@splyntra/dashboard 0.3.0

package/src/lib/api.test.ts

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+import { describe, it, expect, beforeEach } from "vitest";
+import { getActiveProject, setActiveProject } from "./api";
+
+describe("active project persistence", () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  it("defaults to empty (API key's default project)", () => {
+    expect(getActiveProject()).toBe("");
+  });
+
+  it("round-trips a selected project id", () => {
+    setActiveProject("proj-123");
+    expect(getActiveProject()).toBe("proj-123");
+  });
+
+  it("clearing resets to default", () => {
+    setActiveProject("proj-123");
+    setActiveProject("");
+    expect(getActiveProject()).toBe("");
+  });
+});

package/src/lib/api.ts

@@ -0,0 +1,379 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Use Next.js API proxy in production, direct collector URL in development
+const API_BASE =
+  typeof window !== "undefined"
+    ? window.location.origin + "/api"
+    : process.env.NEXT_PUBLIC_API_URL || "http://localhost:4318";
+
+const ACTIVE_PROJECT_KEY = "splyntra_active_project";
+
+/** Active project id (empty = the API key's default project). */
+export function getActiveProject(): string {
+  if (typeof window !== "undefined") {
+    return localStorage.getItem(ACTIVE_PROJECT_KEY) || "";
+  }
+  return "";
+}
+
+export function setActiveProject(projectId: string): void {
+  if (typeof window !== "undefined") {
+    if (projectId) localStorage.setItem(ACTIVE_PROJECT_KEY, projectId);
+    else localStorage.removeItem(ACTIVE_PROJECT_KEY);
+  }
+}
+
+/** Append the active (or supplied) project id as a query param when set. */
+function withProject(url: string, projectId?: string): string {
+  const pid = projectId ?? getActiveProject();
+  if (!pid) return url;
+  return url + (url.includes("?") ? "&" : "?") + `project_id=${encodeURIComponent(pid)}`;
+}
+
+// Exported so commercial dashboard screens (composed in at cloud-build time)
+// can reuse the same authenticated fetch helpers.
+export async function apiGet<T>(path: string): Promise<T> {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 15000);
+  try {
+    const res = await fetch(`${API_BASE}${path}`, {
+      headers: {
+        Authorization: `Bearer ${getApiKey()}`,
+        "Content-Type": "application/json",
+      },
+      signal: controller.signal,
+    });
+    if (!res.ok) throw new Error(`Request failed: ${res.status}`);
+    return res.json();
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+export interface TraceListResponse {
+  traces: TraceListItem[];
+  total: number;
+}
+
+export interface TraceListItem {
+  trace_id: string;
+  agent_id: string;
+  workflow_id: string;
+  status: string;
+  latency_ms: number;
+  total_tokens: number;
+  cost_usd: number;
+  risk_score: number;
+  risk_severity: string;
+  detection_count: number;
+  span_count: number;
+  started_at: string;
+  completed_at: string;
+}
+
+export interface TraceDetailResponse {
+  trace_id: string;
+  spans: SpanItem[];
+  detections: DetectionItem[];
+}
+
+export interface SpanItem {
+  trace_id: string;
+  span_id: string;
+  parent_span_id: string;
+  type: string;
+  name: string;
+  status: string;
+  latency_ms: number;
+  model: string;
+  prompt_tokens: number;
+  completion_tokens: number;
+  cost_usd: number;
+  input_preview: string;
+  output_preview: string;
+  attributes: Record<string, string>;
+  started_at: string;
+}
+
+export interface DetectionItem {
+  trace_id: string;
+  span_id: string;
+  detector: string;
+  category: string;
+  severity: string;
+  confidence: number;
+  description: string;
+  is_beta: number;
+  detected_at: string;
+}
+
+export async function fetchTraces(limit = 50): Promise<TraceListResponse> {
+  return apiGet<TraceListResponse>(withProject(`/v1/traces?limit=${limit}`));
+}
+
+export async function fetchTrace(traceId: string): Promise<TraceDetailResponse> {
+  return apiGet<TraceDetailResponse>(withProject(`/v1/traces/${encodeURIComponent(traceId)}`));
+}
+
+function getApiKey(): string {
+  if (typeof window !== "undefined") {
+    return localStorage.getItem("splyntra_api_key") || "";
+  }
+  return process.env.SPLYNTRA_API_KEY || "";
+}
+
+// ─── Agents API ─────────────────────────────────────────────────────────────
+
+export interface AgentItem {
+  agent_id: string;
+  name?: string;
+  framework?: string;
+  trace_count: number;
+  error_count: number;
+  avg_latency_ms: number;
+  p95_latency_ms: number;
+  total_tokens: number;
+  total_cost: number;
+  detection_count: number;
+  last_seen_at: string;
+}
+
+export interface AgentsResponse {
+  agents: AgentItem[];
+  total: number;
+}
+
+export async function fetchAgents(): Promise<AgentsResponse> {
+  return apiGet<AgentsResponse>(withProject(`/v1/agents`));
+}
+
+// ─── Costs API ──────────────────────────────────────────────────────────────
+
+export interface CostModelItem {
+  model: string;
+  call_count: number;
+  total_prompt_tokens: number;
+  total_completion_tokens: number;
+  total_cost: number;
+  avg_cost_per_call: number;
+}
+
+export interface CostSummary {
+  total_cost: number;
+  total_calls: number;
+  total_tokens: number;
+  avg_cost_per_call: number;
+}
+
+export interface ProjectCostItem {
+  project_id: string;
+  call_count: number;
+  total_tokens: number;
+  total_cost: number;
+}
+
+export interface CostsResponse {
+  models: CostModelItem[];
+  summary: CostSummary;
+  by_project: ProjectCostItem[];
+}
+
+export async function fetchCosts(): Promise<CostsResponse> {
