@qwickapps/server 1.8.0 → 1.8.2

package/src/plugins/maintenance-plugin.ts

@@ -59,8 +59,8 @@ function scanSeedScripts(dir: string, basePath: string = dir): any[] {
       if (entry.isDirectory()) {
         // Recursively scan subdirectories
         results.push(...scanSeedScripts(fullPath, basePath));
-      } else if (entry.isFile() && entry.name.endsWith('.mjs')) {
-        // Found a .mjs file
+      } else if (entry.isFile() && (entry.name.endsWith('.mjs') || entry.name.endsWith('.ts'))) {
+        // Found a .mjs or .ts file
         const stats = statSync(fullPath);
         const relativePath = relative(basePath, fullPath);
         const description = extractDescription(fullPath);
@@ -132,6 +132,9 @@ export interface MaintenancePluginConfig {
   /** Enable database operations (default: true) */
   enableDatabaseOps?: boolean;
 
+  /** Enable migration management (default: true) */
+  enableMigrations?: boolean;
+
   /** Custom seed tasks */
   customTasks?: SeedTask[];
 }
@@ -450,12 +453,18 @@ export function createMaintenancePlugin(config: MaintenancePluginConfig = {}): P
           pluginId: 'maintenance',
           handler: async (req: Request, res: Response) => {
             try {
-              // Security: Only allow in local or development environments
-              const nodeEnv = process.env.NODE_ENV?.toLowerCase();
-              if (nodeEnv !== 'local' && nodeEnv !== 'development') {
+              // Security: Prevent running on production domain
+              const serverUrl = process.env.NEXT_PUBLIC_SERVER_URL || process.env.APP_URL || '';
+
+              // Block if domain is exactly faabzi.com (production)
+              // Allow dev.faabzi.com, staging.faabzi.com, localhost, etc.
+              const isProductionDomain = /^https?:\/\/faabzi\.com(\/|$)/.test(serverUrl);
+
+              if (isProductionDomain) {
                 return res.status(403).json({
-                  error: 'Database reset is only available in local or development environments',
-                  currentEnv: nodeEnv || 'production',
+                  error: 'Database reset is not allowed on production domain (faabzi.com)',
+                  currentUrl: serverUrl,
+                  allowedDomains: 'dev.faabzi.com, staging.faabzi.com, localhost, or local',
                 });
               }
 
@@ -593,6 +602,462 @@ export function createMaintenancePlugin(config: MaintenancePluginConfig = {}): P
         });
       }
 
