@dashwire/server 0.1.0

package/drizzle.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  schema: "./src/db/schema.ts",
+  out: "./drizzle",
+  dialect: "sqlite",
+  dbCredentials: {
+    url: process.env.DASHWIRE_DB_PATH ?? "./dashwire.db",
+  },
+});

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@dashwire/server",
+  "version": "0.1.0",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "private": false,
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsx watch src/index.ts",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "@dashwire/core": "workspace:*",
+    "better-sqlite3": "^11.3.0",
+    "drizzle-orm": "^0.33.0",
+    "fastify": "^4.28.1",
+    "jsonwebtoken": "^9.0.3",
+    "nanoid": "^5.0.7",
+    "socket.io": "^4.8.0"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.11",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/node": "^22.7.0",
+    "drizzle-kit": "^0.24.2",
+    "tsx": "^4.19.1",
+    "typescript": "^5.6.0"
+  }
+}

package/src/auth.service.ts

@@ -0,0 +1,76 @@
+import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+import { eq } from "drizzle-orm";
+import jwt from "jsonwebtoken";
+import { db } from "./db/client.js";
+import { users } from "./db/schema.js";
+
+const JWT_SECRET = process.env.JWT_SECRET || "super-secret-dashwire-key";
+
+function hashPassword(password: string): string {
+  const salt = randomBytes(16).toString("hex");
+  const buffer = scryptSync(password, salt, 64);
+  return `${salt}:${buffer.toString("hex")}`;
+}
+
+function verifyPassword(password: string, storedHash: string): boolean {
+  const [salt, key] = storedHash.split(":");
+  const buffer = scryptSync(password, salt, 64);
+  const storedBuffer = Buffer.from(key, "hex");
+  return timingSafeEqual(buffer, storedBuffer);
+}
+
+export function hasAnyAdmin(): boolean {
+  const admin = db.select().from(users).where(eq(users.role, "admin")).limit(1).get();
+  return !!admin;
+}
+
+export function createAdminUser(username: string, password: string) {
+  if (hasAnyAdmin()) {
+    throw new Error("Admin account bestaat al.");
+  }
+  return createUserRecord(username, password, "admin");
+}
+
+export function createUserRecord(username: string, password: string, role: "admin" | "user" = "user") {
+  const id = randomBytes(8).toString("hex");
+  const passwordHash = hashPassword(password);
+  const now = new Date().toISOString();
+
+  db.insert(users).values({
+    id,
+    username,
+    passwordHash,
+    role,
+    createdAt: now,
+  }).run();
+
+  return jwt.sign({ id, username, role }, JWT_SECRET, { expiresIn: "7d" });
+}
+
+export function authenticateUser(username: string, password: string) {
+  const user = db.select().from(users).where(eq(users.username, username)).get();
+  if (!user || !verifyPassword(password, user.passwordHash)) {
+    throw new Error("Ongeldige gebruikersnaam of wachtwoord.");
+  }
+  return jwt.sign({ id: user.id, username: user.username, role: user.role }, JWT_SECRET, { expiresIn: "7d" });
+}
+
+export function verifyAuthToken(token: string): { id: string; username: string; role: string } | null {
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET) as { id: string; username: string; role: string };
+    return decoded;
+  } catch {
+    return null;
+  }
+}
+
+export function listUsers() {
+  return db.select({ id: users.id, username: users.username, role: users.role, createdAt: users.createdAt }).from(users).all();
+}
+
+export function deleteUser(userId: string, currentUserId: string) {
+  if (userId === currentUserId) {
+    throw new Error("Je kunt je eigen admin-account niet verwijderen.");
+  }
+  db.delete(users).where(eq(users.id, userId)).run();
+}

