@pablozaiden/webapp 1.1.0 → 1.1.1

package/docs/getting-started.md

@@ -190,6 +190,16 @@ reload; `fromEnv` indicates that the server environment locks the value.
 `LoggerAdapter` remains application-owned and can adapt the state to any
 logging library.
 
+### In-memory server logs
+
+Admins can enable temporary server-log capture from Developer Settings next to
+the log-level selector. The framework exposes the current state in
+`/api/config`; it starts disabled on every process start and is never stored in
+the database. Admin clients can retrieve a bounded chronological snapshot from
+`GET /api/server/logs` after enabling capture. The buffer is limited to the
+newest 1,000 framework logger entries or 512 KiB of rendered log lines, and
+turning the setting off clears it.
+
 ### Transient notifications
 
 The standard `renderWebApp` runtime provides the framework notification service

package/docs/server.md

@@ -153,6 +153,8 @@ Built-in endpoints include:
 | `/device` | Browser device-code approval screen |
 | `/.well-known/jwks.json`, `/.well-known/openid-configuration` | Token verification metadata |
 | `/api/preferences/theme`, `/api/preferences/log-level` | Settings persistence |
+| `GET /api/server/logs` | Admin-only snapshot of the in-memory server logs |
+| `PUT /api/server/logs/settings` | Admin-only runtime toggle for in-memory server logs |
 | `/api/server/kill` | Authenticated server shutdown |
 | `/api/ws` | Realtime websocket by default |
 
@@ -162,6 +164,18 @@ The effective log level in `GET /api/config` and `GET
 to `true`. PUT remains an authenticated, same-origin admin mutation and
 returns a conflict when the environment controls the value.
 
+`GET /api/server/logs` is restricted to admin users and returns
+`{ enabled: boolean, logs: ServerLogEntry[] }`. Entries are returned in
+chronological order and contain the timestamp, level, logger scope, message,
+and rendered log line. When capture is disabled, the endpoint returns `200`
+with `enabled: false` and an empty list. `PUT /api/server/logs/settings`
+accepts `{ "enabled": boolean }`, is restricted to admins, and uses the normal
+same-origin policy for browser mutations. API-key and bearer callers continue
+to use the existing token-auth behavior. The in-memory buffer is limited to
+the newest 1,000 entries and 512 KiB of rendered UTF-8 lines; disabling capture
+clears it. These endpoints only expose messages emitted through the framework
+logger and never make the logs durable.
+
 Server-side applications that need credentials for internal runtimes should use
 the server-only `createManagedApiKey`, `listManagedApiKeys`, and
 `revokeManagedApiKey` helpers. Managed keys are persisted in the same API-key

package/docs/settings.md

@@ -8,6 +8,8 @@ Settings is framework-owned so apps stay consistent. It includes:
 - Theme preference: system/light/dark, stored per user
 - Admin user management
 - Admin log-level preference unless `{PREFIX}_LOG_LEVEL` is set
+- Admin in-memory server-log capture toggle; disabled and cleared on process
+  start or when turned off
 - Admin server kill
 - Version/about
 
@@ -33,6 +35,12 @@ the shared hook state after a successful save, and `fromEnv` is true when
 `{PREFIX}_LOG_LEVEL` locks the value. Applications should not add a separate
 configuration fetch or initializer component.
 
+Developer Settings also includes **Store server logs in memory**. It is an
+admin-only, process-local setting and is disabled when the server starts. When
+enabled, the framework logger retains only the newest 1,000 eligible entries
+within a 512 KiB rendered-line limit; disabling it immediately clears the
+buffer. The setting and captured logs are never stored in SQLite.
+
 Security lists only show useful active user credentials. Managed API keys created by
 server-side applications, and their metadata, are not returned by the browser API-key
 list or rendered in Settings. Expired API keys are purged before listing, and revoked

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pablozaiden/webapp",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Opinionated Bun + React webapp framework for single-server apps",
   "license": "MIT",
   "type": "module",

package/src/contracts/index.ts

@@ -114,6 +114,14 @@ export interface AuthSessionSummary {
   active: boolean;
 }
 
