rails_pulse 0.3.3 → 0.4.0.pre.1

data/app/assets/stylesheets/rails_pulse/components/time_range_selector.css

@@ -18,7 +18,7 @@
 
 .time-range-trigger:hover {
   background: var(--color-secondary);
-  border-color: var(--color-border-emphasis);
+  border-color: var(--color-border-dark);
 }
 
 .time-range-trigger svg {
@@ -28,7 +28,7 @@
 
 .time-range-trigger:has(+ [popover]:popover-open) {
   background: var(--color-secondary);
-  border-color: var(--color-border-emphasis);
+  border-color: var(--color-border-dark);
 }
 
 .time-range-trigger:has(+ [popover]:popover-open) svg {
@@ -36,16 +36,16 @@
 }
 
 /* Light mode improvements */
-html[data-color-scheme="light"] .time-range-trigger {
+html:not([data-color-scheme="dark"]) .time-range-trigger {
   border-color: rgba(0, 0, 0, 0.2);
 }
 
-html[data-color-scheme="light"] .time-range-trigger:hover {
+html:not([data-color-scheme="dark"]) .time-range-trigger:hover {
   background: rgba(0, 0, 0, 0.05);
   border-color: rgba(0, 0, 0, 0.3);
 }
 
-html[data-color-scheme="light"] .time-range-trigger:has(+ [popover]:popover-open) {
+html:not([data-color-scheme="dark"]) .time-range-trigger:has(+ [popover]:popover-open) {
   background: rgba(0, 0, 0, 0.05);
   border-color: rgba(0, 0, 0, 0.3);
 }

data/app/assets/stylesheets/rails_pulse/components/utilities.css

@@ -3,37 +3,20 @@
 .w-4 { width: 1rem; }
 .w-6 { width: 1.5rem; }
 .w-8 { width: 2rem; }
-.w-12 { width: 3rem; }
 .w-16 { width: 4rem; }
 .w-20 { width: 5rem; }
 .w-24 { width: 6rem; }
 .w-28 { width: 7rem; }
 .w-32 { width: 8rem; }
 .w-36 { width: 9rem; }
-.w-40 { width: 10rem; }
-.w-44 { width: 11rem; }
 .w-48 { width: 12rem; }
-.w-52 { width: 13rem; }
 .w-56 { width: 14rem; }
 .w-60 { width: 15rem; }
-.w-64 { width: 16rem; }
 
 /* Min-width utilities */
-.min-w-0 { min-width: 0; }
-.min-w-4 { min-width: 1rem; }
-.min-w-8 { min-width: 2rem; }
-.min-w-12 { min-width: 3rem; }
-.min-w-16 { min-width: 4rem; }
-.min-w-20 { min-width: 5rem; }
-.min-w-24 { min-width: 6rem; }
-.min-w-32 { min-width: 8rem; }
 
 /* Max-width utilities */
-.max-w-xs { max-width: 20rem; }
-.max-w-sm { max-width: 24rem; }
-.max-w-md { max-width: 28rem; }
 .max-w-lg { max-width: 32rem; }
-.max-w-xl { max-width: 36rem; }
 
 /* Table layout utilities */
 .table-fixed { table-layout: fixed; }

data/app/controllers/concerns/chart_table_concern.rb

@@ -53,7 +53,7 @@ module ChartTableConcern
   end
 
   def setup_chart_and_table_data
-    ransack_params = params[:q] || {}
+    ransack_params = self.ransack_params
 
     unless partial_request?
       # Setup chart data first using original time range (no sorting from table)
@@ -172,11 +172,18 @@ module ChartTableConcern
     action_name == "show"
   end
 