package/src/db/client.ts

@@ -0,0 +1,60 @@
+import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import * as schema from "./schema.js";
+
+const sqlite = new Database("dashwire.db");
+
+sqlite.exec(`
+  CREATE TABLE IF NOT EXISTS projects (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    api_key_hash TEXT NOT NULL,
+    structure_json TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'offline',
+    created_at TEXT NOT NULL,
+    last_seen_at TEXT
+  );
+
+  CREATE TABLE IF NOT EXISTS project_tokens (
+    id TEXT PRIMARY KEY,
+    project_id TEXT NOT NULL,
+    token TEXT NOT NULL UNIQUE,
+    active INTEGER NOT NULL DEFAULT 1,
+    created_at TEXT NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS capability_state (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    project_id TEXT NOT NULL,
+    capability_path TEXT NOT NULL,
+    value_json TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS overview_config (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    project_id TEXT NOT NULL,
+    capability_path TEXT NOT NULL,
+    stale_since TEXT
+  );
+
+  CREATE TABLE IF NOT EXISTS logs (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    project_id TEXT NOT NULL,
+    level TEXT NOT NULL,
+    message TEXT NOT NULL,
+    source TEXT,
+    metadata_json TEXT,
+    timestamp TEXT NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS users (
+    id TEXT PRIMARY KEY,
+    username TEXT NOT NULL UNIQUE,
+    password_hash TEXT NOT NULL,
+    role TEXT NOT NULL DEFAULT 'admin',
+    created_at TEXT NOT NULL
+  );
+`);
+
+export const db = drizzle(sqlite, { schema });

package/src/db/schema.ts

@@ -0,0 +1,52 @@
+import { sqliteTable, text, integer } from "drizzle-orm/sqlite-core";
+
+export const projects = sqliteTable("projects", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  apiKeyHash: text("api_key_hash").notNull(),
+  structureJson: text("structure_json").notNull(),
+  status: text("status", { enum: ["online", "offline"] }).notNull().default("offline"),
+  createdAt: text("created_at").notNull(),
+  lastSeenAt: text("last_seen_at"),
+});
+
+export const projectTokens = sqliteTable("project_tokens", {
+  id: text("id").primaryKey(),
+  projectId: text("project_id").notNull(),
+  token: text("token").notNull().unique(),
+  active: integer("active", { mode: "boolean" }).notNull().default(true),
+  createdAt: text("created_at").notNull(),
+});
+
+export const capabilityState = sqliteTable("capability_state", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  projectId: text("project_id").notNull(),
+  capabilityPath: text("capability_path").notNull(),
+  valueJson: text("value_json").notNull(),
+  updatedAt: text("updated_at").notNull(),
+});
+
+export const overviewConfig = sqliteTable("overview_config", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  projectId: text("project_id").notNull(),
+  capabilityPath: text("capability_path").notNull(),
+  staleSince: text("stale_since"),
+});
+
+export const logs = sqliteTable("logs", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  projectId: text("project_id").notNull(),
+  level: text("level").notNull(),
+  message: text("message").notNull(),
+  source: text("source"),
+  metadataJson: text("metadata_json"),
+  timestamp: text("timestamp").notNull(),
+});
+
+export const users = sqliteTable("users", {
+  id: text("id").primaryKey(),
+  username: text("username").notNull().unique(),
+  passwordHash: text("password_hash").notNull(),
+  role: text("role").notNull().default("admin"),
+  createdAt: text("created_at").notNull(),
+});

package/src/index.ts

@@ -0,0 +1,44 @@
+import Fastify from "fastify";
+import { Server as SocketServer } from "socket.io";
+import { projectRoutes } from "./routes/projects.js";
+import { overviewRoutes } from "./routes/overview.js";
+import { authRoutes } from "./routes/auth.js";
+import { attachSdkNamespace } from "./realtime/sdkNamespace.js";
+import { attachDashboardNamespace } from "./realtime/dashboardNamespace.js";
+
+export async function startDashwire(userConfig: any = {}) {
+  const PORT = Number(userConfig?.server?.port ?? process.env.PORT ?? 4000);
+  const HOST = userConfig?.server?.host ?? "0.0.0.0";
+  
+  const app = Fastify({ logger: true });
+
+  app.addHook("onRequest", async (req, reply) => {
+    reply.header("Access-Control-Allow-Origin", "*");
+    reply.header("Access-Control-Allow-Methods", "GET,POST,PUT,PATCH,DELETE,OPTIONS");
+    reply.header("Access-Control-Allow-Headers", "Content-Type, Authorization, x-api-key, x-admin-token");
+    
+    if (req.method === "OPTIONS") {
+      return reply.code(200).send();
+    }
+  });
+
+  app.get("/health", async () => ({ ok: true }));
+
+  const io = new SocketServer(app.server, {
+    cors: { origin: "*" },
+  });
+
+  projectRoutes(app, io);
+  overviewRoutes(app);
+  authRoutes(app);
+  attachSdkNamespace(io);
+  attachDashboardNamespace(io);
+
+  await app.listen({ port: PORT, host: HOST });
+  app.log.info(`⚡ Dashwire server running on http://${HOST}:${PORT}`);
+  return app;
+}
+
+if (process.argv[1] && process.argv[1].endsWith("index.ts")) {
+  startDashwire();
+}