+export interface ServerLogEntry {
+  timestamp: string;
+  level: LogLevelName;
+  scope: string;
+  message: string;
+  line: string;
+}
+
 export interface WebAppConfigResponse {
   appName: string;
   version: string;
@@ -127,6 +135,9 @@ export interface WebAppConfigResponse {
     level: LogLevelName;
     fromEnv: boolean;
   };
+  inMemoryLogs: {
+    enabled: boolean;
+  };
   deviceAuth: {
     enabled: boolean;
   };

package/src/server/create-web-app-server.ts

@@ -11,7 +11,7 @@ import {
 import { createAuthentication } from "./authentication";
 import { createFrameworkEndpointHandler } from "./framework-endpoints";
 import { createServerLifecycle } from "./server-lifecycle";
-import { setLogLevel } from "./logger";
+import { inMemoryLogStorage, resetInMemoryLogStorage, setLogLevel } from "./logger";
 import { createWebDocumentProvider, htmlResponse } from "./web-document";
 import { createPublicRouteDispatcher } from "./public-route-dispatch";
 import { createRouteDispatcher } from "./route-dispatch";
@@ -45,6 +45,7 @@ export function createWebAppServer<TEvent = unknown>(input: WebAppServerConfig<T
   if (config.appName !== input.appName || config.envPrefix !== input.envPrefix) {
     throw new Error("runtimeConfig appName and envPrefix must match the createWebAppServer inputs");
   }
+  resetInMemoryLogStorage();
   const store = input.store ?? sqliteWebAppStore({ dataDir: config.dataDir });
   store.initialize();
   const savedLogLevel = store.getLogLevelPreference();
@@ -80,6 +81,7 @@ export function createWebAppServer<TEvent = unknown>(input: WebAppServerConfig<T
     deviceAuthEnabled,
     configResponse: input.configResponse,
     onLogLevelChange: input.logLevel?.onChange,
+    inMemoryLogs: inMemoryLogStorage,
     ensureWebDocument,
   });
   const publicRouteDispatcher = createPublicRouteDispatcher({

package/src/server/framework-endpoints.ts

@@ -48,6 +48,7 @@ import {
   createUserRequestSchema,
   deviceAuthorizationRequestSchema,
   deviceCodeActionRequestSchema,
+  inMemoryLogSettingsRequestSchema,
   logLevelPreferenceRequestSchema,
   passkeyBootstrapOptionsSchema,
   refreshTokenRequestSchema,
@@ -61,7 +62,8 @@ import {
 } from "./request-schemas";
 import { resolveEffectiveLogLevel, type RuntimeConfig } from "./runtime-config";
 import { setLogLevel } from "./logger";
-import { errorResponse, jsonResponse, notFound, parseJson, successResponse } from "./responses";
+import type { InMemoryLogStorage } from "./logger";
+import { errorResponse, jsonResponse, methodNotAllowed, notFound, parseJson, successResponse } from "./responses";
 import type { WebSocketData } from "./realtime/bus";
 
 export interface FrameworkEndpointDependencies {
@@ -75,6 +77,7 @@ export interface FrameworkEndpointDependencies {
   deviceAuthEnabled: boolean;
   configResponse?: WebAppServerConfig["configResponse"];
   onLogLevelChange?: (level: LogLevelName) => void;
+  inMemoryLogs: InMemoryLogStorage;
   ensureWebDocument: () => Promise<WebDocument>;
 }
 
@@ -97,6 +100,7 @@ export function createFrameworkEndpointHandler(dependencies: FrameworkEndpointDe
     deviceAuthEnabled,
     configResponse: extendConfigResponse,
     onLogLevelChange,
+    inMemoryLogs,
     ensureWebDocument,
   } = dependencies;
 
@@ -115,6 +119,9 @@ export function createFrameworkEndpointHandler(dependencies: FrameworkEndpointDe
         level: resolveEffectiveLogLevel(config, store.getLogLevelPreference()),
         fromEnv: config.logLevelFromEnv,
       },
+      inMemoryLogs: {
+        enabled: inMemoryLogs.isEnabled(),
+      },
       apiKeys: { enabled: Boolean(apiKeysEnabled) },
       deviceAuth: { enabled: Boolean(deviceAuthEnabled) },
     } satisfies WebAppConfigResponse;
@@ -433,6 +440,32 @@ export function createFrameworkEndpointHandler(dependencies: FrameworkEndpointDe
           return successResponse({ level: body.level });
         }
       }
+      if (path === "/api/server/logs") {
+        const auth = await authentication.authorize(req, true);
+        if (auth instanceof Response) return auth;
+        ensureAdmin(auth);
+        if (req.method !== "GET") {
+          return methodNotAllowed();
+        }
+        const enabled = inMemoryLogs.isEnabled();
+        return jsonResponse({
+          enabled,
+          logs: enabled ? inMemoryLogs.getEntries() : [],
+        });
+      }
+      if (path === "/api/server/logs/settings") {
+        const auth = await authentication.authorize(req, true);
+        if (auth instanceof Response) return auth;
+        ensureAdmin(auth);
+        if (req.method !== "PUT") {
+          return methodNotAllowed();
+        }
+        const originFailure = checkSameOrigin(req, config, auth, "mutations");
+        if (originFailure) return originFailure;
+        const body = await parseJson(req, inMemoryLogSettingsRequestSchema);
+        inMemoryLogs.setEnabled(body.enabled);
+        return successResponse({ enabled: inMemoryLogs.isEnabled() });
+      }
       if (path === "/api/server/kill" && req.method === "POST") {
         const auth = await authentication.authorize(req, true);
         if (auth instanceof Response) return auth;

