@cybermem/dashboard 0.1.0 → 0.5.1

package/e2e/crud-happy-path.spec.ts

@@ -0,0 +1,214 @@
+/**
+ * CRUD Happy Path E2E Test
+ *
+ * Tests the complete CRUD flow via MCP API and verifies
+ * that X-Client-Name header propagates to dashboard metrics.
+ *
+ * Run with: npm run test:e2e -- crud-happy-path.spec.ts
+ */
+
+import { expect, test } from '@playwright/test';
+import { execSync } from 'child_process';
+
+const MCP_URL = 'http://127.0.0.1:8626/mcp';
+const CLIENT_NAME = `e2e-crud-${Date.now()}`;
+
+// Helpers
+const RPC = (method: string, params: any = {}, id: number) => ({
+    jsonrpc: "2.0",
+    id,
+    method,
+    params
+});
+
+const resetDB = async () => {
+    try {
+        // Remove database files
+        try {
+            execSync("docker exec cybermem-openmemory sh -c 'rm -f /data/openmemory.sqlite*'", { stdio: 'ignore' });
+        } catch (e) { /* ignore - container might not be running */ }
+
+        // Fix permissions on data directory to prevent SQLITE_READONLY after restart
+        try {
+            execSync("docker run --rm -v cybermem-openmemory-data:/data alpine sh -c 'chown -R 1001:1001 /data && chmod 777 /data'", { stdio: 'ignore' });
+        } catch (e) { /* ignore */ }
+
+        // Restart container
+        execSync('docker restart cybermem-openmemory', { stdio: 'ignore' });
+
+        // Poll for health AND MCP routing (up to 60s)
+        const start = Date.now();
+        while (Date.now() - start < 60000) {
+            try {
+                const healthRes = await fetch('http://127.0.0.1:8626/health');
+                if (healthRes.ok) {
+                    // Also verify MCP routing is working (405 is fine for GET, 404 means not ready)
+                    const mcpRes = await fetch('http://127.0.0.1:8626/mcp');
+                    if (mcpRes.status !== 404) {
+                        // Give additional time for MCP to stabilize
+                        await new Promise(r => setTimeout(r, 3000));
+                        return true;
+                    }
+                }
+            } catch (e) { /* retry */ }
+            await new Promise(r => setTimeout(r, 1000));
+        }
+        console.log('⚠️ DB reset timeout, but proceeding');
+        return true;
+    } catch (e) {
+        console.error('DB Reset failed:', e);
+        return false;
+    }
+};
+
+const mcpCall = async (method: string, params: any, id: number) => {
+    const res = await fetch(MCP_URL, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'Accept': 'application/json, text/event-stream',
+            'X-Client-Name': CLIENT_NAME
+        },
+        body: JSON.stringify(RPC(method, params, id))
+    });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    return res.json();
+};
+
+// Skip DB reset if SKIP_DB_RESET=true (for faster runs when stack is clean)
+const SKIP_DB_RESET = process.env.SKIP_DB_RESET === 'true';
+
+// Run tests in serial mode since they share state (memoryId)
+test.describe.configure({ mode: 'serial' });
+
+test.describe('CRUD Happy Path with X-Client-Name', () => {
+    let memoryId: string;
+
+    test.beforeAll(async () => {
+        if (SKIP_DB_RESET) {
+            console.log('⏭️ Skipping DB reset (SKIP_DB_RESET=true)');
+            return;
+        }
+        console.log(`🧹 Resetting DB before test suite...`);
+        await resetDB();
+    });
+
+    test.afterAll(async () => {
+        if (SKIP_DB_RESET) {
+            console.log('⏭️ Skipping DB reset (SKIP_DB_RESET=true)');
+            return;
+        }
+        console.log(`🧹 Resetting DB after test suite...`);
+        await resetDB();
+    });
+
+    test('1. Initialize MCP connection', async () => {
+        const initRes: any = await mcpCall("initialize", {
+            protocolVersion: "2024-11-05",
+            capabilities: { roots: { listChanged: true } },
+            clientInfo: { name: "e2e-crud-tester", version: "1.0.0" }
+        }, 1);
+
+        expect(initRes.result?.serverInfo?.name).toBe("openmemory-mcp");
