fix: harden frontdoor and usage ingestion

apps/aether-gateway/src/handlers/admin/provider/oauth/quota/shared.rs

@@ -317,12 +317,7 @@ pub(super) async fn execute_provider_quota_plan(
     match state.execute_execution_runtime_sync_plan(None, &plan).await {
         Ok(result) => Ok(ProviderQuotaExecutionOutcome::Response(result)),
         Err(err) => {
-            let error = match err {
-                GatewayError::UpstreamUnavailable { message, .. }
-                | GatewayError::ControlUnavailable { message, .. }
-                | GatewayError::Client { message, .. }
-                | GatewayError::Internal(message) => message,
-            };
+            let error = err.into_message();
             let proxy_node_id = plan
                 .proxy
                 .as_ref()

apps/aether-gateway/src/handlers/admin/provider/ops/providers/verify/request.rs

@@ -301,12 +301,7 @@ fn admin_provider_ops_decode_response_bytes(
 }
 
 fn admin_provider_ops_gateway_error_message(error: GatewayError) -> String {
-    match error {
-        GatewayError::UpstreamUnavailable { message, .. }
-        | GatewayError::ControlUnavailable { message, .. }
-        | GatewayError::Client { message, .. }
-        | GatewayError::Internal(message) => message,
-    }
+    error.into_message()
 }
 
 pub(super) fn admin_provider_ops_verify_execution_error_message(error: &str) -> String {

apps/aether-gateway/src/handlers/admin/provider/pool/runtime/reads.rs

@@ -16,7 +16,12 @@ use aether_runtime_state::{DataLayerError, RuntimeState};
 use futures_util::future::join_all;
 use std::collections::{BTreeMap, BTreeSet};
 use std::time::{SystemTime, UNIX_EPOCH};
-use tracing::warn;
+use tracing::{info, warn};
+
+const DEFAULT_POOL_RUNTIME_WINDOW_METRIC_KEY_LIMIT: usize = 512;
+const MAX_POOL_RUNTIME_WINDOW_METRIC_KEY_LIMIT: usize = 10_000;
+const POOL_RUNTIME_WINDOW_METRIC_KEY_LIMIT_ENV: &str =
+    "AETHER_GATEWAY_ADMIN_POOL_RUNTIME_WINDOW_METRIC_KEY_LIMIT";
 
 fn current_unix_secs() -> u64 {
     SystemTime::now()
@@ -29,6 +34,20 @@ fn should_load_active_probe_members(pool_config: &AdminProviderPoolConfig) -> bo
     pool_config.probing_enabled
 }
 
+fn pool_runtime_window_metric_key_limit() -> usize {
+    std::env::var(POOL_RUNTIME_WINDOW_METRIC_KEY_LIMIT_ENV)
+        .ok()
+        .and_then(|value| value.trim().parse::<usize>().ok())
+        .filter(|value| *value > 0)
+        .unwrap_or(DEFAULT_POOL_RUNTIME_WINDOW_METRIC_KEY_LIMIT)
+        .clamp(1, MAX_POOL_RUNTIME_WINDOW_METRIC_KEY_LIMIT)
+}
+
+fn bounded_runtime_window_metric_key_ids(key_ids: &[String], limit: usize) -> &[String] {
+    let end = key_ids.len().min(limit.max(1));
+    &key_ids[..end]
+}
+
 pub(crate) async fn read_admin_provider_pool_cooldown_counts(
     runtime: &RuntimeState,
     provider_ids: &[String],
@@ -54,8 +73,21 @@ pub(crate) async fn read_admin_provider_pool_runtime_state(
 ) -> AdminProviderPoolRuntimeState {
     let mut state = AdminProviderPoolRuntimeState::default();
     let cooldown_keys = pool_cooldown_keys(provider_id, key_ids);
-    let cost_keys = pool_cost_keys(provider_id, key_ids);
-    let latency_keys = pool_latency_keys(provider_id, key_ids);
+    let metric_key_limit = pool_runtime_window_metric_key_limit();
+    let metric_key_ids = bounded_runtime_window_metric_key_ids(key_ids, metric_key_limit);
+    if metric_key_ids.len() < key_ids.len() {
+        info!(
+            event_name = "admin_pool_runtime_window_metrics_truncated",
+            log_type = "event",
+            provider_id,
+            total_key_count = key_ids.len(),
+            scanned_key_count = metric_key_ids.len(),
+            metric_key_limit,
+            "gateway limited admin pool runtime cost/latency window reads"
+        );
+    }
+    let cost_keys = pool_cost_keys(provider_id, metric_key_ids);
+    let latency_keys = pool_latency_keys(provider_id, metric_key_ids);
     let sticky_sessions_enabled = pool_config.sticky_session_ttl_seconds > 0
         && admin_provider_pool_cache_affinity_enabled(pool_config);
 
@@ -179,7 +211,7 @@ pub(crate) async fn read_admin_provider_pool_runtime_state(
             .map(|cost_key| runtime.score_range_by_min(cost_key, cost_window_start)),
     )
     .await;
-    for (key_id, members) in key_ids.iter().zip(cost_results) {
+    for (key_id, members) in metric_key_ids.iter().zip(cost_results) {
         let total = members
             .unwrap_or_default()
             .iter()
@@ -197,7 +229,7 @@ pub(crate) async fn read_admin_provider_pool_runtime_state(
             .map(|latency_key| runtime.score_range_by_min(latency_key, latency_window_start)),
     )
     .await;
-    for (key_id, members) in key_ids.iter().zip(latency_results) {
+    for (key_id, members) in metric_key_ids.iter().zip(latency_results) {
         let samples = members
             .unwrap_or_default()
             .iter()
@@ -265,3 +297,30 @@ pub(crate) async fn read_admin_provider_pool_key_cooldown_reason(
         .kv_get(&pool_cooldown_key(provider_id, key_id))
         .await
 }
+
+#[cfg(test)]
+mod tests {
+    use super::bounded_runtime_window_metric_key_ids;
+
+    #[test]
+    fn runtime_window_metric_key_ids_are_bounded() {
+        let key_ids = vec![
+            "key-1".to_string(),
+            "key-2".to_string(),
+            "key-3".to_string(),
+        ];
+
+        let bounded = bounded_runtime_window_metric_key_ids(&key_ids, 2);
+
+        assert_eq!(bounded, &key_ids[..2]);
+    }
+
+    #[test]
+    fn runtime_window_metric_key_ids_keep_at_least_one_key() {
+        let key_ids = vec!["key-1".to_string(), "key-2".to_string()];
+
+        let bounded = bounded_runtime_window_metric_key_ids(&key_ids, 0);
+
+        assert_eq!(bounded, &key_ids[..1]);
+    }
+}

apps/aether-gateway/src/handlers/admin/request/provider/oauth.rs

@@ -662,10 +662,5 @@ fn admin_provider_oauth_decode_response_bytes(
 }
 
 fn admin_provider_oauth_gateway_error_message(error: GatewayError) -> String {
-    match error {
-        GatewayError::UpstreamUnavailable { message, .. }
-        | GatewayError::ControlUnavailable { message, .. }
-        | GatewayError::Client { message, .. }
-        | GatewayError::Internal(message) => message,
-    }
+    error.into_message()
 }