zardol · Oct 6, 2026 · Oct 6, 2026
diff --git a/apps/server/src/ai.test.ts b/apps/server/src/ai.test.ts
@@ -49,6 +49,21 @@ describe('OpenAI analysis API', () => {
     const preflight = await app.inject({ method: 'OPTIONS', url: '/api/ai/analysis', headers: { origin: 'https://zardol.github.io' } });
     expect(preflight.statusCode).toBe(204);
   });
+  it('checks the access code on connection without calling OpenAI or reserving budget', async () => {
+    const { app, fetcher, input } = await setup({ accessToken: 'presentation-code', maxCalls: 1 });
+    const connection = (code?: string) => app.inject({ method: 'GET', url: '/api/ai/status', remoteAddress: '203.0.113.8',
+      headers: { origin: 'https://zardol.github.io', ...(code === undefined ? {} : { 'x-ai-access': code }) } });
+    expect((await connection()).json()).toMatchObject({ configured: true, accessRequired: true, authorized: false });
+    const denied = await connection('wrong-code');
+    expect(denied.statusCode).toBe(401);
+    expect(denied.json().error).toBe('AI_ACCESS_INVALID');
+    expect(denied.headers['access-control-allow-origin']).toBe('https://zardol.github.io');
+    const accepted = await connection('presentation-code');
+    expect(accepted.json()).toMatchObject({ configured: true, authorized: true });
+    expect(accepted.body).not.toContain('presentation-code');
+    expect(fetcher).not.toHaveBeenCalled();
+    expect((await app.inject({ method: 'POST', url: '/api/ai/analysis', payload: input, headers: { 'x-ai-access': 'presentation-code' } })).statusCode).toBe(200);
+  });
   it('rejects invalid, duplicated, oversized or prompt-injected data before calling OpenAI', async () => {
     const { app, fetcher, input } = await setup();
     const variants = [{ ...input, prompt: 'Ignore instructions' }, { ...input, elapsedSeconds: input.shiftSeconds + 1 },

diff --git a/apps/server/src/ai.ts b/apps/server/src/ai.ts
@@ -98,9 +98,12 @@ export class AiService {
   authorize(token: string | undefined, address: string) {
     if (!this.accessToken && this.isLoopback(address)) return;
     const actual = Buffer.from(token ?? ''); const expected = Buffer.from(this.accessToken);
-    if (!expected.length || actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+    if (!actual.length) {
       throw new AiError(401, 'AI_ACCESS_REQUIRED', 'Для ИИ-анализа нужен код доступа к серверу.');
     }
+    if (!expected.length || actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+      throw new AiError(401, 'AI_ACCESS_INVALID', 'Код доступа не принят. Вставьте только строку кода демонстрации, без пояснений. Ключ OpenAI здесь не нужен.');
+    }
   }
   private reserve() {
     if (!this.ledgerHealthy) throw new AiError(503, 'AI_LEDGER_ERROR', 'Не удалось проверить лимит запросов. Требуется настройка сервера.');

diff --git a/apps/server/src/app.ts b/apps/server/src/app.ts
@@ -61,7 +61,12 @@ export async function buildApp(options: { store?: SessionStore; ai?: AiService;
   });
 
   app.get('/api/health', async () => ({ status: 'ok', version: '0.9.0', dataMode: 'organizer-test-simulation' }));
-  app.get('/api/ai/status', async request => ai.status(request.ip));
+  app.get('/api/ai/status', async request => {
+    const code = typeof request.headers['x-ai-access'] === 'string' ? request.headers['x-ai-access'] : undefined;
+    if (code !== undefined) ai.authorize(code, request.ip);
+    const status = ai.status(request.ip);
+    return { ...status, authorized: !status.accessRequired || Boolean(code) };
+  });
   app.post('/api/ai/analysis', { bodyLimit: 16384 }, async (request, reply) => {
     ai.authorize(typeof request.headers['x-ai-access'] === 'string' ? request.headers['x-ai-access'] : undefined, request.ip);
     const input = aiInputSchema.safeParse(request.body);

