@bakery-framework/plugin-dashboard 1.0.0

package/LICENSE

@@ -0,0 +1,19 @@
+Copyright (c) 2026 Kyle Cyrus Santos Obille
+
+The Software is provided subject to the standard MIT License, as detailed below, with the addition of the Commons Clause v1.0.
+
+The Commons Clause v1.0
+
+The Software is provided to you by the Licensor under the License, as defined below, subject to the following condition.
+
+Without limiting other conditions in the License, the grant of rights under the License will not include, and the License does not grant to you, the right to Sell the Software.
+
+For purposes of the foregoing, “Sell” means practicing any or all of the rights granted to you under the License to provide to third parties, for a fee or other consideration (including without limitation fees for hosting or consulting/support services related to the Software), a product or service whose value derives, entirely or substantially, from the functionality of the Software. Any license notice or attribution required by the License must also include this Commons Clause License Condition notice.
+
+Standard MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software (subject to the Commons Clause condition above), and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,44 @@
+# @bakery-framework/plugin-dashboard
+
+A built-in admin console for
+[Bakery](https://github.com/obillekyle/bakery): database browsing, logs and
+runtime state.
+
+```bash
+bun add @bakery-framework/plugin-dashboard
+```
+
+## Usage
+
+```ts
+// server.config.ts
+import { defineConfig } from '@bakery-framework/core'
+import dashboardPlugin from '@bakery-framework/plugin-dashboard'
+
+export default defineConfig({
+  root: 'src',
+  plugins: [
+    dashboardPlugin({
+      authorize: req => Boolean(req.session?.get('isAdmin')),
+    }),
+  ],
+})
+```
+
+**The dashboard does not authenticate anyone itself.** Your application already
+knows who its users are, so it decides: `authorize` returns true to allow a
+request through. Ship it without one and you are exposing your database browser.
+
+`enabled: false` keeps it out of a build entirely — the documented way to
+disable it in production.
+
+## License
+
+MIT with the Commons Clause v1.0 — see [LICENSE](./LICENSE).
+
+**Not an OSI-approved licence.** The Commons Clause removes the right to *sell*
+the software — meaning to charge for a product or service whose value derives
+substantially from it, hosting and support included. Everything else the MIT
+licence grants is unchanged: use it, modify it, ship it inside your own product.
+If your organisation only permits OSI-approved dependencies, this will not pass
+that check.

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@bakery-framework/plugin-dashboard",
+  "version": "1.0.0",
+  "description": "Bakery dashboard plugin.",
+  "keywords": [
+    "bakery",
+    "bun",
+    "dashboard",
+    "admin",
+    "plugin"
+  ],
+  "author": "obillekyle",
+  "license": "SEE LICENSE IN LICENSE",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/obillekyle/bakery.git",
+    "directory": "packages/plugins/dashboard"
+  },
+  "homepage": "https://github.com/obillekyle/bakery#readme",
+  "bugs": "https://github.com/obillekyle/bakery/issues",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./src/index.ts",
+  "exports": {
+    ".": "./src/index.ts",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "src",
+    "!src/**/*.test.ts",
+    "!src/tests"
+  ],
+  "dependencies": {
+    "@bakery-framework/core": "^1.0.0",
+    "@bakery-framework/orm": "^1.0.0"
+  },
+  "engines": {
+    "bun": ">=1.3.14"
+  }
+}

