Voice spike for my-words, using OpenAI Realtime

backend/src/__tests__/app.test.ts

@@ -12,7 +12,14 @@ const app = createApp();
  * updateUser/deleteUser record their calls. Cast to Auth — we only touch the
  * surface the app handlers use.
  */
-function makeAuthApp(user: { id: string; loggingConsent?: string } | null) {
+function makeAuthApp(
+	user: {
+		id: string;
+		loggingConsent?: string;
+		isAnonymous?: boolean;
+		email?: string;
+	} | null,
+) {
 	const calls: { updateUser: unknown[]; deleteUser: unknown[] } = {
 		updateUser: [],
 		deleteUser: [],
@@ -274,6 +281,88 @@ describe('POST /api/openai/chat/completions', () => {
 	});
 });
 
+describe('POST /api/openai/realtime/session', () => {
+	/** The mint call never reaches OpenAI when the route refuses first. */
+	function stubUpstream() {
+		const fetchMock = vi
+			.fn()
+			.mockResolvedValue(
+				new Response(JSON.stringify({ value: 'ek_test' }), { status: 200 }),
+			);
+		vi.stubGlobal('fetch', fetchMock);
+		return fetchMock;
+	}
+
+	it('401s without a session when auth is on, without minting', async () => {
+		vi.stubEnv('OPENAI_API_KEY', 'sk-main');
+		const fetchMock = stubUpstream();
+		const { app: authApp } = makeAuthApp(null);
+
+		const res = await authApp.request('/api/openai/realtime/session', {
+			method: 'POST',
+		});
+
+		expect(res.status).toBe(401);
+		// The point of the gate: no ephemeral credential was minted against our key.
+		expect(fetchMock).not.toHaveBeenCalled();
+	});
+
+	it('mints against the main key for a signed-in user', async () => {
+		vi.stubEnv('OPENAI_API_KEY', 'sk-main');
+		const fetchMock = stubUpstream();
+		// Allowlisted address — the route enforces the same beta gate as the proxy.
+		const { app: authApp } = makeAuthApp({
+			id: 'user-1',
+			email: 'writer@calvin.edu',
+		});
+
+		const res = await authApp.request('/api/openai/realtime/session', {
+			method: 'POST',
+		});
+
+		expect(res.status).toBe(200);
+		expect(fetchMock).toHaveBeenCalledOnce();
+		const [url, init] = fetchMock.mock.calls[0]!;
+		expect(url).toContain('realtime/client_secrets');
+		expect((init.headers as Record<string, string>).Authorization).toBe(
+			'Bearer sk-main',
+		);
+	});
+
+	it('403s a signed-in user outside the beta allowlist', async () => {
+		vi.stubEnv('OPENAI_API_KEY', 'sk-main');
+		const fetchMock = stubUpstream();
+		const { app: authApp } = makeAuthApp({
+			id: 'user-2',
+			email: 'someone@example.com',
+		});
+
+		const res = await authApp.request('/api/openai/realtime/session', {
+			method: 'POST',
+		});
+
+		expect(res.status).toBe(403);
+		expect(fetchMock).not.toHaveBeenCalled();
+	});
+
+	it('spends the capped demo key for an anonymous session', async () => {
+		vi.stubEnv('OPENAI_API_KEY', 'sk-main');
+		vi.stubEnv('OPENAI_DEMO_API_KEY', 'sk-demo');
+		const fetchMock = stubUpstream();
+		const { app: authApp } = makeAuthApp({ id: 'anon-1', isAnonymous: true });
+
+		const res = await authApp.request('/api/openai/realtime/session', {
+			method: 'POST',
+		});
+
+		expect(res.status).toBe(200);
+		const [, init] = fetchMock.mock.calls[0]!;
+		expect((init.headers as Record<string, string>).Authorization).toBe(
+			'Bearer sk-demo',
+		);
+	});
+});
+
 describe('log-viewer secret gate', () => {
 	it('rejects logs_poll with a wrong secret and accepts the right one', async () => {
 		vi.stubEnv("LOG_SECRET", 'super-secret');

backend/src/app.ts

@@ -11,7 +11,7 @@ import {
 import { deviceClientIds, gitCommit, logSecret } from './config.js';
 import { eraseLoggedData } from './erasure.js';
 import { appendLog, pollLogs, zipLogs } from './logging.js';
-import { openaiProxy } from './openaiProxy.js';
+import { attributeRequest, openaiProxy } from './openaiProxy.js';
 import { captureException, posthogMiddleware } from './posthog.js';
 import { costUsd } from './pricing.js';
 import {
@@ -27,6 +27,17 @@ import {
 import { summarizeUsage } from './usage.js';
 import { isUserAllowed } from './userAllowlist.js';
 
