athar 0.2.1 → 0.3.0

data/app/views/athar/dashboard/_sidebar.html.erb

@@ -0,0 +1,106 @@
+<%
+  # ----- precompute -----
+  max_count = registry.map(&:count).max || 1
+  total_all = registry.sum(&:count)
+
+  # Group by schema, order: public, billing, reporting, then any others alphabetically
+  grouped      = registry.group_by(&:schema)
+  fixed        = %w[public billing reporting]
+  extras       = (grouped.keys - fixed).sort
+  schema_order = (fixed + extras).select { |schema| grouped.key?(schema) }
+
+  grouped.each_value { |models| models.sort_by!(&:count).reverse! }
+
+  # Base params for link building — strip model/page/expanded, keep everything else
+  base_params = request.query_parameters.except(:model, :page, :expanded).except("model", "page", "expanded")
+
+  # Retention display
+  max_age       = Athar.configuration.retention.max_age
+  max_count_ret = Athar.configuration.retention.max_count
+  age_label     = compact_duration(max_age)
+  count_label   = compact_number(max_count_ret)
+%>
+
+<aside class="sidebar">
+  <%# ---- sidebar head ---- %>
+  <div class="sidebar-head">
+    <div class="kbd-row">
+      <span class="brand">
+        <%= image_tag "athar/logo.png", alt: "", class: "brand-logo" %>
+        <span class="brand-name">athar</span>
+        <span class="brand-version">v<%= Athar::VERSION %></span>
+      </span>
+    </div>
+  </div>
+
+  <%# ---- all deletions row ---- %>
+  <%# Sidebar links are plain anchors — clicks trigger a full-page reload, which
+      re-renders the sidebar's active highlight in sync with the main content.
+      In-frame interactions (filter, pager, expand) use partial-fetch instead. %>
+  <a class="sidebar-row sidebar-all <%= "is-active" if filters.model.nil? %>"
+     href="<%= root_path(base_params) %>"
+     <%= 'aria-current="page"'.html_safe if filters.model.nil? %>>
+    <span class="sidebar-row-label">
+      <span class="dot"></span>All deletions
+    </span>
+    <span class="sidebar-count"><%= number_with_delimiter(total_all) %></span>
+  </a>
+
+  <%# ---- scrollable grouped list ---- %>
+  <div class="sidebar-scroll">
+    <% schema_order.each do |schema| %>
+      <% models = grouped[schema] %>
+      <div class="sidebar-group">
+        <div class="sidebar-group-head">
+          <span><%= schema %></span>
+          <span class="sidebar-group-count"><%= models.length %></span>
+        </div>
+        <% models.each do |model| %>
+          <%
+            percent    = max_count > 0 ? (model.count.to_f / max_count * 100) : 0
+            is_active  = filters.model == model.record_type
+            row_href   = root_path(base_params.merge(model: model.record_type))
+          %>
+          <a class="sidebar-row <%= "is-active" if is_active %>"
+             href="<%= row_href %>"
+             <%= 'aria-current="page"'.html_safe if is_active %>>
+            <span class="sidebar-bar" style="width:<%= percent.round(2) %>%"></span>
+            <span class="sidebar-row-label">
+              <span class="mode-dot mode-<%= model.capture_mode %>" title="capture: <%= model.capture_mode %>"></span>
+              <span class="sidebar-model"><%= model.record_type %></span>
+              <% if model.sti %>
+                <span class="sidebar-tag">STI</span>
+              <% end %>
+              <% if model.truncate %>
+                <span class="sidebar-tag" title="TRUNCATE tracked"><%= raw icon_trunc %></span>
+              <% end %>
+              <% if model.masks.any? %>
+                <span class="sidebar-tag mask" title="masks: <%= model.masks.join(", ") %>">m<%= model.masks.length %></span>
+              <% end %>
+            </span>
+            <span class="sidebar-count"><%= number_with_delimiter(model.count) %></span>
+          </a>
+        <% end %>
+      </div>
+    <% end %>
+  </div>
+
+  <%# ---- footer ---- %>
+  <div class="sidebar-foot">
+    <div class="legend">
+      <span><i class="mode-dot mode-identity"></i> identity</span>
+      <span><i class="mode-dot mode-only"></i> only</span>
+      <span><i class="mode-dot mode-snapshot"></i> snapshot</span>
+    </div>
+    <div class="retention" title="<%= max_age || max_count_ret ? "Audit log pruning configured" : "No retention configured — Athar.configure to set max_age / max_count" %>">
+      <span class="retention-label">retention</span>
+      <span class="retention-val">
+        <% if max_age || max_count_ret %>
+          <%= [max_age ? age_label : nil, max_count_ret ? "#{count_label} rows" : nil].compact.join(" · ") %>
+        <% else %>
+          unconfigured
+        <% end %>
+      </span>
+    </div>
+  </div>
+</aside>

