rails_error_dashboard 0.12.0 → 0.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c23f8c75c71f71913d2f5964f25a38642373f2f720e8996377a5877e54a1e6a
-  data.tar.gz: 95e1db7a2687ed2900e3a02a2f33d1a1c21fc70c4597f9d9bf5d5855356d2f98
+  metadata.gz: 2d762f92c5645173b17543925db4d5740d1294af6a2da64e0a9cef6b6032211b
+  data.tar.gz: 056bca6e5ba6083666cf44302979bc8d3ff276d76563de87793051619b616994
 SHA512:
-  metadata.gz: acb081a03269304c9c70b63ee996bd8d446a525bd506f401851d8249ad9bffe2ead0bf63798be64c231604176e03c614c761e4f551b9827802b7881b99f3b1b0
-  data.tar.gz: d28393ca63c1b9639daeb2409cdc3f20074f905e1cbc9e3a89ae7b881dbe2666bfbaf53052d1172803de0ca46d58ff7ae8b4bd6f4d9b24be3ffa61ae1283a20e
+  metadata.gz: 5383eafcd408b881b4721fc496df7077c387c6ecb7f10543dfe8570049dda45c2c408f59f2f0e10c2c385a448a8d1acc6719da0367a654b8e42455bd4c568797
+  data.tar.gz: 6c77de41c4c43f81eab6f7a3bd59626ca2d48d002fe312c535c71e8b8ffd33ec5eddcbec2b3601a8d3d52aee25ceb65037fdf4d56497730f3d85b7a5c8b463e7

data/app/controllers/rails_error_dashboard/application_controller.rb

@@ -10,7 +10,13 @@ module RailsErrorDashboard
     # Declaring it here inverts the default: a controller is protected unless
     # it explicitly opts out with skip_before_action, which is a visible,
     # reviewable act rather than an omission nobody notices.
-    before_action :authenticate_dashboard_user!
+    #
+    # Prepended so it runs before the CSRF check. A host app with
+    # default_protect_from_forgery registers verify_authenticity_token on
+    # ActionController::Base, ahead of anything declared here; an unauthenticated
+    # POST was then answered about its token (and by the error renderer) instead
+    # of with a 401.
+    prepend_before_action :authenticate_dashboard_user!
 
     include Pagy::Method
 
@@ -46,7 +52,9 @@ module RailsErrorDashboard
       # Log the error for debugging
       Rails.logger.error("[RailsErrorDashboard] Dashboard controller error: #{exception.class} - #{exception.message}")
       Rails.logger.error("Request: #{request.path} (#{request.method})")
-      Rails.logger.error("Params: #{params.inspect}")
+      # filtered_parameters, not params.inspect: the host app's filter_parameters
+      # must apply to the dashboard's log lines too.
+      Rails.logger.error("Params: #{request.filtered_parameters.inspect}")
       Rails.logger.error(exception.backtrace&.first(10)&.join("\n")) if exception.backtrace
 
       render_dashboard_error(
@@ -72,6 +80,45 @@ module RailsErrorDashboard
       )
     end
 
+    # Client mistakes are not dashboard failures. Without these, the catch-all
+    # above answered 500 "Something went wrong" for an expired CSRF token, which
+    # is both the wrong status and the wrong advice. One warn line each, and no
+    # parameters: a rejected form post is exactly where a secret would be.
+    rescue_from ActionController::ParameterMissing, ActionController::BadRequest do |exception|
+      Rails.logger.warn("[RailsErrorDashboard] Bad request: #{exception.class} on #{request.method} #{request.path}")
+
+      render_dashboard_error(
+        icon: "bi-x-octagon",
+        title: red_t("red.errors_page.bad_request.title"),
+        message: red_t("red.errors_page.bad_request.message"),
+        status: :bad_request
+      )
+    end
+
+    rescue_from ActionController::UnknownFormat do |exception|
+      Rails.logger.warn("[RailsErrorDashboard] Unknown format: #{exception.class} on #{request.method} #{request.path}")
+
+      render_dashboard_error(
+        icon: "bi-file-earmark-x",
+        title: red_t("red.errors_page.not_acceptable.title"),
+        message: red_t("red.errors_page.not_acceptable.message"),
+        status: :not_acceptable
+      )
+    end
+
+    rescue_from ActionController::InvalidAuthenticityToken do |exception|
+      Rails.logger.warn("[RailsErrorDashboard] CSRF token rejected: #{exception.class} on #{request.method} #{request.path}")
+
+      render_dashboard_error(
+        icon: "bi-shield-exclamation",
+        title: red_t("red.errors_page.csrf.title"),
+        message: red_t("red.errors_page.csrf.message"),
+        # Numeric: Rack renamed the symbol (:unprocessable_entity is deprecated,
+        # :unprocessable_content is unknown to the Rack that Rails 7.0 uses).
+        status: 422
+      )
+    end
+
     # Handle Pagy pagination errors — redirect to page 1, preserving filters.
     # Drop both :page and :per_page from the preserved query string. Either can
     # trigger the rescue (page out of range, per_page negative or non-numeric);
@@ -81,9 +128,12 @@ module RailsErrorDashboard
       Rails.logger.warn("[RailsErrorDashboard] Pagination error: #{exception.message}")
       preserved = request.query_parameters.except("page", :page, "per_page", :per_page)
       target = preserved.any? ? "#{request.path}?#{preserved.to_query}" : request.path
-      redirect_to target, status: :moved_permanently
+      redirect_to target, status: :see_other
     end
 
