Fix codebase audit issues: tenant filtering, orphaned migrations, CLI parity

.gitignore

@@ -36,6 +36,7 @@ Thumbs.db
 # Build
 dist/
 build/output/
+/agentledger
 
 # Node (dashboard)
 web/node_modules/

cmd/agentledger/costs.go

@@ -31,30 +31,38 @@ func costsCmd() *cobra.Command {
 		configPath string
 		last       string
 		groupBy    string
+		tenant     string
 	)
 
 	cmd := &cobra.Command{
 		Use:   "costs",
 		Short: "Show cost report",
 		RunE: func(_ *cobra.Command, _ []string) error {
-			return runCosts(configPath, last, groupBy)
+			return runCosts(configPath, last, groupBy, tenant)
 		},
 	}
 
 	cmd.Flags().StringVarP(&configPath, "config", "c", "", "path to config file")
 	cmd.Flags().StringVar(&last, "last", "24h", "time window (e.g., 1h, 24h, 7d)")
 	cmd.Flags().StringVar(&groupBy, "by", "model", "group by: model, provider, key, agent, session")
+	cmd.Flags().StringVar(&tenant, "tenant", "", "filter by tenant ID")
 
 	return cmd
 }
 
-func runCosts(configPath, last, groupBy string) error {
+func runCosts(configPath, last, groupBy, tenant string) error {
 	cfg, err := config.Load(configPath)
 	if err != nil {
 		return err
 	}
 
-	store, err := ledger.NewSQLite(cfg.Storage.DSN)
+	var store ledger.Ledger
+	switch cfg.Storage.Driver {
+	case "postgres":
+		store, err = ledger.NewPostgres(cfg.Storage.DSN, cfg.Storage.MaxOpenConns, cfg.Storage.MaxIdleConns)
+	default:
+		store, err = ledger.NewSQLite(cfg.Storage.DSN)
+	}
 	if err != nil {
 		return err
 	}
@@ -67,9 +75,10 @@ func runCosts(configPath, last, groupBy string) error {
 
 	now := time.Now()
 	filter := ledger.CostFilter{
-		Since:   now.Add(-window),
-		Until:   now,
-		GroupBy: groupBy,
+		Since:    now.Add(-window),
+		Until:    now,
+		GroupBy:  groupBy,
+		TenantID: tenant,
 	}
 
 	entries, err := store.QueryCosts(context.Background(), filter)

internal/budget/budget_test.go

@@ -31,7 +31,7 @@ func (s *stubLedger) GetTotalSpend(_ context.Context, _ string, since, _ time.Ti
 func (s *stubLedger) GetTotalSpendByTenant(_ context.Context, _ string, _, _ time.Time) (float64, error) {
 	return 0, nil
 }
-func (s *stubLedger) QueryCostTimeseries(_ context.Context, _ string, _, _ time.Time) ([]ledger.TimeseriesPoint, error) {
+func (s *stubLedger) QueryCostTimeseries(_ context.Context, _ string, _, _ time.Time, _ string) ([]ledger.TimeseriesPoint, error) {
 	return nil, nil
 }
 func (s *stubLedger) Close() error { return nil }

internal/dashboard/handlers.go

@@ -33,12 +33,14 @@ func (h *Handler) handleSummary(w http.ResponseWriter, r *http.Request) {
 	now := time.Now().UTC()
 	dayStart := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, time.UTC)
 	monthStart := time.Date(now.Year(), now.Month(), 1, 0, 0, 0, 0, time.UTC)
+	tenantID := r.URL.Query().Get("tenant")
 
 	// Get today's costs by model.
 	todayCosts, err := h.ledger.QueryCosts(r.Context(), ledger.CostFilter{
-		Since:   dayStart,
-		Until:   now,
-		GroupBy: "model",
+		Since:    dayStart,
+		Until:    now,
+		GroupBy:  "model",
+		TenantID: tenantID,
 	})
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, err.Error())
@@ -54,9 +56,10 @@ func (h *Handler) handleSummary(w http.ResponseWriter, r *http.Request) {
 
 	// Get month's costs.
 	monthCosts, err := h.ledger.QueryCosts(r.Context(), ledger.CostFilter{
-		Since:   monthStart,
-		Until:   now,
-		GroupBy: "model",
+		Since:    monthStart,
+		Until:    now,
+		GroupBy:  "model",
+		TenantID: tenantID,
 	})
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, err.Error())
@@ -93,10 +96,12 @@ func (h *Handler) handleTimeseries(w http.ResponseWriter, r *http.Request) {
 		hours = 24
 	}
 
+	tenantID := r.URL.Query().Get("tenant")
+
 	now := time.Now().UTC()
 	since := now.Add(-time.Duration(hours) * time.Hour)
 