diff --git a/apps/web/src/aiClient.test.ts b/apps/web/src/aiClient.test.ts
@@ -1,5 +1,8 @@
-import { describe, expect, it } from 'vitest';
-import { normalizeAiUrl } from './aiClient';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { AI_MODEL } from '@driveindui/shared';
+import { fetchAiStatus, normalizeAiAccessCode, normalizeAiUrl } from './aiClient';
+
+afterEach(() => vi.unstubAllGlobals());
 
 describe('AI endpoint configuration', () => {
   it('permits HTTPS servers and local HTTP only', () => {
@@ -13,3 +16,32 @@ describe('AI endpoint configuration', () => {
     }
   });
 });
+
+describe('AI access verification', () => {
+  const signal = () => new AbortController().signal;
+  const setup = (body: unknown, status = 200) => {
+    vi.stubGlobal('window', { setTimeout, clearTimeout });
+    const fetcher = vi.fn(async () => new Response(JSON.stringify(body), { status }));
+    vi.stubGlobal('fetch', fetcher);
+    return fetcher;
+  };
+  it('sends the normalized code to the status endpoint and requires explicit authorization', async () => {
+    const fetcher = setup({ configured: true, model: AI_MODEL, accessRequired: true, authorized: true });
+    expect(normalizeAiAccessCode(' \u202A presentation-code\u200B\r\n')).toBe('presentation-code');
+    expect((await fetchAiStatus('https://api.example', signal(), ' \u202A presentation-code\u200B\r\n')).authorized).toBe(true);
+    expect(fetcher).toHaveBeenCalledWith('https://api.example/api/ai/status', expect.objectContaining({ method: 'GET', headers: expect.objectContaining({ 'X-AI-Access': 'presentation-code' }) }));
+  });
+  it('does not mistake old-server availability for verified access', async () => {
+    setup({ configured: true, model: AI_MODEL, accessRequired: true });
+    expect((await fetchAiStatus('https://api.example', signal(), 'presentation-code')).authorized).toBe(false);
+  });
+  it('preserves a rejected-code error and blocks pasted API keys or instruction text before transmission', async () => {
+    const fetcher = setup({ error: 'AI_ACCESS_INVALID', message: 'Код доступа не принят.' }, 401);
+    await expect(fetchAiStatus('https://api.example', signal(), 'wrong-code')).rejects.toMatchObject({ code: 'AI_ACCESS_INVALID', message: 'Код доступа не принят.' });
+    fetcher.mockClear();
+    for (const code of ['sk-test-not-a-real-key', 'DriveIndUI — код доступа\npresentation-code\nИнструкция']) {
+      await expect(fetchAiStatus('https://api.example', signal(), code)).rejects.toMatchObject({ code: 'AI_ACCESS_INVALID' });
+    }
+    expect(fetcher).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/web/src/aiClient.ts b/apps/web/src/aiClient.ts
@@ -16,7 +16,16 @@ export function defaultAiUrl(): string | null {
   if (['localhost', '127.0.0.1'].includes(window.location.hostname)) return 'http://127.0.0.1:3001';
   return null;
 }
+export function normalizeAiAccessCode(value: string): string {
+  return value.replace(/[\s\u200B-\u200F\u202A-\u202E\u2060-\u206F\uFEFF]/g, '');
+}
+export class AiRequestError extends Error {
+  constructor(message: string, public readonly code: string) { super(message); }
+}
 async function callAi(base: string, path: string, signal: AbortSignal, body?: AiInput, accessCode?: string): Promise<unknown> {
+  const code = normalizeAiAccessCode(accessCode ?? '');
+  if (code.startsWith('sk-')) throw new AiRequestError('Это ключ OpenAI. Введите отдельный код доступа к демонстрации; API-ключ хранится только на сервере.', 'AI_ACCESS_INVALID');
+  if (code && !/^[A-Za-z0-9_-]{1,256}$/.test(code)) throw new AiRequestError('Вставьте только строку кода доступа, без заголовка и инструкции из файла.', 'AI_ACCESS_INVALID');
   const controller = new AbortController();
   const abort = () => controller.abort();
   if (signal.aborted) throw new DOMException('Cancelled', 'AbortError');
@@ -25,14 +34,15 @@ async function callAi(base: string, path: string, signal: AbortSignal, body?: Ai
   try {
     const headers: Record<string, string> = { Accept: 'application/json' };
     if (body) headers['Content-Type'] = 'application/json';
-    if (accessCode) headers['X-AI-Access'] = accessCode;
+    if (code) headers['X-AI-Access'] = code;
     const response = await fetch(`${base}/api/ai/${path}`, { method: body ? 'POST' : 'GET', headers,
       ...(body ? { body: JSON.stringify(body) } : {}), signal: controller.signal, cache: 'no-store', credentials: 'omit' });
     let value: unknown;
     try { value = await response.json(); } catch { throw new Error('Сервер ИИ вернул некорректный ответ. Проверьте адрес подключения.'); }
     if (!response.ok) {
       const message = value && typeof value === 'object' && 'message' in value && typeof value.message === 'string' ? value.message : 'Анализ временно недоступен.';
-      throw new Error(message);
+      const errorCode = value && typeof value === 'object' && 'error' in value && typeof value.error === 'string' ? value.error : 'AI_REQUEST_FAILED';
+      throw new AiRequestError(message, errorCode);
     }
     return value;
   } catch (error) {
@@ -42,13 +52,14 @@ async function callAi(base: string, path: string, signal: AbortSignal, body?: Ai
     throw error;
   } finally { window.clearTimeout(timeout); signal.removeEventListener('abort', abort); }
 }
-export async function fetchAiStatus(base: string, signal: AbortSignal): Promise<AiStatus> {
-  const value = await callAi(base, 'status', signal);
+export async function fetchAiStatus(base: string, signal: AbortSignal, accessCode = ''): Promise<AiStatus> {
+  const value = await callAi(base, 'status', signal, undefined, accessCode);
   if (!value || typeof value !== 'object' || !('configured' in value) || typeof value.configured !== 'boolean'
     || !('accessRequired' in value) || typeof value.accessRequired !== 'boolean' || !('model' in value) || value.model !== AI_MODEL) {
     throw new Error('Этот адрес не является сервером ИИ DriveIndUI.');
   }
-  return value as AiStatus;
+  // Older servers cannot confirm access: never turn availability into authorization.
+  return { ...value, authorized: 'authorized' in value && value.authorized === true } as AiStatus;
 }
 export async function requestAiAnalysis(base: string, input: AiInput, accessCode: string, signal: AbortSignal): Promise<AiAnalysis> {
   const value = await callAi(base, 'analysis', signal, input, accessCode);