package/src/server/logger.ts

@@ -1,4 +1,4 @@
-import type { LogLevelName } from "../contracts";
+import type { LogLevelName, ServerLogEntry } from "../contracts";
 
 const ORDER: Record<LogLevelName, number> = {
   trace: 10,
@@ -8,7 +8,21 @@ const ORDER: Record<LogLevelName, number> = {
   error: 50,
 };
 
+export const MAX_IN_MEMORY_LOG_ENTRIES = 1_000;
+export const MAX_IN_MEMORY_LOG_BYTES = 512 * 1024;
+
 let currentLevel: LogLevelName = "info";
+let inMemoryLogStorageEnabled = false;
+let inMemoryLogEntries: ServerLogEntry[] = [];
+let inMemoryLogBytes = 0;
+const textEncoder = new TextEncoder();
+
+export interface InMemoryLogStorage {
+  isEnabled(): boolean;
+  setEnabled(enabled: boolean): void;
+  getEntries(): ServerLogEntry[];
+  reset(): void;
+}
 
 export function setLogLevel(level: LogLevelName): void {
   currentLevel = level;
@@ -18,6 +32,58 @@ export function getLogLevel(): LogLevelName {
   return currentLevel;
 }
 
+function lineByteLength(line: string): number {
+  return textEncoder.encode(line).byteLength;
+}
+
+function appendInMemoryLogEntry(entry: ServerLogEntry): void {
+  if (!inMemoryLogStorageEnabled) {
+    return;
+  }
+  const entryBytes = lineByteLength(entry.line);
+  if (entryBytes > MAX_IN_MEMORY_LOG_BYTES) {
+    return;
+  }
+  inMemoryLogEntries.push(entry);
+  inMemoryLogBytes += entryBytes;
+  while (inMemoryLogEntries.length > MAX_IN_MEMORY_LOG_ENTRIES || inMemoryLogBytes > MAX_IN_MEMORY_LOG_BYTES) {
+    const removed = inMemoryLogEntries.shift();
+    if (!removed) {
+      break;
+    }
+    inMemoryLogBytes -= lineByteLength(removed.line);
+  }
+}
+
+export function setInMemoryLogStorageEnabled(enabled: boolean): void {
+  inMemoryLogStorageEnabled = enabled;
+  if (!enabled) {
+    inMemoryLogEntries = [];
+    inMemoryLogBytes = 0;
+  }
+}
+
+export function isInMemoryLogStorageEnabled(): boolean {
+  return inMemoryLogStorageEnabled;
+}
+
+export function getInMemoryLogEntries(): ServerLogEntry[] {
+  return inMemoryLogEntries.map((entry) => ({ ...entry }));
+}
+
+export function resetInMemoryLogStorage(): void {
+  inMemoryLogStorageEnabled = false;
+  inMemoryLogEntries = [];
+  inMemoryLogBytes = 0;
+}
+
+export const inMemoryLogStorage: InMemoryLogStorage = {
+  isEnabled: isInMemoryLogStorageEnabled,
+  setEnabled: setInMemoryLogStorageEnabled,
+  getEntries: getInMemoryLogEntries,
+  reset: resetInMemoryLogStorage,
+};
+
 export function createLogger(scope: string) {
   function log(level: LogLevelName, message: string, fields?: Record<string, unknown>): void {
     if (ORDER[level] < ORDER[currentLevel]) {
@@ -26,6 +92,7 @@ export function createLogger(scope: string) {
     const timestamp = new Date().toISOString();
     const suffix = fields ? ` ${JSON.stringify(fields)}` : "";
     const line = `${timestamp}\t${level.toUpperCase()}\t${scope}\t${message}${suffix}`;
+    appendInMemoryLogEntry({ timestamp, level, scope, message, line });
     if (level === "error") {
       console.error(line);
     } else if (level === "warn") {

package/src/server/request-schemas.ts

@@ -142,3 +142,7 @@ export const themePreferenceRequestSchema = z.object({
 export const logLevelPreferenceRequestSchema = z.object({
   level: z.enum(["trace", "debug", "info", "warn", "error"]),
 });
+
+export const inMemoryLogSettingsRequestSchema = z.object({
+  enabled: z.boolean(),
+});

package/src/web/components/index.tsx

@@ -252,6 +252,18 @@ export function SelectField({ label, children, ...props }: SelectHTMLAttributes<
   );
 }
 