+  # Hook: override to return param keys that should be excluded from chart queries.
+  # Use this when a filter requires a JOIN that chart queries don't perform
+  # (e.g. route path/action filters that need rails_pulse_routes joined).
+  def chart_filter_exclusions
+    []
+  end
+
   # Builds ransack parameters for chart queries
   # Common pattern: time range + optional duration filter + resource scope
   # Handles "recent" mode where @page_timings.start_time/@end_time may be nil
   def build_chart_ransack_params(ransack_params)
-    base_params = ransack_params.except(:s)
+    base_params = ransack_params.except(:s, *chart_filter_exclusions)
 
     # Add time filters if we have time boundaries (not in "recent" mode)
     if @page_timings&.start_time && @page_timings&.end_time
@@ -196,7 +203,7 @@ module ChartTableConcern
 
     # Scope to specific resource on show pages
     if show_action?
-      base_params.merge(summarizable_id_eq: current_resource.id)
+      base_params.merge(resource_id_scope)
     else
       base_params
     end
@@ -308,4 +315,9 @@ module ChartTableConcern
   def current_resource
     nil
   end
+
+  # Ransack scope for chart summaries on show pages. Override to customize (e.g. IN queries).
+  def resource_id_scope
+    { summarizable_id_eq: current_resource.id }
+  end
 end

data/app/controllers/concerns/ransack_params_concern.rb

@@ -0,0 +1,18 @@
+# RansackParamsConcern
+#
+# Every filterable page reads its Ransack conditions from params[:q]. The
+# dashboard's own forms always send a hash, but a hand-edited URL can make it
+# a string or an array (`?q=foo`), and each caller would then invoke Hash
+# methods on it and 500. Normalise once, here.
+module RansackParamsConcern
+  extend ActiveSupport::Concern
+
+  private
+
+  # params[:q] as an ActionController::Parameters hash, or an empty one when
+  # the value is absent or not hash-shaped.
+  def ransack_params
+    q = params[:q]
+    q.respond_to?(:permit) ? q : ActionController::Parameters.new({})
+  end
+end

data/app/controllers/concerns/response_range_concern.rb

@@ -5,9 +5,9 @@
 # Supports both page-specific duration filters and global performance threshold filters.
 module ResponseRangeConcern
   extend ActiveSupport::Concern
+  include RansackParamsConcern
 
   def setup_duration_range(type = :route)
-    ransack_params = params[:q] || {}
     thresholds = RailsPulse.configuration.public_send("#{type}_thresholds")
 
     # Check all duration-related parameters

data/app/controllers/concerns/time_range_concern.rb

@@ -11,6 +11,7 @@
 # Normalizes times to beginning/end of hour or day based on range duration.
 module TimeRangeConcern
   extend ActiveSupport::Concern
+  include RansackParamsConcern
 
   included do
     # Define the constant in the including class - ordered by most common usage
@@ -40,8 +41,6 @@ module TimeRangeConcern
     end_time = Time.zone.now
     selected_time_range = default_key
 