+      // Migration Management Routes
+      if (config.enableMigrations !== false) {
+        // Ensure migration_executions table exists
+        registry.addRoute({
+          method: 'post',
+          path: '/migrations/_init',
+          pluginId: 'maintenance',
+          handler: async (req: Request, res: Response) => {
+            try {
+              if (hasPostgres()) {
+                const db = getPostgres();
+                await db.queryRaw(`
+                  CREATE TABLE IF NOT EXISTS migration_executions (
+                    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+                    status TEXT NOT NULL CHECK (status IN ('running', 'completed', 'failed')),
+                    started_at TIMESTAMPTZ NOT NULL,
+                    completed_at TIMESTAMPTZ,
+                    exit_code INTEGER,
+                    output TEXT,
+                    error TEXT,
+                    duration_ms INTEGER,
+                    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+                  )
+                `);
+                await db.queryRaw(`
+                  CREATE INDEX IF NOT EXISTS idx_migration_executions_status
+                  ON migration_executions(status)
+                `);
+                await db.queryRaw(`
+                  CREATE INDEX IF NOT EXISTS idx_migration_executions_started_at
+                  ON migration_executions(started_at DESC)
+                `);
+              }
+              res.json({ success: true });
+            } catch (error) {
+              logger.error('Failed to initialize migration_executions table', { error });
+              res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
+            }
+          },
+        });
+
+        // GET /migrations/status - Get migration status
+        registry.addRoute({
+          method: 'get',
+          path: '/migrations/status',
+          pluginId: 'maintenance',
+          handler: async (req: Request, res: Response) => {
+            try {
+              // Check if there are any pending migrations by checking Payload
+              // This is a simple implementation - just returns basic status
+              res.json({
+                available: true,
+                lastChecked: new Date().toISOString(),
+              });
+            } catch (error) {
+              logger.error('Failed to get migration status', { error });
+              res.status(500).json({
+                error: error instanceof Error ? error.message : String(error),
+              });
+            }
+          },
+        });
+
+        // GET /migrations/execute - Execute Payload migrations with SSE output
+        registry.addRoute({
+          method: 'get',
+          path: '/migrations/execute',
+          pluginId: 'maintenance',
+          handler: async (req: Request, res: Response) => {
+            const MIGRATION_LOCK_ID = 123456789;
+            const MIGRATION_TIMEOUT_MS = 10 * 60 * 1000; // 10 minutes
+            let lockAcquired = false;
+
+            try {
+              // Ensure table exists (lazy initialization)
+              if (hasPostgres()) {
+                const db = getPostgres();
+                try {
+                  await db.queryRaw(`
+                    CREATE TABLE IF NOT EXISTS migration_executions (
+                      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+                      status TEXT NOT NULL CHECK (status IN ('running', 'completed', 'failed')),
+                      started_at TIMESTAMPTZ NOT NULL,
+                      completed_at TIMESTAMPTZ,
+                      exit_code INTEGER,
+                      output TEXT,
+                      error TEXT,
+                      duration_ms INTEGER,
+                      created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                      updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+                    )
+                  `);
+                } catch (err) {
+                  logger.debug('Table initialization check', { err });
+                }
+              }
+
+              // Acquire advisory lock for concurrency control
+              if (hasPostgres()) {
+                const db = getPostgres();
+                const lockResult = await db.queryOne<{ pg_try_advisory_lock: boolean }>(
+                  'SELECT pg_try_advisory_lock($1) as pg_try_advisory_lock',
+                  [MIGRATION_LOCK_ID]
+                );
+
+                lockAcquired = lockResult?.pg_try_advisory_lock || false;
+
+                if (!lockAcquired) {
+                  return res.status(409).json({
+                    error: 'Migrations are already running. Please wait for them to complete.',
+                  });
+                }
+              }
+
+              // Set SSE headers
+              res.setHeader('Content-Type', 'text/event-stream');
+              res.setHeader('Cache-Control', 'no-cache');
+              res.setHeader('Connection', 'keep-alive');
+              res.setHeader('X-Accel-Buffering', 'no'); // Disable nginx buffering
+              res.setHeader('Content-Encoding', 'identity'); // Disable compression
+              res.flushHeaders();
+
+              // Create execution record in database
+              let executionId: string | null = null;
+              if (hasPostgres()) {
+                const db = getPostgres();
+                const result = await db.queryOne<{ id: string }>(
+                  `INSERT INTO migration_executions (status, started_at)
+                   VALUES ($1, NOW())
+                   RETURNING id`,
+                  ['running']
+                );
+                executionId = result?.id || null;
+              }
+
+              const startTime = Date.now();
+              let exitCode: number | undefined = undefined;
+              let output = '';
+              let error = '';
+              let migrationProcess: any = null;
+              let timeoutHandle: NodeJS.Timeout | null = null;
+
+              // Cleanup function to ensure resources are released
+              const cleanup = async (reason: string) => {
+                logger.debug(`Migration cleanup: ${reason}`, { executionId });
+
+                // Clear timeout if set