-	points, err := h.ledger.QueryCostTimeseries(r.Context(), interval, since, now)
+	points, err := h.ledger.QueryCostTimeseries(r.Context(), interval, since, now, tenantID)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, err.Error())
 		return

internal/dashboard/handlers_test.go

@@ -26,7 +26,7 @@ func (s *stubLedger) GetTotalSpend(_ context.Context, _ string, _, _ time.Time)
 func (s *stubLedger) GetTotalSpendByTenant(_ context.Context, _ string, _, _ time.Time) (float64, error) {
 	return 0, nil
 }
-func (s *stubLedger) QueryCostTimeseries(_ context.Context, _ string, _, _ time.Time) ([]ledger.TimeseriesPoint, error) {
+func (s *stubLedger) QueryCostTimeseries(_ context.Context, _ string, _, _ time.Time, _ string) ([]ledger.TimeseriesPoint, error) {
 	return s.timeseries, nil
 }
 func (s *stubLedger) Close() error { return nil }
@@ -120,6 +120,66 @@ func TestHandleCosts(t *testing.T) {
 	}
 }
 
+func TestHandleCostsWithTenant(t *testing.T) {
+	store := &stubLedger{
+		costs: []ledger.CostEntry{
+			{Model: "gpt-4o-mini", Requests: 3, TotalCostUSD: 0.15},
+		},
+	}
+	h := NewHandler(store, nil)
+
+	mux := http.NewServeMux()
+	h.RegisterRoutes(mux)
+
+	req := httptest.NewRequest("GET", "/api/dashboard/costs?group_by=model&tenant=alpha", nil)
+	w := httptest.NewRecorder()
+	mux.ServeHTTP(w, req)
+
+	if w.Code != 200 {
+		t.Fatalf("status = %d, want 200", w.Code)
+	}
+}
+
+func TestHandleSummaryWithTenant(t *testing.T) {
+	store := &stubLedger{
+		costs: []ledger.CostEntry{
+			{Model: "gpt-4o-mini", Requests: 5, TotalCostUSD: 0.25},
+		},
+	}
+	h := NewHandler(store, nil)
+
+	mux := http.NewServeMux()
+	h.RegisterRoutes(mux)
+
+	req := httptest.NewRequest("GET", "/api/dashboard/summary?tenant=beta", nil)
+	w := httptest.NewRecorder()
+	mux.ServeHTTP(w, req)
+
+	if w.Code != 200 {
+		t.Fatalf("status = %d, want 200", w.Code)
+	}
+}
+
+func TestHandleTimeseriesWithTenant(t *testing.T) {
+	store := &stubLedger{
+		timeseries: []ledger.TimeseriesPoint{
+			{Timestamp: time.Now(), CostUSD: 0.10, Requests: 2},
+		},
+	}
+	h := NewHandler(store, nil)
+
+	mux := http.NewServeMux()
+	h.RegisterRoutes(mux)
+
+	req := httptest.NewRequest("GET", "/api/dashboard/timeseries?tenant=gamma", nil)
+	w := httptest.NewRecorder()
+	mux.ServeHTTP(w, req)
+
+	if w.Code != 200 {
+		t.Fatalf("status = %d, want 200", w.Code)
+	}
+}
+
 func TestHandleSessionsWithoutTracker(t *testing.T) {
 	store := &stubLedger{}
 	h := NewHandler(store, nil)

internal/ledger/ledger.go

@@ -22,8 +22,8 @@ type Ledger interface {
 	GetTotalSpendByTenant(ctx context.Context, tenantID string, since, until time.Time) (float64, error)
 
 	// QueryCostTimeseries returns cost and request counts bucketed by time interval.
-	// interval should be "hour" or "day".
-	QueryCostTimeseries(ctx context.Context, interval string, since, until time.Time) ([]TimeseriesPoint, error)
+	// interval should be "hour" or "day". tenantID is optional (empty = all tenants).
+	QueryCostTimeseries(ctx context.Context, interval string, since, until time.Time, tenantID string) ([]TimeseriesPoint, error)
 
 	// Close releases any held resources.
 	Close() error

internal/ledger/postgres.go

@@ -127,22 +127,29 @@ func (p *Postgres) QueryCosts(ctx context.Context, filter CostFilter) ([]CostEnt
 	return entries, rows.Err()
 }
 
-func (p *Postgres) QueryCostTimeseries(ctx context.Context, interval string, since, until time.Time) ([]TimeseriesPoint, error) {
+func (p *Postgres) QueryCostTimeseries(ctx context.Context, interval string, since, until time.Time, tenantID string) ([]TimeseriesPoint, error) {
 	bucket := "date_trunc('hour', timestamp)"
 	if interval == "day" {
 		bucket = "date_trunc('day', timestamp)"
 	}
 
+	where := "timestamp >= $1 AND timestamp <= $2"
+	args := []any{since.UTC(), until.UTC()}
+	if tenantID != "" {
+		args = append(args, tenantID)
+		where += fmt.Sprintf(" AND tenant_id = $%d", len(args))
+	}
+
 	q := fmt.Sprintf(`SELECT
 		%s as bucket,
 		COALESCE(SUM(cost_usd), 0),
 		COUNT(*)
 	FROM usage_records
-	WHERE timestamp >= $1 AND timestamp <= $2
+	WHERE %s
 	GROUP BY bucket
-	ORDER BY bucket ASC`, bucket)
+	ORDER BY bucket ASC`, bucket, where)
 