+    DEFAULT_PER_PAGE = 25
+    MAX_PER_PAGE = 100
+
     private
 
     # Set the dashboard's locale for this request and restore whatever was
@@ -176,7 +226,26 @@ module RailsErrorDashboard
       @resolved_pagy_locales ||= {}
     end
 
+    # Page size for every paginated action. Only the upper bound is enforced
+    # here: a value that is not a positive integer is passed through unchanged
+    # so that Pagy rejects it and the rescue above redirects, as it always has.
+    def per_page_param
+      raw = params[:per_page]
+      return DEFAULT_PER_PAGE if raw.blank?
+
+      number = Integer(raw, exception: false) if raw.is_a?(String)
+      number && number > MAX_PER_PAGE ? MAX_PER_PAGE : raw
+    end
+
     def render_dashboard_error(icon:, title:, message:, detail: nil, icon_style: nil, status: :internal_server_error)
+      # The styled page runs queries and names the host app's applications. A
+      # caller who has not authenticated gets the title and nothing else: no
+      # layout, no queries, and no exception detail.
+      unless @dashboard_authenticated
+        render plain: title, status: status
+        return
+      end
+
       set_common_view_variables
       error_html = <<~ERB
         <div class="red-empty-state" style="margin-top: var(--space-6);">
@@ -208,6 +277,10 @@ module RailsErrorDashboard
       else
         authenticate_with_basic_auth
       end
+
+      # performed? means a 401/403 (or a redirect from the host's lambda) has
+      # already been rendered. Read by render_dashboard_error.
+      @dashboard_authenticated = !performed?
     end
 
     def authenticate_with_lambda(auth_lambda)
@@ -229,14 +302,22 @@ module RailsErrorDashboard
 
     def authenticate_with_basic_auth
       authenticate_or_request_with_http_basic do |username, password|
-        ActiveSupport::SecurityUtils.secure_compare(
-          username,
-          RailsErrorDashboard.configuration.dashboard_username
-        ) &
-        ActiveSupport::SecurityUtils.secure_compare(
-          password,
-          RailsErrorDashboard.configuration.dashboard_password
-        )
+        # A Basic header need not decode to "user:pass": with no colon the
+        # password is nil, with nothing decodable both are. secure_compare
+        # raises on nil, which used to surface as a 500 rendered by the
+        # dashboard's own error page. A malformed header is a failed login.
+        next false if username.nil? || password.nil?
+
+        # A credential configured as nil must deny everyone. Coercing it with
+        # to_s would make it equal to an empty login ("Basic Og==" is ":").
+        expected_username = RailsErrorDashboard.configuration.dashboard_username
+        expected_password = RailsErrorDashboard.configuration.dashboard_password
+        next false if expected_username.nil? || expected_password.nil?
+
+        # Non-short-circuit & on purpose: both comparisons always run, so the
+        # response time does not reveal which half was wrong.
+        ActiveSupport::SecurityUtils.secure_compare(username.to_s, expected_username.to_s) &
+          ActiveSupport::SecurityUtils.secure_compare(password.to_s, expected_password.to_s)
       end
     end
   end

data/app/controllers/rails_error_dashboard/errors_controller.rb

@@ -2,7 +2,8 @@
 
 module RailsErrorDashboard
   class ErrorsController < ApplicationController
-    before_action :authenticate_dashboard_user!
+    # Authentication is declared once, on ApplicationController, and prepended.
+    # Re-declaring it here moved it to the END of the chain, behind the CSRF check.
     before_action :set_application_context
     before_action :check_default_credentials
     before_action :load_storm_banner
@@ -45,6 +46,10 @@ module RailsErrorDashboard
     # 4000, and the copy that drifts is the one the user reads.
     AI_HELP_QUESTION_LIMIT = 4000
 
