fix: security hardening, real AI costs, traceId propagation & audit logging

- S1: enforceOrgIsolation — organizationId always from JWT for non-SUPER_ADMIN (header ignored)
- S4: auditService.log() on ORG_MODE_CHANGED, ORG_PERSONALITY_UPDATED, ORG_BYOK_KEYS_UPDATED
- O1: traceId (UUID) generated at webhook, forwarded via x-trace-id header, injected into BullMQ job data, threaded through whatsapp-logic handler chain
- D3: /v1/analytics/usage now aggregates real UsageEvent.costUsd + tokens (tokensIn/Out) with per-feature breakdown instead of token estimates
- D4: BrandingDataSchema added to shared-types — brandingData strictly typed (logoUrl, primaryColor, orgName) instead of z.any()
- A6: InboundHandler fetches user.language in parallel with org token, passes it to Whisper
- A2: sendLessonDay() caches personalized lesson text in Redis 6h by (trackDayId, activity, language)
- P1: sendLessonDay() parallelized — user+trackDay batched in one include, userProgress fetched in parallel
- D2: ExerciseHandler Redis 30s dedup lock prevents double exercise submission

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/routes/analytics.ts

@@ -22,7 +22,9 @@ export async function analyticsRoutes(fastify: FastifyInstance) {
                 inboundMessages,
                 outboundMessages,
                 totalUsers,
-                activeUsersLast24h
+                activeUsersLast24h,
+                usageAgg,
+                usageByFeature,
             ] = await Promise.all([
                 prisma.message.count({ where: { organizationId } }),
                 prisma.message.count({ where: { organizationId, direction: 'INBOUND' } }),
@@ -33,22 +35,23 @@ export async function analyticsRoutes(fastify: FastifyInstance) {
                         organizationId,
                         lastActivityAt: { gte: new Date(Date.now() - 24 * 60 * 60 * 1000) }
                     }
-                })
+                }),
+                // Real costs from UsageEvent table
+                prisma.usageEvent.aggregate({
+                    where: { organizationId },
+                    _sum: { tokensIn: true, tokensOut: true, costUsd: true },
+                }),
+                prisma.usageEvent.groupBy({
+                    by: ['feature'],
+                    where: { organizationId },
+                    _sum: { costUsd: true, tokensIn: true, tokensOut: true },
+                    _count: { _all: true },
+                }),
             ]);
 
-            // ~1000 tokens avg per outbound AI message (only outbound calls the LLM)
-            const estimatedTokens = outboundMessages * 1000;
-
-            // Pricing per 1M tokens (input+output blended) — updated May 2026
-            const MODEL_PRICES_USD_PER_1M: Record<string, number> = {
-                'gpt-4o': 7.50,
-                'gpt-4o-mini': 0.30,
-                'gemini-2.0-flash': 0.15,
-                'gemini-1.5-pro': 3.50,
-                'claude-sonnet-4-6': 4.50,
-            };
-            const activeModel = process.env.DEFAULT_AI_MODEL || 'gpt-4o-mini';
-            const pricePerMillion = MODEL_PRICES_USD_PER_1M[activeModel] ?? 0.30;
+            const realTokensIn = usageAgg._sum.tokensIn ?? 0;
+            const realTokensOut = usageAgg._sum.tokensOut ?? 0;
+            const realCostUsd = usageAgg._sum.costUsd ?? 0;
 
             return {
                 messages: {
@@ -61,9 +64,17 @@ export async function analyticsRoutes(fastify: FastifyInstance) {
                     activeLast24h: activeUsersLast24h
                 },
                 costs: {
-                    estimatedTokens,
-                    estimatedUsd: (estimatedTokens / 1_000_000) * pricePerMillion,
-                    model: activeModel
+                    tokensIn: realTokensIn,
+                    tokensOut: realTokensOut,
+                    totalTokens: realTokensIn + realTokensOut,
+                    totalUsd: realCostUsd,
+                    byFeature: usageByFeature.map((f: any) => ({
+                        feature: f.feature,
+                        calls: f._count._all,
+                        tokensIn: f._sum.tokensIn ?? 0,
+                        tokensOut: f._sum.tokensOut ?? 0,
+                        costUsd: f._sum.costUsd ?? 0,
+                    })),
                 }
             };
         } catch (err) {

apps/api/src/routes/billing.ts

@@ -2,6 +2,7 @@ import { FastifyInstance } from 'fastify';
 import { prisma } from '../services/prisma';
 import OpenAI from 'openai';
 import { creditWallet } from '../services/wallet';
+import { auditService } from '../services/audit';
 
