adonisjs-server-stats 1.13.0 → 1.14.0

package/dist/src/routes/dashboard_routes.js

@@ -1,9 +1,33 @@
 import { log } from '../utils/logger.js';
-let _whenReady;
-function bindDash(getController, method) {
+import { clampPerPage } from '../dashboard/paginate_helper.js';
+/**
+ * Lightweight CSRF guard for state-changing routes. Since `noSessionMiddleware`
+ * strips `Set-Cookie`, session-based CSRF tokens can't apply — instead we require
+ * the request to be provably same-origin (via the `Sec-Fetch-Site` fetch-metadata
+ * header) or to carry an `X-Requested-With` header, neither of which a cross-site
+ * form/navigation can forge. Returns true when the request is allowed.
+ */
+function isSameOriginRequest(ctx) {
+    const fetchSite = ctx.request.header('sec-fetch-site');
+    if (fetchSite)
+        return fetchSite === 'same-origin' || fetchSite === 'none';
+    // Older clients without fetch metadata: require an explicit XHR marker,
+    // which a cross-site simple form submission cannot set.
+    return !!ctx.request.header('x-requested-with');
+}
+/** Wrap a dashboard handler so it rejects cross-site state-changing requests. */
+function guardCsrf(handler) {
+    return async (ctx) => {
+        if (!isSameOriginRequest(ctx)) {
+            return ctx.response.forbidden({ error: 'Cross-site request blocked' });
+        }
+        return handler(ctx);
+    };
+}
+function bindDash(getController, method, whenReady) {
     return async (ctx) => {
-        if (_whenReady)
-            await _whenReady();
+        if (whenReady)
+            await whenReady();
         const controller = getController();
         if (!controller) {
             log.warn(`503 on ${ctx.request.url()} — dashboardController is null (method: ${method}). ` +
@@ -15,10 +39,10 @@ function bindDash(getController, method) {
         return controller[method].call(controller, ctx);
     };
 }
-function bindApi(getApi, fn) {
+function bindApi(getApi, fn, whenReady) {
     return async (ctx) => {
-        if (_whenReady)
-            await _whenReady();
+        if (whenReady)
+            await whenReady();
         const api = getApi();
         if (!api) {
             log.warn(`503 on ${ctx.request.url()} — apiController is null. ` +
@@ -30,13 +54,13 @@ function bindApi(getApi, fn) {
         return fn(api, ctx);
     };
 }
-function registerQueryRoutes(router, getApi) {
+function registerQueryRoutes(router, getApi, whenReady) {
     router
         .get('/api/queries', bindApi(getApi, async (api, ctx) => {
         const qs = ctx.request.qs();
         return ctx.response.json(await api.getQueries({
             page: Number(qs.page) || 1,
-            perPage: Number(qs.perPage) || 25,
+            perPage: clampPerPage(Number(qs.perPage) || 25),
             search: qs.search || undefined,
             filters: {
                 durationMin: qs.duration_min ? Number(qs.duration_min) : undefined,
@@ -45,50 +69,50 @@ function registerQueryRoutes(router, getApi) {
                 connection: qs.connection || undefined,
             },
         }));
-    }))
+    }, whenReady))
         .as('server-stats.queries');
 }
-function registerEventRoutes(router, getApi) {
+function registerEventRoutes(router, getApi, whenReady) {
     router
         .get('/api/events', bindApi(getApi, async (api, ctx) => {
         const qs = ctx.request.qs();
         return ctx.response.json(await api.getEvents({
             page: Number(qs.page) || 1,
-            perPage: Number(qs.perPage) || 25,
+            perPage: clampPerPage(Number(qs.perPage) || 25),
             search: qs.search || undefined,
             filters: { eventName: qs.event_name || undefined },
         }));
-    }))
+    }, whenReady))
         .as('server-stats.events');
 }
-function registerRouteApiRoutes(router, getApi) {
+function registerRouteApiRoutes(router, getApi, whenReady) {
     router
-        .get('/api/routes', bindApi(getApi, (api, ctx) => ctx.response.json(api.getRoutes(ctx.request.qs().search || undefined))))
+        .get('/api/routes', bindApi(getApi, (api, ctx) => ctx.response.json(api.getRoutes(ctx.request.qs().search || undefined)), whenReady))
         .as('server-stats.routes');
 }
-function registerLogRoutes(router, getApi) {
+function registerLogRoutes(router, getApi, whenReady) {
     router
         .get('/api/logs', bindApi(getApi, async (api, ctx) => {
         const qs = ctx.request.qs();
         return ctx.response.json(await api.getLogs({
             page: Number(qs.page) || 1,
-            perPage: Number(qs.perPage) || 50,
+            perPage: clampPerPage(Number(qs.perPage) || 50),
             search: qs.message || qs.search || undefined,
             filters: {
                 level: qs.level || undefined,