data/app/views/athar/dashboard/_table.html.erb

@@ -0,0 +1,30 @@
+<div class="table-wrap">
+  <table class="dtable">
+    <thead>
+      <tr>
+        <th class="th-expand"></th>
+        <th class="th-when">deleted_at</th>
+        <th>record</th>
+        <th>schema.table</th>
+        <th>capture</th>
+        <th>actor</th>
+        <th>metadata</th>
+        <th class="th-id">id</th>
+      </tr>
+    </thead>
+
+    <tbody>
+      <% rows.each do |row| %>
+        <%= render "athar/dashboard/row", row: row, expanded: expanded, registry_by_id: registry_by_id, actor_labels: actor_labels %>
+      <% end %>
+    </tbody>
+  </table>
+
+  <% if rows.empty? %>
+    <div class="table-empty">
+      <div class="empty-mark">∅</div>
+      <div class="empty-title">no audit rows match these filters</div>
+      <div class="empty-sub">athar_deletions returned 0 rows for the active query</div>
+    </div>
+  <% end %>
+</div>

data/app/views/athar/dashboard/_topbar.html.erb

@@ -0,0 +1,30 @@
+<header class="topbar">
+  <div class="crumbs">
+    <span class="crumb">athar</span><span class="crumb-sep">/</span><span class="crumb">deletions</span><%
+    if model %>
+      <span class="crumb-sep">/</span>
+      <span class="crumb crumb-active"><%= h model.record_type %></span>
+      <span class="crumb-meta mono"><%= model.schema %>.<%= model.table %></span>
+      <%= mode_pill(model.capture_mode) %>
+      <% if model.masks.present? %>
+        <%= mask_pill(model.masks) %>
+      <% end %>
+      <% if model.truncate %>
+        <span class="pill subtle">+ truncate</span>
+      <% end %>
+    <% else %>
+      <span class="crumb-meta">all tracked tables</span>
+    <% end %>
+  </div>
+
+  <div class="topbar-right">
+    <% theme = cookies[:athar_theme] || "dark" %>
+    <button class="theme-btn" type="button" title="Toggle theme" data-athar-theme-toggle><%= theme == "dark" ? "◐" : "◑" %></button>
+    <span class="conn-pill">
+      <span class="conn-dot"></span>
+      <span><%= connection.database %></span>
+      <span class="dim mono"><%= connection.version %></span>
+    </span>
+    <span class="time-pill mono"><%= absolute_time(now) %></span>
+  </div>
+</header>

data/app/views/athar/dashboard/index.html.erb

@@ -0,0 +1,31 @@
+<%# Sidebar lives outside #athar-dashboard so filter changes / pagination / row
+    expand can swap only the main content via partial-fetch (anchors with
+    `data-athar-partial-link` and forms with `data-athar-partial-form`, both
+    handled by app/assets/javascripts/athar/dashboard.js).
+
+    The dashboard body is split into #athar-pre (topbar + KPI strip) and
+    #athar-post (table + pager) regions. Partial swaps replace each region
+    independently and skip the filter bar entirely — that way the search
+    input and actor select are never destroyed mid-keystroke and focus /
+    selection / value can never be lost. The filter bar's own visual state
+    (active segments, selected actor) is reconciled from the URL after each
+    swap; see updateFilterBarFromUrl in dashboard.js. %>
+<div class="app">
+  <%= render "athar/dashboard/sidebar", registry: @registry, filters: @filters %>
+
+  <main class="main">
+    <div id="athar-dashboard">
+      <div id="athar-pre">
+        <%= render "athar/dashboard/topbar", filters: @filters, model: @selected_model, connection: @connection_info, now: @now %>
+        <%= render "athar/dashboard/kpi_strip", kpis: @kpis, total: @total %>
+      </div>
+
+      <%= render "athar/dashboard/filter_bar", filters: @filters, actors: @actors %>
+
+      <div id="athar-post">
+        <%= render "athar/dashboard/table", rows: @rows, expanded: @filters.expanded, registry_by_id: @registry_by_id, filters: @filters, actor_labels: @actor_labels %>
+        <%= render "athar/dashboard/pager", page: @page %>
+      </div>
+    </div>
+  </main>
+</div>