+                if (timeoutHandle) {
+                  clearTimeout(timeoutHandle);
+                  timeoutHandle = null;
+                }
+
+                // Kill process if still running
+                if (migrationProcess && !migrationProcess.killed) {
+                  migrationProcess.kill('SIGTERM');
+                }
+
+                // Update execution record if not already completed
+                if (hasPostgres() && executionId && exitCode === undefined) {
+                  const db = getPostgres();
+                  const duration = Date.now() - startTime;
+                  await db.query(
+                    `UPDATE migration_executions
+                     SET status = $1, completed_at = NOW(),
+                         error = $2, duration_ms = $3, updated_at = NOW()
+                     WHERE id = $4 AND status = 'running'`,
+                    ['failed', reason, duration, executionId]
+                  ).catch(err => logger.error('Failed to update execution on cleanup', { err }));
+                }
+
+                // Release advisory lock
+                if (hasPostgres() && lockAcquired) {
+                  const db = getPostgres();
+                  await db.query(
+                    'SELECT pg_advisory_unlock($1)',
+                    [MIGRATION_LOCK_ID]
+                  ).catch(err => logger.error('Failed to release advisory lock', { err }));
+                  lockAcquired = false;
+                }
+              };
+
+              // Handle client disconnect
+              res.on('close', () => {
+                cleanup('Client disconnected before completion').catch(err =>
+                  logger.error('Cleanup failed on disconnect', { err })
+                );
+              });
+
+              try {
+                // Execute Payload migration command
+                const { spawn } = await import('child_process');
+
+                migrationProcess = spawn('npx', ['payload', 'migrate', '--force-accept-warning'], {
+                  cwd: process.cwd(),
+                  env: {
+                    ...process.env,
+                    CI: 'true',              // Force non-interactive mode
+                    NODE_ENV: 'production',   // Disable dev mode prompts
+                  },
+                });
+
+                // Automatically answer 'y' to any interactive prompts
+                if (migrationProcess.stdin) {
+                  migrationProcess.stdin.write('y\n');
+                  migrationProcess.stdin.end();
+                }
+
+                // Set timeout to prevent hanging migrations
+                timeoutHandle = setTimeout(() => {
+                  logger.warn('Migration timeout - killing process', { executionId, timeout: MIGRATION_TIMEOUT_MS });
+                  if (migrationProcess && !migrationProcess.killed) {
+                    migrationProcess.kill('SIGTERM');
+                    error += '\n[TIMEOUT] Migration exceeded maximum execution time and was terminated.';
+                  }
+                }, MIGRATION_TIMEOUT_MS);
+
+                // Stream stdout
+                migrationProcess.stdout?.on('data', (data: Buffer) => {
+                  const chunk = data.toString();
+                  output += chunk;
+                  if (!res.writableEnded) {
+                    res.write(`data: ${JSON.stringify({
+                      type: 'output',
+                      data: chunk,
+                      timestamp: new Date().toISOString()
+                    })}\n\n`);
+                  }
+                });
+
+                // Stream stderr
+                migrationProcess.stderr?.on('data', (data: Buffer) => {
+                  const chunk = data.toString();
+                  error += chunk;
+                  if (!res.writableEnded) {
+                    res.write(`data: ${JSON.stringify({
+                      type: 'error',
+                      data: chunk,
+                      timestamp: new Date().toISOString()
+                    })}\n\n`);
+                  }
+                });
+
+                // Wait for process to complete
+                await new Promise<void>((resolve, reject) => {
+                  migrationProcess.on('close', (code: number | null) => {
+                    exitCode = code || 0;
+                    resolve();
+                  });
+                  migrationProcess.on('error', (err: Error) => {
+                    reject(err);
+                  });
+                });
+
+                // Clear timeout since process completed
+                if (timeoutHandle) {
+                  clearTimeout(timeoutHandle);
+                  timeoutHandle = null;
+                }
+
+                const duration = Date.now() - startTime;
+
+                // Update execution record
+                if (hasPostgres() && executionId) {
+                  const db = getPostgres();
+                  await db.query(
+                    `UPDATE migration_executions
+                     SET status = $1, completed_at = NOW(), exit_code = $2,
+                         output = $3, error = $4, duration_ms = $5, updated_at = NOW()
+                     WHERE id = $6`,
+                    [
+                      exitCode === 0 ? 'completed' : 'failed',
+                      exitCode,
+                      output,
+                      error,
+                      duration,
+                      executionId,
+                    ]
+                  );
+                }
+
+                // Send completion event
+                if (!res.writableEnded) {
+                  res.write(`data: ${JSON.stringify({
+                    type: 'complete',
+                    exitCode,
+                    duration,
+                    timestamp: new Date().toISOString()
+                  })}\n\n`);
+                }
+
+                res.end();
+
+                // Release advisory lock after successful completion
+                if (hasPostgres() && lockAcquired) {
+                  const db = getPostgres();
+                  await db.query('SELECT pg_advisory_unlock($1)', [MIGRATION_LOCK_ID]);
+                  lockAcquired = false;
+                }
+              } catch (error) {
+                logger.error('Migration execution failed', { error });