                 requestId: qs.request_id || qs.requestId || undefined,
             },
         }));
-    }))
+    }, whenReady))
         .as('server-stats.logs');
 }
-function registerEmailRoutes(router, getApi) {
+function registerEmailRoutes(router, getApi, whenReady) {
     router
         .get('/api/emails', bindApi(getApi, async (api, ctx) => {
         const qs = ctx.request.qs();
         return ctx.response.json(await api.getEmails({
             page: Number(qs.page) || 1,
-            perPage: Number(qs.perPage) || 25,
+            perPage: clampPerPage(Number(qs.perPage) || 25),
             search: qs.search || undefined,
             filters: {
                 from: qs.from || undefined,
@@ -98,24 +122,29 @@ function registerEmailRoutes(router, getApi) {
                 mailer: qs.mailer || undefined,
             },
         }));
-    }))
+    }, whenReady))
         .as('server-stats.emails');
     router
         .get('/api/emails/:id/preview', bindApi(getApi, async (api, ctx) => {
         const html = await api.getEmailPreview(Number(ctx.params.id));
         if (!html)
             return ctx.response.notFound({ error: 'Email not found' });
-        return ctx.response.header('Content-Type', 'text/html; charset=utf-8').send(html);
-    }))
+        return ctx.response
+            .header('Content-Type', 'text/html; charset=utf-8')
+            .header('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'")
+            .header('X-Content-Type-Options', 'nosniff')
+            .header('X-Frame-Options', 'SAMEORIGIN')
+            .send(html);
+    }, whenReady))
         .as('server-stats.emails.preview');
 }
-function registerTraceRoutes(router, getApi) {
+function registerTraceRoutes(router, getApi, whenReady) {
     router
         .get('/api/traces', bindApi(getApi, async (api, ctx) => {
         const qs = ctx.request.qs();
         return ctx.response.json(await api.getTraces({
             page: Number(qs.page) || 1,
-            perPage: Number(qs.perPage) || 25,
+            perPage: clampPerPage(Number(qs.perPage) || 25),
             search: qs.search || undefined,
             filters: {
                 method: qs.method ? qs.method.toUpperCase() : undefined,
@@ -124,7 +153,7 @@ function registerTraceRoutes(router, getApi) {
                 statusMax: qs.status_max ? Number(qs.status_max) : undefined,
             },
         }));
-    }))
+    }, whenReady))
         .as('server-stats.traces');
     router
         .get('/api/traces/:id', bindApi(getApi, async (api, ctx) => {
@@ -132,83 +161,88 @@ function registerTraceRoutes(router, getApi) {
         if (!trace)
             return ctx.response.notFound({ error: 'Trace not found' });
         return ctx.response.json(trace);
-    }))
+    }, whenReady))
         .as('server-stats.traces.show');
 }
-function registerDashboardPageRoutes(router, getDashboardController) {
-    router.get('/', bindDash(getDashboardController, 'page')).as('server-stats.dashboard');
+function registerDashboardPageRoutes(router, getDashboardController, whenReady) {
+    router.get('/', bindDash(getDashboardController, 'page', whenReady)).as('server-stats.dashboard');
     router
-        .get('/api/overview', bindDash(getDashboardController, 'overview'))
+        .get('/api/overview', bindDash(getDashboardController, 'overview', whenReady))
         .as('server-stats.overview');
     router
-        .get('/api/overview/chart', bindDash(getDashboardController, 'overviewChart'))
+        .get('/api/overview/chart', bindDash(getDashboardController, 'overviewChart', whenReady))
         .as('server-stats.overview.chart');
     router
-        .get('/api/requests', bindDash(getDashboardController, 'requests'))
+        .get('/api/requests', bindDash(getDashboardController, 'requests', whenReady))
         .as('server-stats.requests');
     router
-        .get('/api/requests/:id', bindDash(getDashboardController, 'requestDetail'))
+        .get('/api/requests/:id', bindDash(getDashboardController, 'requestDetail', whenReady))
         .as('server-stats.requests.show');
 }
-function registerQueryDashboardRoutes(router, getDashboardController) {
+function registerQueryDashboardRoutes(router, getDashboardController, whenReady) {
     router
-        .get('/api/queries/grouped', bindDash(getDashboardController, 'queriesGrouped'))
+        .get('/api/queries/grouped', bindDash(getDashboardController, 'queriesGrouped', whenReady))
         .as('server-stats.queries.grouped');
     router
-        .get('/api/queries/:id/explain', bindDash(getDashboardController, 'queryExplain'))
+        .get('/api/queries/:id/explain', bindDash(getDashboardController, 'queryExplain', whenReady))
         .as('server-stats.queries.explain');