+        await mcpCall("notifications/initialized", {}, 2);
+    });
+
+    test('2. CREATE - Store memory', async () => {
+        const storeRes: any = await mcpCall("tools/call", {
+            name: "openmemory_store",
+            arguments: {
+                content: `CRUD Happy Path Test Memory ${CLIENT_NAME}`,
+                tags: ["e2e", "crud-test"]
+            }
+        }, 3);
+
+        expect(storeRes.error).toBeUndefined();
+        const payload = JSON.parse(storeRes.result.content[1].text);
+        memoryId = payload.id;
+        expect(memoryId).toBeTruthy();
+        console.log(`   ✅ Created memory: ${memoryId}`);
+    });
+
+    test('3. READ - Get memory by ID', async () => {
+        const getRes: any = await mcpCall("tools/call", {
+            name: "openmemory_get",
+            arguments: { id: memoryId }
+        }, 4);
+
+        expect(getRes.error).toBeUndefined();
+        const payload = JSON.parse(getRes.result.content[0].text);
+        expect(payload.content).toContain('CRUD Happy Path Test Memory');
+    });
+
+    test('4. READ - List memories', async () => {
+        const listRes: any = await mcpCall("tools/call", {
+            name: "openmemory_list",
+            arguments: { limit: 10 }
+        }, 5);
+
+        expect(listRes.error).toBeUndefined();
+        const payload = JSON.parse(listRes.result.content[1].text);
+        const found = payload.items.some((m: any) => m.id === memoryId);
+        expect(found).toBe(true);
+    });
+
+    test('5. READ - Query memories (semantic search)', async () => {
+        const queryRes: any = await mcpCall("tools/call", {
+            name: "openmemory_query",
+            arguments: { query: "CRUD Happy Path" }
+        }, 6);
+
+        expect(queryRes.error).toBeUndefined();
+    });
+
+    test('6. DELETE - Remove memory', async () => {
+        const deleteRes: any = await mcpCall("tools/call", {
+            name: "openmemory_delete",
+            arguments: { id: memoryId }
+        }, 7);
+
+        // DELETE may not exist in all OpenMemory versions - skip if not available
+        if (deleteRes.error?.message?.includes('not found')) {
+            test.skip();
+        }
+    });
+
+    test('7. Verify client appears in Dashboard', async ({ page }) => {
+        // Navigate to dashboard
+        await page.goto('http://localhost:3000');
+
+        // Login if needed
+        const passwordInput = page.getByPlaceholder('Enter admin password');
+        if (await passwordInput.isVisible()) {
+            await passwordInput.fill('admin');
+            await page.keyboard.press('Enter');
+        }
+
+        // Handle password alert modal if appears
+        const dontShowAgainButton = page.locator('button:has-text("Don\'t show again")');
+        if (await dontShowAgainButton.isVisible({ timeout: 2000 }).catch(() => false)) {
+            await dontShowAgainButton.click();
+        }
+
+        // Wait for dashboard to load
+        await expect(page.getByRole('heading', { name: 'CyberMem' })).toBeVisible({ timeout: 15000 });
+
+        // Wait for metrics to propagate (Prometheus scrape interval)
+        await page.waitForTimeout(5000);
+
+        // Scroll to find Audit Log section
+        const auditHeader = page.locator('h3:has-text("Audit Log")');
+        await auditHeader.scrollIntoViewIfNeeded();
+
+        // Verify audit log table is visible
+        await expect(page.locator('th:has-text("Client")')).toBeVisible({ timeout: 10000 });
+
+        // Look for our client in the audit log (partial match on e2e-crud)
+        // The client name should appear in audit log entries
+        const pageContent = await page.content();
+        const clientVisible = pageContent.includes('e2e-crud') || pageContent.includes('E2E CRUD');
+
+        console.log(`   Client ${CLIENT_NAME} visible in dashboard: ${clientVisible}`);
+        // Note: Client might show up as display name if mapped in clients.json
+    });
+});