+
+                // Send error event via SSE
+                if (!res.writableEnded) {
+                  res.write(`data: ${JSON.stringify({
+                    type: 'error',
+                    data: error instanceof Error ? error.message : String(error),
+                    timestamp: new Date().toISOString()
+                  })}\n\n`);
+                }
+
+                // Update execution record as failed
+                if (hasPostgres() && executionId) {
+                  const db = getPostgres();
+                  const duration = Date.now() - startTime;
+                  await db.query(
+                    `UPDATE migration_executions
+                     SET status = $1, completed_at = NOW(),
+                         error = $2, duration_ms = $3, updated_at = NOW()
+                     WHERE id = $4`,
+                    ['failed', error instanceof Error ? error.message : String(error), duration, executionId]
+                  );
+                }
+
+                res.end();
+
+                // Release advisory lock after error
+                if (hasPostgres() && lockAcquired) {
+                  const db = getPostgres();
+                  await db.query('SELECT pg_advisory_unlock($1)', [MIGRATION_LOCK_ID]);
+                  lockAcquired = false;
+                }
+              }
+            } catch (error) {
+              logger.error('Migration execution setup failed', { error });
+
+              // Release advisory lock if acquired
+              if (hasPostgres() && lockAcquired) {
+                const db = getPostgres();
+                await db.query('SELECT pg_advisory_unlock($1)', [MIGRATION_LOCK_ID])
+                  .catch(err => logger.error('Failed to release lock on setup error', { err }));
+              }
+
+              res.status(500).json({
+                error: error instanceof Error ? error.message : String(error),
+              });
+            }
+          },
+        });
+
+        // GET /migrations/history - Get migration execution history
+        registry.addRoute({
+          method: 'get',
+          path: '/migrations/history',
+          pluginId: 'maintenance',
+          handler: async (req: Request, res: Response) => {
+            try {
+              if (!hasPostgres()) {
+                return res.json({ executions: [] });
+              }
+
+              const db = getPostgres();
+              const { limit = '10', offset = '0', status, search } = req.query;
+
+              let query = 'SELECT * FROM migration_executions WHERE 1=1';
+              const params: (string | number)[] = [];
+              let paramIndex = 1;
+
+              if (status && typeof status === 'string') {
+                query += ` AND status = $${paramIndex}`;
+                params.push(status);
+                paramIndex++;
+              }
+
+              if (search && typeof search === 'string') {
+                query += ` AND (output ILIKE $${paramIndex} OR error ILIKE $${paramIndex})`;
+                params.push(`%${search}%`);
+                paramIndex++;
+              }
+
+              query += ` ORDER BY started_at DESC LIMIT $${paramIndex} OFFSET $${paramIndex + 1}`;
+              params.push(parseInt(limit as string, 10), parseInt(offset as string, 10));
+
+              const executions = await db.query(query, params);
+
+              // Get total count
+              let countQuery = 'SELECT COUNT(*) as count FROM migration_executions WHERE 1=1';
+              const countParams: string[] = [];
+              let countParamIndex = 1;
+
+              if (status && typeof status === 'string') {
+                countQuery += ` AND status = $${countParamIndex}`;
+                countParams.push(status);
+                countParamIndex++;
+              }
+
+              if (search && typeof search === 'string') {
+                countQuery += ` AND (output ILIKE $${countParamIndex} OR error ILIKE $${countParamIndex})`;
+                countParams.push(`%${search}%`);
+              }
+
+              const countResult = await db.queryOne<{ count: string }>(countQuery, countParams);
+              const total = parseInt(countResult?.count || '0', 10);
+
+              res.json({
+                executions,
+                pagination: {
+                  total,
+                  limit: parseInt(limit as string, 10),
+                  offset: parseInt(offset as string, 10),
+                },
+              });
+            } catch (error) {
+              logger.error('Failed to fetch migration history', { error });
+              res.status(500).json({
+                error: error instanceof Error ? error.message : String(error),
+              });
+            }
+          },
+        });
+
+        // GET /migrations/history/:id - Get detailed migration execution result
+        registry.addRoute({
+          method: 'get',
+          path: '/migrations/history/:id',
+          pluginId: 'maintenance',
+          handler: async (req: Request, res: Response) => {
+            try {
+              if (!hasPostgres()) {
+                return res.status(404).json({ error: 'Execution not found' });
+              }
+
+              const { id } = req.params;
+              const db = getPostgres();
+
+              const execution = await db.queryOne(
+                'SELECT * FROM migration_executions WHERE id = $1',
+                [id]
+              );
+
+              if (!execution) {
+                return res.status(404).json({ error: 'Execution not found' });
+              }
+
+              res.json({ execution });
+            } catch (error) {
+              logger.error('Failed to fetch migration execution detail', { error });
+              res.status(500).json({
+                error: error instanceof Error ? error.message : String(error),
+                message: error instanceof Error ? error.message : String(error),
+              });
+            }
+          },
+        });
+      }
+
       // Register maintenance widgets
       if (config.enableSeeds !== false) {
         registry.addWidget({
@@ -606,6 +1071,19 @@ export function createMaintenancePlugin(config: MaintenancePluginConfig = {}): P
         });
       }
 