 }
-function registerCacheRoutes(router, getDashboardController) {
-    router.get('/api/cache', bindDash(getDashboardController, 'cacheStats')).as('server-stats.cache');
+function registerCacheRoutes(router, getDashboardController, whenReady) {
+    router
+        .get('/api/cache', bindDash(getDashboardController, 'cacheStats', whenReady))
+        .as('server-stats.cache');
     router
-        .get('/api/cache/:key', bindDash(getDashboardController, 'cacheKey'))
+        .get('/api/cache/:key', bindDash(getDashboardController, 'cacheKey', whenReady))
         .as('server-stats.cache.show')
         .where('key', /.*/);
     router
-        .delete('/api/cache/:key', bindDash(getDashboardController, 'cacheKeyDelete'))
+        .delete('/api/cache/:key', guardCsrf(bindDash(getDashboardController, 'cacheKeyDelete', whenReady)))
         .as('server-stats.cache.delete')
         .where('key', /.*/);
 }
-function registerJobRoutes(router, getDashboardController) {
-    router.get('/api/jobs', bindDash(getDashboardController, 'jobs')).as('server-stats.jobs');
+function registerJobRoutes(router, getDashboardController, whenReady) {
     router
-        .get('/api/jobs/:id', bindDash(getDashboardController, 'jobDetail'))
+        .get('/api/jobs', bindDash(getDashboardController, 'jobs', whenReady))
+        .as('server-stats.jobs');
+    router
+        .get('/api/jobs/:id', bindDash(getDashboardController, 'jobDetail', whenReady))
         .as('server-stats.jobs.show');
     router
-        .post('/api/jobs/:id/retry', bindDash(getDashboardController, 'jobRetry'))
+        .post('/api/jobs/:id/retry', guardCsrf(bindDash(getDashboardController, 'jobRetry', whenReady)))
         .as('server-stats.jobs.retry');
 }
-function registerConfigAndFilterRoutes(router, getDashboardController) {
-    router.get('/api/config', bindDash(getDashboardController, 'config')).as('server-stats.config');
+function registerConfigAndFilterRoutes(router, getDashboardController, whenReady) {
+    router
+        .get('/api/config', bindDash(getDashboardController, 'config', whenReady))
+        .as('server-stats.config');
     router
-        .get('/api/filters', bindDash(getDashboardController, 'savedFilters'))
+        .get('/api/filters', bindDash(getDashboardController, 'savedFilters', whenReady))
         .as('server-stats.filters');
     router
-        .post('/api/filters', bindDash(getDashboardController, 'createSavedFilter'))
+        .post('/api/filters', guardCsrf(bindDash(getDashboardController, 'createSavedFilter', whenReady)))
         .as('server-stats.filters.create');
     router
-        .delete('/api/filters/:id', bindDash(getDashboardController, 'deleteSavedFilter'))
+        .delete('/api/filters/:id', guardCsrf(bindDash(getDashboardController, 'deleteSavedFilter', whenReady)))
         .as('server-stats.filters.delete');
 }
 /** Register dashboard routes. */
 export function registerDashboardRoutes(opts) {
     const { router, dashboardPath, getDashboardController, getApiController, middleware } = opts;
-    if (opts.whenReady)
-        _whenReady = opts.whenReady;
+    const whenReady = opts.whenReady;
     const base = dashboardPath.replace(/\/+$/, '');
     router
         .group(() => {
-        registerDashboardPageRoutes(router, getDashboardController);
-        registerQueryRoutes(router, getApiController);
-        registerEventRoutes(router, getApiController);
-        registerRouteApiRoutes(router, getApiController);
-        registerLogRoutes(router, getApiController);
-        registerEmailRoutes(router, getApiController);
-        registerTraceRoutes(router, getApiController);
-        registerQueryDashboardRoutes(router, getDashboardController);
-        registerCacheRoutes(router, getDashboardController);
-        registerJobRoutes(router, getDashboardController);
-        registerConfigAndFilterRoutes(router, getDashboardController);
+        registerDashboardPageRoutes(router, getDashboardController, whenReady);
+        registerQueryRoutes(router, getApiController, whenReady);
+        registerEventRoutes(router, getApiController, whenReady);
+        registerRouteApiRoutes(router, getApiController, whenReady);
+        registerLogRoutes(router, getApiController, whenReady);
+        registerEmailRoutes(router, getApiController, whenReady);
+        registerTraceRoutes(router, getApiController, whenReady);
+        registerQueryDashboardRoutes(router, getDashboardController, whenReady);
+        registerCacheRoutes(router, getDashboardController, whenReady);
+        registerJobRoutes(router, getDashboardController, whenReady);
+        registerConfigAndFilterRoutes(router, getDashboardController, whenReady);
     })
         .prefix(base)
         .use(middleware);