data/app/views/athar/deletions/_detail.html.erb

@@ -0,0 +1,115 @@
+<% model_info = registry_by_id&.dig([deletion.schema_name, deletion.table_name]) %>
+
+<div class="detail">
+  <div class="detail-grid">
+
+    <%# Section 1: record_data %>
+    <section class="detail-section">
+      <header class="detail-h">
+        <span>record_data</span>
+        <% if model_info %>
+          <%= mask_pill(model_info.masks) %>
+          <%= mode_pill(model_info.capture_mode) %>
+        <% end %>
+      </header>
+      <% if deletion.record_data.blank? || deletion.record_data.empty? %>
+        <div class="json-empty">
+          <% if model_info&.capture_mode == "identity" %>
+            {} <span class="muted">— identity-only capture, no record_data</span>
+          <% else %>
+            {}
+          <% end %>
+        </div>
+      <% else %>
+        <%= render_json_kv(deletion.record_data) %>
+      <% end %>
+    </section>
+
+    <%# Section 2: metadata %>
+    <section class="detail-section">
+      <header class="detail-h">
+        <span>metadata</span>
+      </header>
+
+      <%= render_json_kv(deletion.metadata) %>
+    </section>
+
+    <%# Section 3: identity (wide) %>
+    <section class="detail-section detail-wide">
+      <header class="detail-h">
+        <span>identity</span>
+      </header>
+      <table class="kv-table">
+        <tbody>
+          <tr>
+            <td class="kv-key">athar_deletions.id</td>
+            <td class="kv-val mono">
+              <%= deletion.id %>
+              <%= copy_button(deletion.id.to_s, label: "audit id") %>
+            </td>
+          </tr>
+          <tr>
+            <td class="kv-key">record_type</td>
+            <td class="kv-val"><%= deletion.record_type %></td>
+          </tr>
+          <tr>
+            <td class="kv-key">record_id</td>
+            <td class="kv-val mono">
+              <% if deletion.record_id.present? %>
+                <%= deletion.record_id %>
+                <%= copy_button(deletion.record_id.to_s, label: "record_id") %>
+              <% else %>
+                <span class="muted">—</span>
+              <% end %>
+            </td>
+          </tr>
+          <tr>
+            <td class="kv-key">schema · table</td>
+            <td class="kv-val mono"><%= deletion.schema_name %>.<%= deletion.table_name %></td>
+          </tr>
+          <tr>
+            <td class="kv-key">deleted_at</td>
+            <td class="kv-val mono"><%= absolute_time(deletion.deleted_at) %></td>
+          </tr>
+          <tr>
+            <td class="kv-key">actor</td>
+            <td class="kv-val">
+              <% if deletion.actor_id.present? %>
+                <span class="mono"><%= deletion.actor_type %>#<%= deletion.actor_id %></span>
+                ·
+                <% actor_record = deletion.actor %>
+                <%= h Athar::Dashboard::ActorLabels.humanize(actor_record, deletion.actor_type, deletion.actor_id) %>
+                <%= copy_button("#{deletion.actor_type}##{deletion.actor_id}", label: "actor") %>
+              <% elsif deletion.metadata.is_a?(Hash) && deletion.metadata["actor"] %>
+                <span class="mono muted">
+                  <%= ERB::Util.html_escape(deletion.metadata["actor"]) %>
+                  <span class="pill subtle">metadata</span>
+                </span>
+              <% else %>
+                <span class="muted">(none)</span>
+              <% end %>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </section>
+
+    <%# Section 4: requery (wide) %>
+    <% ruby_snippet = "Athar::Deletion.for_record(#{deletion.record_type}, #{deletion.record_id}).last" %>
+    <% sql_snippet  = "SELECT *\nFROM athar_deletions\nWHERE id = #{deletion.id};" %>
+    <section class="detail-section detail-wide">
+      <header class="detail-h">
+        <span>requery</span>
+      </header>
+      <div class="code-wrap">
+        <%= copy_button(ruby_snippet, label: "Ruby snippet") %>
+        <pre class="code"><code><%= h ruby_snippet %></code></pre>
+      </div>
+      <div class="code-wrap">
+        <%= copy_button(sql_snippet, label: "SQL snippet") %>
+        <pre class="code"><code><%= h sql_snippet %></code></pre>
+      </div>
+    </section>
+
+  </div>
+</div>

data/app/views/athar/deletions/show.html.erb

@@ -0,0 +1,3 @@
+<div id="detail_<%= @deletion.id %>">
+  <%= render "athar/deletions/detail", deletion: @deletion, registry_by_id: @registry_by_id %>
+</div>