+      // Register migration management widget
+      if (config.enableMigrations !== false) {
+        registry.addWidget({
+          id: 'migration-management',
+          title: 'Database Migrations',
+          component: 'MigrationManagementWidget',
+          type: 'maintenance',
+          priority: 15,
+          showByDefault: true, // Show by default on maintenance page
+          pluginId: 'maintenance',
+        });
+      }
+
       // TODO: Register service control routes
       if (config.enableServiceControl !== false) {
         logger.debug('Service control enabled');

package/src/plugins/notifications/NotificationsManagementPage.tsx

@@ -32,7 +32,7 @@ interface NotificationsStats {
 }
 
 export const NotificationsManagementPage: React.FC<NotificationsManagementPageProps> = ({
-  apiPrefix = '/api/notifications',
+  apiPrefix = '/qapi/notifications',
 }) => {
   const [notifications, setNotifications] = useState<Notification[]>([]);
   const [stats, setStats] = useState<NotificationsStats | null>(null);

package/src/plugins/notifications/NotificationsStatusWidget.tsx

@@ -10,7 +10,7 @@ export interface NotificationsStatusWidgetProps {
   apiPrefix?: string;
 }
 
-export function NotificationsStatusWidget({ apiPrefix = '/api/notifications' }: NotificationsStatusWidgetProps) {
+export function NotificationsStatusWidget({ apiPrefix = '/qapi/notifications' }: NotificationsStatusWidgetProps) {
   const [stats, setStats] = useState<{
     totalNotifications: number;
     pendingNotifications: number;

package/src/plugins/parental/ParentalManagementPage.tsx

@@ -23,7 +23,7 @@ interface ParentalControl {
   updatedAt: string;
 }
 
-export function ParentalManagementPage({ apiPrefix = '/api/parental' }: ParentalManagementPageProps) {
+export function ParentalManagementPage({ apiPrefix = '/qapi/parental' }: ParentalManagementPageProps) {
   const [activeTab, setActiveTab] = useState<'all' | 'active' | 'violations' | 'config'>('all');
   const [controls, setControls] = useState<ParentalControl[]>([]);
   const [loading, setLoading] = useState(true);

package/src/plugins/parental/ParentalStatusWidget.tsx

@@ -10,7 +10,7 @@ export interface ParentalStatusWidgetProps {
   apiPrefix?: string;
 }
 
-export function ParentalStatusWidget({ apiPrefix = '/api/parental' }: ParentalStatusWidgetProps) {
+export function ParentalStatusWidget({ apiPrefix = '/qapi/parental' }: ParentalStatusWidgetProps) {
   const [stats, setStats] = useState<{
     totalControls: number;
     activeControls: number;

package/src/plugins/postgres/PostgresManagementPage.tsx

@@ -42,7 +42,7 @@ interface PoolConfig {
 }
 
 export const PostgresManagementPage: React.FC<PostgresManagementPageProps> = ({
-  apiPrefix = '/api/plugins/postgres',
+  apiPrefix = '/qapi/plugins/postgres',
 }) => {
   const [connections, setConnections] = useState<ConnectionInfo[]>([]);
   const [queryLogs, setQueryLogs] = useState<QueryLog[]>([]);

package/src/plugins/postgres/PostgresStatusWidget.tsx

@@ -28,7 +28,7 @@ interface PostgresStats {
 }
 
 export const PostgresStatusWidget: React.FC<PostgresStatusWidgetProps> = ({
-  apiPrefix = '/api/plugins/postgres',
+  apiPrefix = '/qapi/plugins/postgres',
 }) => {
   const [stats, setStats] = useState<PostgresStats | null>(null);
   const [loading, setLoading] = useState(true);

package/src/plugins/preferences/PreferencesManagementPage.tsx

@@ -29,7 +29,7 @@ interface Preference {
   updatedAt: string;
 }
 
-export function PreferencesManagementPage({ apiPrefix = '/api/preferences' }: PreferencesManagementPageProps) {
+export function PreferencesManagementPage({ apiPrefix = '/qapi/preferences' }: PreferencesManagementPageProps) {
   const [activeTab, setActiveTab] = useState<'overview' | 'user' | 'global' | 'config'>('overview');
   const [preferenceSets, setPreferenceSets] = useState<PreferenceSet[]>([]);
   const [preferences, setPreferences] = useState<Preference[]>([]);

package/src/plugins/preferences/PreferencesStatusWidget.tsx

@@ -10,7 +10,7 @@ export interface PreferencesStatusWidgetProps {
   apiPrefix?: string;
 }
 