package/dist/src/routes/debug_routes.js

@@ -1,9 +1,8 @@
-import { getAppDbClient, buildExplainSql, extractPlan } from '../dashboard/query_explain_handler.js';
-let _whenReady;
-function bindDebug(getController, method) {
+import { getAppDbClient, buildExplainSql, extractPlan, hasUnsafeSqlTokens, } from '../dashboard/query_explain_handler.js';
+function bindDebug(getController, method, whenReady) {
     return async (ctx) => {
-        if (_whenReady)
-            await _whenReady();
+        if (whenReady)
+            await whenReady();
         const controller = getController();
         if (!controller)
             return ctx.response.serviceUnavailable({
@@ -12,10 +11,10 @@ function bindDebug(getController, method) {
         return controller[method].call(controller, ctx);
     };
 }
-function bindApi(getApi, fn) {
+function bindApi(getApi, fn, whenReady) {
     return async (ctx) => {
-        if (_whenReady)
-            await _whenReady();
+        if (whenReady)
+            await whenReady();
         const api = getApi();
         if (!api)
             return ctx.response.serviceUnavailable({
@@ -24,62 +23,69 @@ function bindApi(getApi, fn) {
         return fn(api, ctx);
     };
 }
-function registerDebugConfigRoutes(router, getDebugController) {
-    router.get('/config', bindDebug(getDebugController, 'config')).as('server-stats.debug.config');
+function registerDebugConfigRoutes(router, getDebugController, whenReady) {
     router
-        .get('/diagnostics', bindDebug(getDebugController, 'diagnostics'))
+        .get('/config', bindDebug(getDebugController, 'config', whenReady))
+        .as('server-stats.debug.config');
+    router
+        .get('/diagnostics', bindDebug(getDebugController, 'diagnostics', whenReady))
         .as('server-stats.debug.diagnostics');
 }
-function registerDebugQueryAndEventRoutes(router, getApiController) {
+function registerDebugQueryAndEventRoutes(router, getApiController, whenReady) {
     router
         .get('/queries', bindApi(getApiController, async (api, ctx) => {
         const queries = await api.getQueries({ source: 'memory' });
         return ctx.response.json({ queries: queries.data, summary: api.getQuerySummary() });
-    }))
+    }, whenReady))
         .as('server-stats.debug.queries');
     router
         .get('/events', bindApi(getApiController, async (api, ctx) => {
         const result = await api.getEvents({ source: 'memory' });
         return ctx.response.json({ events: result.data, total: result.meta.total });
-    }))
+    }, whenReady))
         .as('server-stats.debug.events');
     router
         .get('/routes', bindApi(getApiController, (api, ctx) => {
         const result = api.getRoutes();
         return ctx.response.json({ routes: result.data, total: result.meta.total });
-    }))
+    }, whenReady))
         .as('server-stats.debug.routes');
 }
-function registerDebugLogRoutes(router, getApiController) {
+function registerDebugLogRoutes(router, getApiController, whenReady) {
     router
         .get('/logs', bindApi(getApiController, async (api, ctx) => {
         const result = await api.getLogs({ source: 'auto', perPage: 200 });
         return ctx.response.json(result.data);
-    }))
+    }, whenReady))
         .as('server-stats.debug.logs');
 }
-function registerDebugEmailRoutes(router, getApiController) {
+function registerDebugEmailRoutes(router, getApiController, whenReady) {
     router
         .get('/emails', bindApi(getApiController, async (api, ctx) => {
         const result = await api.getEmails({});
         return ctx.response.json({ emails: result.data, total: result.meta.total });
-    }))
+    }, whenReady))
         .as('server-stats.debug.emails');
     router
         .get('/emails/:id/preview', bindApi(getApiController, async (api, ctx) => {
         const html = await api.getEmailPreview(Number(ctx.params.id));