+// Mints short-lived ephemeral credentials so a browser can open a WebRTC
+// Realtime session without ever seeing the server API key. This is the only
+// server involvement in the voice tab: audio and tool calls run browser →
+// OpenAI directly (frontend/src/pages/my-words/voice/, and
+// docs/my-words-voice-native-research.md).
+const OPENAI_REALTIME_SESSION_URL =
+	'https://api.openai.com/v1/realtime/client_secrets';
+// The realtime-capable model the ephemeral session is bound to. Override via env
+// as OpenAI ships new ids (gpt-realtime, gpt-realtime-2, …).
+const REALTIME_MODEL = process.env.OPENAI_REALTIME_MODEL || 'gpt-realtime-2';
+
 /** Extract the raw bearer token from the Authorization header, or null. */
 function bearerToken(c: Context): string | null {
 	const header = c.req.header('Authorization') ?? '';
@@ -104,6 +115,64 @@ export function createApp({ auth }: { auth?: Auth } = {}): Hono {
 		}),
 	);
 
+	// Mint an ephemeral Realtime session token for the browser voice spike. The
+	// server key stays here; the browser receives only the short-lived secret it
+	// uses to open the WebRTC session directly with OpenAI.
+	app.post('/api/openai/realtime/session', async (c) => {
+		// A realtime session spends a model key just like a proxied generation, so
+		// it answers to the same attribution: a real session spends the main key, a
+		// demo session the capped one, and sessionless traffic is refused wherever
+		// auth is on rather than quietly billing the main key. Without this the
+		// route was open — anyone who could reach it could mint a token against
+		// OPENAI_API_KEY.
+		//
+		// Metering is still missing, and can't be done here: the audio runs
+		// browser → OpenAI over WebRTC, so no tokens pass through this server to
+		// count. Recording it means reading `usage` off the client's `response.done`
+		// events and reporting them back. Until then a voice session is billable but
+		// absent from `llm_usage`, which is why the page stays behind a flag.
+		const user = await resolveUser(c);
+		// Same beta allowlist the proxy enforces — otherwise voice is a way around
+		// it that also happens to spend a model key.
+		if (user && !user.isAllowed) return c.json({ detail: 'Forbidden' }, 403);
+		const attribution = attributeRequest(user, !!auth);
+		if (!attribution) {
+			return c.json({ detail: 'Sign in to use voice.' }, 401);
+		}
+		const key = attribution.apiKey;
+		if (!key) {
+			return c.json({ detail: 'OPENAI_API_KEY not set' }, 500);
+		}
+		let upstream: Response;
+		try {
+			upstream = await fetch(OPENAI_REALTIME_SESSION_URL, {
+				method: 'POST',
+				headers: {
+					Authorization: `Bearer ${key}`,
+					'Content-Type': 'application/json',
+				},
+				body: JSON.stringify({
+					session: { type: 'realtime', model: REALTIME_MODEL },
+				}),
+			});
+		} catch (e) {
+			console.error(
+				'[realtime-session] upstream fetch failed:',
+				(e as Error).message,
+			);
+			throw e; // -> onError -> 500 JSON
+		}
+
+		const text = await upstream.text();
+		if (!upstream.ok) {
+			console.warn(`[realtime-session] ${upstream.status} ${text.slice(0, 200)}`);
+		}
+		return new Response(text, {
+			status: upstream.status,
+			headers: { 'Content-Type': 'application/json' },
+		});
+	});
+
 	// Resolve the authenticated user from the request's session, or null. Returns
 	// null when auth is disabled (dev/tests without BETTER_AUTH_ENABLED) so the
 	// caller can 401 — identity-keyed logging requires a session. `isAnonymous`