feat: access-usage last-used column and filter; get_access_audit in System MCP tool catalogue

dist/assets/i18n/en.json

@@ -128,6 +128,35 @@
   "noFilterResults": "No results match your filter.",
   "clearFilter": "Clear filter",
   "retry": "Retry",
+  "accessUsage": {
+    "lastUsed": "Last used",
+    "lastActive": "Last active",
+    "never": "Never",
+    "unreferenced": "Unreferenced",
+    "disabledButAttempted": "Inactive, but clients are still sending it",
+    "filter": {
+      "label": "Not used in",
+      "any": "Any",
+      "days30": "30 days",
+      "days90": "90 days",
+      "days180": "180 days",
+      "never": "Never used"
+    },
+    "tooltip": {
+      "lastUsed": "Last used {{at}}",
+      "lastUsedOn": "Last used on {{service}} (HTTP {{status}})",
+      "lastUsedOnService": "Last used on {{service}}",
+      "neverUsed": "No use recorded",
+      "neverUsedSince": "No use recorded since {{since}}",
+      "lastDenied": "Last denied {{at}}",
+      "disabledButAttempted": "Inactive, but clients are still sending it",
+      "stale": "Stale: not used in the last {{days}} days",
+      "staleNoWindow": "Stale: not used recently",
+      "lastLogin": "Last login {{at}}",
+      "requests30d": "Requests in the last 30 days: {{count}}",
+      "unreferenced": "No API key, user, or auth provider references this role"
+    }
+  },
   "skeleton": {
     "loading": "Loading content"
   },

src/app/adf-admins/df-manage-admins/df-manage-admins-table.component.ts

@@ -39,6 +39,7 @@ export class DfManageAdminsTableComponent extends DfManageTableComponent<UserRow
     dialog: MatDialog
   ) {
     super(router, activatedRoute, liveAnnouncer, translateService, dialog);
+    this.enableAccessUsage('user', { header: 'accessUsage.lastActive' });
   }
   override columns = USER_COLUMNS;
 

src/app/adf-apps/df-manage-apps/df-manage-apps-table.component.html

@@ -17,6 +17,23 @@
   </button>
   <ng-content select="[topActions]"></ng-content>
   <div class="spacer"></div>
+  <ng-container *ngIf="accessUsage as usage">
+    <mat-form-field
+      *ngIf="usage.available"
+      class="df-usage-filter"
+      data-testid="access-usage-filter"
+      appearance="outline"
+      subscriptSizing="dynamic">
+      <mat-label>{{ 'accessUsage.filter.label' | transloco }}</mat-label>
+      <mat-select [formControl]="usage.filter">
+        <mat-option
+          *ngFor="let option of usage.filterOptions"
+          [value]="option.value">
+          {{ option.label | transloco }}
+        </mat-option>
+      </mat-select>
+    </mat-form-field>
+  </ng-container>
   <mat-form-field
     *ngIf="allowFilter"
     class="search-input"
@@ -117,10 +134,18 @@
                 column.columnDef !== 'active' &&
                 column.columnDef !== 'tokens' &&
                 column.columnDef !== 'spend' &&
-                column.columnDef !== 'role'
+                column.columnDef !== 'role' &&
+                column.columnDef !== 'lastUsed'
               ">
               {{ column?.cell(row) }}
             </ng-container>
+            <df-access-usage-cell
+              *ngIf="column.columnDef === 'lastUsed'"
+              [usage]="accessUsage?.get(row.id)"
+              [staleDays]="accessUsage?.staleDays ?? null"
+              [trackingStartedAt]="
+                accessUsage?.trackingStartedAt ?? null
+              "></df-access-usage-cell>
           </td>
         </ng-container>
         <ng-container
@@ -246,7 +271,11 @@
         <td class="mat-cell" [attr.colspan]="columns.length">
           <ng-container
             *ngIf="tableState !== 'loading' && tableState !== 'error'">
-            <ng-container *ngIf="currentFilter.value; else noFilterActive">
+            <ng-container
+              *ngIf="
+                currentFilter.value || accessUsage?.filterActive;
+                else noFilterActive
+              ">
               {{ 'noFilterResults' | transloco }}
               <button
                 mat-button

src/app/adf-apps/df-manage-apps/df-manage-apps-table.component.ts

@@ -170,6 +170,10 @@ export class DfManageAppsTableComponent extends DfManageTableComponent<VirtualKe
     }
 
     this.loadMetrics();
+    this.enableAccessUsage('app', {
+      header: 'accessUsage.lastUsed',
+      before: 'tokens',
+    });
   }
 
   override columns = [

src/app/adf-apps/df-manage-apps/df-manage-apps-table.spec.ts

@@ -7,6 +7,12 @@ import { TranslocoHttpLoader } from 'src/transloco-loader';
 import { of } from 'rxjs';
 import { ActivatedRoute } from '@angular/router';
 import { NoopAnimationsModule } from '@angular/platform-browser/animations';
+import {
+  DfAccessUsageService,
+  unavailableAccessUsage,
+} from 'src/app/shared/services/df-access-usage.service';
+import { AccessUsageResult } from 'src/app/shared/types/access-usage';
+import { DfSnackbarService } from 'src/app/shared/services/df-snackbar.service';
 
