1 files changed, 26 insertions, 0 deletions
diff --git a/internal/adminapi/usage_test.go b/internal/adminapi/usage_test.go
new file mode 100644
index 0000000..e6192d6
--- /dev/null
+++ b/internal/adminapi/usage_test.go
@@ -0,0 +1,26 @@
+package adminapi
+
+import (
+	"testing"
+
+	"aigw/internal/controlplane"
+)
+
+func TestTenantUsageRedactionRemovesRouteInternals(t *testing.T) {
+	page := controlplane.UsagePage{Data: []controlplane.UsageRecord{{
+		ProviderID: "provider-uuid", ProviderName: "Internal Provider", UpstreamModel: "vendor/model-v2",
+	}}}
+	redactTenantUsagePage(&page)
+	if page.Data[0].ProviderID != "" || page.Data[0].ProviderName != "" || page.Data[0].UpstreamModel != "" {
+		t.Fatalf("tenant usage leaked route internals: %+v", page.Data[0])
+	}
+
+	analytics := controlplane.UsageAnalytics{
+		Models:    []controlplane.UsageModelAnalytics{{PublicModel: "public/model", ProviderCount: 3}},
+		Providers: []controlplane.UsageProviderAnalytics{{ProviderID: "provider-uuid", ProviderName: "Internal Provider"}},
+	}
+	redactTenantUsageAnalytics(&analytics)
+	if len(analytics.Providers) != 0 || analytics.Models[0].ProviderCount != 0 {
+		t.Fatalf("tenant analytics leaked provider topology: %+v", analytics)
+	}
+}