data/app/views/athar/table_events/_detail.html.erb

@@ -0,0 +1,80 @@
+<div class="detail">
+  <div class="detail-grid">
+
+    <%# Section 1: metadata %>
+    <section class="detail-section">
+      <header class="detail-h">
+        <span>metadata</span>
+      </header>
+
+      <%= render_json_kv(event.metadata) %>
+    </section>
+
+    <%# Section 2: identity (wide) %>
+    <section class="detail-section detail-wide">
+      <header class="detail-h">
+        <span>identity</span>
+      </header>
+      <table class="kv-table">
+        <tbody>
+          <tr>
+            <td class="kv-key">athar_table_events.id</td>
+            <td class="kv-val mono">
+              <%= event.id %>
+              <%= copy_button(event.id.to_s, label: "audit id") %>
+            </td>
+          </tr>
+          <tr>
+            <td class="kv-key">event_type</td>
+            <td class="kv-val"><%= event.event_type %></td>
+          </tr>
+          <tr>
+            <td class="kv-key">schema · table</td>
+            <td class="kv-val mono"><%= event.schema_name %>.<%= event.table_name %></td>
+          </tr>
+          <tr>
+            <td class="kv-key">occurred_at</td>
+            <td class="kv-val mono"><%= absolute_time(event.occurred_at) %></td>
+          </tr>
+          <tr>
+            <td class="kv-key">actor</td>
+            <td class="kv-val">
+              <% if event.actor_id.present? %>
+                <span class="mono"><%= event.actor_type %>#<%= event.actor_id %></span>
+                ·
+                <% actor_record = event.actor %>
+                <%= h Athar::Dashboard::ActorLabels.humanize(actor_record, event.actor_type, event.actor_id) %>
+                <%= copy_button("#{event.actor_type}##{event.actor_id}", label: "actor") %>
+              <% elsif event.metadata.is_a?(Hash) && event.metadata["actor"] %>
+                <span class="mono muted">
+                  <%= ERB::Util.html_escape(event.metadata["actor"]) %>
+                  <span class="pill subtle">metadata</span>
+                </span>
+              <% else %>
+                <span class="muted">(none)</span>
+              <% end %>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </section>
+
+    <%# Section 3: requery (wide) %>
+    <% ruby_snippet = "Athar::TableEvent.find(#{event.id})" %>
+    <% sql_snippet  = "SELECT *\nFROM athar_table_events\nWHERE id = #{event.id};" %>
+    <section class="detail-section detail-wide">
+      <header class="detail-h">
+        <span>requery</span>
+      </header>
+      <div class="code-wrap">
+        <%= copy_button(ruby_snippet, label: "Ruby snippet") %>
+        <pre class="code"><code><%= h ruby_snippet %></code></pre>
+      </div>
+      <div class="code-wrap">
+        <%= copy_button(sql_snippet, label: "SQL snippet") %>
+        <pre class="code"><code><%= h sql_snippet %></code></pre>
+      </div>
+    </section>
+
+  </div>
+</div>

data/app/views/athar/table_events/show.html.erb

@@ -0,0 +1,3 @@
+<div id="detail_<%= @event.id %>">
+  <%= render "athar/table_events/detail", event: @event %>
+</div>

data/app/views/layouts/athar/application.html.erb

@@ -0,0 +1,29 @@
+<!doctype html>
+<html lang="en" data-theme="<%= cookies[:athar_theme] || "dark" %>">
+  <head>
+    <meta charset="utf-8">
+    <title>Athar</title>
+
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="csrf-token" content="<%= form_authenticity_token %>">
+    <meta name="athar-theme-url" content="<%= theme_path %>">
+
+    <%# If the host has Turbo, force a full document load when entering /athar
+        so our JS owns the page (no double-Turbo, no leftover host listeners). %>
+    <meta name="turbo-visit-control" content="reload">
+
+    <link rel="icon" type="image/png" href="<%= asset_path("athar/logo.png") %>">
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
+
+    <%= stylesheet_link_tag athar_asset_path("dashboard.css") %>
+    <%= javascript_include_tag athar_asset_path("dashboard.js"), defer: true, nonce: athar_csp_nonce %>
+  </head>
+
+  <body>
+    <%= yield %>
+    <%# Single ARIA live region for in-page announcements (e.g. "Copied N"). %>
+    <div id="athar-aria-live" class="sr-only" aria-live="polite" aria-atomic="true"></div>
+  </body>
+</html>