-    ransack_params = params[:q] || {}
-
     # Priority 1: Page-specific preset from dropdown (check this first!)
     if ransack_params[:period_start_range].present? && ransack_params[:period_start_range].to_sym != :custom
       # Predefined time range from dropdown
@@ -59,22 +58,30 @@ module TimeRangeConcern
     elsif ransack_params[:period_start_range].present? && ransack_params[:period_start_range].to_sym == :custom && ransack_params[:custom_date_range].present? && ransack_params[:custom_date_range].include?(" to ")
       # Custom datetime range from custom range picker
       dates = ransack_params[:custom_date_range].split(" to ")
-      start_time = parse_time_param(dates[0].strip)
-      end_time = parse_time_param(dates[1].strip)
-      selected_time_range = :custom
+      custom_start = parse_time_param(dates[0].strip)
+      custom_end = parse_time_param(dates[1].strip)
+      if custom_start && custom_end
+        start_time = custom_start
+        end_time = custom_end
+        selected_time_range = :custom
+      end
     # Priority 3: Page-specific filters (chart zoom)
     elsif ransack_params[:occurred_at_gteq].present? && ransack_params[:occurred_at_lt].present?
       # Custom time range from chart zoom
-      start_time = parse_time_param(ransack_params[:occurred_at_gteq])
-      end_time = parse_time_param(ransack_params[:occurred_at_lt])
-      selected_time_range = :custom
+      zoom_start = parse_time_param(ransack_params[:occurred_at_gteq])
+      zoom_end = parse_time_param(ransack_params[:occurred_at_lt])
+      if zoom_start && zoom_end
+        start_time = zoom_start
+        end_time = zoom_end
+        selected_time_range = :custom
+      end
     # Priority 4: Time range selector (from session)
     elsif session[:time_range_preference].present?
       preference = session[:time_range_preference]
       if preference.is_a?(Hash) && preference["type"] == "custom"
         # Custom range from time range selector
-        start_time = parse_time_param(preference["start_time"])
-        end_time = parse_time_param(preference["end_time"])
+        start_time = parse_time_param(preference["start_time"]) || start_time
+        end_time = parse_time_param(preference["end_time"]) || end_time
         selected_time_range = :custom
       else
         # Preset from time range selector
@@ -90,8 +97,8 @@ module TimeRangeConcern
       end
     # Priority 5: Global filters (from session)
     elsif session_global_filters["start_time"].present? || session_global_filters["end_time"].present?
-      start_time = parse_time_param(session_global_filters["start_time"]) if session_global_filters["start_time"].present?
-      end_time = parse_time_param(session_global_filters["end_time"]) if session_global_filters["end_time"].present?
+      start_time = parse_time_param(session_global_filters["start_time"]) || start_time
+      end_time = parse_time_param(session_global_filters["end_time"]) || end_time
       selected_time_range = :custom
     end
     # Priority 6: Default time range (already set above)
@@ -112,17 +119,24 @@ module TimeRangeConcern
 
   private
 
+  # Returns nil for anything that does not parse, so a hand-edited or stale
+  # value falls back to the default range instead of raising.
   def parse_time_param(param)
     case param
     when Time, DateTime
       param.in_time_zone
     when String
+      return nil if param.blank?
+
       # Parse as server local time (not UTC, not Time.zone)
       # This ensures flatpickr datetime strings are interpreted in server's timezone
       Time.parse(param).localtime
+    when Numeric
+      Time.zone.at(param)
     else
-      # Assume it's an integer timestamp
-      Time.zone.at(param.to_i)
+      nil
     end
+  rescue ArgumentError, TypeError, RangeError
+    nil
   end
 end

data/app/controllers/rails_pulse/application_controller.rb

@@ -2,11 +2,30 @@ module RailsPulse
   class ApplicationController < ActionController::Base
     include PaginationConcern
     include SessionFiltersConcern
+    include RansackParamsConcern
+
+    # Declared here rather than inherited. ActionController::Base only gets
+    # protect_from_forgery from the host's `default_protect_from_forgery`,
+    # which load_defaults 5.2+ turns on — a host still on an older
+    # load_defaults (or one that set the flag false and calls
+    # protect_from_forgery in its own ApplicationController) would leave every
+    # state-changing engine endpoint forgeable. Idempotent when the host
+    # already has it; the deployments API and assets controller keep their
+    # explicit skips.
+    protect_from_forgery with: :exception
 
     before_action :authenticate_rails_pulse_user!
     before_action :set_onboarding_state
     before_action :load_deployment_markers
 
+    # Values accepted into the cookie session. Everything else is dropped:
+    # the session has a 4 KB ceiling and a stored value is re-parsed on every
+    # later request, so an unbounded or unparseable string would 500 the
+    # dashboard until the cookie is cleared.
+    TIME_RANGE_PRESETS = %w[last_24_hours last_7_days last_14_days last_30_days].freeze
+    PERFORMANCE_THRESHOLDS = %w[slow very_slow critical].freeze
+    MAX_TIME_PARAM_LENGTH = 64
+
     def set_global_filters
       if params[:clear] == "true"
         session.delete(:global_filters)
@@ -15,21 +34,24 @@ module RailsPulse
         filters = session[:global_filters] || {}
 