 describe('DfManageAppsTableComponent', () => {
   let component: DfManageAppsTableComponent;
@@ -45,3 +51,60 @@ describe('DfManageAppsTableComponent', () => {
     expect(component).toBeTruthy();
   });
 });
+
+describe('DfManageAppsTableComponent access usage column', () => {
+  const setup = (result: AccessUsageResult) => {
+    TestBed.configureTestingModule({
+      imports: [
+        DfManageAppsTableComponent,
+        HttpClientTestingModule,
+        NoopAnimationsModule,
+      ],
+      providers: [
+        provideTransloco({
+          config: { defaultLang: 'en', availableLangs: ['en'] },
+          loader: TranslocoHttpLoader,
+        }),
+        TranslocoService,
+        { provide: ActivatedRoute, useValue: { data: of({}) } },
+        {
+          provide: DfAccessUsageService,
+          useValue: { load: jest.fn(() => of(result)) },
+        },
+        {
+          provide: DfSnackbarService,
+          useValue: { setSnackbarLastEle: jest.fn() },
+        },
+      ],
+    });
+    const fixture = TestBed.createComponent(DfManageAppsTableComponent);
+    fixture.detectChanges();
+    return fixture;
+  };
+
+  it('keeps the existing columns when access usage is unavailable', () => {
+    const fixture = setup(unavailableAccessUsage());
+    expect(fixture.componentInstance.displayedColumns).toEqual([
+      'active',
+      'name',
+      'role',
+      'apiKey',
+      'tokens',
+      'spend',
+      'meter',
+      'actions',
+    ]);
+    expect(
+      fixture.nativeElement.querySelector('[data-testid="access-usage-filter"]')
+    ).toBeNull();
+  });
+
+  it('adds "Last used" ahead of the metering columns when available', () => {
+    const fixture = setup({ available: true, rows: new Map(), meta: null });
+    const columns = fixture.componentInstance.displayedColumns;
+    expect(columns.indexOf('lastUsed')).toBe(columns.indexOf('tokens') - 1);
+    expect(
+      fixture.nativeElement.querySelector('[data-testid="access-usage-filter"]')
+    ).not.toBeNull();
+  });
+});

src/app/adf-roles/df-manage-roles/df-manage-roles-table.component.ts

@@ -96,6 +96,7 @@ export class DfManageRolesTableComponent extends DfManageTableComponent<RoleRow>
         duplicateAction
       );
     }
+    this.enableAccessUsage('role', { header: 'accessUsage.lastUsed' });
   }
 
   filterQuery = getFilterQuery('roles');

src/app/adf-services/df-service-details/system-mcp-tools.spec.ts

@@ -22,12 +22,13 @@ const EXPECTED_TOOL_NAMES = [
   'create_app',
   'get_app',
   'list_admins',
+  'get_access_audit',
   'call_system_api',
 ];
 
 describe('SYSTEM_MCP_TOOLS catalogue', () => {
-  it('contains exactly the 17 tools exposed by df-system-mcp-server', () => {
-    expect(SYSTEM_MCP_TOOLS.length).toBe(17);
+  it('contains exactly the 18 tools exposed by df-system-mcp-server', () => {
+    expect(SYSTEM_MCP_TOOLS.length).toBe(18);
     expect(SYSTEM_MCP_TOOLS.map(t => t.name)).toEqual(EXPECTED_TOOL_NAMES);
   });
 

src/app/adf-services/df-service-details/system-mcp-tools.ts

@@ -101,6 +101,13 @@ export const SYSTEM_MCP_TOOLS: ReadonlyArray<SystemMcpTool> = [
     title: 'List Admins',
     description: 'List the administrator accounts on this instance.',
   },
+  // Access audit (read-only)
+  {
+    name: 'get_access_audit',
+    title: 'Get Access Audit',
+    description:
+      'Report last-used / never-used / stale API keys, roles and users from system/access_usage.',
+  },
   // Generic
   {
     name: 'call_system_api',

src/app/adf-users/df-manage-users/df-manage-users-table.component.ts

@@ -38,6 +38,7 @@ export class DfManageUsersTableComponent extends DfManageTableComponent<UserRow>
     dialog: MatDialog
   ) {
     super(router, activatedRoute, liveAnnouncer, translateService, dialog);
+    this.enableAccessUsage('user', { header: 'accessUsage.lastActive' });
   }
   override columns = USER_COLUMNS;
 

src/app/shared/components/df-access-usage-cell/df-access-usage-cell.component.html

@@ -0,0 +1,26 @@
+<span
+  class="df-usage"
+  data-testid="access-usage-cell"
+  [class.df-usage--muted]="view.muted"
+  [matTooltip]="tooltip"
+  matTooltipClass="df-usage-tooltip">
+  <ng-container *ngIf="view.warning">
+    <fa-icon
+      class="df-usage__warning"
+      data-testid="access-usage-warning"
+      aria-hidden="true"
+      [icon]="faTriangleExclamation"></fa-icon>
+    <span class="cdk-visually-hidden">{{
+      'accessUsage.disabledButAttempted' | transloco
+    }}</span>
+  </ng-container>
+  <span class="df-usage__label">{{
+    view.relative ?? ('accessUsage.never' | transloco)
+  }}</span>
+</span>
+<df-badge
+  *ngIf="view.unreferenced"
+  data-testid="access-usage-unreferenced"
+  variant="warning"
+  [dot]="false"
+  [label]="'accessUsage.unreferenced' | transloco"></df-badge>

src/app/shared/components/df-access-usage-cell/df-access-usage-cell.component.scss

@@ -0,0 +1,23 @@
+// Token-driven so light, dark, and phosphor all stay legible.
+:host {
+  display: inline-flex;
+  align-items: center;
+  gap: var(--df-space-2);
+  white-space: nowrap;
+}
+
+.df-usage {
+  display: inline-flex;
+  align-items: center;
+  gap: var(--df-space-2);
+}
+
+// Never used or stale: quiet, not alarming.
+.df-usage--muted {
+  color: var(--df-text-faint);
+}
+
+// Inactive credential still being sent.
+.df-usage__warning {
+  color: var(--df-warning);
+}