package/src/logs.service.ts

@@ -0,0 +1,15 @@
+import { db } from "./db/client.js";
+import { logs } from "./db/schema.js";
+
+export function insertLog(projectId: string, level: string, message: string, source?: string, metadata?: Record<string, unknown>): number {
+  const timestamp = new Date().toISOString();
+  const res = db.insert(logs).values({
+    projectId,
+    level,
+    message,
+    source: source ?? null,
+    metadataJson: metadata ? JSON.stringify(metadata) : null,
+    timestamp,
+  }).run();
+  return Number(res.lastInsertRowid);
+}

package/src/overview.service.ts

@@ -0,0 +1,28 @@
+import { db } from "./db/client.js";
+import { overviewConfig } from "./db/schema.js";
+import { eq } from "drizzle-orm";
+
+export interface OverviewEntryInput {
+  projectId: string;
+  capabilityPath: string;
+  order: number;
+}
+
+export function setOverviewConfig(entries: OverviewEntryInput[]): void {
+  db.delete(overviewConfig).run();
+  for (const entry of entries) {
+    db.insert(overviewConfig)
+      .values({ 
+        projectId: entry.projectId, 
+        capabilityPath: entry.capabilityPath 
+      })
+      .run();
+  }
+}
+
+export function getOverviewConfig(projectId?: string) {
+  if (projectId) {
+    return db.select().from(overviewConfig).where(eq(overviewConfig.projectId, projectId)).all();
+  }
+  return db.select().from(overviewConfig).all();
+}