         # Update time filters if provided
-        if params[:start_time].present? && params[:end_time].present?
-          filters["start_time"] = params[:start_time]
-          filters["end_time"] = params[:end_time]
+        start_time = valid_time_param(params[:start_time])
+        end_time = valid_time_param(params[:end_time])
+        if start_time && end_time
+          filters["start_time"] = start_time
+          filters["end_time"] = end_time
         end
 
-        # Update performance threshold if provided (or remove if empty)
-        if params[:performance_threshold].present?
-          filters["performance_threshold"] = params[:performance_threshold]
+        # Update performance threshold if provided (or remove if empty/unknown)
+        threshold = params[:performance_threshold].to_s
+        if PERFORMANCE_THRESHOLDS.include?(threshold)
+          filters["performance_threshold"] = threshold
         else
           filters.delete("performance_threshold")
         end
 
         # Update tag visibility - convert enabled tags to disabled tags
         all_tags = RailsPulse.configuration.tags
-        enabled_tags = params[:enabled_tags] || []
+        enabled_tags = Array(params[:enabled_tags]).map(&:to_s)
 
         # Handle "non_tagged" separately
         session[:show_non_tagged] = enabled_tags.include?("non_tagged")
@@ -50,28 +72,45 @@ module RailsPulse
       end
 
       # Redirect back to the referring page or root
-      redirect_back(fallback_location: root_path)
+      redirect_back(fallback_location: root_path, allow_other_host: false)
     end
 
     def set_time_range
-      if params[:preset].present?
+      preset = params[:preset].to_s
+      start_time = valid_time_param(params[:start_time])
+      end_time = valid_time_param(params[:end_time])
+
+      if preset.present?
         # Store preset selection
-        session[:time_range_preference] = params[:preset]
-      elsif params[:start_time].present? && params[:end_time].present?
+        session[:time_range_preference] = preset if TIME_RANGE_PRESETS.include?(preset)
+      elsif start_time && end_time
         # Store custom range
         session[:time_range_preference] = {
           type: "custom",
-          start_time: params[:start_time],
-          end_time: params[:end_time]
+          start_time: start_time,
+          end_time: end_time
         }
       end
 
       # Redirect back to the referring page or root
-      redirect_back(fallback_location: root_path)
+      redirect_back(fallback_location: root_path, allow_other_host: false)
     end
 
     private
 
+    # The original string if it is short enough to live in the session and
+    # Time.parse accepts it (TimeRangeConcern parses it back the same way);
+    # nil otherwise.
+    def valid_time_param(value)
+      value = value.to_s.strip
+      return nil if value.blank? || value.length > MAX_TIME_PARAM_LENGTH
+
+      Time.parse(value)
+      value
+    rescue ArgumentError, TypeError
+      nil
+    end
+
     def partial_request?
       request.headers["X-Partial-Request"] == "true"
     end
@@ -80,33 +119,65 @@ module RailsPulse
       RailsPulse.logger
     end
 
+    # Two hooks, run in order:
+    #
+    # * `authentication_method` — the legacy hook. It denies by rendering or
+    #   redirecting (the documented `unless signed_in? then redirect_to`
+    #   style). Returning literal `false` without responding is also a
+    #   denial; returning nil (which `unless … end` does on success) allows.
+    # * `authorize` — a fail-closed predicate. Anything falsy is a 403.
+    #
+    # With neither configured, HTTP Basic against RAILS_PULSE_PASSWORD.
     def authenticate_rails_pulse_user!
-      return unless RailsPulse.configuration.authentication_enabled
+      config = RailsPulse.configuration
+      return unless config.authentication_enabled
 
-      # If no authentication method is configured, use fallback HTTP Basic Auth
-      if RailsPulse.configuration.authentication_method.nil?
+      if config.authentication_method.nil? && config.authorize.nil?
         return fallback_http_basic_auth
       end
 
