diff --git a/backend/internal/handler/admin/dashboard_handler.go b/backend/internal/handler/admin/dashboard_handler.go
index e9fbb630fa..b42b395d33 100644
--- a/backend/internal/handler/admin/dashboard_handler.go
+++ b/backend/internal/handler/admin/dashboard_handler.go
@@ -675,6 +675,9 @@ func (h *DashboardHandler) GetUserBreakdown(c *gin.Context) {
}
}
+ // sort_by 由 repo 层 allowlist 校验;非法值静默回退默认排序(actual_cost)。
+ dim.SortBy = strings.TrimSpace(c.Query("sort_by"))
+
limit := 50
if v := c.Query("limit"); v != "" {
if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 200 {
diff --git a/backend/internal/handler/admin/dashboard_handler_user_breakdown_test.go b/backend/internal/handler/admin/dashboard_handler_user_breakdown_test.go
index b3a05111b3..3065eee3c4 100644
--- a/backend/internal/handler/admin/dashboard_handler_user_breakdown_test.go
+++ b/backend/internal/handler/admin/dashboard_handler_user_breakdown_test.go
@@ -59,7 +59,21 @@ func TestGetUserBreakdown_GroupIDFilter(t *testing.T) {
require.Equal(t, int64(42), repo.capturedDim.GroupID)
require.Empty(t, repo.capturedDim.Model)
require.Empty(t, repo.capturedDim.Endpoint)
- require.Equal(t, 50, repo.capturedLimit) // default limit
+ require.Equal(t, 50, repo.capturedLimit) // default limit
+ require.Empty(t, repo.capturedDim.SortBy) // no sort_by => empty (repo falls back to default)
+}
+
+func TestGetUserBreakdown_SortBy(t *testing.T) {
+ repo := &userBreakdownRepoCapture{}
+ router := newUserBreakdownRouter(repo)
+
+ req := httptest.NewRequest(http.MethodGet,
+ "/admin/dashboard/user-breakdown?start_date=2026-03-01&end_date=2026-03-16&sort_by=total_tokens", nil)
+ w := httptest.NewRecorder()
+ router.ServeHTTP(w, req)
+
+ require.Equal(t, http.StatusOK, w.Code)
+ require.Equal(t, "total_tokens", repo.capturedDim.SortBy)
}
func TestGetUserBreakdown_ModelFilter(t *testing.T) {
diff --git a/backend/internal/pkg/usagestats/usage_log_types.go b/backend/internal/pkg/usagestats/usage_log_types.go
index a96ea670c4..29af4d2d50 100644
--- a/backend/internal/pkg/usagestats/usage_log_types.go
+++ b/backend/internal/pkg/usagestats/usage_log_types.go
@@ -164,13 +164,16 @@ type UserSpendingRankingResponse struct {
// UserBreakdownItem represents per-user usage breakdown within a dimension (group, model, endpoint).
type UserBreakdownItem struct {
- UserID int64 `json:"user_id"`
- Email string `json:"email"`
- Requests int64 `json:"requests"`
- TotalTokens int64 `json:"total_tokens"`
- Cost float64 `json:"cost"` // 标准计费
- ActualCost float64 `json:"actual_cost"` // 实际扣除
- AccountCost float64 `json:"account_cost"` // 账号成本
+ UserID int64 `json:"user_id"`
+ Email string `json:"email"`
+ Requests int64 `json:"requests"`
+ InputTokens int64 `json:"input_tokens"` // 输入 token 累计
+ OutputTokens int64 `json:"output_tokens"` // 输出 token 累计
+ CacheTokens int64 `json:"cache_tokens"` // 缓存创建 + 读取 token 累计
+ TotalTokens int64 `json:"total_tokens"` // 输入+输出+缓存 token 累计
+ Cost float64 `json:"cost"` // 标准计费
+ ActualCost float64 `json:"actual_cost"` // 实际扣除
+ AccountCost float64 `json:"account_cost"` // 账号成本
}
// UserBreakdownDimension specifies the dimension to filter for user breakdown.