+  return apiGet<CostsResponse>(withProject(`/v1/costs`));
+}
+
+// ─── Evaluation API (separate service, proxied via /api/eval) ───────────────
+
+const EVAL_BASE =
+  typeof window !== "undefined" ? window.location.origin + "/api/eval" : process.env.EVAL_URL || "http://localhost:8002";
+
+export interface EvalDataset {
+  id: string;
+  name: string;
+  slug: string;
+  description: string;
+  latest_version: number;
+  item_count: number;
+  created_at: string;
+}
+
+export interface EvalRun {
+  id: string;
+  dataset_id: string;
+  score: number;
+  item_count: number;
+  passed: boolean;
+  regression: boolean;
+  per_scorer: Record<string, number>;
+  created_at: string;
+}
+
+async function evalGet<T>(path: string): Promise<T> {
+  const res = await fetch(`${EVAL_BASE}${path}`, {
+    headers: { Authorization: `Bearer ${getApiKey()}`, "Content-Type": "application/json" },
+  });
+  if (!res.ok) throw new Error(`Eval request failed: ${res.status}`);
+  return res.json();
+}
+
+export async function fetchDatasets(): Promise<{ datasets: EvalDataset[] }> {
+  return evalGet(`/v1/datasets`);
+}
+
+export async function fetchEvalRuns(datasetId?: string): Promise<{ runs: EvalRun[] }> {
+  return evalGet(`/v1/evaluations${datasetId ? `?dataset_id=${encodeURIComponent(datasetId)}` : ""}`);
+}
+
+export async function apiSend(path: string, method: string, body?: unknown): Promise<any> {
+  const res = await fetch(`${API_BASE}${path}`, {
+    method,
+    headers: { Authorization: `Bearer ${getApiKey()}`, "Content-Type": "application/json" },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  if (!res.ok && res.status !== 204) throw new Error(`Request failed: ${res.status}`);
+  return res.status === 204 ? null : res.json().catch(() => null);
+}
+
+// ─── Metrics API ─────────────────────────────────────────────────────────────
+
+export interface MetricPoint {
+  bucket: string;
+  trace_count: number;
+  error_count: number;
+  avg_latency_ms: number;
+  p95_latency_ms: number;
+  total_tokens: number;
+  total_cost: number;
+}
+
+export interface MetricsResponse {
+  points: MetricPoint[];
+  window: number;
+  interval: number;
+}
+
+export async function fetchMetrics(windowSec = 86400, intervalSec = 300): Promise<MetricsResponse> {
+  return apiGet<MetricsResponse>(withProject(`/v1/metrics?window=${windowSec}&interval=${intervalSec}`));
+}
+
+// ─── Projects API ─────────────────────────────────────────────────────────
+
+export interface ProjectItem {
+  id: string;
+  name: string;
+  slug: string;
+  environment: string;
+  created_at: string;
+}
+
+export interface ProjectsResponse {
+  projects: ProjectItem[];
+  total: number;
+}
+
+export async function fetchProjects(): Promise<ProjectsResponse> {
+  return apiGet<ProjectsResponse>(`/v1/projects`);
+}
+
+export async function createProject(input: {
+  name: string;
+  slug?: string;
+  environment?: string;
+}): Promise<ProjectItem> {
+  return apiSend(`/v1/projects`, "POST", input);
+}
+
+// ─── API keys (provisioning; requires an admin-scoped key) ───────────────────
+
+export interface ApiKeyItem {
+  id: string;
+  name: string;
+  project_id: string;
+  key_prefix: string;
+  scopes: string[];
+  is_active: boolean;
+  last_used_at: string | null;
+  created_at: string;
+}
+
+export async function fetchKeys(): Promise<{ keys: ApiKeyItem[] }> {
+  return apiGet<{ keys: ApiKeyItem[] }>(`/v1/keys`);
+}
+
+// Returns the plaintext key exactly once (in `key`).
+export async function createKey(input: {
+  name: string;
+  project_id?: string;
+  scopes?: string[];
+}): Promise<{ key: string; meta: ApiKeyItem }> {
+  return apiSend(`/v1/keys`, "POST", input);
+}
+
+export async function revokeKey(id: string): Promise<void> {
+  await apiSend(`/v1/keys/${encodeURIComponent(id)}`, "DELETE");
+}
+
+export async function rotateKey(id: string): Promise<{ key: string }> {
+  return apiSend(`/v1/keys/${encodeURIComponent(id)}/rotate`, "POST");
+}
+
+// ─── Alerts API ─────────────────────────────────────────────────────────────
+
+export interface AlertItem {
+  id: string;
+  org_id: string;
+  project_id: string;
+  name: string;
+  type: string;
+  config: Record<string, unknown>;
+  channels: string[];
+  is_active: boolean;
+  created_at: string;
+}
+
+export interface AlertEventItem {
+  id: string;
+  alert_id: string;
+  alert_name: string;
+  trace_id: string;
+  risk_score: number;
+  severity: string;
+  fired_at: string;
+}
+
+export interface AlertsResponse {
+  alerts: AlertItem[];
+  events: AlertEventItem[];
+}
+
+export async function fetchAlerts(): Promise<AlertsResponse> {
+  return apiGet<AlertsResponse>(withProject(`/v1/alerts`));
+}
+
+export interface CreateAlertInput {
+  name: string;
+  type: string;
+  project_id?: string;
+  config: Record<string, unknown>;
+  channels: string[];
+}
+
+export async function createAlert(input: CreateAlertInput): Promise<{ id: string }> {
+  const res = await fetch(`${API_BASE}/v1/alerts`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${getApiKey()}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify(input),
+  });
+  if (!res.ok) throw new Error(`Failed to create alert: ${res.status}`);
+  return res.json();
+}
+
+export async function deleteAlert(alertId: string): Promise<void> {
+  const res = await fetch(`${API_BASE}/v1/alerts/${encodeURIComponent(alertId)}`, {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${getApiKey()}` },
+  });
+  if (!res.ok && res.status !== 204) throw new Error(`Failed to delete alert: ${res.status}`);
+}