package/src/projects.service.ts

@@ -0,0 +1,204 @@
+import { randomBytes } from "node:crypto";
+import { eq, and } from "drizzle-orm";
+import jwt from "jsonwebtoken";
+import { db } from "./db/client.js";
+import { projects, projectTokens, capabilityState, overviewConfig } from "./db/schema.js";
+import type { DashboardStructure, Capability } from "@dashwire/core";
+
+const JWT_SECRET = process.env.JWT_SECRET || "super-secret-dashwire-key";
+
+function allPaths(structure: DashboardStructure): Set<string> {
+  const set = new Set<string>();
+  for (const section of structure.sections) {
+    for (const cap of section.capabilities) set.add(cap.path);
+  }
+  return set;
+}
+
+export interface RegisterResult {
+  token: string;
+  staleOverviewPaths: string[];
+}
+
+export function registerProject(projectId: string, projectName: string, structure: DashboardStructure, authToken?: string): RegisterResult {
+  const existing = db.select().from(projects).where(eq(projects.id, projectId)).get();
+  const now = new Date().toISOString();
+  const structureJsonString = JSON.stringify(structure);
+
+  let activeToken = authToken;
+
+  if (authToken) {
+    // Valideer enkel of het token geldig en actief is in de database (geen strenge project-ID match vereist)
+    const verified = verifyProjectToken(authToken);
+    if (!verified) {
+      throw new Error("Unauthorized: Invalid or inactive token.");
+    }
+    activeToken = authToken;
+  } else {
+    // Zoek het eerste actieve token in de database dat als universele sleutel kan dienen
+    const existingTokenRecord = db.select().from(projectTokens).where(eq(projectTokens.active, true)).get();
+    if (existingTokenRecord) {
+      activeToken = existingTokenRecord.token;
+    } else {
+      throw new Error("Unauthorized: No active token found. Please generate a token first via the /security page.");
+    }
+  }
+
+  if (!existing) {
+    db.insert(projects)
+      .values({
+        id: projectId,
+        name: projectName,
+        apiKeyHash: "jwt-secured",
+        structureJson: structureJsonString,
+        status: "offline",
+        createdAt: now,
+      })
+      .run();
+  } else {
+    db.update(projects)
+      .set({
+        name: projectName,
+        structureJson: structureJsonString,
+      })
+      .where(eq(projects.id, projectId))
+      .run();
+  }
+
+  const currentPaths = allPaths(structure);
+  const configEntries = db.select().from(overviewConfig).where(eq(overviewConfig.projectId, projectId)).all();
+  const staleOverviewPaths: string[] = [];
+  for (const entry of configEntries) {
+    if (!currentPaths.has(entry.capabilityPath)) {
+      staleOverviewPaths.push(entry.capabilityPath);
+      db.update(overviewConfig).set({ staleSince: now }).where(eq(overviewConfig.id, entry.id)).run();
+    } else if (entry.staleSince) {
+      db.update(overviewConfig).set({ staleSince: null }).where(eq(overviewConfig.id, entry.id)).run();
+    }
+  }
+
+  return { token: activeToken!, staleOverviewPaths };
+}
+
+export function verifyProjectToken(token: string): { universal: boolean } | null {
+  try {
+    jwt.verify(token, JWT_SECRET);
+    const record = db.select().from(projectTokens).where(and(eq(projectTokens.token, token), eq(projectTokens.active, true))).get();
+    if (!record) return null;
+    return { universal: true };
+  } catch {
+    return null;
+  }
+}
+
+export function listAllTokens() {
+  return db.select().from(projectTokens).all();
+}
+
+export function createTokenForProject(label?: string) {
+  const tokenName = label || "Universele Sleutel";
+  const token = jwt.sign({ name: tokenName, scope: "dashwire-access" }, JWT_SECRET);
+  const id = randomBytes(8).toString("hex");
+  const now = new Date().toISOString();
+
+  db.insert(projectTokens).values({
+    id,
+    projectId: "universal", // Niet gekoppeld aan 1 specifiek project
+    token,
+    active: true,
+    createdAt: now,
+  }).run();
+
+  return token;
+}
+
+export function setTokenActiveStatus(tokenId: string, active: boolean) {
+  db.update(projectTokens).set({ active }).where(eq(projectTokens.id, tokenId)).run();
+}
+
+export function deleteToken(tokenId: string) {
+  db.delete(projectTokens).where(eq(projectTokens.id, tokenId)).run();
+}
+
+export function setProjectStatus(projectId: string, status: "online" | "offline"): void {
+  db.update(projects).set({ status, lastSeenAt: new Date().toISOString() }).where(eq(projects.id, projectId)).run();
+}
+
+export function getProject(projectId: string) {
+  const project = db.select().from(projects).where(eq(projects.id, projectId)).get();
+  if (!project) return null;
+  const state = db.select().from(capabilityState).where(eq(capabilityState.projectId, projectId)).all();
+  const stateMap: Record<string, unknown> = {};
+  for (const row of state) stateMap[row.capabilityPath] = JSON.parse(row.valueJson);
+
+  const tokenRecord = db.select().from(projectTokens).where(eq(projectTokens.active, true)).get();
+  const token = tokenRecord ? tokenRecord.token : jwt.sign({ scope: "dashwire-access" }, JWT_SECRET);
+
+  const { apiKeyHash, structureJson, ...safe } = project;
+  return {
+    ...safe,
+    token,
+    structure: JSON.parse(structureJson) as DashboardStructure,
+    state: stateMap,
+  };
+}
+
+export function listProjects() {
+  return db.select().from(projects).all().map((p) => {
+    const tokenRecord = db.select().from(projectTokens).where(eq(projectTokens.active, true)).get();
+    const token = tokenRecord ? tokenRecord.token : "";
+    return {
+      id: p.id,
+      name: p.name,
+      status: p.status,
+      lastSeenAt: p.lastSeenAt,
+      token,
+    };
+  });
+}
+
+export function upsertCapabilityState(projectId: string, path: string, value: unknown, overwrite = true): void {
+  const now = new Date().toISOString();
+  const existing = db.select()
+    .from(capabilityState)
+    .where(eq(capabilityState.projectId, projectId))
+    .all()
+    .find((r) => r.capabilityPath === path);
+  
+  if (existing) {
+    if (overwrite) {
+      db.update(capabilityState)
+        .set({ valueJson: JSON.stringify(value), updatedAt: now })
+        .where(
+          and(
+            eq(capabilityState.projectId, projectId),
+            eq(capabilityState.capabilityPath, path)
+          )
+        )
+        .run();
+    }
+  } else {
+    db.insert(capabilityState)
+      .values({ 
+        projectId, 
+        capabilityPath: path, 
+        valueJson: JSON.stringify(value), 
+        updatedAt: now 
+      })
+      .run();
+  }
+}
+
+export function bulkSyncState(projectId: string, state: Record<string, unknown>): void {
+  for (const [path, value] of Object.entries(state)) {
+    upsertCapabilityState(projectId, path, value, false);
+  }
+}
+
+export function findCapability(structure: DashboardStructure, path: string): Capability | undefined {
+  for (const section of structure.sections) {
+    const found = section.capabilities.find((c) => c.path === path);
+    if (found) return found;
+  }
+  return undefined;
+}