package/src/authorize.ts

@@ -0,0 +1,76 @@
+import { getClientIp } from '@bakery-framework/core/utils/http'
+
+/**
+ * Decides whether a request may use the console.
+ *
+ * The dashboard used to run its own identity system: a shared `DASHPASS`
+ * secret, a login form, a session flag, a constant-time compare and a
+ * failed-attempt backoff map. That is a lot of security-sensitive surface for
+ * a framework to own, and it composed with nothing — an app with real users
+ * and roles still had to hand out a second, shared password.
+ *
+ * So the dashboard no longer authenticates anyone. The host application, which
+ * already knows who its users are, supplies a predicate.
+ */
+export type AuthorizeFn = (req: Request) => boolean | Promise<boolean>
+
+/**
+ * Addresses only. `'localhost'` used to be a member because the request's
+ * *hostname* was compared against this set as well — see below for why that is
+ * gone. A peer address is never the string `localhost`, and accepting it would
+ * mean an `X-Forwarded-For: localhost` counted as loopback under `trustProxy`.
+ */
+const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1'])
+
+/** True when the request came from this machine. */
+export function isLoopback(req: Request): boolean {
+  // The peer address is the only evidence here the client does not choose.
+  // This used to fall back to `new URL(req.url).hostname`, which Bun builds
+  // from the client's own `Host` header — and `DEFAULT_HOST` is 0.0.0.0, so a
+  // dev server listens on every interface. Any peer on the LAN could send
+  // `Host: localhost` and be handed the database browser.
+  //
+  // getClientIp reads config and the live server, either of which may be
+  // absent (tests, early boot). An address that cannot be determined is
+  // indeterminate, and an indeterminate answer is a denial — not a reason to
+  // consult something the requester controls.
+  let ip = ''
+  try {
+    ip = getClientIp(req)
+  } catch {
+    // See above: no server and no config means no evidence, which is a denial.
+    ip = ''
+  }
+
+  return LOOPBACK.has(ip)
+}
+
+/**
+ * Fail closed. With no predicate configured the console is reachable only from
+ * loopback in development, and from nowhere in production — so forgetting to
+ * configure it cannot expose a database browser to the internet.
+ */
+export function defaultAuthorize(req: Request): boolean {
+  if (!import.meta.env.DEV) return false
+  return isLoopback(req)
+}
+
+export function resolveAuthorize(authorize?: AuthorizeFn): AuthorizeFn {
+  return authorize ?? defaultAuthorize
+}
+
+/**
+ * Run a predicate without letting a throwing one grant access.
+ */
+export async function isAuthorized(
+  authorize: AuthorizeFn,
+  req: Request,
+): Promise<boolean> {
+  try {
+    return Boolean(await authorize(req))
+  } catch {
+    // An authorization check that errors is indeterminate, and an
+    // indeterminate answer is a denial.
+    return false
+  }
+}