+    # Cached in place of nil when the issue tracker has nothing to say, so that
+    # "nothing" is remembered for the TTL like any other answer.
+    NO_PLATFORM_DATA = "none"
+
     # The initializer every "not enabled" notice points at. A path, not prose.
     INITIALIZER_PATH = "config/initializers/rails_error_dashboard.rb"
 
@@ -86,11 +91,18 @@ module RailsErrorDashboard
       # on out-of-range pages (e.g. ?page=999999) so application_controller.rb's
       # rescue_from can redirect to a valid page. Without this, pagy 43.x silently
       # returns an empty result and users see "All clear!" instead of their data.
-      @pagy, @errors = pagy(:offset, errors_query, limit: params[:per_page] || 25, raise_range_error: true)
+      @pagy, @errors = pagy(:offset, errors_query, limit: per_page_param, raise_range_error: true)
 
       # Get dashboard stats using Query (pass application filter)
       @stats = Queries::DashboardStats.call(application_id: @current_application_id)
 
+      # Which Turbo streams this page listens to: its application's (or the
+      # global ones), and new-row prepends only when a new row belongs on top.
+      @live_streams = Services::ErrorBroadcaster.streams_for_view(
+        application_id: @current_application_id,
+        filtered: live_prepend_unsafe?
+      )
+
       # Get filter options using Query (pass application filter)
       filter_options = Queries::FilterOptions.call(application_id: @current_application_id)
       @error_types = filter_options[:error_types]
@@ -130,8 +142,9 @@ module RailsErrorDashboard
     # Phase 3: Workflow Integration Actions (via Commands)
 
     def assign
-      @error = Commands::AssignError.call(params[:id], assigned_to: params[:assigned_to])
-      redirect_to error_path(@error, **app_context_params)
+      result = Commands::AssignError.call(params[:id], assigned_to: params[:assigned_to])
+      flash[:alert] = red_t("red.flash.assign.blank") unless result[:success]
+      redirect_to error_path(result[:error], **app_context_params)
     end
 
     def unassign
@@ -140,13 +153,19 @@ module RailsErrorDashboard
     end
 
     def update_priority
-      @error = Commands::UpdateErrorPriority.call(params[:id], priority_level: params[:priority_level])
-      redirect_to error_path(@error, **app_context_params)
+      result = Commands::UpdateErrorPriority.call(params[:id], priority_level: params[:priority_level])
+      flash[:alert] = red_t("red.flash.priority.invalid") unless result[:success]
+      redirect_to error_path(result[:error], **app_context_params)
     end
 
     def snooze
-      @error = Commands::SnoozeError.call(params[:id], hours: params[:hours].to_i, reason: params[:reason])
-      redirect_to error_path(@error, **app_context_params)
+      # The raw value, not to_i: "abc".to_i is 0 and a nested parameter has no
+      # to_i at all. The command decides what a number of hours is.
+      result = Commands::SnoozeError.call(params[:id], hours: params[:hours], reason: params[:reason])
+      unless result[:success]
+        flash[:alert] = red_t("red.flash.snooze.invalid_hours", max: Commands::SnoozeError::MAX_SNOOZE_HOURS)
+      end
+      redirect_to error_path(result[:error], **app_context_params)
     end
 
     def unsnooze
@@ -166,7 +185,19 @@ module RailsErrorDashboard
 
     def update_status
       result = Commands::UpdateErrorStatus.call(params[:id], status: params[:status], comment: params[:comment])
-      redirect_to error_path(result[:error], **app_context_params)
+      error = result[:error]
+
+      # The command refuses some transitions; saying nothing made a refused
+      # change look like a successful one.
+      if result[:success]
+        flash[:notice] = red_t("red.flash.status.updated", status: status_flash_label(error.status))
+      elsif result[:reason] == :invalid_transition
+        flash[:alert] = red_t("red.flash.status.invalid_transition",
+                              from: status_flash_label(error.status), to: status_flash_label(params[:status]))
+      else
+        flash[:alert] = red_t("red.flash.status.unknown")
+      end
+      redirect_to error_path(error, **app_context_params)
     end
 