         if (!html)
             return ctx.response.notFound({ error: 'Email not found' });
-        return ctx.response.header('Content-Type', 'text/html; charset=utf-8').send(html);
-    }))
+        return ctx.response
+            .header('Content-Type', 'text/html; charset=utf-8')
+            .header('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'")
+            .header('X-Content-Type-Options', 'nosniff')
+            .header('X-Frame-Options', 'SAMEORIGIN')
+            .send(html);
+    }, whenReady))
         .as('server-stats.debug.emailPreview');
 }
-function registerDebugTraceRoutes(router, getApiController) {
+function registerDebugTraceRoutes(router, getApiController, whenReady) {
     router
         .get('/traces', bindApi(getApiController, async (api, ctx) => {
         const result = await api.getTraces({ source: 'memory' });
         return ctx.response.json({ traces: result.data, total: result.meta.total });
-    }))
+    }, whenReady))
         .as('server-stats.debug.traces');
     router
         .get('/traces/:id', bindApi(getApiController, async (api, ctx) => {
@@ -87,16 +93,16 @@ function registerDebugTraceRoutes(router, getApiController) {
         if (!trace)
             return ctx.response.notFound({ error: 'Trace not found' });
         return ctx.response.json(trace);
-    }))
+    }, whenReady))
         .as('server-stats.debug.traceDetail');
 }
-function registerDebugExplainRoute(router, getDebugStore, getApp) {
+function registerDebugExplainRoute(router, whenReady, getDebugStore, getApp) {
     if (!getDebugStore || !getApp)
         return;
     router
         .get('/queries/:id/explain', async (ctx) => {
-        if (_whenReady)
-            await _whenReady();
+        if (whenReady)
+            await whenReady();
         const store = getDebugStore();
         const app = getApp();
         if (!store || !app) {
@@ -108,6 +114,11 @@ function registerDebugExplainRoute(router, getDebugStore, getApp) {
         if (!query.sql.trim().toUpperCase().startsWith('SELECT')) {
             return ctx.response.badRequest({ error: 'EXPLAIN is only supported for SELECT queries' });
         }
+        if (hasUnsafeSqlTokens(query.sql)) {
+            return ctx.response.badRequest({
+                error: 'EXPLAIN rejected: query contains disallowed tokens',
+            });
+        }
         try {
             const appDb = await getAppDbClient(app, query.connection || undefined);
             if (!appDb) {
@@ -136,17 +147,16 @@ function registerDebugExplainRoute(router, getDebugStore, getApp) {
 /** Register debug panel API routes. */
 export function registerDebugRoutes(opts) {
     const { router, debugEndpoint, getDebugController, getApiController, middleware } = opts;
-    if (opts.whenReady)
-        _whenReady = opts.whenReady;
+    const whenReady = opts.whenReady;
     const base = debugEndpoint.replace(/\/+$/, '');
     router
         .group(() => {
-        registerDebugConfigRoutes(router, getDebugController);
-        registerDebugQueryAndEventRoutes(router, getApiController);
-        registerDebugExplainRoute(router, opts.getDebugStore, opts.getApp);
-        registerDebugLogRoutes(router, getApiController);
-        registerDebugEmailRoutes(router, getApiController);
-        registerDebugTraceRoutes(router, getApiController);
+        registerDebugConfigRoutes(router, getDebugController, whenReady);
+        registerDebugQueryAndEventRoutes(router, getApiController, whenReady);
+        registerDebugExplainRoute(router, whenReady, opts.getDebugStore, opts.getApp);
+        registerDebugLogRoutes(router, getApiController, whenReady);
+        registerDebugEmailRoutes(router, getApiController, whenReady);
+        registerDebugTraceRoutes(router, getApiController, whenReady);
     })
         .prefix(base)
         .use(middleware);

