fix: secure assistant generation telemetry

apps/nextjs/src/app/api/assistant/chat/route.ts

@@ -8,7 +8,11 @@ import { parse, stringify } from "superjson";
 import { z } from "zod/v4";
 
 import { createTRPCContext, mcpRouter } from "@homarr/api/mcp";
-import { getAssistantContextEntitiesAsync, getSelectedModelDetailsAsync } from "@homarr/api/assistant";
+import {
+  createAssistantGenerationAccessToken,
+  getAssistantContextEntitiesAsync,
+  getSelectedModelDetailsAsync,
+} from "@homarr/api/assistant";
 import { auth } from "@homarr/auth/next";
 import { env } from "@homarr/common/env";
 import { decryptSecret } from "@homarr/common/server";
@@ -538,6 +542,15 @@ export async function POST(request: Request) {
             ? { upstreamCost: asFiniteNumber(telemetry?.upstreamCost) }
             : {}),
           ...(generationId ? { generationId } : {}),
+          ...(generationId
+            ? {
+                generationAccessToken: createAssistantGenerationAccessToken({
+                  userId: session.user.id,
+                  threadId: thread.id,
+                  generationId,
+                }),
+              }
+            : {}),
           ...(typeof telemetry?.routedProvider === "string" ? { routedProvider: telemetry.routedProvider } : {}),
           ...(asFiniteNumber(telemetry?.fallbackCount) !== undefined
             ? { fallbackCount: asFiniteNumber(telemetry?.fallbackCount) }

apps/nextjs/src/components/assistant/assistant-message-metadata.ts

@@ -30,6 +30,7 @@ export type AssistantRequestStep = {
   upstreamCost?: number;
   cacheDiscount?: number;
   generationId?: string;
+  generationAccessToken?: string;
   routedProvider?: string;
   finishReason?: string;
   nativeFinishReason?: string;
@@ -189,6 +190,9 @@ export const getAssistantTelemetry = (metadata: unknown): AssistantRequestTeleme
               ? { cacheDiscount: getFiniteNonNegativeNumber(candidate.cacheDiscount) }
               : {}),
             ...(typeof candidate.generationId === "string" ? { generationId: candidate.generationId } : {}),
+            ...(typeof candidate.generationAccessToken === "string"
+              ? { generationAccessToken: candidate.generationAccessToken }
+              : {}),
             ...(typeof candidate.routedProvider === "string" ? { routedProvider: candidate.routedProvider } : {}),
             ...(typeof candidate.finishReason === "string" ? { finishReason: candidate.finishReason } : {}),
             ...(typeof candidate.nativeFinishReason === "string"

apps/nextjs/src/components/assistant/assistant-panel.tsx

@@ -739,6 +739,7 @@ const RequestTelemetry = () => {
     : `${t("usage.contextWindow")}: ${t("usage.notReported")}`;
   const displayedThroughput = telemetry.providerOutputTokensPerSecond ?? telemetry.outputTokensPerSecond;
   const hasProviderMetrics =
+    telemetry.provider === "openrouter" ||
     generationQuery.isFetching ||
     telemetry.providerOutputTokensPerSecond !== undefined ||
     telemetry.generationTimeMs !== undefined ||
@@ -991,6 +992,11 @@ const RequestTelemetry = () => {
                       </Text>
                     </Group>
                   )}
+                  {!generationQuery.isFetching && generationQuery.data?.complete === false && (
+                    <Text size="xs" c="dimmed">
+                      {t("usage.providerDetailsPending")}
+                    </Text>
+                  )}
                   <Box className={classes.usageGrid}>
                     <div>
                       <Text size="xs" c="dimmed">