@panoboard/core 1.1.5

package/dist/query/template.js

@@ -0,0 +1,36 @@
+// Copyright 2026 Mataki Labs LLC
+//
+// Licensed under the Business Source License 1.1 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://github.com/panoboard/panoboard/blob/main/LICENSE
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+import nunjucks from "nunjucks";
+const env = new nunjucks.Environment(null, { autoescape: false });
+export function renderTemplate(sql, templateVars, resolvedVarValues, params) {
+    // 1. Validate each template var value against its allowlist
+    for (const [name, def] of Object.entries(templateVars)) {
+        const value = resolvedVarValues[name];
+        if (value === undefined && def.value) {
+            // Use the hardcoded default value
+            resolvedVarValues[name] = def.value;
+        }
+        const finalValue = resolvedVarValues[name];
+        if (finalValue !== undefined && !def.allowlist.includes(finalValue)) {
+            throw new Error(`Template variable '${name}' value '${finalValue}' is not in the allowlist: [${def.allowlist.join(", ")}]`);
+        }
+    }
+    // 2. Render with Nunjucks -- context contains only declared template vars and params
+    const context = {
+        ...resolvedVarValues,
+        params, // for {% if params.x %} conditional blocks
+    };
+    return env.renderString(sql, context);
+}
+//# sourceMappingURL=template.js.map

package/dist/query/template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template.js","sourceRoot":"","sources":["../../src/query/template.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAQlE,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,YAAyC,EACzC,iBAAyC,EACzC,MAA+B;IAE/B,4DAA4D;IAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACrC,kCAAkC;YAClC,iBAAiB,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;QACtC,CAAC;QACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,YAAY,UAAU,+BAA+B,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,MAAM,OAAO,GAAG;QACd,GAAG,iBAAiB;QACpB,MAAM,EAAE,2CAA2C;KACpD,CAAC;IAEF,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC"}

package/dist/schemas/config.d.ts

@@ -0,0 +1,74 @@
+import { z } from "zod";
+export declare const configSchema: z.ZodObject<{
+    server: z.ZodDefault<z.ZodObject<{
+        port: z.ZodDefault<z.ZodNumber>;
+        base_url: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    dashboards: z.ZodDefault<z.ZodObject<{
+        dir: z.ZodDefault<z.ZodString>;
+        gcs_bucket: z.ZodOptional<z.ZodString>;
+        gcs_prefix: z.ZodOptional<z.ZodString>;
+        s3_bucket: z.ZodOptional<z.ZodString>;
+        s3_prefix: z.ZodOptional<z.ZodString>;
+        s3_region: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    timezone: z.ZodDefault<z.ZodString>;
+    theme: z.ZodDefault<z.ZodString>;
+    auth: z.ZodDefault<z.ZodObject<{
+        mode: z.ZodDefault<z.ZodEnum<{
+            iap: "iap";
+            oauth: "oauth";
+            none: "none";
+        }>>;
+        providers: z.ZodOptional<z.ZodObject<{
+            google: z.ZodOptional<z.ZodObject<{
+                client_id: z.ZodString;
+                client_secret: z.ZodString;
+                allowed_domain: z.ZodOptional<z.ZodString>;
+                allowed_emails: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                role_groups: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                service_account_key: z.ZodOptional<z.ZodString>;
+                admin_email: z.ZodOptional<z.ZodString>;
+                default_role: z.ZodDefault<z.ZodString>;
+            }, z.core.$strict>>;
+            github: z.ZodOptional<z.ZodObject<{
+                client_id: z.ZodString;
+                client_secret: z.ZodString;
+                allowed_org: z.ZodOptional<z.ZodString>;
+                role_teams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        iap: z.ZodOptional<z.ZodObject<{
+            audience: z.ZodString;
+            role_header: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        session: z.ZodOptional<z.ZodObject<{
+            secret: z.ZodString;
+            ttl: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    context_token: z.ZodOptional<z.ZodObject<{
+        signing_key: z.ZodString;
+        header: z.ZodOptional<z.ZodString>;
+        query_param: z.ZodOptional<z.ZodString>;
+        max_age: z.ZodOptional<z.ZodString>;
+        required: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    cache: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        provider: z.ZodOptional<z.ZodEnum<{
+            redis: "redis";
+        }>>;
+        url: z.ZodOptional<z.ZodString>;
+        default_ttl: z.ZodOptional<z.ZodString>;
+        key_prefix: z.ZodDefault<z.ZodString>;
+        dashboard_ttl: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strict>>;
+    startup_checks: z.ZodDefault<z.ZodObject<{
+        datasources: z.ZodDefault<z.ZodBoolean>;
+        deep_sql_lint: z.ZodDefault<z.ZodBoolean>;
+        required: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type Config = z.infer<typeof configSchema>;
+//# sourceMappingURL=config.d.ts.map

package/dist/schemas/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/schemas/config.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqHxB,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAWd,CAAC;AAEZ,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/schemas/config.js