 const PLAN_LIMITS: Record<string, { aiCreditsLimit: number; label: string }> = {
     STARTER:    { aiCreditsLimit: 500,   label: 'Démarrage'  },
@@ -343,6 +344,12 @@ Les templates sont des messages pré-approuvés par Meta pour initier une conver
                 const allowed = ['EDTECH', 'CRM_MARKETING', 'AI_AGENT', 'CUSTOMER_SERVICE'];
                 if (!allowed.includes(mode)) return JSON.stringify({ error: `Invalid mode. Allowed: ${allowed.join(', ')}` });
                 await prisma.organization.update({ where: { id: organizationId }, data: { mode: mode as any } });
+                auditService.log({
+                    action: 'ORG_MODE_CHANGED',
+                    actorId: (req as any).user?.id,
+                    resourceId: organizationId,
+                    details: { newMode: mode, callerRole },
+                });
                 return JSON.stringify({ success: true, newMode: mode, message: `Mode changed to ${mode}` });
             }
 

apps/api/src/routes/organizations.ts

@@ -12,6 +12,7 @@ import { createSubscriber, orgChannel } from '../lib/redis';
 import { KBService } from '../services/kb-service';
 import { CRMService } from '../services/crm-service';
 import { OrganizationCreationSchema, createOrganizationWithAdmin } from '../services/organization-service';
+import { auditService } from '../services/audit';
 
 type P<K extends string = 'id'> = { Params: Record<K, string> };
 type Q<T extends Record<string, string | undefined>> = { Querystring: T };
@@ -100,6 +101,16 @@ export async function organizationRoutes(fastify: FastifyInstance) {
             const data = encryptSecrets(body.data);
             const org = await prisma.organization.update({ where: { id }, data });
             await invalidateOrganizationCache(id);
+
+            if (wantsOwnKeys) {
+                auditService.log({
+                    action: 'ORG_BYOK_KEYS_UPDATED',
+                    actorId: req.user?.id,
+                    resourceId: id,
+                    details: { updatedKeys: Object.keys(body.data).filter(k => k.includes('ApiKey')) },
+                });
+            }
+
             return decryptSecrets(org);
         } catch (err) {
             logger.warn({ err, organizationId: id }, '[ORG] update failed');
@@ -198,6 +209,12 @@ export async function organizationRoutes(fastify: FastifyInstance) {
             });
 
             await invalidateOrganizationCache(id);
+            auditService.log({
+                action: 'ORG_PERSONALITY_UPDATED',
+                actorId: req.user?.id,
+                resourceId: id,
+                details: { fields: Object.keys(body.data) },
+            });
             return updatedOrg;
         } catch (err) {
             logger.warn({ err, organizationId: id }, '[ORG] personality update failed');

apps/api/src/routes/whatsapp.ts

@@ -153,6 +153,7 @@ export async function whatsappRoutes(fastify: FastifyInstance) {
                 // The bridge owns org resolution, WEBHOOK mode handling, and Redis queue ops.
                 // WORKER_BRIDGE_URL env var can override for separate-container deployments.
                 const workerBridgeUrl = process.env.WORKER_BRIDGE_URL || 'http://localhost:8082';
+                const traceId = crypto.randomUUID();
                 reply.code(200).send('EVENT_RECEIVED');
                 setImmediate(async () => {
                     try {
@@ -161,11 +162,12 @@ export async function whatsappRoutes(fastify: FastifyInstance) {
                             headers: {
                                 'Content-Type': 'application/json',
                                 'Authorization': `Bearer ${process.env.ADMIN_API_KEY}`,
-                                'x-organization-id': organizationId
+                                'x-organization-id': organizationId,
+                                'x-trace-id': traceId
                             },
                             body: JSON.stringify(request.body)
                         });
-                        logger.info({ status: res.status, organizationId, phoneNumberId }, '[WHATSAPP-GATEWAY] Forwarded to worker bridge');
+                        logger.info({ status: res.status, organizationId, phoneNumberId, traceId }, '[WHATSAPP-GATEWAY] Forwarded to worker bridge');
                     } catch (err) {
                         logger.error({ err, organizationId }, '[WHATSAPP-GATEWAY] Forward to worker bridge failed');
                     }

apps/whatsapp-worker/src/handlers/InboundHandler.ts

@@ -12,7 +12,7 @@ import { redis } from '../lib/redis';
 
 export class InboundHandler implements JobHandler {
     async handle(job: Job<JobData>): Promise<void> {
-        let { phone, text, audioUrl, imageUrl, organizationId } = job.data;
+        let { phone, text, audioUrl, imageUrl, organizationId, traceId } = job.data;
         
         if (!phone) {
             logger.error(`[INBOUND_HANDLER] Missing phone number`);
@@ -100,7 +100,8 @@ export class InboundHandler implements JobHandler {
             imageUrl,
             organizationId,
             audioUrl ? 'audio' : imageUrl ? 'image' : undefined,
-            audioUrl || imageUrl || undefined
+            audioUrl || imageUrl || undefined,
+            traceId
         );
     }
 }

apps/whatsapp-worker/src/handlers/types.ts

@@ -89,6 +89,7 @@ export interface JobData {
     accessToken?: string;
     overrideAudioUrl?: string;
     sendSpinner?: boolean;
+    traceId?: string;
     