-	rows, err := p.db.QueryContext(ctx, q, since.UTC(), until.UTC())
+	rows, err := p.db.QueryContext(ctx, q, args...)
 	if err != nil {
 		return nil, fmt.Errorf("querying cost timeseries: %w", err)
 	}

internal/ledger/postgres_test.go

@@ -154,7 +154,7 @@ func TestPostgres_QueryCostTimeseries(t *testing.T) {
 		}
 	}
 
-	points, err := pg.QueryCostTimeseries(ctx, "hour", hourAgo.Add(-time.Minute), now.Add(time.Minute))
+	points, err := pg.QueryCostTimeseries(ctx, "hour", hourAgo.Add(-time.Minute), now.Add(time.Minute), "")
 	if err != nil {
 		t.Fatalf("QueryCostTimeseries: %v", err)
 	}

internal/ledger/recorder_test.go

@@ -30,7 +30,7 @@ func (c *countingLedger) GetTotalSpendByTenant(_ context.Context, _ string, _, _
 	return 0, nil
 }
 
-func (c *countingLedger) QueryCostTimeseries(_ context.Context, _ string, _, _ time.Time) ([]TimeseriesPoint, error) {
+func (c *countingLedger) QueryCostTimeseries(_ context.Context, _ string, _, _ time.Time, _ string) ([]TimeseriesPoint, error) {
 	return nil, nil
 }
 
@@ -53,7 +53,7 @@ func (f *failingLedger) GetTotalSpendByTenant(_ context.Context, _ string, _, _
 	return 0, nil
 }
 
-func (f *failingLedger) QueryCostTimeseries(_ context.Context, _ string, _, _ time.Time) ([]TimeseriesPoint, error) {
+func (f *failingLedger) QueryCostTimeseries(_ context.Context, _ string, _, _ time.Time, _ string) ([]TimeseriesPoint, error) {
 	return nil, nil
 }
 

internal/ledger/sqlite.go

@@ -129,24 +129,31 @@ func (s *SQLite) QueryCosts(ctx context.Context, filter CostFilter) ([]CostEntry
 	return entries, rows.Err()
 }
 
-func (s *SQLite) QueryCostTimeseries(ctx context.Context, interval string, since, until time.Time) ([]TimeseriesPoint, error) {
+func (s *SQLite) QueryCostTimeseries(ctx context.Context, interval string, since, until time.Time, tenantID string) ([]TimeseriesPoint, error) {
 	// Go's time.Time stores as "2006-01-02 15:04:05.999999 +0000 UTC" in SQLite,
 	// but strftime only parses ISO8601. Use substr to extract the datetime portion.
 	bucket := "strftime('%Y-%m-%d %H:00:00', substr(timestamp, 1, 19))"
 	if interval == "day" {
 		bucket = "strftime('%Y-%m-%d 00:00:00', substr(timestamp, 1, 19))"
 	}
 
+	where := "timestamp >= ? AND timestamp <= ?"
+	args := []any{since.UTC(), until.UTC()}
+	if tenantID != "" {
+		where += " AND tenant_id = ?"
+		args = append(args, tenantID)
+	}
+
 	q := fmt.Sprintf(`SELECT
 		%s as bucket,
 		COALESCE(SUM(cost_usd), 0),
 		COUNT(*)
 	FROM usage_records
-	WHERE timestamp >= ? AND timestamp <= ?
+	WHERE %s
 	GROUP BY bucket
-	ORDER BY bucket ASC`, bucket)
+	ORDER BY bucket ASC`, bucket, where)
 
-	rows, err := s.db.QueryContext(ctx, q, since.UTC(), until.UTC())
+	rows, err := s.db.QueryContext(ctx, q, args...)
 	if err != nil {
 		return nil, fmt.Errorf("querying cost timeseries: %w", err)
 	}

internal/mcp/interceptor_test.go

@@ -38,7 +38,7 @@ func (r *recordingLedger) GetTotalSpendByTenant(_ context.Context, _ string, _,
 	return 0, nil
 }
 
-func (r *recordingLedger) QueryCostTimeseries(_ context.Context, _ string, _, _ time.Time) ([]ledger.TimeseriesPoint, error) {
+func (r *recordingLedger) QueryCostTimeseries(_ context.Context, _ string, _, _ time.Time, _ string) ([]ledger.TimeseriesPoint, error) {
 	return nil, nil
 }
 

internal/proxy/proxy_test.go

@@ -43,7 +43,7 @@ func (m *mockStore) GetTotalSpendByTenant(_ context.Context, _ string, _, _ time
 	return m.totalSpend, nil
 }
 
-func (m *mockStore) QueryCostTimeseries(_ context.Context, _ string, _, _ time.Time) ([]ledger.TimeseriesPoint, error) {
+func (m *mockStore) QueryCostTimeseries(_ context.Context, _ string, _, _ time.Time, _ string) ([]ledger.TimeseriesPoint, error) {
 	return nil, nil
 }