@@ -0,0 +1,129 @@
+// Copyright 2026 Mataki Labs LLC
+//
+// Licensed under the Business Source License 1.1 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://github.com/panoboard/panoboard/blob/main/LICENSE
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+import { z } from "zod";
+const timezoneSchema = z
+    .string()
+    .refine((val) => val === "UTC" || val.includes("/"), {
+    message: 'Timezone must be a valid IANA timezone (contain a "/" or be "UTC")',
+});
+const serverSchema = z
+    .object({
+    port: z.number().int().positive().default(3000),
+    base_url: z.string().optional(),
+})
+    .strict()
+    .default({ port: 3000 });
+const dashboardsSchema = z
+    .object({
+    dir: z.string().default("/config/dashboards"),
+    gcs_bucket: z.string().optional(),
+    gcs_prefix: z.string().optional(),
+    s3_bucket: z.string().optional(),
+    s3_prefix: z.string().optional(),
+    s3_region: z.string().optional(),
+})
+    .strict()
+    .default({ dir: "/config/dashboards" });
+const googleProviderSchema = z
+    .object({
+    client_id: z.string(),
+    client_secret: z.string(),
+    allowed_domain: z.string().optional(),
+    allowed_emails: z.array(z.string().email()).optional(),
+    role_groups: z.record(z.string(), z.string()).optional(),
+    service_account_key: z.string().optional(),
+    admin_email: z.string().email().optional(),
+    default_role: z.string().default("viewer"),
+})
+    .strict();
+const githubProviderSchema = z
+    .object({
+    client_id: z.string(),
+    client_secret: z.string(),
+    allowed_org: z.string().optional(),
+    role_teams: z.record(z.string(), z.string()).optional(),
+})
+    .strict();
+const authProvidersSchema = z
+    .object({
+    google: googleProviderSchema.optional(),
+    github: githubProviderSchema.optional(),
+})
+    .strict()
+    .optional();
+const authIapSchema = z
+    .object({
+    audience: z.string(),
+    role_header: z.string().optional(),
+})
+    .strict()
+    .optional();
+const authSessionSchema = z
+    .object({
+    secret: z.string().min(32),
+    ttl: z.string().optional(),
+})
+    .strict()
+    .optional();
+const authSchema = z
+    .object({
+    mode: z.enum(["oauth", "iap", "none"]).default("none"),
+    providers: authProvidersSchema,
+    iap: authIapSchema,
+    session: authSessionSchema,
+})
+    .strict()
+    .default({ mode: "none" });
+const contextTokenSchema = z
+    .object({
+    signing_key: z.string(),
+    header: z.string().optional(),
+    query_param: z.string().optional(),
+    max_age: z.string().optional(),
+    required: z.boolean().optional(),
+})
+    .strict()
+    .optional();
+const cacheSchema = z
+    .object({
+    enabled: z.boolean().default(false),
+    provider: z.enum(["redis"]).optional(),
+    url: z.string().optional(),
+    default_ttl: z.string().optional(),
+    key_prefix: z.string().default("panoboard"),
+    dashboard_ttl: z.record(z.string(), z.string()).optional(),
+})
+    .strict()
+    .default({ enabled: false, key_prefix: "panoboard" });
+const startupChecksSchema = z
+    .object({
+    datasources: z.boolean().default(true),
+    deep_sql_lint: z.boolean().default(false),
+    required: z.boolean().default(true),
+})
+    .strict()
+    .default({ datasources: true, deep_sql_lint: false, required: true });
+export const configSchema = z
+    .object({
+    server: serverSchema,
+    dashboards: dashboardsSchema,
+    timezone: timezoneSchema.default("UTC"),
+    theme: z.string().default("dark"),
+    auth: authSchema,
+    context_token: contextTokenSchema,
+    cache: cacheSchema,
+    startup_checks: startupChecksSchema,
+})
+    .strict();
+//# sourceMappingURL=config.js.map

package/dist/schemas/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/schemas/config.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;IACnD,OAAO,EACL,oEAAoE;CACvE,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,MAAM,EAAE;KACR,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAE3B,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,EAAE;KACR,OAAO,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC;AAE1C,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC1C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,MAAM,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,EAAE,CAAC;AAEd,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,EAAE,CAAC;AAEd,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,EAAE,CAAC;AAEd,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACtD,SAAS,EAAE,mBAAmB;IAC9B,GAAG,EAAE,aAAa;IAClB,OAAO,EAAE,iBAAiB;CAC3B,CAAC;KACD,MAAM,EAAE;KACR,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAE7B,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,EAAE,CAAC;AAEd,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC;KACD,MAAM,EAAE;KACR,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;AAExD,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACpC,CAAC;KACD,MAAM,EAAE;KACR,OAAO,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,MAAM,EAAE,YAAY;IACpB,UAAU,EAAE,gBAAgB;IAC5B,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,UAAU;IAChB,aAAa,EAAE,kBAAkB;IACjC,KAAK,EAAE,WAAW;IAClB,cAAc,EAAE,mBAAmB;CACpC,CAAC;KACD,MAAM,EAAE,CAAC"}