     def create_issue
@@ -361,8 +392,12 @@ module RailsErrorDashboard
       result = Queries::ReleaseTimeline.call(days, application_id: @current_application_id)
       all_releases = result[:releases]
       @summary = result[:summary]
+      # Taken from every release, before pagination: the summary cards describe
+      # the whole period, not the page in view.
+      @current_release = all_releases.find { |r| r[:current] }
+      @problematic_release_count = all_releases.count { |r| r[:problematic] }
 
-      @pagy, @releases = pagy(:offset, all_releases, limit: params[:per_page] || 25)
+      @pagy, @releases = pagy(:offset, all_releases, limit: per_page_param)
     end
 
     def storms
@@ -378,7 +413,7 @@ module RailsErrorDashboard
       all_entries = result[:entries]
       @summary = result[:summary]
 
-      @pagy, @entries = pagy(:offset, all_entries, limit: params[:per_page] || 25)
+      @pagy, @entries = pagy(:offset, all_entries, limit: per_page_param)
     end
 
     def deprecations
@@ -398,7 +433,7 @@ module RailsErrorDashboard
       @total_count = all_deprecations.sum { |d| d[:count] }
       @affected_count = all_deprecations.flat_map { |d| d[:error_ids] }.uniq.size
 
-      @pagy, @deprecations = pagy(:offset, all_deprecations, limit: params[:per_page] || 25)
+      @pagy, @deprecations = pagy(:offset, all_deprecations, limit: per_page_param)
     end
 
     def n_plus_one_summary
@@ -418,7 +453,7 @@ module RailsErrorDashboard
       @total_count = all_patterns.sum { |p| p[:count] }
       @affected_count = all_patterns.flat_map { |p| p[:error_ids] }.uniq.size
 
-      @pagy, @patterns = pagy(:offset, all_patterns, limit: params[:per_page] || 25)
+      @pagy, @patterns = pagy(:offset, all_patterns, limit: per_page_param)
     end
 
     def cache_health_summary
@@ -439,7 +474,7 @@ module RailsErrorDashboard
       @avg_hit_rate = non_nil_rates.any? ? (non_nil_rates.sum / non_nil_rates.size).round(1) : nil
       @total_cache_ops = all_entries.sum { |e| e[:reads] + e[:writes] }
 
-      @pagy, @entries = pagy(:offset, all_entries, limit: params[:per_page] || 25)
+      @pagy, @entries = pagy(:offset, all_entries, limit: per_page_param)
     end
 
     def job_health_summary
@@ -459,7 +494,7 @@ module RailsErrorDashboard
       @total_failed = all_entries.sum { |e| e[:failed] || e[:errored] || 0 }
       @adapters_detected = all_entries.map { |e| e[:adapter] }.uniq
 
-      @pagy, @entries = pagy(:offset, all_entries, limit: params[:per_page] || 25)
+      @pagy, @entries = pagy(:offset, all_entries, limit: per_page_param)
     end
 
     def database_health_summary
@@ -490,7 +525,7 @@ module RailsErrorDashboard
       @total_dead = all_entries.sum { |e| e[:dead] }
       @total_waiting = all_entries.sum { |e| e[:waiting] }
 
-      @pagy, @entries = pagy(:offset, all_entries, limit: params[:per_page] || 25)
+      @pagy, @entries = pagy(:offset, all_entries, limit: per_page_param)
     end
 
     def swallowed_exceptions
@@ -515,7 +550,7 @@ module RailsErrorDashboard
       @total_rescue_count = all_entries.sum { |e| e[:rescue_count] }
       @total_raise_count = all_entries.sum { |e| e[:raise_count] }
 
-      @pagy, @entries = pagy(:offset, all_entries, limit: params[:per_page] || 25)
+      @pagy, @entries = pagy(:offset, all_entries, limit: per_page_param)
     end
 
     def rack_attack_summary
@@ -545,7 +580,7 @@ module RailsErrorDashboard
       # never silently understated.
       @overflow_count = result[:overflow_count].to_i
 