package/e2e/metrics.spec.ts

@@ -0,0 +1,28 @@
+
+import { expect, test } from '@playwright/test';
+
+test.describe('Dashboard Metrics & Viz', () => {
+
+    test.beforeEach(async ({ page }) => {
+        // Login before each test
+        await page.goto('/');
+        const loginInput = page.getByPlaceholder('Enter admin password');
+        if (await loginInput.isVisible()) {
+            await loginInput.fill('admin');
+            await page.getByRole('button', { name: 'Login' }).click();
+            await expect(page.getByRole('heading', { name: 'CyberMem' })).toBeVisible();
+        }
+    });
+
+    test('should display core metrics', async ({ page }) => {
+        await expect(page.getByText('Memory Records')).toBeVisible();
+        await expect(page.getByText('Success Rate')).toBeVisible();
+    });
+
+    test('should check responsiveness', async ({ page }) => {
+        // Test already runs in desktop and mobile projects config
+        // Just verify critical components are visible
+        const nav = page.locator('header');
+        await expect(nav).toBeVisible();
+    });
+});

package/eslint.config.mjs

@@ -0,0 +1,15 @@
+import nextConfig from 'eslint-config-next';
+
+const eslintConfig = [
+  ...nextConfig,
+  {
+    rules: {
+      // Disable false-positive for sessionStorage reads in useEffect
+      'react-hooks/set-state-in-effect': 'off',
+      // Disable for shadcn/ui components that use Math.random() in useMemo
+      'react-hooks/purity': 'off',
+    },
+  },
+];
+
+export default eslintConfig;

package/lib/data/dashboard-context.tsx

@@ -17,12 +17,26 @@ interface ClientConfig {
   configType: string
 }
 
+interface ServiceStatus {
+  name: string
+  status: 'ok' | 'error' | 'warning'
+  message?: string
+  latencyMs?: number
+}
+
+interface SystemHealth {
+  overall: 'ok' | 'degraded' | 'error'
+  services: ServiceStatus[]
+  timestamp: string
+}
+
 interface DashboardContextType {
   strategy: DataSourceStrategy
   isDemo: boolean
   toggleDemo: () => void
   refreshSignal: number
   clientConfigs: ClientConfig[]
+  systemHealth: SystemHealth | null
 }
 
 const DashboardContext = createContext<DashboardContextType | undefined>(undefined)
@@ -32,6 +46,7 @@ export function DashboardProvider({ children }: { children: React.ReactNode }) {
   const [strategy, setStrategy] = useState<DataSourceStrategy>(new ProductionDataSource())
   const [refreshSignal, setRefreshSignal] = useState(0)
   const [clientConfigs, setClientConfigs] = useState<ClientConfig[]>([])
+  const [systemHealth, setSystemHealth] = useState<SystemHealth | null>(null)
 
   // Load configuration on mount
   useEffect(() => {
@@ -42,6 +57,34 @@ export function DashboardProvider({ children }: { children: React.ReactNode }) {
         .catch(err => console.error("Failed to load client configs:", err))
   }, [])
 
+  // Check system health
+  useEffect(() => {
+    const checkHealth = async () => {
+      try {
+        const res = await fetch("/api/health", { signal: AbortSignal.timeout(5000) })
+        if (res.ok) {
+          const data = await res.json()
+          setSystemHealth(data)
+        } else {
+          setSystemHealth({
+            overall: 'error',
+            services: [{ name: 'Dashboard API', status: 'error', message: `HTTP ${res.status}` }],
+            timestamp: new Date().toISOString()
+          })
+        }
+      } catch (error: any) {
+        setSystemHealth({
+          overall: 'error',
+          services: [{ name: 'Dashboard API', status: 'error', message: error.message || 'Connection failed' }],
+          timestamp: new Date().toISOString()
+        })
+      }
+    }
+    checkHealth()
+    const interval = setInterval(checkHealth, 30000) // Check every 30s
+    return () => clearInterval(interval)
+  }, [])
+
   const toggleDemo = () => {
     const newState = !isDemo
     setIsDemo(newState)
@@ -60,7 +103,7 @@ export function DashboardProvider({ children }: { children: React.ReactNode }) {
   }, [isDemo])
 
