Remove platform key support and fix API key hierarchy documentation

Author: nickprotop

cloud/src/LrmCloud.Api/Services/Translation/ApiKeyHierarchyService.cs

@@ -7,13 +7,12 @@
 namespace LrmCloud.Api.Services.Translation;
 
 /// <summary>
-/// Resolves API keys and configurations using the hierarchy: Project → User → Organization → Platform.
+/// Resolves API keys and configurations using the hierarchy: Project → User → Organization.
 /// </summary>
 public class ApiKeyHierarchyService : IApiKeyHierarchyService
 {
     private readonly AppDbContext _db;
     private readonly IApiKeyEncryptionService _encryption;
-    private readonly IConfiguration _configuration;
     private static readonly JsonSerializerOptions JsonOptions = new()
     {
         PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
@@ -22,12 +21,10 @@ public class ApiKeyHierarchyService : IApiKeyHierarchyService
 
     public ApiKeyHierarchyService(
         AppDbContext db,
-        IApiKeyEncryptionService encryption,
-        IConfiguration configuration)
+        IApiKeyEncryptionService encryption)
     {
         _db = db;
         _encryption = encryption;
-        _configuration = configuration;
     }
 
     public async Task<(string? ApiKey, string? Source)> ResolveApiKeyAsync(
@@ -74,13 +71,6 @@ public ApiKeyHierarchyService(
             }
         }
 
-        // 4. Check platform-level key (from configuration)
-        var platformKey = GetPlatformApiKey(provider);
-        if (!string.IsNullOrEmpty(platformKey))
-        {
-            return (platformKey, "platform");
-        }
-
         return (null, null);
     }
 
@@ -96,18 +86,8 @@ public async Task<ResolvedProviderConfigDto> ResolveProviderConfigAsync(
             Provider = provider
         };
 
-        // Start with platform config
         var mergedConfig = new Dictionary<string, object?>();
         var configSources = new Dictionary<string, string>();
-        var platformConfig = GetPlatformConfig(provider);
-        if (platformConfig != null)
-        {
-            foreach (var kvp in platformConfig)
-            {
-                mergedConfig[kvp.Key] = kvp.Value;
-                configSources[kvp.Key] = "platform";
-            }
-        }
 
         // Merge organization config
         if (organizationId.HasValue)
@@ -205,17 +185,6 @@ public async Task<ResolvedProviderConfigDto> ResolveProviderConfigAsync(
             }
         }
 
-        // Check platform API key if no other source found
-        if (result.ApiKeySource == null)
-        {
-            var platformKey = GetPlatformApiKey(provider);
-            if (!string.IsNullOrEmpty(platformKey))
-            {
-                result.ApiKeySource = "platform";
-                result.MaskedApiKey = _encryption.Mask(platformKey);
-            }
-        }
-
         // Determine if provider is configured
         var requiresApiKey = ProviderConfigHelper.RequiresApiKey(provider);
         result.IsConfigured = !requiresApiKey || result.ApiKeySource != null;
@@ -510,40 +479,6 @@ private ProviderConfigDto MapToDto(string provider, string level, string? encryp
         };
     }
 
-    private string? GetPlatformApiKey(string provider)
-    {
-        // Check configuration for platform-level keys
-        var configKey = $"TranslationProviders:{provider}:ApiKey";
-        var apiKey = _configuration[configKey];
-
-        if (string.IsNullOrEmpty(apiKey))
-        {
-            // Also check environment variables with standard naming
-            var envVarName = $"LRM_{provider.ToUpperInvariant()}_API_KEY";
-            apiKey = Environment.GetEnvironmentVariable(envVarName);
-        }
-
-        return apiKey;
-    }
-
-    private Dictionary<string, object?>? GetPlatformConfig(string provider)
-    {
-        // Check configuration for platform-level provider config
-        var section = _configuration.GetSection($"TranslationProviders:{provider}");
-        if (!section.Exists()) return null;
-
-        var config = new Dictionary<string, object?>();
-        foreach (var child in section.GetChildren())
-        {
-            if (child.Key != "ApiKey") // Don't include API key in config
-            {
-                config[child.Key] = child.Value;
-            }
-        }
-
-        return config.Count > 0 ? config : null;
-    }
-
     private static string GetProviderDisplayName(string provider)
     {
         return provider.ToLowerInvariant() switch

