Count the whole ledger, and only the sessions that are still live

Three admin numbers were reporting something other than what their
labels claimed.

The Event Ledger's stat row was computed from the page of entries the
query had just capped, so "Total" was always the row limit and the
status cards only described the newest page. It now counts with a GROUP
BY over every row matching the same filter, and the panel footer says
how much of the ledger is on screen.

"Active Sessions" on the dashboard counted every row in the session
table, expired ones included. It now filters on expiresAt.

getAdminSubscriptionStats scans Stripe 100 subscriptions at a time and
computed a hasMore flag that nothing read, so a platform with more than
100 in any status silently showed 100. The flag is now named truncated,
carries the scan limit, and the Subscriptions panel says the counts are
floors when it trips.

Also drops stats.byType from the ledger response, which nothing read.

Claude-Session: https://claude.ai/code/session_01LqxkXwhjRDsJ1N9cBYpU1n

Author: InfinityBowman

packages/web/src/components/admin/AnalyticsSection.tsx

@@ -299,6 +299,11 @@ export function AnalyticsSection() {
       <div className='grid grid-cols-1 gap-6 lg:grid-cols-3'>
         <AdminPanel
           title='Subscriptions'
+          description={
+            subscriptionData?.truncated ?
+              `At least ${subscriptionData.statusScanLimit} in one status - counts are floors`
+            : undefined
+          }
           padded
           action={
             <RefreshButton

packages/web/src/routes/_app/_protected/admin/billing.ledger.tsx

@@ -312,6 +312,13 @@ function AdminBillingLedgerPage() {
 
       <AdminPanel
         title='Events'
+        footer={
+          stats && entries.length < stats.total ?
+            <span className='text-muted-foreground text-[13px]'>
+              Showing the {entries.length} most recent of {stats.total}.
+            </span>
+          : undefined
+        }
         action={
           <>
             <Input

packages/web/src/server/functions/__tests__/admin-billing-observability.server.test.ts

@@ -228,6 +228,48 @@ describe('getAdminBillingLedger', () => {
     result.entries.forEach(e => expect(e.status).toBe('failed'));
   });
 
+  it('counts every matching row, not just the page it returns', async () => {
+    const nowSec = Math.floor(Date.now() / 1000);
+    for (let i = 0; i < 5; i++) {
+      await seedStripeEventLedger({
+        id: `lt${i}`,
+        payloadHash: `ht${i}`,
+        receivedAt: nowSec + i,
+        route: '/webhooks/stripe',
+        requestId: `rt${i}`,
+        status: i < 3 ? 'processed' : 'failed',
+      });
+    }
+
+    const result = await getAdminBillingLedger(mockAdminSession(), createDb(env.DB), { limit: 2 });
+    expect(result.entries.length).toBe(2);
+    expect(result.stats.total).toBe(5);
+    expect(result.stats.byStatus.processed).toBe(3);
+    expect(result.stats.byStatus.failed).toBe(2);
+  });
+
+  it('narrows the stats to the active filter', async () => {
+    const nowSec = Math.floor(Date.now() / 1000);
+    for (let i = 0; i < 5; i++) {
+      await seedStripeEventLedger({
+        id: `lf${i}`,
+        payloadHash: `hf${i}`,
+        receivedAt: nowSec + i,
+        route: '/webhooks/stripe',
+        requestId: `rf${i}`,
+        status: i < 3 ? 'processed' : 'failed',
+      });
+    }
+
+    const result = await getAdminBillingLedger(mockAdminSession(), createDb(env.DB), {
+      status: 'failed',
+      limit: 1,
+    });
+    expect(result.entries.length).toBe(1);
+    expect(result.stats.total).toBe(2);
+    expect(result.stats.byStatus).toEqual({ failed: 2 });
+  });
+
   it('filters by type', async () => {
     const nowSec = Math.floor(Date.now() / 1000);
     await seedStripeEventLedger({

packages/web/src/server/functions/__tests__/admin-stats.server.test.ts

@@ -169,7 +169,7 @@ describe('getAdminSubscriptionStats', () => {
     expect(result.trialing).toBe(1);
     expect(result.pastDue).toBe(0);
     expect(result.canceled).toBe(2);
-    expect(result.hasMore).toBe(true);
+    expect(result.truncated).toBe(true);
   });
 
   it('throws when Stripe throws', async () => {

packages/web/src/server/functions/__tests__/admin-users.server.test.ts

@@ -64,14 +64,18 @@ function mockAdminSession(overrides?: { userId?: string }): Session {
   } as Session;
 }
 
-async function seedSessionRow(id: string, userId: string, opts: Partial<{ ip: string }> = {}) {
+async function seedSessionRow(
+  id: string,
+  userId: string,
+  opts: Partial<{ ip: string; expiresAt: Date }> = {},
+) {
   const db = createDb(env.DB);
   const now = new Date();
   await db.insert(session).values({
     id,
     token: `${id}-token`,
     userId,
-    expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+    expiresAt: opts.expiresAt ?? new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
     createdAt: now,
     updatedAt: now,
     ipAddress: opts.ip ?? null,
@@ -111,6 +115,15 @@ describe('getAdminStats', () => {
     expect(result.recentSignups).toBeGreaterThanOrEqual(2);
     void admin;
   });
+
+  it('counts only sessions that have not expired', async () => {
+    const u = await buildUser();
+    await seedSessionRow('s-live', u.id);
+    await seedSessionRow('s-expired', u.id, { expiresAt: new Date(Date.now() - 60_000) });
+
+    const result = await getAdminStats(mockAdminSession(), createDb(env.DB));
+    expect(result.activeSessions).toBe(1);
+  });
 });
 