-      @pagy, @events = pagy(:offset, all_events, limit: params[:per_page] || 25)
+      @pagy, @events = pagy(:offset, all_events, limit: per_page_param)
     end
 
     def actioncable_health_summary
@@ -566,7 +601,7 @@ module RailsErrorDashboard
       @total_events = all_channels.sum { |c| c[:total_events] }
       @total_rejections = all_channels.sum { |c| c[:rejection_count] }
 
-      @pagy, @channels = pagy(:offset, all_channels, limit: params[:per_page] || 25)
+      @pagy, @channels = pagy(:offset, all_channels, limit: per_page_param)
     end
 
     def llm_health_summary
@@ -586,7 +621,7 @@ module RailsErrorDashboard
       @totals = result[:totals]
       all_models = result[:models]
 
-      @pagy, @models = pagy(:offset, all_models, limit: params[:per_page] || 25)
+      @pagy, @models = pagy(:offset, all_models, limit: per_page_param)
     end
 
     def activestorage_health_summary
@@ -607,7 +642,7 @@ module RailsErrorDashboard
       @total_operations = all_services.sum { |s| s[:total_operations] }
       @errors_with_storage = all_services.sum { |s| s[:error_count] }
 
-      @pagy, @services = pagy(:offset, all_services, limit: params[:per_page] || 25)
+      @pagy, @services = pagy(:offset, all_services, limit: per_page_param)
     end
 
     def diagnostic_dumps
@@ -620,8 +655,10 @@ module RailsErrorDashboard
       scope = DiagnosticDump.recent
       scope = scope.where(application_id: @current_application_id) if @current_application_id.present?
       @total_dumps = scope.count
+      # The newest dump overall; the "latest" cards must not change with the page.
+      @latest_dump = scope.first
 
-      @pagy, @dumps = pagy(:offset, scope, limit: params[:per_page] || 25)
+      @pagy, @dumps = pagy(:offset, scope, limit: per_page_param)
     end
 
     def create_diagnostic_dump
@@ -755,15 +792,30 @@ module RailsErrorDashboard
     # a request like ?days=99999999 would scan the full table on every health
     # query, defeating index pruning and burning CPU.
     def days_param(default:)
-      raw = params[:days].presence || default
+      # days[x]=1 and days[]=7 are not numbers; to_i on them raised.
+      raw = params[:days]
+      raw = default unless raw.is_a?(String) && raw.present?
       raw.to_i.clamp(1, 365)
     end
 
     def set_application_context
+      # application_id[x]=1 is not an id. Left in params, the nested value reached
+      # url_for in the layout ("unable to convert unpermitted parameters to hash")
+      # and every page answered 500. An array of ids is still allowed.
+      params.delete(:application_id) if params[:application_id].is_a?(ActionController::Parameters)
+
       @current_application_id = params[:application_id].presence
       @applications = Application.ordered_by_name.pluck(:name, :id)
     end
 
+    # True when a brand-new error cannot simply be put on top of this list: any
+    # filter other than the application is active (the row may not match it), a
+    # sort is chosen, or this is not the first page.
+    def live_prepend_unsafe?
+      other_filters = FILTERABLE_PARAMS - [ :application_id ]
+      other_filters.any? { |key| params[key].present? } || params[:page].to_s.to_i > 1
+    end
+
     # Preserves the application_id param across redirects
     def app_context_params
       @current_application_id.present? ? { application_id: @current_application_id } : {}
@@ -777,6 +829,12 @@ module RailsErrorDashboard
       [ "red", kind, error.external_issue_provider, repo.presence || "-", error.external_issue_number ].join("/")
     end
 
+    # The status labels the index and show pages already use; an unlabelled
+    # value ("new" has no key) falls back to the raw text.
+    def status_flash_label(status)
+      red_t("red.errors.row.status.#{status}", default: status.to_s.tr("_", " "))
+    end
+
     def fetch_platform_issue(error)
       return nil unless error.external_issue_url.present? && error.external_issue_number.present?
       return nil unless RailsErrorDashboard.configuration.enable_issue_tracking
@@ -784,13 +842,25 @@ module RailsErrorDashboard
       # The repository belongs in the key: two repositories sharing an issue
       # number would otherwise read each other's cached state.
       cache_key = issue_cache_key("issue_state", error)
-      Rails.cache.fetch(cache_key, expires_in: 60.seconds) do
-        client = Services::IssueTrackerClient.for_error(error)
-        return nil unless client
-
-        result = client.fetch_issue(number: error.external_issue_number)
-        result[:success] ? result : nil
+      #
+      # The negative result is cached too, as NO_PLATFORM_DATA rather than nil.
+      # `return nil unless client` used to leave the METHOD, so the block never
+      # finished and nothing was written; a raising client skipped the write the
+      # same way. Either meant one API attempt (and its timeout) per page view.
+      cached = Rails.cache.fetch(cache_key, expires_in: 60.seconds) do
+        fetch_issue_state(error) || NO_PLATFORM_DATA
       end
+      cached == NO_PLATFORM_DATA ? nil : cached
+    rescue => e
+      nil
+    end
+
+    def fetch_issue_state(error)
+      client = Services::IssueTrackerClient.for_error(error)
+      return nil unless client
+
+      result = client.fetch_issue(number: error.external_issue_number)
+      result[:success] ? result : nil
     rescue => e
       nil
     end
@@ -801,13 +871,20 @@ module RailsErrorDashboard
 