package/dist/src/routes/no_session_middleware.d.ts

@@ -7,8 +7,11 @@ import type { HttpContext } from '@adonisjs/core/http';
  * Because this package's routes are polled every few seconds, this causes
  * rapid cookie accumulation that can break the browser.
  *
- * This middleware runs after the route handler (and any global middleware)
- * and removes the `Set-Cookie` header so sessions are never started by
- * server-stats routes.
+ * The `Set-Cookie` header is stripped **before** `next()` runs so it is gone
+ * even when a downstream handler flushes headers early (e.g. a streaming/SSE
+ * route under these prefixes) — stripping only after `next()` would be a no-op
+ * once the response has already been flushed. It is stripped again after
+ * `next()` to also cover cookies set by later global middleware on buffered
+ * responses.
  */
 export declare function noSessionMiddleware(ctx: HttpContext, next: () => Promise<void>): Promise<void>;

package/dist/src/routes/no_session_middleware.js

@@ -6,11 +6,15 @@
  * Because this package's routes are polled every few seconds, this causes
  * rapid cookie accumulation that can break the browser.
  *
- * This middleware runs after the route handler (and any global middleware)
- * and removes the `Set-Cookie` header so sessions are never started by
- * server-stats routes.
+ * The `Set-Cookie` header is stripped **before** `next()` runs so it is gone
+ * even when a downstream handler flushes headers early (e.g. a streaming/SSE
+ * route under these prefixes) — stripping only after `next()` would be a no-op
+ * once the response has already been flushed. It is stripped again after
+ * `next()` to also cover cookies set by later global middleware on buffered
+ * responses.
  */
 export async function noSessionMiddleware(ctx, next) {
+    ctx.response.response.removeHeader('set-cookie');
     await next();
     ctx.response.response.removeHeader('set-cookie');
 }

package/dist/src/routes/register_routes.d.ts

@@ -21,6 +21,14 @@ export interface RegisterRoutesOptions {
     debugEndpoint?: string;
     dashboardPath?: string;
     shouldShow?: (ctx: HttpContext) => boolean;
+    /**
+     * Escape hatch to register the sensitive dashboard/debug/stats routes WITHOUT
+     * any access guard when no `shouldShow` callback is provided. Off by default —
+     * without either `shouldShow` or this flag, sensitive routes are NOT registered
+     * (fail closed). Enabling this exposes the dashboard (which can surface secrets,
+     * email bodies, and SQL) to anyone who can reach it. Local dev only.
+     */
+    unsafeAllowNoAuth?: boolean;
     /** Optional promise that resolves when controllers are initialized. */
     whenReady?: () => Promise<void>;
 }