+export function CheckboxField({ label, hint, ...props }: Omit<InputHTMLAttributes<HTMLInputElement>, "type"> & { label: string; hint?: string }) {
+  return (
+    <label className="wapp-checkbox-field">
+      <input {...props} type="checkbox" />
+      <span>
+        {label}
+        {hint ? <small>{hint}</small> : null}
+      </span>
+    </label>
+  );
+}
+
 export function SegmentedControl<T extends string>({ value, options, onChange, label }: { value: T; options: Array<{ value: T; label: string }>; onChange: (value: T) => void; label: string }) {
   return (
     <div className="wapp-segmented" role="group" aria-label={label}>

package/src/web/settings/account-section.tsx

@@ -1,7 +1,7 @@
 import { useState } from "react";
 import type { LogLevelName, WebAppConfigResponse } from "../../contracts";
 import { appJson } from "../api-client";
-import { Badge, Button, ErrorState, FormSection, LoadingState, SelectField } from "../components";
+import { Badge, Button, CheckboxField, ErrorState, FormSection, LoadingState, SelectField } from "../components";
 import { useLogLevel } from "../log-level";
 import { isThemePreference, useTheme } from "../theme";
 
@@ -21,6 +21,7 @@ export function AccountSection({ config, refresh, setError }: AccountSectionProp
   const { preference, setPreference, loading, error, retry } = useTheme();
   const logLevel = useLogLevel();
   const [logLevelSaving, setLogLevelSaving] = useState(false);
+  const [inMemoryLogsSaving, setInMemoryLogsSaving] = useState(false);
 
   async function updateLogLevel(value: string) {
     if (!isLogLevelName(value)) {
@@ -39,6 +40,22 @@ export function AccountSection({ config, refresh, setError }: AccountSectionProp
     }
   }
 
+  async function updateInMemoryLogs(enabled: boolean) {
+    try {
+      setError(undefined);
+      setInMemoryLogsSaving(true);
+      await appJson<unknown>("/api/server/logs/settings", {
+        method: "PUT",
+        body: JSON.stringify({ enabled }),
+      });
+      await refresh();
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+    } finally {
+      setInMemoryLogsSaving(false);
+    }
+  }
+
   return (
     <>
       {config.currentUser ? (
@@ -88,6 +105,13 @@ export function AccountSection({ config, refresh, setError }: AccountSectionProp
               {LOG_LEVEL_NAMES.map((level) => <option key={level} value={level}>{level}</option>)}
             </SelectField>
           ) : null}
+          <CheckboxField
+            label="Store server logs in memory"
+            hint="Temporary; disabled and cleared when the server process starts or this setting is turned off."
+            checked={config.inMemoryLogs.enabled}
+            disabled={inMemoryLogsSaving}
+            onChange={(event) => void updateInMemoryLogs(event.currentTarget.checked)}
+          />
         </FormSection>
       ) : null}
     </>

package/src/web/styles.css

@@ -1618,6 +1618,32 @@ textarea::placeholder {
   resize: vertical;
 }
 
+.wapp-checkbox-field {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.5rem;
+}
+
+.wapp-checkbox-field input {
+  width: 1rem;
+  min-height: 1rem;
+  margin-top: 0.125rem;
+  flex: 0 0 auto;
+}
+
+.wapp-checkbox-field span {
+  font-size: 0.8125rem;
+  font-weight: 500;
+}
+
+.wapp-checkbox-field small {
+  display: block;
+  color: var(--wapp-muted);
+  font-size: 0.75rem;
+  font-weight: 400;
+  margin-top: 0.25rem;
+}
+
 .wapp-field small {
   display: block;
   color: var(--wapp-muted);

package/src/web/webapp-config.tsx

@@ -50,6 +50,7 @@ function isWebAppConfigResponse(value: unknown): value is WebAppConfigResponse {
     && isRecord(value["logLevel"])
     && isLogLevelName(value["logLevel"]["level"])
     && typeof value["logLevel"]["fromEnv"] === "boolean"
+    && hasBooleanFields(value["inMemoryLogs"], ["enabled"])
     && hasBooleanFields(value["deviceAuth"], ["enabled"])
     && hasBooleanFields(value["apiKeys"], ["enabled"]);
 }