       # Cache for 60 seconds to avoid API hammering on page refreshes
       cache_key = issue_cache_key("issue_comments", error)
+      # (an empty list is cached like any other answer -- see fetch_platform_issue)
       Rails.cache.fetch(cache_key, expires_in: 60.seconds) do
-        client = Services::IssueTrackerClient.for_error(error)
-        return [] unless client
+        fetch_issue_comments(error)
+      end || []
+    rescue => e
+      []
+    end
 
-        result = client.fetch_comments(number: error.external_issue_number, per_page: 20)
-        result[:success] ? result[:comments] : []
-      end
+    def fetch_issue_comments(error)
+      client = Services::IssueTrackerClient.for_error(error)
+      return [] unless client
+
+      result = client.fetch_comments(number: error.external_issue_number, per_page: 20)
+      result[:success] ? Array(result[:comments]) : []
     rescue => e
       []
     end

data/app/controllers/rails_error_dashboard/webhooks_controller.rb

@@ -295,6 +295,9 @@ module RailsErrorDashboard
         status: "new",
         reopened_at: Time.current
       )
+      # Someone reopened the issue on the forge: a user action, so the cached
+      # stat cards are invalidated now rather than at their TTL.
+      Services::AnalyticsCacheManager.clear
     end
   end
 end

data/app/helpers/rails_error_dashboard/application_helper.rb

@@ -37,7 +37,39 @@ module RailsErrorDashboard
       value.to_json.gsub("</", '<\/').html_safe
     end
 
-    # Returns Bootstrap color class for error severity
+    # Returns the value only when it is an absolute http(s) URL, otherwise nil.
+    # Every URL that comes from a stored column or a third-party API goes
+    # through this before it becomes an href, an img src or a window.open
+    # target. ERB escaping and link_to stop attribute breakout; neither rejects
+    # a scheme such as "javascript:". Same rule as the write path
+    # (Commands::LinkExistingIssue), so a row stored before that check existed
+    # is still inert when rendered.
+    def safe_external_url(value)
+      value if Services::UrlSafety.http_url?(value)
+    end
+
+    DEFAULT_LABEL_COLOR = "#6c757d"
+
+    # A forge label colour, safe to put in a style attribute. Anything that is
+    # not 3 or 6 hex digits becomes neutral grey: ERB escaping keeps a value
+    # inside the attribute but does not stop it being CSS ("fff;position:fixed").
+    def safe_label_color(raw)
+      return DEFAULT_LABEL_COLOR unless raw.is_a?(String)
+
+      hex = raw.delete_prefix("#")
+      hex.match?(/\A(?:\h{6}|\h{3})\z/) ? "##{hex}" : DEFAULT_LABEL_COLOR
+    end
+
+    # Black or white, whichever reads on the given background. Takes the output
+    # of safe_label_color, never the raw label value.
+    def label_text_color(background)
+      hex = background.to_s.delete_prefix("#")
+      return "#fff" unless hex.match?(/\A(?:\h{6}|\h{3})\z/)
+
+      hex = hex.chars.map { |c| c * 2 }.join if hex.length == 3
+      hex.scan(/../).sum { |pair| pair.to_i(16) } > 382 ? "#000" : "#fff"
+    end
+
     # Uses Catppuccin Mocha colors in dark theme via CSS variables
     # @param severity [Symbol] The severity level (:critical, :high, :medium, :low, :info)
     # @return [String] Bootstrap color class (danger, warning, info, secondary)
@@ -226,6 +258,19 @@ module RailsErrorDashboard
       nil
     end
 
