From 7ee0c3050013bf98160ced4a80c74f5622a00690 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sat, 10 Oct 2026 20:03:19 +0100
Subject: [PATCH] Fix authenticated resource usage tracking

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 CHANGELOG.md                                    | 12 ++++++++++++
 src/Yavsc.Api/Program.cs                        |  2 +-
 src/Yavsc.Blogs/Program.cs                      |  2 +-
 .../ResourceUsageApiControllerTests.cs          | 17 +++++++++++++++++
 4 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e1a3be3a2..36ad580b9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,18 @@
 # Changelog
 
+## [1.0.8-rc25] - unstable
 
+### Added
+
+### Changed
+
+### Fixed
+
+* [Yavsc.Api][Yavsc.Blogs] Les appels API et la bande passante sont
+  désormais enregistrés côté serveur pour les requêtes authentifiées :
+  le middleware de télémétrie est maintenant branché après
+  l'authentification, ce qui permet de comptabiliser `ApiCalls` et
+  `BandwidthMb` au lieu d'enregistrer des zéros.
 
 ## [1.0.8-rc24] - unstable
 
diff --git a/src/Yavsc.Api/Program.cs b/src/Yavsc.Api/Program.cs
index 3545774ae..be9601d49 100644
--- a/src/Yavsc.Api/Program.cs
+++ b/src/Yavsc.Api/Program.cs
@@ -134,11 +134,11 @@ internal class Program
             if (app.Environment.IsDevelopment())
                 app.UseDeveloperExceptionPage();
 
-            app.UseMiddleware<ResourceUsageTelemetryMiddleware>();
             app
                 .UseRouting()
                 .UseAuthentication()
                 .UseAuthorization()
+                .UseMiddleware<ResourceUsageTelemetryMiddleware>()
                 .UseCors("default");
             app.MapIdentityApi<ApplicationUser>().RequireAuthorization("ApiScope");
             app.MapDefaultControllerRoute();
diff --git a/src/Yavsc.Blogs/Program.cs b/src/Yavsc.Blogs/Program.cs
index 21a26e637..6d69c6785 100644
--- a/src/Yavsc.Blogs/Program.cs
+++ b/src/Yavsc.Blogs/Program.cs
@@ -98,11 +98,11 @@ internal class Program
         {
             if (app.Environment.IsDevelopment())
                 app.UseDeveloperExceptionPage();
-            app.UseMiddleware<ResourceUsageTelemetryMiddleware>();
             app
                 .UseRouting()
                 .UseAuthentication()
                 .UseAuthorization()
+                .UseMiddleware<ResourceUsageTelemetryMiddleware>()
                 .UseCors("default")
                 ;
             app.Services.GetRequiredService<ILoggerFactory>().CreateLogger("Program")
diff --git a/src/test/Yavsc.Api.Tests/ResourceUsageApiControllerTests.cs b/src/test/Yavsc.Api.Tests/ResourceUsageApiControllerTests.cs
index 8b8347aae..33b3f392a 100644
--- a/src/test/Yavsc.Api.Tests/ResourceUsageApiControllerTests.cs
+++ b/src/test/Yavsc.Api.Tests/ResourceUsageApiControllerTests.cs
@@ -98,6 +98,23 @@ public sealed class ResourceUsageApiControllerTests : IClassFixture<ApiWebServer
         Assert.True(record.BandwidthMb >= 3.5m);
     }
 
+    [Fact]
+    public async Task GetCurrentUserUsage_records_telemetry_values_from_authenticated_requests()
+    {
+        using var http = NewClient(_fixture, "telemetry-user");
+
+        var response = await http.GetAsync("/api/v1/resource-usage/me", TestContext.Current.CancellationToken);
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+
+        using var scope = _fixture.Services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<Yavsc.Models.ApplicationDbContext>();
+        var record = await db.ResourceUsageRecords
+            .SingleAsync(r => r.UserId == "telemetry-user");
+
+        Assert.True(record.ApiCalls >= 1m);
+        Assert.True(record.BandwidthMb > 0m);
+    }
+
     [Fact]
     public async Task GetAdminOverview_returns_latest_usage_snapshot_for_each_user()
     {