cloud/src/LrmCloud.Api/Services/Translation/CloudTranslationService.cs

@@ -60,7 +60,7 @@ public async Task<List<TranslationProviderDto>> GetAvailableProvidersAsync(
                 Description = available
                     ? $"LRM managed translation ({remaining:N0} chars remaining)"
                     : reason ?? "LRM translation unavailable",
-                ApiKeySource = "platform"
+                ApiKeySource = "lrm" // LRM managed provider, not user BYOK
             });
         }
 
@@ -332,7 +332,7 @@ await LogUsageEventAsync(
                     response.CharactersTranslated,
                     providerName,
                     isLrmProvider,
-                    isLrmProvider ? "platform" : keySource);
+                    isLrmProvider ? "lrm" : keySource);
 
                 // Track per-provider usage for analytics (against acting user for audit trail)
                 await TrackProviderUsageAsync(userId, request.Provider ?? "auto", response.CharactersTranslated, response.TranslatedCount);

cloud/src/LrmCloud.Api/Services/Translation/ICloudTranslationService.cs

@@ -5,7 +5,7 @@ namespace LrmCloud.Api.Services.Translation;
 /// <summary>
 /// Service for cloud-based translation operations.
 /// Wraps LocalizationManager.Core translation providers with cloud-specific features:
-/// - API key hierarchy (project → user → organization → platform)
+/// - API key hierarchy (project → user → organization)
 /// - Usage tracking and limits
 /// - Caching
 /// </summary>

cloud/src/LrmCloud.Api/Services/Translation/LrmTranslationProvider.cs

@@ -202,9 +202,10 @@ public async Task<LrmTranslationResult> TranslateAsync(
                 result.FromCache = response.FromCache;
 
                 // Note: Usage tracking is handled by CloudTranslationService, not here
-                _logger.LogDebug(
-                    "LRM translation via {Backend}: {Chars} chars (billable to user {BillableUserId})",
-                    backend, sourceText.Length, billableUserId);
+                _logger.LogInformation(
+                    "LRM translation via {Backend}: {SourceLang} → {TargetLang}, {Chars} chars{FromCache}",
+                    backend, sourceLanguage, targetLanguage, sourceText.Length,
+                    response.FromCache ? " (cached)" : "");
 
                 return result; // Success - return immediately
             }
@@ -314,9 +315,8 @@ private List<string> GetBackendsForFailover()
                 }
             };
 
-            // Add any platform-level API keys here if we have them
-            // For now, we rely on free providers or self-hosted ones
-            ApplyPlatformConfig(config, backend);
+            // Apply backend-specific configuration from config.json
+            ApplyBackendConfig(config, backend);
 
             return TranslationProviderFactory.Create(backend, config);
         }
@@ -327,7 +327,7 @@ private List<string> GetBackendsForFailover()
         }
     }
 
-    private void ApplyPlatformConfig(ConfigurationModel config, string backend)
+    private void ApplyBackendConfig(ConfigurationModel config, string backend)
     {
         config.Translation ??= new TranslationConfiguration();
         config.Translation.ApiKeys ??= new TranslationApiKeys();

cloud/src/LrmCloud.Shared/DTOs/Translation/ProviderConfigDtos.cs

@@ -10,7 +10,7 @@ public class ProviderConfigBase
 {
     /// <summary>
     /// Optional rate limit (requests per minute).
-    /// When null, the platform default is used.
+    /// When null, the provider default is used.
     /// </summary>
     public int? RateLimitPerMinute { get; set; }
 }
@@ -176,7 +176,7 @@ public class ProviderConfigDto
     public string Provider { get; set; } = string.Empty;
 
     /// <summary>
-    /// Configuration level: "platform", "organization", "user", "project".
+    /// Configuration level: "organization", "user", "project".
     /// </summary>
     public string Level { get; set; } = string.Empty;
 