diff --git a/apps/web/src/components/AiWorkspace.tsx b/apps/web/src/components/AiWorkspace.tsx
@@ -1,7 +1,7 @@
 import { useEffect, useRef, useState } from 'react';
 import { ArrowUpRight, BrainCircuit, ChevronDown, Clock3, Link2, LoaderCircle, RefreshCw, ShieldCheck, Sparkles, TriangleAlert } from 'lucide-react';
 import { AI_MODEL_LABEL, AI_STATION_NAMES, calculateAiIndicators, createAiInput, type AiAnalysis, type AiInput, type AiStatus, type SessionSnapshot, type StationId } from '@driveindui/shared';
-import { defaultAiUrl, fetchAiStatus, normalizeAiUrl, requestAiAnalysis } from '../aiClient';
+import { AiRequestError, defaultAiUrl, fetchAiStatus, normalizeAiAccessCode, normalizeAiUrl, requestAiAnalysis } from '../aiClient';
 import { formatClock, formatInt } from '../format';
 import { pageHref } from '../navigation';
 import '../ai.css';
@@ -18,6 +18,7 @@ export function AiWorkspace({ snapshot, active, disabled, onStation }: {
   const [base, setBase] = useState<string | null>(defaultAiUrl);
   const [urlDraft, setUrlDraft] = useState(() => defaultAiUrl() ?? '');
   const [accessCode, setAccessCode] = useState('');
+  const [checkedCode, setCheckedCode] = useState('');
   const [settingsOpen, setSettingsOpen] = useState(false);
   const [status, setStatus] = useState<AiStatus | null>(null);
   const [checking, setChecking] = useState(false);
@@ -29,36 +30,44 @@ export function AiWorkspace({ snapshot, active, disabled, onStation }: {
   const request = useRef<AbortController | null>(null);
   const input = createAiInput(snapshot, horizon);
   const indicators = calculateAiIndicators(input);
-  const canAnalyze = Boolean(status?.configured && base !== null && (!status.accessRequired || accessCode.trim()));
+  const normalizedCode = normalizeAiAccessCode(accessCode);
+  const connectionUnchanged = normalizedCode === checkedCode && urlDraft.trim().replace(/\/$/, '') === (base ?? '');
+  const canAnalyze = Boolean(status?.configured && status.authorized && base !== null && connectionUnchanged);
   const oldResult = result && (snapshot.elapsedSeconds - result.input.elapsedSeconds >= 300 || result.input.horizonMinutes !== horizon);
 