 describe('GET /api/admin/users', () => {

packages/web/src/server/functions/admin-billing.server.ts

@@ -1,6 +1,6 @@
 import type { Database } from '@corates/db/client';
 import { stripeEventLedger, subscription } from '@corates/db/schema';
-import { and, desc, eq } from 'drizzle-orm';
+import { and, count, desc, eq } from 'drizzle-orm';
 import { throwDomainError, AUTH_ERRORS } from '@corates/shared';
 import { isAdminUser } from '@corates/workers/auth-admin';
 import { LedgerStatus } from '@corates/db/stripe-event-ledger';
@@ -26,41 +26,28 @@ export async function getAdminBillingLedger(
   const conditions = [];
   if (status) conditions.push(eq(stripeEventLedger.status, status));
   if (eventType) conditions.push(eq(stripeEventLedger.type, eventType));
+  const whereClause = conditions.length > 0 ? and(...conditions) : undefined;
 
-  const entries =
-    conditions.length > 0 ?
-      await db
-        .select()
-        .from(stripeEventLedger)
-        .where(and(...conditions))
-        .orderBy(desc(stripeEventLedger.receivedAt))
-        .limit(limit)
-        .all()
-    : await db
-        .select()
-        .from(stripeEventLedger)
-        .orderBy(desc(stripeEventLedger.receivedAt))
-        .limit(limit)
-        .all();
+  const entries = await db
+    .select()
+    .from(stripeEventLedger)
+    .where(whereClause)
+    .orderBy(desc(stripeEventLedger.receivedAt))
+    .limit(limit)
+    .all();
+
+  // Counted over every matching row rather than the page above, so the totals
+  // are not just the page size.
+  const statusCounts = await db
+    .select({ status: stripeEventLedger.status, count: count() })
+    .from(stripeEventLedger)
+    .where(whereClause)
+    .groupBy(stripeEventLedger.status)
+    .all();
 
   const stats = {
-    total: entries.length,
-    byStatus: entries.reduce(
-      (acc, e) => {
-        acc[e.status] = (acc[e.status] || 0) + 1;
-        return acc;
-      },
-      {} as Record<string, number>,
-    ),
-    byType: entries
-      .filter(e => e.type)
-      .reduce(
-        (acc, e) => {
-          if (e.type) acc[e.type] = (acc[e.type] || 0) + 1;
-          return acc;
-        },
-        {} as Record<string, number>,
-      ),
+    total: statusCounts.reduce((sum, row) => sum + row.count, 0),
+    byStatus: Object.fromEntries(statusCounts.map(row => [row.status, row.count])),
   };
 
   return {

packages/web/src/server/functions/admin-stats.server.ts

@@ -7,7 +7,7 @@ import {
   organization,
   stripeEventLedger,
 } from '@corates/db/schema';
-import { count, gte, sql } from 'drizzle-orm';
+import { count, gt, gte, sql } from 'drizzle-orm';
 import { throwDomainError, AUTH_ERRORS } from '@corates/shared';
 import { isAdminUser } from '@corates/workers/auth-admin';
 import { TIME_DURATIONS } from '@corates/workers/constants';
@@ -27,7 +27,7 @@ export async function getAdminStats(session: Session, db: Database) {
   const [userCount, projectCount, sessionCount] = await Promise.all([
     db.select({ count: count() }).from(user),
     db.select({ count: count() }).from(projects),
-    db.select({ count: count() }).from(sessionTable),
+    db.select({ count: count() }).from(sessionTable).where(gt(sessionTable.expiresAt, new Date())),
   ]);
 
   const sevenDaysAgo = Math.floor(Date.now() / 1000) - TIME_DURATIONS.STATS_RECENT_DAYS_SEC;
@@ -195,23 +195,29 @@ export async function getAdminWebhookStats(
   };
 }
 
+const SUBSCRIPTION_STATUS_SCAN_LIMIT = 100;
+
 export async function getAdminSubscriptionStats(session: Session) {
   assertAdmin(session);
 
   const stripe = createStripeClient(env.STRIPE_SECRET_KEY);
+  const limit = SUBSCRIPTION_STATUS_SCAN_LIMIT;
   const statusCounts = await Promise.all([
-    stripe.subscriptions.search({ query: 'status:"active"', limit: 100 }),
-    stripe.subscriptions.search({ query: 'status:"trialing"', limit: 100 }),
-    stripe.subscriptions.search({ query: 'status:"past_due"', limit: 100 }),
-    stripe.subscriptions.search({ query: 'status:"canceled"', limit: 100 }),
+    stripe.subscriptions.search({ query: 'status:"active"', limit }),
+    stripe.subscriptions.search({ query: 'status:"trialing"', limit }),
+    stripe.subscriptions.search({ query: 'status:"past_due"', limit }),
+    stripe.subscriptions.search({ query: 'status:"canceled"', limit }),
   ]);
 
   return {
     active: statusCounts[0].data.length,
     trialing: statusCounts[1].data.length,
     pastDue: statusCounts[2].data.length,
     canceled: statusCounts[3].data.length,
-    hasMore: statusCounts.some(r => r.has_more),
+    // Stripe has no count API, so each status is a capped scan; once one fills
+    // its page every count here is a floor rather than a total.
+    truncated: statusCounts.some(r => r.has_more),
+    statusScanLimit: SUBSCRIPTION_STATUS_SCAN_LIMIT,
   };
 }