package/src/lib/auth-extensions.ts

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Auth extension seam (mirrors lib/slots.ts). Lets a build inject additional
+// next-auth providers and post-sign-in hooks without forking the open auth
+// setup. The open edition registers nothing here (Credentials + the implicit
+// single org); the commercial build's overlay registers OAuth providers
+// (Google/GitHub/OIDC) and an org-onboarding hook.
+//
+// auth.ts imports lib/auth-providers (a no-op file in the open repo, replaced by
+// the cloud overlay) for its registration side effects, then reads the values
+// below when constructing NextAuth.
+import type { NextAuthConfig } from "next-auth";
+
+type Provider = NonNullable<NextAuthConfig["providers"]>[number];
+type SignInUser = { id?: string; email?: string | null; name?: string | null };
+type SignInHook = (user: SignInUser, account: unknown) => Promise<void> | void;
+
+const extraProviders: Provider[] = [];
+const signInHooks: SignInHook[] = [];
+let onboardingPath: string | null = null;
+
+/** Register one or more next-auth providers (called from the cloud overlay). */
+export function registerAuthProviders(...providers: Provider[]): void {
+  extraProviders.push(...providers);
+}
+
+/** Providers contributed by extensions (empty in the open edition). */
+export function registeredAuthProviders(): Provider[] {
+  return extraProviders;
+}
+
+/** Register a hook run after a successful sign-in (e.g. link OAuth identity). */
+export function registerSignInHook(fn: SignInHook): void {
+  signInHooks.push(fn);
+}
+
+export function registeredSignInHooks(): SignInHook[] {
+  return signInHooks;
+}
+
+/** The cloud build sets this so users without an org are sent to onboarding. */
+export function setOnboardingRedirect(path: string): void {
+  onboardingPath = path;
+}
+
+export function onboardingRedirect(): string | null {
+  return onboardingPath;
+}