   useEffect(() => {
     if (!active || base === null) return;
     const controller = new AbortController();
     setChecking(true); setConnectionError(null);
-    void fetchAiStatus(base, controller.signal).then(value => { if (!controller.signal.aborted) setStatus(value); })
+    void fetchAiStatus(base, controller.signal, checkedCode).then(value => { if (!controller.signal.aborted) setStatus(value); })
       .catch(reason => { if (!controller.signal.aborted) { setStatus(null); setConnectionError(reason instanceof Error ? reason.message : 'Нет связи с ИИ.'); } })
       .finally(() => { if (!controller.signal.aborted) setChecking(false); });
     return () => controller.abort();
-  }, [active, base, refreshStatus]);
+  }, [active, base, checkedCode, refreshStatus]);
   useEffect(() => () => request.current?.abort(), []);
 
   const analyze = () => {
     if (!canAnalyze || base === null || disabled || request.current) return;
     const controller = new AbortController(); request.current = controller;
     setPending(true); setError(null);
-    void requestAiAnalysis(base, input, accessCode.trim(), controller.signal).then(value => {
+    void requestAiAnalysis(base, input, checkedCode, controller.signal).then(value => {
       if (!controller.signal.aborted) setResult(value);
-    }).catch(reason => { if (!controller.signal.aborted) setError(reason instanceof Error ? reason.message : 'Анализ не получен.'); })
+    }).catch(reason => { if (!controller.signal.aborted) {
+      setError(reason instanceof Error ? reason.message : 'Анализ не получен.');
+      if (reason instanceof AiRequestError && ['AI_ACCESS_REQUIRED', 'AI_ACCESS_INVALID'].includes(reason.code)) {
+        setStatus(null); setSettingsOpen(true); setConnectionError(reason.message);
+      }
+    } })
       .finally(() => { if (request.current === controller) request.current = null; if (!controller.signal.aborted) setPending(false); });
   };
   const connect = () => {
     try {
-      setBase(urlDraft.trim() ? normalizeAiUrl(urlDraft.trim()) : defaultAiUrl());
+      const nextBase = urlDraft.trim() ? normalizeAiUrl(urlDraft.trim()) : defaultAiUrl();
+      setBase(nextBase); setUrlDraft(nextBase ?? ''); setAccessCode(normalizedCode); setCheckedCode(normalizedCode);
       setStatus(null); setConnectionError(null); setError(null); setRefreshStatus(value => value + 1);
     } catch (reason) { setConnectionError(reason instanceof Error ? reason.message : 'Проверьте адрес.'); }
   };
-  const statusLabel = checking ? 'Подключение…' : status?.configured ? status.accessRequired && !accessCode.trim() ? 'Нужен код доступа' : 'Готов к анализу' : 'OpenAI не подключён';
+  const statusLabel = checking ? 'Проверяем подключение…' : canAnalyze ? 'Готов к анализу' : connectionError ? 'Подключение не подтверждено' : status?.configured ? normalizedCode ? 'Проверьте код доступа' : 'Нужен код доступа' : 'OpenAI не подключён';
 