@@ -187,6 +190,8 @@ type UserBreakdownDimension struct {
RequestType *int16 // filter by request_type (non-nil to enable)
Stream *bool // filter by stream flag (non-nil to enable)
BillingType *int8 // filter by billing_type (non-nil to enable)
+ // SortBy 指定排序列(空 = 默认按 actual_cost)。合法值由 repo 层 allowlist 校验。
+ SortBy string
}
// APIKeyUsageTrendPoint represents API key usage trend data point
diff --git a/backend/internal/repository/usage_log_repo_trend.go b/backend/internal/repository/usage_log_repo_trend.go
index 392f1c8300..7302296683 100644
--- a/backend/internal/repository/usage_log_repo_trend.go
+++ b/backend/internal/repository/usage_log_repo_trend.go
@@ -603,6 +603,9 @@ func (r *usageLogRepository) GetUserBreakdownStats(ctx context.Context, startTim
COALESCE(ul.user_id, 0) as user_id,
COALESCE(u.email, '') as email,
COUNT(*) as requests,
+ COALESCE(SUM(ul.input_tokens), 0) as input_tokens,
+ COALESCE(SUM(ul.output_tokens), 0) as output_tokens,
+ COALESCE(SUM(ul.cache_creation_tokens + ul.cache_read_tokens), 0) as cache_tokens,
COALESCE(SUM(ul.input_tokens + ul.output_tokens + ul.cache_creation_tokens + ul.cache_read_tokens), 0) as total_tokens,
COALESCE(SUM(ul.total_cost), 0) as cost,
COALESCE(SUM(ul.actual_cost), 0) as actual_cost,
@@ -651,7 +654,13 @@ func (r *usageLogRepository) GetUserBreakdownStats(ctx context.Context, startTim
args = append(args, *dim.BillingType)
}
- query += " GROUP BY ul.user_id, u.email ORDER BY actual_cost DESC"
+ // ORDER BY 列来自固定 allowlist(非用户原样字符串),避免 SQL 注入。
+ orderBy := "actual_cost"
+ switch dim.SortBy {
+ case "total_tokens", "input_tokens", "output_tokens", "cache_tokens", "requests", "cost", "actual_cost":
+ orderBy = dim.SortBy
+ }
+ query += " GROUP BY ul.user_id, u.email ORDER BY " + orderBy + " DESC"
if limit > 0 {
query += fmt.Sprintf(" LIMIT %d", limit)
}
@@ -674,6 +683,9 @@ func (r *usageLogRepository) GetUserBreakdownStats(ctx context.Context, startTim
&row.UserID,
&row.Email,
&row.Requests,
+ &row.InputTokens,
+ &row.OutputTokens,
+ &row.CacheTokens,
&row.TotalTokens,
&row.Cost,
&row.ActualCost,
diff --git a/frontend/src/api/admin/dashboard.ts b/frontend/src/api/admin/dashboard.ts
index dda7d8927d..97c16aa362 100644
--- a/frontend/src/api/admin/dashboard.ts
+++ b/frontend/src/api/admin/dashboard.ts
@@ -167,6 +167,8 @@ export interface UserBreakdownParams {
endpoint?: string
endpoint_type?: 'inbound' | 'upstream' | 'path'
limit?: number
+ // Sort column for the ranking (allowlisted server-side; falls back to actual_cost)
+ sort_by?: 'total_tokens' | 'input_tokens' | 'output_tokens' | 'cache_tokens' | 'requests' | 'cost' | 'actual_cost'
// Additional filter conditions
user_id?: number
api_key_id?: number
diff --git a/frontend/src/components/admin/usage/UserTokenRanking.vue b/frontend/src/components/admin/usage/UserTokenRanking.vue
new file mode 100644
index 0000000000..ad24ae1288
--- /dev/null
+++ b/frontend/src/components/admin/usage/UserTokenRanking.vue
@@ -0,0 +1,180 @@
+
+
+ {{ t('admin.usage.tokenRanking.title') }}
+
+ {{ t('admin.usage.tokenRanking.subtitle') }}
+
+
+
+
+
+
+
+ #
+ {{ t('admin.usage.tokenRanking.columns.user') }}
+
+ {{ t(col.label) }}
+
+
+
+
+
+
+
+
+
+ {{ t('admin.dashboard.noDataAvailable') }}
+
+
+
+
+ {{ index + 1 }}
+
+ {{ item.email || `User #${item.user_id}` }}
+
+ {{ item.requests.toLocaleString() }}
+ {{ fmtTokens(item.input_tokens) }}
+ {{ fmtTokens(item.output_tokens) }}
+ {{ fmtTokens(item.cache_tokens) }}
+ {{ fmtTokens(item.total_tokens) }}
+ ${{ fmtCost(item.actual_cost) }}
+