data/config/routes.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+Athar::Engine.routes.draw do
+  root "dashboard#index"
+  resources :deletions,    only: [:show]
+  resources :table_events, only: [:show]
+  resource :theme, only: [:update]
+end

data/lib/athar/dashboard/actor_labels.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Athar
+  module Dashboard
+    # Builds a human-readable label for an actor record. Real host apps may or
+    # may not override `to_s` on their actor models (Devise's User typically
+    # doesn't), so this falls back to common identifying attributes before
+    # using `to_s`, and to "Type#id" when nothing readable is available.
+    module ActorLabels
+      IDENTIFYING_ATTRIBUTES = %i[email name username login handle].freeze
+
+      class << self
+        def humanize(record, type, id)
+          return "#{type}##{id}" unless record
+
+          IDENTIFYING_ATTRIBUTES.each do |attribute|
+            next unless record.respond_to?(attribute)
+
+            value = record.public_send(attribute)
+            return value.to_s if value.present?
+          end
+
+          string = record.to_s
+          return string if string.is_a?(String) && !string.start_with?("#<")
+
+          "#{type}##{id}"
+        end
+      end
+    end
+  end
+end

data/lib/athar/dashboard/actor_options.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module Athar
+  module Dashboard
+    class ActorOptions
+      Result = Data.define(:users, :system, :anonymous_label)
+      LIMIT  = 50
+
+      def initialize(cutoff:)
+        @cutoff = cutoff
+      end
+
+      def call(connection: ActiveRecord::Base.connection)
+        Result.new(
+          users: load_users(connection),
+          system: load_system(connection),
+          anonymous_label: "(anonymous)"
+        )
+      end
+
+      private
+
+      def load_users(connection) # rubocop:disable Metrics/AbcSize,Metrics/MethodLength
+        rows = connection.select_all(<<~SQL).to_a
+          SELECT actor_type, actor_id::text AS actor_id, MAX(deleted_at) AS last_seen
+          FROM #{Athar::DELETIONS_TABLE_NAME}
+          WHERE actor_id IS NOT NULL AND deleted_at >= #{quote(@cutoff)}
+          GROUP BY actor_type, actor_id
+          ORDER BY last_seen DESC
+          LIMIT #{LIMIT}
+        SQL
+
+        rows.group_by { |row| row["actor_type"] }.flat_map do |type, rows_for_type|
+          klass = type.safe_constantize
+
+          if klass.respond_to?(:where)
+            ids = rows_for_type.map { |row| row["actor_id"] }
+            records_by_id = klass.where(klass.primary_key => ids).index_by { |record| record.id.to_s }
+
+            rows_for_type.map do |row|
+              record = records_by_id[row["actor_id"]]
+              { value: "user:#{row["actor_type"]}:#{row["actor_id"]}",
+                label: ActorLabels.humanize(record, type, row["actor_id"]) }
+            end
+          else
+            rows_for_type.map do |row|
+              { value: "user:#{row["actor_type"]}:#{row["actor_id"]}", label: "#{type}##{row["actor_id"]}" }
+            end
+          end
+        end
+      end
+
+      def load_system(connection)
+        rows = connection.select_all(<<~SQL).to_a
+          SELECT metadata->>'actor' AS name, MAX(deleted_at) AS last_seen
+          FROM #{Athar::DELETIONS_TABLE_NAME}
+          WHERE actor_id IS NULL AND metadata ? 'actor' AND deleted_at >= #{quote(@cutoff)}
+          GROUP BY 1
+          ORDER BY last_seen DESC
+          LIMIT #{LIMIT}
+        SQL
+
+        rows.map { |row| { value: "sys:#{row["name"]}", label: row["name"] } }
+      end
+
+      def quote(value)
+        ActiveRecord::Base.connection.quote(value)
+      end
+    end
+  end
+end

data/lib/athar/dashboard/connection_info.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Athar
+  module Dashboard
+    # Database name + Postgres major version, rendered in the topbar.
+    class ConnectionInfo
+      attr_reader :database, :version
+
+      def self.fetch(
+        connection: ActiveRecord::Base.connection,
+        db_config: ActiveRecord::Base.connection_db_config
+      )
+        version_num = connection.select_value("SHOW server_version_num").to_i
+        new(database: db_config.database.to_s, version: "pg#{version_num / 10_000}")
+      end
+
+      def initialize(database:, version:)
+        @database = database
+        @version = version
+
+        freeze
+      end
+    end
+  end
+end