package/src/lib/auth-providers.ts

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Extension point: the open edition registers no extra auth providers (it uses
+// email/password Credentials with a single implicit organization). The
+// commercial cloud build replaces this file in its composition step to register
+// OAuth providers (Google / GitHub / Microsoft-OIDC) and an org-onboarding hook
+// via lib/auth-extensions. Importing this module for its side effects is a no-op
+// here, which keeps the open build standalone.
+export {};

package/src/lib/collector-auth-providers.ts

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Extension point: the open edition registers no BFF auth resolver (single
+// implicit org → the server key is correct). The commercial cloud build
+// replaces this file in its composition step to register a resolver that scopes
+// each collector request to the logged-in user's active org via a trusted
+// service token + X-Splyntra-Org-Id headers. No-op here keeps the open build
+// standalone.
+export {};

package/src/lib/collector-auth.ts

@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Resolves how the dashboard BFF authenticates to the collector / evaluation
+// service on behalf of the logged-in user. This is the multi-tenant seam.
+//
+// Open (Community) default: a single implicit org, so the BFF attaches the
+// server-side org key (SPLYNTRA_API_KEY) — or, only outside production, the dev
+// key. The commercial Cloud build registers a resolver (see the no-op
+// collector-auth-providers below, replaced by the cloud overlay) that instead
+// uses a trusted service token + X-Splyntra-Org-Id headers so each request is
+// scoped to the user's ACTIVE org (api_keys store only hashes, so a per-org key
+// can't be replayed). The collector honors that header path only when its
+// COLLECTOR_SERVICE_TOKEN matches.
+import "@/lib/collector-auth-providers"; // side-effect: cloud overlay registers its resolver
+
+type SessionLike = { user?: { id?: string; orgId?: string; role?: string } } | null | undefined;
+export interface CollectorAuth {
+  headers: Record<string, string>;
+}
+// May be async: the cloud resolver verifies org membership in Postgres before
+// trusting session.orgId (so a forged JWT orgId can't reach another tenant).
+type Resolver = (
+  session: SessionLike,
+  incomingKey: string
+) => Promise<CollectorAuth | null> | CollectorAuth | null;
+
+let resolver: Resolver | null = null;
+
+/** Register the BFF auth resolver (called by the cloud overlay). */
+export function registerCollectorAuthResolver(fn: Resolver): void {
+  resolver = fn;
+}
+
+// Community default: explicit client key, else the server org key, else the dev
+// key in non-production. Never falls back to the dev key in production.
+function defaultAuth(incomingKey: string): CollectorAuth {
+  // The dev key activates ONLY when NODE_ENV is explicitly "development" — an
+  // unset NODE_ENV in production must NOT silently enable it (fail closed).
+  const serverKey =
+    process.env.SPLYNTRA_API_KEY ||
+    (process.env.NODE_ENV === "development" ? "splyntra_dev_key" : "");
+  const key = incomingKey || serverKey;
+  return { headers: key ? { authorization: `Bearer ${key}` } : {} };
+}
+
+/** Resolve the auth headers the BFF must attach for this request. */
+export async function resolveCollectorAuth(session: unknown, incomingKey: string): Promise<CollectorAuth> {
+  if (resolver) {
+    const r = await resolver(session as SessionLike, incomingKey);
+    if (r) return r;
+  }
+  return defaultAuth(incomingKey);
+}

package/src/lib/db.ts

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+import { Pool } from "pg";
+
+// Server-only Postgres pool for user/team management (next-auth lives in the
+// BFF, so user auth talks to Postgres directly rather than via the collector).
+const globalForPg = globalThis as unknown as { _pgPool?: Pool };
+
+export const pool =
+  globalForPg._pgPool ??
+  new Pool({
+    connectionString:
+      process.env.POSTGRES_DSN ||
+      "postgres://splyntra:splyntra@localhost:5432/splyntra?sslmode=disable",
+    max: 5,
+  });
+
+if (process.env.NODE_ENV !== "production") globalForPg._pgPool = pool;
+
+export type Role = "owner" | "admin" | "member" | "viewer";
+
+const RANK: Record<Role, number> = { viewer: 0, member: 1, admin: 2, owner: 3 };
+
+/** True if `role` is at least as privileged as `min`. */
+export function roleAtLeast(role: string | undefined, min: Role): boolean {
+  if (!role || !(role in RANK)) return false;
+  return RANK[role as Role] >= RANK[min];
+}