   return (
-    <DashboardContext.Provider value={{ strategy, isDemo, toggleDemo, refreshSignal, clientConfigs }}>
+    <DashboardContext.Provider value={{ strategy, isDemo, toggleDemo, refreshSignal, clientConfigs, systemHealth }}>
       {children}
     </DashboardContext.Provider>
   )

package/lib/rate-limit.ts

@@ -0,0 +1,77 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+interface RateLimitEntry {
+  count: number;
+  resetTime: number;
+}
+
+// In-memory rate limiter (for single-instance deployments)
+// For production clusters, consider using Redis
+const rateLimitMap = new Map<string, RateLimitEntry>();
+
+const RATE_LIMIT_WINDOW_MS = 60 * 1000; // 1 minute
+const RATE_LIMIT_MAX_REQUESTS = 100;    // 100 requests per minute
+
+function getClientIP(request: NextRequest): string {
+  const forwarded = request.headers.get('x-forwarded-for');
+  if (forwarded) {
+    return forwarded.split(',')[0].trim();
+  }
+  return request.headers.get('x-real-ip') || 'unknown';
+}
+
+export function checkRateLimit(request: NextRequest): { allowed: boolean; remaining: number; resetIn: number } {
+  const clientIP = getClientIP(request);
+  const now = Date.now();
+
+  const entry = rateLimitMap.get(clientIP);
+
+  if (!entry || now > entry.resetTime) {
+    // New window
+    rateLimitMap.set(clientIP, {
+      count: 1,
+      resetTime: now + RATE_LIMIT_WINDOW_MS
+    });
+    return { allowed: true, remaining: RATE_LIMIT_MAX_REQUESTS - 1, resetIn: RATE_LIMIT_WINDOW_MS };
+  }
+
+  if (entry.count >= RATE_LIMIT_MAX_REQUESTS) {
+    return {
+      allowed: false,
+      remaining: 0,
+      resetIn: entry.resetTime - now
+    };
+  }
+
+  entry.count++;
+  return {
+    allowed: true,
+    remaining: RATE_LIMIT_MAX_REQUESTS - entry.count,
+    resetIn: entry.resetTime - now
+  };
+}
+
+export function rateLimitResponse(resetIn: number): NextResponse {
+  return NextResponse.json(
+    { error: 'Too many requests. Please try again later.' },
+    {
+      status: 429,
+      headers: {
+        'Retry-After': String(Math.ceil(resetIn / 1000)),
+        'X-RateLimit-Limit': String(RATE_LIMIT_MAX_REQUESTS),
+        'X-RateLimit-Remaining': '0',
+        'X-RateLimit-Reset': String(Math.ceil(resetIn / 1000))
+      }
+    }
+  );
+}
+
+// Periodic cleanup of expired entries (every 5 minutes)
+setInterval(() => {
+  const now = Date.now();
+  for (const [key, entry] of rateLimitMap.entries()) {
+    if (now > entry.resetTime) {
+      rateLimitMap.delete(key);
+    }
+  }
+}, 5 * 60 * 1000);