package/src/realtime/dashboardNamespace.ts

@@ -0,0 +1,36 @@
+import type { Server as SocketServer, Socket } from "socket.io";
+
+export function attachDashboardNamespace(io: SocketServer): void {
+  const dashNsp = io.of("/dashboard");
+  const sdkNsp = io.of("/sdk");
+
+  dashNsp.on("connection", (socket: Socket) => {
+    socket.on("subscribe:project", ({ projectId }: { projectId: string }) => {
+      if (!projectId) return;
+      socket.join(projectId);
+    });
+
+    socket.on("unsubscribe:project", ({ projectId }: { projectId: string }) => {
+      if (!projectId) return;
+      socket.leave(projectId);
+    });
+
+    socket.on(
+      "capability:command",
+      ({ projectId, path, value }: { projectId: string; path: string; value: unknown }) => {
+        if (!projectId || !path) return;
+
+        sdkNsp.to(projectId).emit("capability:command", { path, value });
+      }
+    );
+
+    socket.on(
+      "action:execute",
+      ({ projectId, path }: { projectId: string; path: string }) => {
+        if (!projectId || !path) return;
+
+        sdkNsp.to(projectId).emit("action:execute", { path });
+      }
+    );
+  });
+}

package/src/realtime/sdkNamespace.ts

@@ -0,0 +1,88 @@
+import type { Server as SocketServer, Socket } from "socket.io";
+import {
+  verifyProjectToken,
+  setProjectStatus,
+  upsertCapabilityState,
+} from "../projects.service.js";
+
+export function attachSdkNamespace(io: SocketServer): void {
+  const sdkNsp = io.of("/sdk");
+
+  sdkNsp.use((socket, next) => {
+    const token = socket.handshake.auth?.token;
+
+    if (!token) return next(new Error("Token required"));
+    if (!verifyProjectToken(token)) return next(new Error("Invalid token"));
+
+    next();
+  });
+
+  sdkNsp.on("connection", (socket: Socket) => {
+    const projectId =
+      (socket.handshake.query.projectId as string) ||
+      (socket.handshake.auth?.projectId as string);
+
+    if (projectId) {
+      socket.data.projectId = projectId;
+      socket.join(projectId);
+      setProjectStatus(projectId, "online");
+
+      io.of("/dashboard").to(projectId).emit("project:online", {
+        projectId,
+      });
+    }
+
+    socket.on("state:sync", ({ state }) => {
+      const pid = socket.data.projectId || projectId;
+      if (!pid) return;
+
+      setProjectStatus(pid, "online");
+
+      io.of("/dashboard").to(pid).emit("project:online", {
+        projectId: pid,
+      });
+
+      for (const [path, value] of Object.entries(state)) {
+        upsertCapabilityState(pid, path, value, false);
+      }
+    });
+
+    socket.on("state:update", ({ path, value }) => {
+      const pid = socket.data.projectId || projectId;
+      if (!pid) return;
+
+      upsertCapabilityState(pid, path, value, true);
+
+      io.of("/dashboard").to(pid).emit("state:update", {
+        projectId: pid,
+        path,
+        value,
+      });
+    });
+
+    socket.on("log:new", ({ level, message, source, metadata, timestamp }) => {
+      const pid = socket.data.projectId || projectId;
+      if (!pid) return;
+
+      io.of("/dashboard").to(pid).emit("log:new", {
+        projectId: pid,
+        level,
+        message,
+        source,
+        metadata,
+        timestamp,
+      });
+    });
+
+    socket.on("disconnect", () => {
+      const pid = socket.data.projectId || projectId;
+      if (!pid) return;
+
+      setProjectStatus(pid, "offline");
+
+      io.of("/dashboard").to(pid).emit("project:offline", {
+        projectId: pid,
+      });
+    });
+  });
+}