package/src/lib/features.ts

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Feature flags. All false in the open-source build. The cloud/enterprise build
+// flips the relevant flags via injected runtime config (NEXT_PUBLIC_FEATURE_*),
+// which lights up nav slots whose screens are composed in from the private
+// frontend/cloud-screens package. Flags gate VISIBILITY of code that may ship;
+// truly private screens ship only via slots (see slots.ts).
+function flag(name: string): boolean {
+  // NEXT_PUBLIC_* are inlined at build time; unset → false in OSS.
+  return process.env[`NEXT_PUBLIC_FEATURE_${name}`] === "true";
+}
+
+export const features = {
+  governance: flag("GOVERNANCE"), // policy engine, delegation, activity ledger
+  sso: flag("SSO"),
+  billing: flag("BILLING"),
+  identity: flag("IDENTITY"),
+} as const;
+
+export type FeatureName = keyof typeof features;

package/src/lib/hooks.ts

@@ -0,0 +1,116 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import {
+  fetchTraces,
+  fetchTrace,
+  fetchAgents,
+  fetchCosts,
+  fetchProjects,
+  fetchAlerts,
+  fetchMetrics,
+  fetchDatasets,
+  fetchEvalRuns,
+  fetchKeys,
+  EvalDataset,
+  EvalRun,
+  ApiKeyItem,
+  TraceListResponse,
+  TraceDetailResponse,
+  AgentsResponse,
+  CostsResponse,
+  ProjectsResponse,
+  AlertsResponse,
+  MetricsResponse,
+} from "@/lib/api";
+import { useProject } from "@/lib/project-context";
+
+export function useTraces(limit = 50) {
+  const { projectId } = useProject();
+  return useQuery<TraceListResponse>({
+    queryKey: ["traces", limit, projectId],
+    queryFn: () => fetchTraces(limit),
+    retry: 1,
+  });
+}
+
+export function useTrace(traceId: string) {
+  const { projectId } = useProject();
+  return useQuery<TraceDetailResponse>({
+    queryKey: ["trace", traceId, projectId],
+    queryFn: () => fetchTrace(traceId),
+    enabled: !!traceId,
+    retry: 1,
+  });
+}
+
+export function useAgents() {
+  const { projectId } = useProject();
+  return useQuery<AgentsResponse>({
+    queryKey: ["agents", projectId],
+    queryFn: () => fetchAgents(),
+    retry: 1,
+  });
+}
+
+export function useCosts() {
+  const { projectId } = useProject();
+  return useQuery<CostsResponse>({
+    queryKey: ["costs", projectId],
+    queryFn: () => fetchCosts(),
+    retry: 1,
+  });
+}
+
+export function useMetrics(windowSec = 86400, intervalSec = 300) {
+  const { projectId } = useProject();
+  return useQuery<MetricsResponse>({
+    queryKey: ["metrics", windowSec, intervalSec, projectId],
+    queryFn: () => fetchMetrics(windowSec, intervalSec),
+    retry: 1,
+  });
+}
+
+export function useDatasets() {
+  return useQuery<{ datasets: EvalDataset[] }>({
+    queryKey: ["eval-datasets"],
+    queryFn: () => fetchDatasets(),
+    retry: 1,
+  });
+}
+
+export function useEvalRuns(datasetId?: string) {
+  return useQuery<{ runs: EvalRun[] }>({
+    queryKey: ["eval-runs", datasetId ?? "all"],
+    queryFn: () => fetchEvalRuns(datasetId),
+    retry: 1,
+  });
+}
+
+export function useKeys() {
+  return useQuery<{ keys: ApiKeyItem[] }>({
+    queryKey: ["keys"],
+    queryFn: () => fetchKeys(),
+    retry: 1,
+  });
+}
+
+
+export function useProjects() {
+  return useQuery<ProjectsResponse>({
+    queryKey: ["projects"],
+    queryFn: () => fetchProjects(),
+    retry: 1,
+    refetchInterval: false,
+  });
+}
+
+export function useAlerts() {
+  const { projectId } = useProject();
+  return useQuery<AlertsResponse>({
+    queryKey: ["alerts", projectId],
+    queryFn: () => fetchAlerts(),
+    retry: 1,
+  });
+}