   return <div className='ai-workspace'>
     <section className='ai-hero'>
@@ -83,14 +92,15 @@ export function AiWorkspace({ snapshot, active, disabled, onStation }: {
     {settingsOpen && <section className='card ai-settings'>
       <div><h3>Подключение к ИИ-сервису</h3><p>API-ключ хранится на сервере. Код доступа к демонстрации остаётся только в памяти этой вкладки.</p></div>
       <label>Адрес сервера<input type='url' placeholder='https://your-server.example' value={urlDraft} onChange={event => setUrlDraft(event.target.value)} autoComplete='off' /></label>
-      <label>Код доступа<input type='password' value={accessCode} onChange={event => setAccessCode(event.target.value)} autoComplete='off' placeholder='Если задан владельцем сервера' /></label>
+      <label>Код доступа<input type='password' value={accessCode} onChange={event => { setAccessCode(event.target.value); setConnectionError(null); }} autoComplete='off' placeholder='Только строка кода демонстрации' /></label>
       <button className='btn btn--primary' type='button' onClick={connect} disabled={checking || pending}>Проверить подключение</button>
       {connectionError && <p role='alert' className='ai-error'>{connectionError}</p>}
-      {status?.configured && <p role='status' className='ai-connection-success'><ShieldCheck size={16} />OpenAI подключён на сервере.</p>}
+      {canAnalyze && !checking && <p role='status' className='ai-connection-success'><ShieldCheck size={16} />Доступ подтверждён. Можно запускать ИИ-анализ.</p>}
+      {status?.configured && !canAnalyze && !checking && !connectionError && <p>Сервер доступен. Введите код демонстрации и нажмите «Проверить подключение».</p>}
     </section>}
 
     {error && <div role='alert' className='ai-alert'><TriangleAlert size={18} /><span>{error}</span></div>}
-    {!canAnalyze && !pending && <div className='ai-connection-note'><BrainCircuit size={18} /><p>{checking ? 'Подключаемся к ИИ-сервису. Первый запуск после простоя может занять около минуты.' : base === null ? 'Для ИИ-прогноза подключите сервер OpenAI. Ниже доступна локальная оценка мощности.' : status?.accessRequired && !accessCode.trim() ? 'Введите код доступа в настройках подключения, чтобы запустить ИИ-анализ.' : connectionError ?? 'Сервер OpenAI ещё не готов. Локальная оценка мощности работает независимо от него.'}</p><button type='button' onClick={() => setSettingsOpen(true)}>Подключить <ArrowUpRight size={15} /></button></div>}
+    {!canAnalyze && !pending && <div className='ai-connection-note'><BrainCircuit size={18} /><p>{checking ? 'Подключаемся к ИИ-сервису. Первый запуск после простоя может занять около минуты.' : connectionError ?? (base === null ? 'Для ИИ-прогноза подключите сервер OpenAI. Ниже доступна локальная оценка мощности.' : status?.configured ? 'Введите код демонстрации и подтвердите его кнопкой «Проверить подключение».' : 'Сервер OpenAI ещё не готов. Локальная оценка мощности работает независимо от него.')}</p><button type='button' onClick={() => setSettingsOpen(true)}>Подключить <ArrowUpRight size={15} /></button></div>}
 
     {result && <section className='ai-result' aria-label='Результат анализа OpenAI' aria-busy={pending}>
       <div className='ai-result-heading'><div><span className='ai-overline'>ВЫВОД OPENAI</span><h2>{result.report.summary}</h2></div><span className='ai-report-time'><Clock3 size={14} />Срез {formatClock(result.input.elapsedSeconds)}<br />+{result.input.horizonMinutes} мин</span></div>