package/src/routes/auth.ts

@@ -0,0 +1,90 @@
+import type { FastifyInstance } from "fastify";
+import { hasAnyAdmin, createAdminUser, authenticateUser, createUserRecord, verifyAuthToken, listUsers, deleteUser } from "../auth.service.js";
+
+export function authRoutes(app: FastifyInstance) {
+  app.get("/api/auth/status", async (_req, reply) => {
+    return reply.send({ hasAdmin: hasAnyAdmin() });
+  });
+
+  app.post<{ Body: { username?: string; password?: string } }>(
+    "/api/auth/setup",
+    async (req, reply) => {
+      const { username, password } = req.body || {};
+      if (!username || !password) {
+        return reply.code(400).send({ error: "Gebruikersnaam en wachtwoord zijn verplicht." });
+      }
+      try {
+        if (hasAnyAdmin()) {
+          return reply.code(400).send({ error: "Setup is al voltooid." });
+        }
+        const token = createAdminUser(username, password);
+        return reply.send({ token });
+      } catch (err: any) {
+        return reply.code(400).send({ error: err.message });
+      }
+    }
+  );
+
+  app.post<{ Body: { username?: string; password?: string } }>(
+    "/api/auth/login",
+    async (req, reply) => {
+      const { username, password } = req.body || {};
+      if (!username || !password) {
+        return reply.code(400).send({ error: "Vul alle velden in." });
+      }
+      try {
+        const token = authenticateUser(username, password);
+        return reply.send({ token });
+      } catch (err: any) {
+        return reply.code(401).send({ error: err.message });
+      }
+    }
+  );
+
+  app.get("/api/users", async (req, reply) => {
+    const authHeader = req.headers.authorization;
+    const token = authHeader?.startsWith("Bearer ") ? authHeader.substring(7) : "";
+    const verified = verifyAuthToken(token);
+    if (!verified || verified.role !== "admin") {
+      return reply.code(403).send({ error: "Toegang geweigerd. Alleen voor admins." });
+    }
+    return reply.send(listUsers());
+  });
+
+  app.post<{ Body: { username: string; password: string; role?: "admin" | "user" } }>(
+    "/api/users",
+    async (req, reply) => {
+      const authHeader = req.headers.authorization;
+      const token = authHeader?.startsWith("Bearer ") ? authHeader.substring(7) : "";
+      const verified = verifyAuthToken(token);
+      if (!verified || verified.role !== "admin") {
+        return reply.code(403).send({ error: "Toegang geweigerd. Alleen voor admins." });
+      }
+      try {
+        const { username, password, role } = req.body;
+        const newUser = createUserRecord(username, password, role || "user");
+        return reply.send(newUser);
+      } catch (err: any) {
+        return reply.code(400).send({ error: err.message });
+      }
+    }
+  );
+
+  // --- AANPASSING IN: de DELETE /api/users/:userId route ---
+  app.delete<{ Params: { userId: string } }>("/api/users/:userId", async (req, reply) => {
+    const authHeader = req.headers.authorization;
+    const token = authHeader?.startsWith("Bearer ") ? authHeader.substring(7) : "";
+    const verified = verifyAuthToken(token);
+    
+    if (!verified || verified.role !== "admin") {
+      return reply.code(403).send({ error: "Toegang geweigerd." });
+    }
+
+    try {
+      deleteUser(req.params.userId, verified.id);
+      return reply.send({ success: true });
+    } catch (err: any) {
+      return reply.code(400).send({ error: err.message });
+    }
+  });
+}

