_metadata = repository
+            .list_keys_by_ids(&[key_id.to_string()])
+            .await
+            .expect("key should load before reservation")
+            .pop()
+            .expect("key should exist before reservation")
+            .upstream_metadata;
 
         let result = reserve_codex_account_reset(
             &admin_state,
@@ -2093,10 +2159,7 @@ mod tests {
             .expect("key should reload")
             .pop()
             .expect("key should exist");
-        assert_eq!(
-            stored.upstream_metadata.unwrap()["codex"],
-            json!({"credential_generation":"credential-v1"})
-        );
+        assert_eq!(stored.upstream_metadata, original_metadata);
     }
 
     #[tokio::test]
@@ -2231,6 +2294,11 @@ mod tests {
                 codex["account_quota_reset_history"][0]["outcome"],
                 json!("reset")
             );
+            assert_eq!(codex["reset_credits"]["available_count"], json!(1u64));
+            assert_eq!(
+                codex["reset_credits"]["credits"],
+                json!([{"id": "credit-2", "expires_at": 30_000u64}])
+            );
         }
     }