     // Interactive components
     buttons?: Array<{ id: string; title: string }>;

apps/whatsapp-worker/src/index.ts

@@ -76,6 +76,7 @@ server.post('/v1/internal/whatsapp/inbound', async (req: FastifyRequest, reply:
     }
 
     let organizationId: string | null = req.headers['x-organization-id'] as string || null;
+    const traceId: string = (req.headers['x-trace-id'] as string) || `auto-${Date.now()}`;
     const payload = req.body as { entry?: Array<{ changes?: Array<{ value?: { metadata?: { phone_number_id?: string } } }> }> };
 
     // 🏢 Multi-Tenant Routing Hardening:
@@ -123,20 +124,19 @@ server.post('/v1/internal/whatsapp/inbound', async (req: FastifyRequest, reply:
 
     for (const msg of extractedMessages) {
         if (msg.text !== undefined) {
-            logger.info(`[BRIDGE] Enqueuing inbound message from ${msg.phone}`);
+            logger.info({ traceId }, `[BRIDGE] Enqueuing inbound message from ${msg.phone}`);
             await whatsappQueue.add('handle-inbound', {
                 phone: msg.phone,
                 text: msg.text,
-                organizationId
+                organizationId,
+                traceId,
             }, {
                 attempts: 3,
                 backoff: { type: 'exponential', delay: 1000 }
             });
         } else if (msg.mediaId) {
-            // 🎙️ Handle media (Images and Audio)
             const isImage = msg.mediaType === 'image';
-            
-            logger.info(`[BRIDGE] Enqueuing inbound media (${msg.mediaType}) from ${msg.phone}`);
+            logger.info({ traceId }, `[BRIDGE] Enqueuing inbound media (${msg.mediaType}) from ${msg.phone}`);
 
             // Single media job: MediaHandler handles transcription + DB logging + pedagogy.
             // A second handle-inbound job was previously enqueued here, causing double
@@ -147,7 +147,8 @@ server.post('/v1/internal/whatsapp/inbound', async (req: FastifyRequest, reply:
                 phone: msg.phone,
                 organizationId,
                 caption: msg.caption,
-                sendSpinner: true  // MediaHandler will send a localized spinner after user lookup
+                sendSpinner: true,
+                traceId,
             }, { priority: 1, attempts: 3, backoff: { type: 'exponential', delay: 2000 } });
         }
     }

apps/whatsapp-worker/src/services/whatsapp-logic.ts

@@ -34,19 +34,20 @@ export class WhatsAppLogic {
     }
 
     static async handleIncomingMessage(
-        phone: string, 
-        text: string, 
-        audioUrl?: string, 
-        imageUrl?: string, 
+        phone: string,
+        text: string,
+        audioUrl?: string,
+        imageUrl?: string,
         organizationId?: string,
         mediaType?: string,
-        mediaId?: string
+        mediaId?: string,
+        incomingTraceId?: string
     ) {
         if (!organizationId) {
             logger.error({ phone }, '[WHATSAPP_LOGIC] Missing organizationId — refusing to process to prevent cross-tenant contamination');
             return;
         }
-        const traceId = audioUrl ? `[STT-FLOW-${phone.slice(-4)}]` : imageUrl ? `[IMG-FLOW-${phone.slice(-4)}]` : `[TXT-FLOW-${phone.slice(-4)}]`;
+        const traceId = incomingTraceId ?? (audioUrl ? `[STT-FLOW-${phone.slice(-4)}]` : imageUrl ? `[IMG-FLOW-${phone.slice(-4)}]` : `[TXT-FLOW-${phone.slice(-4)}]`);
         const normalizedText = this.normalizeCommand(text);
         logger.info(`${traceId} Orchestrating Inbound: ${normalizedText}`);
 

packages/shared-types/src/organization.ts

@@ -25,6 +25,14 @@ export const FlowConfigSchema = z.object({
 export type FlowConfig = z.infer<typeof FlowConfigSchema>;
 export type Sector = z.infer<typeof SectorSchema>;
 
+export const BrandingDataSchema = z.object({
+    logoUrl: z.string().url().optional(),
+    primaryColor: z.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
+    orgName: z.string().max(100).optional(),
+}).strict();
+
+export type BrandingData = z.infer<typeof BrandingDataSchema>;
+
 export const OrganizationSchema = z.object({
     name: z.string().min(1),
     contactEmail: z.string().email().optional(),
@@ -39,7 +47,7 @@ export const OrganizationSchema = z.object({
     knowledgeBaseUrl: z.string().url().optional().or(z.literal('')),
     systemUserToken: z.string().optional(),
     metaBusinessId: z.string().optional(),
-    brandingData: z.any().optional(),
+    brandingData: BrandingDataSchema.optional(),
     subscriptionPlan: z.enum(['STARTER', 'GROWTH', 'SCALE', 'ENTERPRISE']).optional(),
     openAiApiKey: z.string().optional(),
     googleAiApiKey: z.string().optional(),