package/src/routes/overview.ts

@@ -0,0 +1,27 @@
+import type { FastifyInstance } from "fastify";
+import { getOverviewConfig, setOverviewConfig } from "../overview.service.js";
+
+function requireAdmin(req: any, reply: any): boolean {
+  const token = req.headers["x-admin-token"];
+  const expected = process.env.DASHWIRE_ADMIN_TOKEN;
+  if (!expected || token !== expected) {
+    reply.status(401).send({ error: "unauthorized" });
+    return false;
+  }
+  return true;
+}
+
+export function overviewRoutes(app: FastifyInstance) {
+  app.get("/api/overview-config", async () => {
+    return getOverviewConfig();
+  });
+
+  app.put<{ Body: { entries: { projectId: string; capabilityPath: string; order: number }[] } }>(
+    "/api/overview-config",
+    async (req, reply) => {
+      if (!requireAdmin(req, reply)) return;
+      setOverviewConfig(req.body.entries);
+      return reply.send({ ok: true });
+    },
+  );
+}

package/src/routes/projects.ts

@@ -0,0 +1,93 @@
+import type { FastifyInstance } from "fastify";
+import type { Server as SocketServer } from "socket.io";
+import { registerProject, listProjects, getProject, listAllTokens, createTokenForProject, setTokenActiveStatus, deleteToken } from "../projects.service.js";
+import type { DashboardStructure } from "@dashwire/core";
+import { logs } from "../db/schema.js";
+import { desc } from "drizzle-orm/sql/expressions/select";
+import { eq } from "drizzle-orm/sql/expressions/conditions";
+import { db } from "../db/client.js";
+
+export function projectRoutes(app: FastifyInstance, io: SocketServer) {
+  app.post<{ Params: { id: string }; Body: { projectName: string; structure: DashboardStructure } }>(
+    "/api/projects/:id/register",
+    async (req, reply) => {
+      const { id: projectId } = req.params;
+      const authHeader = req.headers.authorization;
+      const authToken = authHeader?.startsWith("Bearer ") ? authHeader.substring(7) : undefined;
+      const { projectName, structure } = req.body;
+
+      try {
+        const result = registerProject(projectId, projectName, structure, authToken);
+        return reply.send(result);
+      } catch (err: any) {
+        return reply.code(401).send({ error: err.message });
+      }
+    }
+  );
+
+  app.get("/api/projects", async (_req, reply) => {
+    return reply.send(listProjects());
+  });
+
+  app.get("/api/projects/tokens/all", async (_req, reply) => {
+    return reply.send(listAllTokens());
+  });
+
+  app.post<{ Body: { label?: string } }>(
+    "/api/projects/tokens/new",
+    async (req, reply) => {
+      const body = req.body as { label?: string };
+      try {
+        const token = createTokenForProject(body?.label);
+        return reply.send({ token });
+      } catch (err: any) {
+        return reply.code(400).send({ error: err.message });
+      }
+    }
+  );
+
+  app.patch<{ Params: { tokenId: string }; Body: { active: boolean } }>(
+    "/api/projects/tokens/:tokenId",
+    async (req, reply) => {
+      const { tokenId } = req.params;
+      const { active } = req.body;
+      setTokenActiveStatus(tokenId, active);
+      return reply.send({ success: true });
+    }
+  );
+
+  app.delete<{ Params: { tokenId: string } }>(
+    "/api/projects/tokens/:tokenId",
+    async (req, reply) => {
+      const { tokenId } = req.params;
+      deleteToken(tokenId);
+      return reply.send({ success: true });
+    }
+  );
+
+  app.get<{ Params: { id: string } }>("/api/projects/:id", async (req, reply) => {
+    const { id: projectId } = req.params;
+    const project = getProject(projectId);
+    if (!project) {
+      return reply.code(404).send({ error: "Project niet gevonden" });
+    }
+    return reply.send(project);
+  });
+
+  app.get<{ Params: { id: string }; Querystring: { limit?: string } }>(
+    "/api/projects/:id/logs",
+    async (req, reply) => {
+      const { id: projectId } = req.params;
+      const limit = Number(req.query.limit ?? 50);
+      
+      const projectLogs = db.select()
+        .from(logs)
+        .where(eq(logs.projectId, projectId))
+        .orderBy(desc(logs.id))
+        .limit(limit)
+        .all();
+
+      return reply.send(projectLogs.reverse());
+    }
+  );
+}

package/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "types": ["node"]
+  },
+  "include": ["src"]
+}