-export function PreferencesStatusWidget({ apiPrefix = '/api/preferences' }: PreferencesStatusWidgetProps) {
+export function PreferencesStatusWidget({ apiPrefix = '/qapi/preferences' }: PreferencesStatusWidgetProps) {
   const [stats, setStats] = useState<{
     totalPreferences: number;
     activeUsers: number;

package/src/plugins/profiles/ProfilesManagementPage.tsx

@@ -22,7 +22,7 @@ interface Profile {
   createdAt: string;
 }
 
-export function ProfilesManagementPage({ apiPrefix = '/api/profiles' }: ProfilesManagementPageProps) {
+export function ProfilesManagementPage({ apiPrefix = '/qapi/profiles' }: ProfilesManagementPageProps) {
   const [activeTab, setActiveTab] = useState<'all' | 'complete' | 'incomplete' | 'config'>('all');
   const [profiles, setProfiles] = useState<Profile[]>([]);
   const [loading, setLoading] = useState(true);

package/src/plugins/profiles/ProfilesStatusWidget.tsx

@@ -10,7 +10,7 @@ export interface ProfilesStatusWidgetProps {
   apiPrefix?: string;
 }
 
-export function ProfilesStatusWidget({ apiPrefix = '/api/profiles' }: ProfilesStatusWidgetProps) {
+export function ProfilesStatusWidget({ apiPrefix = '/qapi/profiles' }: ProfilesStatusWidgetProps) {
   const [stats, setStats] = useState<{
     totalProfiles: number;
     completeProfiles: number;

package/src/plugins/qwickbrain/QwickbrainManagementPage.tsx

@@ -30,7 +30,7 @@ interface QwickbrainStats {
 }
 
 export const QwickbrainManagementPage: React.FC<QwickbrainManagementPageProps> = ({
-  apiPrefix = '/api/qwickbrain',
+  apiPrefix = '/qapi/qwickbrain',
 }) => {
   const [repositories, setRepositories] = useState<Repository[]>([]);
   const [stats, setStats] = useState<QwickbrainStats | null>(null);

package/src/plugins/qwickbrain/QwickbrainStatusWidget.tsx

@@ -10,7 +10,7 @@ export interface QwickbrainStatusWidgetProps {
   apiPrefix?: string;
 }
 
-export function QwickbrainStatusWidget({ apiPrefix = '/api/qwickbrain' }: QwickbrainStatusWidgetProps) {
+export function QwickbrainStatusWidget({ apiPrefix = '/qapi/qwickbrain' }: QwickbrainStatusWidgetProps) {
   const [stats, setStats] = useState<{
     totalDocuments: number;
     indexedRepositories: number;

package/src/plugins/rate-limit/RateLimitManagementPage.tsx

@@ -31,7 +31,7 @@ interface RateLimitStats {
 }
 
 export const RateLimitManagementPage: React.FC<RateLimitManagementPageProps> = ({
-  apiPrefix = '/api/rate-limit',
+  apiPrefix = '/qapi/rate-limit',
 }) => {
   const [rules, setRules] = useState<RateLimitRule[]>([]);
   const [stats, setStats] = useState<RateLimitStats | null>(null);

package/src/plugins/rate-limit/RateLimitStatusWidget.tsx

@@ -10,7 +10,7 @@ export interface RateLimitStatusWidgetProps {
   apiPrefix?: string;
 }
 
-export function RateLimitStatusWidget({ apiPrefix = '/api/rate-limit' }: RateLimitStatusWidgetProps) {
+export function RateLimitStatusWidget({ apiPrefix = '/qapi/rate-limit' }: RateLimitStatusWidgetProps) {
   const [stats, setStats] = useState<{
     totalRequests: number;
     blockedRequests: number;