-      # Safely execute authentication method in controller context
-      case RailsPulse.configuration.authentication_method
+      unless config.authentication_method.nil?
+        run_authentication_method(config.authentication_method)
+        return if performed?
+      end
+
+      run_authorize_predicate(config.authorize) if config.authorize
+    rescue StandardError => e
+      logger.warn "RailsPulse authentication failed: #{e.message}"
+      redirect_to config.authentication_redirect_path
+    end
+
+    def run_authentication_method(hook)
+      result = case hook
       when Proc
-        instance_exec(&RailsPulse.configuration.authentication_method)
+        instance_exec(&hook)
       when Symbol, String
-        method_name = RailsPulse.configuration.authentication_method.to_s
-        if respond_to?(method_name, true)
-          send(method_name)
-        else
+        method_name = hook.to_s
+        unless respond_to?(method_name, true)
           logger.error "RailsPulse: Authentication method '#{method_name}' not found"
-          render plain: "Authentication configuration error", status: :internal_server_error
+          return render plain: "Authentication configuration error", status: :internal_server_error
         end
+        send(method_name)
       else
-        logger.error "RailsPulse: Invalid authentication method type: #{RailsPulse.configuration.authentication_method.class}"
-        render plain: "Authentication configuration error", status: :internal_server_error
+        logger.error "RailsPulse: Invalid authentication method type: #{hook.class}"
+        return render plain: "Authentication configuration error", status: :internal_server_error
       end
-    rescue StandardError => e
-      logger.warn "RailsPulse authentication failed: #{e.message}"
-      redirect_to RailsPulse.configuration.authentication_redirect_path
+
+      return if performed?
+      return unless result == false
+
+      # `proc { current_user&.admin? }` reads as a predicate but never halts
+      # the chain. Treat an explicit false as the denial it was meant to be.
+      logger.warn "RailsPulse: authentication_method returned false without rendering or redirecting; " \
+                  "denying access. Use config.authorize for predicate-style checks."
+      render plain: "Forbidden", status: :forbidden
+    end
+
+    def run_authorize_predicate(predicate)
+      allowed = predicate.arity.zero? ? instance_exec(&predicate) : predicate.call(self)
+      return if allowed
+
+      render plain: "Forbidden", status: :forbidden
     end
 
     def fallback_http_basic_auth
@@ -119,7 +190,8 @@ module RailsPulse
           logger.error "RailsPulse: No authentication method configured and RAILS_PULSE_PASSWORD not set. Access denied."
           false
         else
-          username == expected_username && password == expected_password
+          ActiveSupport::SecurityUtils.secure_compare(username.to_s, expected_username) &&
+            ActiveSupport::SecurityUtils.secure_compare(password.to_s, expected_password)
         end
       end
     end
@@ -134,6 +206,7 @@ module RailsPulse
       last_summary_at = RailsPulse::Summary.maximum(:updated_at)
       @has_summaries = last_summary_at.present?
       @summaries_stale = RailsPulse.configuration.warn_on_stale_summaries && @has_summaries && last_summary_at < 2.hours.ago
+      @route_backfill_pending = RailsPulse::Route.needs_action_backfill?
     end
   end
 end

data/app/controllers/rails_pulse/dashboard_controller.rb

@@ -33,6 +33,15 @@ module RailsPulse
 
       # System Health bar
       @health_summary = RailsPulse::Dashboard::HealthSummary.new(disabled_tags: disabled_tags, show_non_tagged: show_non_tagged, period: @period).to_health_data
+
+      @storage_status = RailsPulse::Dashboard::StorageStatus.new
+
+      # Deployments panel — scoped to the same window as the chart markers so
+      # the panel and the markers drawn on the charts always agree.
+      deployments_in_range = RailsPulse::Deployment.for_range(Time.zone.at(@start_time), Time.zone.at(@end_time))
+      @deployment_count = deployments_in_range.count
+      @recent_deployments = deployments_in_range.recent.limit(4)
+      @last_deployment = RailsPulse::Deployment.recent.first
     end
   end
 end