package/middleware.ts

@@ -0,0 +1,43 @@
+import { NextResponse } from 'next/server'
+import type { NextRequest } from 'next/server'
+
+export function middleware(request: NextRequest) {
+  // CSRF Protection for mutating requests
+  if (['POST', 'PUT', 'DELETE', 'PATCH'].includes(request.method)) {
+    const origin = request.headers.get('origin')
+    const referer = request.headers.get('referer')
+    const host = request.headers.get('host')
+
+    // If no origin/referer, or they don't match the host, block it.
+    // NOTE: This is a strict check. For local dev, internal API calls might need bypass if no origin set.
+    // Browsers ALWAYS send Origin for cross-origin POSTs.
+    // For same-origin, they usually send it too, but we can fall back to Referer.
+    
+    // Allow server-side calls (no origin/referer) ONLY if coming from trusted internal network? 
+    // Actually, for a dashboard, we expect browser interaction.
+    // If strict compliance is needed: logic below.
+    
+    if (origin) {
+      const originHost = origin.replace(/^https?:\/\//, '')
+      if (originHost !== host) {
+         return new NextResponse('CSRF Validation Failed', { status: 403 })
+      }
+    } else if (referer) {
+       const refererHost = new URL(referer).host
+       if (refererHost !== host) {
+          return new NextResponse('CSRF Validation Failed', { status: 403 })
+       }
+    } else {
+       // Ideally we block requests without Origin/Referer in modern browsers for mutations
+       // But to be safe for non-browser tooling (if used): header check
+       // We'll enforce that the request must have come from our UI
+       // return new NextResponse('Missing Origin/Referer', { status: 403 })
+    }
+  }
+
+  return NextResponse.next()
+}
+
+export const config = {
+  matcher: '/api/:path*',
+}

package/package.json

@@ -1,14 +1,23 @@
 {
   "name": "@cybermem/dashboard",
-  "version": "0.1.0",
+  "version": "0.5.1",
+  "description": "CyberMem Monitoring Dashboard",
+  "homepage": "https://cybermem.dev",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mikhailkogan17/cybermem.git",
+    "directory": "packages/dashboard"
+  },
+  "license": "MIT",
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
     "build": "next build --webpack",
-    "dev": "next dev",
+    "dev": "next dev --webpack",
     "lint": "eslint .",
-    "start": "next start"
+    "start": "next start",
+    "test:e2e": "playwright test"
   },
   "dependencies": {
     "@headlessui/react": "^2.2.9",
@@ -76,13 +85,15 @@
     "zod": "3.25.76"
   },
   "devDependencies": {
+    "@eslint/eslintrc": "^3.3.3",
+    "@playwright/test": "^1.57.0",
     "@tailwindcss/postcss": "^4.1.9",
     "@types/dockerode": "^3.3.47",
     "@types/node": "^22",
     "@types/react": "^19",
     "@types/react-dom": "^19",
-    "eslint": "^8.57.0",
-    "eslint-config-next": "14.2.3",
+    "eslint": "^9.0.0",
+    "eslint-config-next": "^16.1.1",
     "postcss": "^8.5",
     "tailwindcss": "^4.1.9",
     "tw-animate-css": "1.3.3",

package/playwright.config.ts

@@ -0,0 +1,35 @@
+
+import { defineConfig, devices } from '@playwright/test';
+
+export default defineConfig({
+  testDir: './e2e',
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: 3,
+  timeout: 10000,  // 10s max per test
+  expect: {
+    timeout: 5000,  // 5s for assertions
+  },
+  workers: process.env.CI ? 1 : undefined,
+  reporter: 'html',
+  use: {
+    baseURL: process.env.BASE_URL || 'http://localhost:3000',
+    trace: 'on-first-retry',
+    ignoreHTTPSErrors: true,
+  },
+  projects: [
+    {
+      name: 'chromium',
+      use: { ...devices['Desktop Chrome'] },
+    },
+  ],
+  webServer: {
+    // Kill any existing process on 3000 before starting dev server
+    command: 'lsof -ti:3000 | xargs kill -9 2>/dev/null || true; npm run dev -- -p 3000',
+    url: 'http://localhost:3000',
+    reuseExistingServer: !process.env.CI,
+    stdout: 'pipe',
+    stderr: 'pipe',
+    timeout: 60000,
+  },
+});