@@ -239,7 +239,7 @@ public class ResolvedProviderConfigDto
     public bool IsConfigured { get; set; }
 
     /// <summary>
-    /// Where the API key comes from: "platform", "organization", "user", "project".
+    /// Where the API key comes from: "organization", "user", "project", or "lrm" for the managed provider.
     /// Null if no API key is configured.
     /// </summary>
     public string? ApiKeySource { get; set; }

cloud/src/LrmCloud.Shared/DTOs/Translation/TranslationProviderDto.cs

@@ -46,7 +46,7 @@ public class TranslationProviderDto
     public string? Description { get; set; }
 
     /// <summary>
-    /// Source of the API key (if configured): "project", "user", "organization", "platform".
+    /// Source of the API key (if configured): "project", "user", "organization", or "lrm" for the managed provider.
     /// </summary>
     public string? ApiKeySource { get; set; }
 }

cloud/src/LrmCloud.Shared/Entities/UsageEvent.cs

@@ -71,7 +71,7 @@ public class UsageEvent
     public bool IsLrmProvider { get; set; }
 
     /// <summary>
-    /// Source of the API key: "user", "organization", "project", "platform".
+    /// Source of the API key: "user", "organization", "project", or "lrm" for the managed provider.
     /// </summary>
     [Required]
     [MaxLength(20)]

cloud/src/LrmCloud.Web/Components/EditProjectDialog.razor

@@ -368,7 +368,7 @@
             Remove the <strong>@_selectedProvider?.DisplayName</strong> API key override for this project?
         </MudText>
         <MudText Color="Color.Secondary" Class="mt-2">
-            The project will fall back to organization, user, or platform-level keys.
+            The project will fall back to organization or user-level keys.
         </MudText>
     </DialogContent>
     <DialogActions>
@@ -706,7 +706,7 @@
         "project" => "Project key",
         "organization" => "Organization key",
         "user" => "User key",
-        "platform" => "Platform key",
+        "lrm" => "LRM managed",
         _ => "Unknown"
     };
 }

cloud/src/LrmCloud.Web/Pages/Organizations/ApiKeys.razor

@@ -41,12 +41,12 @@
         <MudPaper Class="pa-4 mb-4">
             <MudText Typo="Typo.h6" Class="mb-2">Key Hierarchy</MudText>
             <MudText Typo="Typo.body2" Color="Color.Secondary" Class="mb-4">
-                API keys are resolved in order: Project → User → Organization → Platform.
-                Organization keys are shared across all projects in this organization.
+                For organization projects, API keys are resolved in order: Project → Organization.
+                User's personal API keys are not used for organization projects to ensure consistent billing.
             </MudText>
 
             <MudAlert Severity="Severity.Info" Dense="true" Class="mb-0">
-                Keys configured here will be used by all projects in this organization unless overridden at the project or user level.
+                Keys configured here will be used by all projects in this organization unless overridden at the project level.
             </MudAlert>
         </MudPaper>
 
@@ -234,7 +234,7 @@
             Are you sure you want to remove the <strong>@_selectedProvider?.DisplayName</strong> API key?
         </MudText>
         <MudText Color="Color.Secondary" Class="mt-2">
-            Projects in this organization will fall back to user or platform-level keys.
+            Projects in this organization will fall back to project-level overrides if configured.
         </MudText>
     </DialogContent>
     <DialogActions>

cloud/src/LrmCloud.Web/Pages/Projects/Settings.razor

@@ -440,7 +440,7 @@ else
             Remove the <strong>@_selectedProvider?.DisplayName</strong> API key override for this project?
         </MudText>
         <MudText Color="Color.Secondary" Class="mt-2">
-            The project will fall back to organization, user, or platform-level keys.
+            The project will fall back to organization or user-level keys.
         </MudText>
     </DialogContent>
     <DialogActions>
@@ -806,7 +806,7 @@ else
         "project" => "Project key",
         "organization" => "Organization key",
         "user" => "User key",
-        "platform" => "Platform key",
+        "lrm" => "LRM managed",
         _ => "Unknown"
     };
 }