package/src/client/dashboard.ts

@@ -0,0 +1,165 @@
+import {
+  addActiveFilter,
+  changePageSize,
+  clearActiveFilters,
+  closeEditModal,
+  closeExportMenuIfOutside,
+  closeImportModal,
+  closeInsertModal,
+  deleteTableRow,
+  exportToCSV,
+  exportToJSON,
+  fetchTableData,
+  filterTablesList,
+  handleCsvFileSelect,
+  inspectTable,
+  loadSchema,
+  nextPage,
+  openEditModal,
+  openImportModal,
+  openInsertModal,
+  prevPage,
+  removeActiveFilter,
+  runQuery,
+  selectDatabaseTable,
+  startInlineEdit,
+  submitEditRow,
+  submitImportCsv,
+  submitInsertRow,
+  toggleExportMenu,
+  toggleGridSort,
+  truncateCurrentTable,
+} from './parts/database'
+import { refreshShimmerCache } from './parts/effects'
+import { clearLogs, initLogsWebSocket, toggleLogsPlay } from './parts/logs'
+import {
+  changeSessionPageSize,
+  loadSessions,
+  nextSessionPage,
+  openSessionKeyEditor,
+  prevSessionPage,
+  queueSessionSearch,
+  revokeSession,
+  sessionKeyAction,
+} from './parts/sessions'
+import {
+  bindSparklineTooltips,
+  changePagesFilter,
+  changeTimescale,
+  initAnalyticsWebSocket,
+  loadStats,
+  resetAnalytics,
+} from './parts/stats'
+import { SegmentedProgress } from './parts/utils'
+
+declare const match: any
+
+function toggleProfileDropdown(event: Event) {
+  if (event) event.stopPropagation()
+  const menu = document.getElementById('profile-menu')
+  if (menu) {
+    const isVisible = menu.style.display === 'flex'
+    menu.style.display = isVisible ? 'none' : 'flex'
+  }
+}
+
+function switchTab(tabId: string) {
+  const tabBtns = document.querySelectorAll('.tab-btn')
+  const panels = document.querySelectorAll('.panel')
+
+  for (const btn of tabBtns) {
+    btn.classList.remove('active')
+
+    if (btn.getAttribute('onclick')?.includes(tabId)) {
+      btn.classList.add('active')
+    }
+  }
+
+  for (const panel of panels) {
+    panel.classList.toggle('active', panel.id === `panel-${tabId}`)
+  }
+
+  const crumb = document.getElementById('crumb-current')
+  const label = document.querySelector(`.tab-btn.active span:last-child`)
+  if (crumb && label) crumb.textContent = label.textContent
+
+  match(tabId, {
+    sessions: loadSessions,
+    database: loadSchema,
+    logs: initLogsWebSocket,
+    'top-pages': () => loadStats(true),
+  })
+
+  refreshShimmerCache()
+}
+
+window.addEventListener('click', closeExportMenuIfOutside)
+
+window.addEventListener('click', e => {
+  const menu = document.getElementById('profile-menu')
+  const trigger = document.querySelector('.profile-trigger-btn')
+  if (
+    menu &&
+    trigger &&
+    !trigger.contains(e.target as Node) &&
+    !menu.contains(e.target as Node)
+  ) {
+    menu.style.display = 'none'
+  }
+})
+
+const w = window as any
+w.SegmentedProgress = SegmentedProgress
+w.switchTab = switchTab
+w.resetAnalytics = resetAnalytics
+w.changePagesFilter = changePagesFilter
+w.toggleProfileDropdown = toggleProfileDropdown
+w.changeTimescale = changeTimescale
+
+w.loadSessions = loadSessions
+w.revokeSession = revokeSession
+w.queueSessionSearch = queueSessionSearch
+w.prevSessionPage = prevSessionPage
+w.nextSessionPage = nextSessionPage
+w.changeSessionPageSize = changeSessionPageSize
+w.sessionKeyAction = sessionKeyAction
+w.openSessionKeyEditor = openSessionKeyEditor
+
+w.loadSchema = loadSchema
+w.filterTablesList = filterTablesList
+w.selectDatabaseTable = selectDatabaseTable
+w.fetchTableData = fetchTableData
+w.toggleGridSort = toggleGridSort
+w.prevPage = prevPage
+w.nextPage = nextPage
+w.changePageSize = changePageSize
+w.startInlineEdit = startInlineEdit
+w.addActiveFilter = addActiveFilter
+w.removeActiveFilter = removeActiveFilter
+w.clearActiveFilters = clearActiveFilters
+w.openInsertModal = openInsertModal
+w.closeInsertModal = closeInsertModal
+w.submitInsertRow = submitInsertRow
+w.openEditModal = openEditModal
+w.closeEditModal = closeEditModal
+w.submitEditRow = submitEditRow
+w.openImportModal = openImportModal
+w.closeImportModal = closeImportModal
+w.handleCsvFileSelect = handleCsvFileSelect
+w.submitImportCsv = submitImportCsv
+w.toggleExportMenu = toggleExportMenu
+w.exportToCSV = exportToCSV
+w.exportToJSON = exportToJSON
+w.truncateCurrentTable = truncateCurrentTable
+w.deleteTableRow = deleteTableRow
+w.inspectTable = inspectTable
+w.runQuery = runQuery
+
+w.initLogsWebSocket = initLogsWebSocket
+w.toggleLogsPlay = toggleLogsPlay
+w.clearLogs = clearLogs
+
+if (document.getElementById('panel-stats')) {
+  bindSparklineTooltips()
+  initAnalyticsWebSocket()
+}