Update src/api/admin.py

src/api/admin.py

@@ -715,3 +715,71 @@ async def admin_analytics_recent(request: Request):
     _require_session(request)
     return await _worker_get("/analytics/recent")
 
+@router.get("/worker-health")
+async def admin_worker_health(request: Request):
+    """Diagnose the backend -> Worker -> D1 chain and say plainly what is wrong.
+
+    Checks, in order: is CLOUDFLARE_WORKER_URL set; is the Worker reachable and
+    running v3.8; is CLOUDFLARE_WORKER_TOKEN set; does it authenticate against
+    the Worker's analytics surface. Returns a verdict plus the raw status codes.
+    """
+    _require_session(request)
+    import httpx as _hx
+    from src.config import get_settings as _gs, LIBBEE_VERSION as _ver
+    settings = _gs()
+    worker = (settings.cloudflare_worker_url or "").rstrip("/")
+    token = settings.cloudflare_worker_token or ""
+    out = {
+        "backend_version": _ver,
+        "worker_url_configured": bool(worker),
+        "worker_token_configured": bool(token),
+        "checks": {},
+        "verdict": "",
+    }
+    if not worker:
+        out["verdict"] = "CLOUDFLARE_WORKER_URL is not set in the Space secrets."
+        return out
+    headers = {"Authorization": f"Bearer {token}"} if token else {}
+    try:
+        async with _hx.AsyncClient(timeout=8) as client:
+            rv = await client.get(f"{worker}/version")
+            out["checks"]["version_status"] = rv.status_code
+            try:
+                out["checks"]["worker_version"] = (rv.json() or {}).get("version")
+            except Exception:
+                out["checks"]["worker_version"] = None
+            ra = await client.get(f"{worker}/analytics", headers=headers)
+            out["checks"]["analytics_status"] = ra.status_code
+            if ra.status_code == 200:
+                try:
+                    out["checks"]["total_queries_logged"] = (ra.json() or {}).get("total")
+                except Exception:
+                    pass
+    except Exception as exc:
+        out["verdict"] = f"Worker unreachable: {exc}"
+        return out
+
+    wv = out["checks"].get("worker_version")
+    a = out["checks"].get("analytics_status")
+    if wv != "3.8.0":
+        out["verdict"] = (
+            "Worker is not running v3.8.0 (no /version response). Deploy "
+            "cloudflare-worker-v3.8.js in the Cloudflare dashboard."
+        )
+    elif a == 401 and not token:
+        out["verdict"] = (
+            "Worker requires a token but CLOUDFLARE_WORKER_TOKEN is not set in "
+            "the Space secrets. Add it with the same value as the Worker's "
+            "ANALYTICS_TOKEN, then restart the Space."
+        )
+    elif a == 401:
+        out["verdict"] = (
+            "CLOUDFLARE_WORKER_TOKEN does not match the Worker's ANALYTICS_TOKEN. "
+            "Re-copy the value into both places."
+        )
+    elif a == 200:
+        out["verdict"] = "OK - backend, Worker and D1 analytics are connected."
+    else:
+        out["verdict"] = f"Unexpected analytics status {a}."
+    return out
+