+    # Parses a timestamp that came from somewhere RED does not control (an issue
+    # tracker's API). nil for anything that is not a date: a blank, free text, a
+    # number, a nested value. Never raises -- one odd comment must not take the
+    # error page down with it.
+    def safe_parse_time(value)
+      return value if value.is_a?(Time) || value.is_a?(DateTime)
+      return nil unless value.is_a?(String) && value.present?
+
+      (Time.zone || Time).parse(value)
+    rescue ArgumentError, TypeError, RangeError
+      nil
+    end
+
     # Renders a relative time ("3 hours ago") that updates automatically
     # @param time [Time, DateTime, nil] The timestamp to display
     # @param fallback [String] Text to show if time is nil

data/app/helpers/rails_error_dashboard/backtrace_helper.rb

@@ -175,6 +175,11 @@ module RailsErrorDashboard
           }
         end
       end
+    rescue => e
+      # Source context is a nicety. A cache store that is down must not take
+      # the error page with it -- the same rule read_coverage_for_file follows.
+      Rails.logger.error("[RailsErrorDashboard] read_source_code failed: #{e.class}: #{e.message}")
+      nil
     end
 
     # Read coverage data for a file when coverage tracking is active
@@ -204,6 +209,9 @@ module RailsErrorDashboard
         reader = Services::GitBlameReader.new(frame[:file_path], frame[:line_number])
         reader.read_blame
       end
+    rescue => e
+      Rails.logger.error("[RailsErrorDashboard] read_git_blame failed: #{e.class}: #{e.message}")
+      nil
     end
 
     # Generate GitHub/GitLab/Bitbucket link for a frame

data/app/jobs/rails_error_dashboard/concerns/plain_channel_message.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  module Concerns
+    # Delivery of a plain, one-sentence message that is ABOUT the dashboard's
+    # own behaviour rather than about one error: "a storm is in progress",
+    # "further new-error notifications are suppressed". The per-error jobs
+    # build rich payloads from an ErrorLog; these messages have no row.
+    #
+    # Shared by StormNotificationJob and NotificationBurstSummaryJob.
+    module PlainChannelMessage
+      private
+
+      # Slack takes {text:}, Discord {content:}, custom webhooks a
+      # machine-readable event. Email and PagerDuty are not used: neither has
+      # a sensible shape for a message that is not an incident.
+      def deliver_plain_message(message, webhook_payload)
+        config = RailsErrorDashboard.configuration
+        delivered = false
+
+        if config.enable_slack_notifications && config.slack_webhook_url.present?
+          post_json(config.slack_webhook_url, { text: message })
+          delivered = true
+        end
+
+        if config.enable_discord_notifications && config.discord_webhook_url.present?
+          post_json(config.discord_webhook_url, { content: message })
+          delivered = true
+        end
+
+        if config.enable_webhook_notifications && config.webhook_urls.present?
+          config.webhook_urls.each { |url| post_json(url, webhook_payload) }
+          delivered = true
+        end
+
+        # An email-only or PagerDuty-only deployment has no channel for this.
+        # Say so where an operator can find it rather than dropping it silently.
+        unless delivered
+          Rails.logger.warn("[RailsErrorDashboard] #{self.class.name.demodulize}: no Slack, Discord or webhook channel is enabled; message not sent: #{message}")
+        end
+      end
+
+      def t(key, locale, **options)
+        RailsErrorDashboard::I18nStore.translate(key, locale: locale, **options)
+      end
+
+      def app_name(config)
+        config.application_name || ENV["APPLICATION_NAME"] ||
+          (defined?(Rails) && Rails.application.class.module_parent_name) || "Rails Application"
+      end
+
+      def post_json(url, payload)
+        if defined?(HTTParty)
+          HTTParty.post(url, body: payload.to_json,
+            headers: { "Content-Type" => "application/json" }, timeout: 10)
+        else
+          uri = URI(url)
+          http = Net::HTTP.new(uri.host, uri.port)
+          http.use_ssl = uri.scheme == "https"
+          http.open_timeout = 5
+          http.read_timeout = 10
+          request = Net::HTTP::Post.new(uri.path, { "Content-Type" => "application/json" })
+          request.body = payload.to_json
+          http.request(request)
+        end
+      rescue => e
+        Rails.logger.error("[RailsErrorDashboard] #{self.class.name.demodulize} post failed: #{e.message}")
+      end
+    end
+  end
+end