data/app/controllers/rails_pulse/deployments_controller.rb

@@ -1,7 +1,22 @@
 module RailsPulse
   class DeploymentsController < ApplicationController
-    skip_before_action :authenticate_rails_pulse_user!
-    before_action :authenticate_deployment_request!
+    # The API actions authenticate by token so CI can post without a session;
+    # the browsable pages use the dashboard's own authentication like every
+    # other page. Scoping the skip to create/finish means adding a UI does not
+    # widen the hole the 0.4.0 audit closed.
+    skip_before_action :authenticate_rails_pulse_user!, only: %i[create finish]
+    skip_before_action :verify_authenticity_token, only: %i[create finish]
+    before_action :authenticate_deployment_request!, only: %i[create finish]
+
+    def index
+      @ransack_query = Deployment.ransack(ransack_params)
+      @ransack_query.sorts = "started_at desc" if @ransack_query.sorts.empty?
+      @pagination, @table_data = paginate(@ransack_query.result, limit: session_pagination_limit)
+    end
+
+    def show
+      @deployment = Deployment.find(params[:id])
+    end
 
     def create
       deployment = RailsPulse::Deployment.new(
@@ -44,10 +59,16 @@ module RailsPulse
     def authenticate_deployment_request!
       token = RailsPulse.configuration.deployment_api_token
       if token.present?
-        provided = request.headers["X-Rails-Pulse-Token"]
-        render json: { error: "Unauthorized" }, status: :unauthorized unless provided == token
-      else
+        provided = request.headers["X-Rails-Pulse-Token"].to_s
+        unless ActiveSupport::SecurityUtils.secure_compare(provided, token)
+          render json: { error: "Unauthorized" }, status: :unauthorized
+        end
+      elsif RailsPulse.configuration.authentication_enabled
         authenticate_rails_pulse_user!
+      else
+        # No token configured and authentication disabled — fail closed.
+        # Without a token there is no way to verify the caller.
+        render json: { error: "Unauthorized — set deployment_api_token or enable authentication" }, status: :unauthorized
       end
     end
 

data/app/controllers/rails_pulse/exception_occurrences_controller.rb

@@ -0,0 +1,19 @@
+module RailsPulse
+  class ExceptionOccurrencesController < ApplicationController
+    before_action :set_exception_group
+    before_action :set_occurrence
+
+    def show
+    end
+
+    private
+
+    def set_exception_group
+      @exception_group = ExceptionGroup.find(params[:exception_id])
+    end
+
+    def set_occurrence
+      @occurrence = @exception_group.occurrences.find(params[:id])
+    end
+  end
+end

data/app/controllers/rails_pulse/exceptions_controller.rb

@@ -0,0 +1,119 @@
+module RailsPulse
+  class ExceptionsController < ApplicationController
+    include TimeRangeConcern
+    include TagFilterConcern
+    include DeploymentMarkersConcern
+
+    before_action :set_exception_group, only: %i[show update]
+
+    def index
+      ransack_params = self.ransack_params.dup
+      apply_default_status_filter!(ransack_params)
+
+      @ransack_query = ExceptionGroup.ransack(ransack_params)
+      @ransack_query.sorts = "last_seen_at desc" if @ransack_query.sorts.empty?
+      @pagination, @table_data = paginate(@ransack_query.result, limit: session_pagination_limit)
+
+      setup_frequency_view
+    end
+
+    def show
+      occurrences = @exception_group.occurrences.order(occurred_at: :desc)
+      @latest_occurrence = occurrences.first
+      @pagination, @occurrences = paginate(occurrences, limit: session_pagination_limit)
+    end
+
+    def update
+      if params.key?(:preserve)
+        update_preserve
+      else
+        update_status
+      end
+    end
+
+    private
+
+    # The index is a list of groups, not an aggregate table, so it does not use
+    # ChartTableConcern. It still needs a time range and a frequency series:
+    # without them the page can say what is failing but not whether it is
+    # getting worse, which is the question users actually arrive with.
+    def setup_frequency_view
+      # Timestamps, not Times, to match every other index controller — the
+      # shared concerns and helpers that read @start_time expect integers.
+      @start_time, @end_time, @selected_time_range, @time_diff_hours = setup_time_range
+
+      @period_type = @time_diff_hours <= 25 ? "hour" : "day"
+      period_days  = window_days_for(@selected_time_range)
+
+      populate_deployment_markers
+
+      @occurrence_volume_chart = Exceptions::Charts::OccurrenceVolume.new(
+        start_time: Time.zone.at(@start_time),
+        end_time: Time.zone.at(@end_time),
+        period_type: @period_type
+      ).to_chart_data
+
+      card_params = { period: period_days, period_type: @period_type }
+
+      @total_occurrences_metric_card = Exceptions::Cards::TotalOccurrences.new(**card_params).to_metric_card
+      @exception_rate_metric_card    = Exceptions::Cards::ExceptionRate.new(**card_params).to_metric_card
+      @open_groups_metric_card       = Exceptions::Cards::OpenGroups.new(**card_params).to_metric_card
+    end
+
+    def set_exception_group
+      @exception_group = ExceptionGroup.find(params[:id])
+    end
+
+    # The card copy ("compared to previous N days") has to name the range the
+    # user picked. Measuring the span instead reads one day long, because the
+    # range runs from the start of the first day to the end of the last.
+    def window_days_for(selected_range)
+      case selected_range.to_s
+      when "last_24_hours" then 1
+      when "last_7_days"   then 7
+      when "last_14_days"  then 14
+      when "last_30_days"  then 30
+      else [ ((@end_time - @start_time) / 1.day.to_i).round, 1 ].max
+      end
+    end
+
+    # Exceptions are low-volume compared with requests, so a day is rarely
+    # enough to see a trend. Matches the jobs and queries defaults.
+    def default_time_range_key
+      :last_7_days
+    end
+
+    # Default the list to open groups. An explicit blank status ("All")
+    # clears the filter; any other value is passed through to ransack.
+    def apply_default_status_filter!(ransack_params)
+      if !ransack_params.key?(:status_eq) && !ransack_params.key?("status_eq")
+        ransack_params[:status_eq] = "open"
+      elsif ransack_params[:status_eq].blank? && ransack_params["status_eq"].blank?
+        ransack_params.delete(:status_eq)
+        ransack_params.delete("status_eq")
+      end
+    end
+
+    def update_preserve
+      @exception_group.update!(preserve: ActiveModel::Type::Boolean.new.cast(params[:preserve]))
+      flash[:notice] = @exception_group.preserve? ? "Exception preserved from cleanup." : "Exception no longer preserved."
+      redirect_to exception_path(@exception_group)
+    end
+
+    def update_status
+      new_status = params[:status]
+      unless ExceptionGroup::STATUSES.include?(new_status)
+        head :unprocessable_entity
+        return
+      end
+
+      @exception_group.update!(
+        status: new_status,
+        resolved_at: new_status == "resolved" ? Time.current : nil
+      )
+
+      flash[:notice] = "Exception marked as #{new_status}."
+      redirect_to exception_path(@exception_group)
+    end
+  end
+end

data/app/controllers/rails_pulse/job_runs_controller.rb

@@ -6,7 +6,7 @@ module RailsPulse
     before_action :set_run, only: :show
 
     def index
-      @ransack_query = @job.runs.ransack(params[:q])
+      @ransack_query = @job.runs.ransack(ransack_params)
       @pagination, @runs = paginate(@ransack_query.result.order(occurred_at: :desc), limit: session_pagination_limit)
       @table_data = @runs
     end