package/dist/src/routes/register_routes.js

@@ -3,10 +3,29 @@ import { registerDashboardRoutes } from './dashboard_routes.js';
 import { registerDebugRoutes } from './debug_routes.js';
 import { noSessionMiddleware } from './no_session_middleware.js';
 import { registerStatsRoute } from './stats_routes.js';
+import { log } from '../utils/logger.js';
+/** One-time warning latch for the unsafeAllowNoAuth escape hatch. */
+let _warnedNoAuth = false;
 /**
  * Register all server-stats routes in a single call.
  */
 export function registerAllRoutes(options) {
+    // Fail closed: without an access guard (`shouldShow`) the sensitive routes must
+    // not be registered unless the caller explicitly opts in via `unsafeAllowNoAuth`.
+    if (!options.shouldShow) {
+        if (!options.unsafeAllowNoAuth) {
+            log.warn('server-stats: no `authorize`/`shouldShow` guard configured — sensitive routes ' +
+                '(dashboard, debug API, stats) will NOT be registered. Provide an authorize callback, ' +
+                'or set `unsafeAllowNoAuth: true` to expose them without auth (local dev only).');
+            return;
+        }
+        if (!_warnedNoAuth) {
+            _warnedNoAuth = true;
+            log.warn('server-stats: `unsafeAllowNoAuth` is enabled — the dashboard is exposed WITHOUT ' +
+                'authentication. It can surface secrets, email bodies, and SQL to anyone who can ' +
+                'reach it. Do not use this outside strictly local development.');
+        }
+    }
     const middleware = [
         noSessionMiddleware,
         ...(options.shouldShow ? [createAccessMiddleware(options.shouldShow)] : []),

package/dist/src/types.d.ts

@@ -751,6 +751,18 @@ export interface ServerStatsConfig {
      * ```
      */
     authorize?: (ctx: import('@adonisjs/core/http').HttpContext) => boolean;
+    /**
+     * Register the sensitive dashboard/debug/stats routes WITHOUT any access
+     * guard when no {@link authorize} callback is provided.
+     *
+     * The package fails closed: without either {@link authorize} or this flag,
+     * the sensitive routes are **not** registered. Enabling this exposes the
+     * dashboard — which can surface secrets, email bodies, and SQL — to anyone
+     * who can reach it. Local development only.
+     *
+     * @default false
+     */
+    unsafeAllowNoAuth?: boolean;
     /**
      * Enable the debug panel (toolbar overlay).
      *
@@ -838,6 +850,25 @@ export interface ResolvedServerStatsConfig {
     devToolbar?: DevToolbarOptions;
     /** Optional access-control callback. */
     shouldShow?: (ctx: import('@adonisjs/core/http').HttpContext) => boolean;
+    /** Collection interval in milliseconds (new name for {@link intervalMs}). */
+    pollInterval?: number;
+    /** Whether real-time (SSE) broadcasting is enabled (new name for {@link transport}). */
+    realtime?: boolean;
+    /** HTTP endpoint path or `false` to disable (new name for {@link endpoint}). */
+    statsEndpoint?: string | false;
+    /** Access-control callback (new name for {@link shouldShow}). */
+    authorize?: (ctx: import('@adonisjs/core/http').HttpContext) => boolean;
+    /**
+     * Escape hatch to register sensitive routes without an access guard.
+     * Exposes the dashboard without auth — local development only.
+     */
+    unsafeAllowNoAuth?: boolean;
+    /** Debug panel configuration (new name/shape replacing {@link devToolbar}). */
+    toolbar?: boolean | ToolbarConfig;
+    /** Full-page dashboard configuration. */
+    dashboard?: boolean | DashboardConfig;
+    /** Advanced fine-tuning options. */
+    advanced?: AdvancedConfig;
     /** Whether verbose informational logging is enabled. Always present after `defineConfig()`. */
     verbose: boolean;
 }

package/dist/src/utils/app_import.js

@@ -36,12 +36,16 @@ export async function appImport(specifier) {
             try {
                 return await import(pathToFileURL(resolved).href);
             }
-            catch { }
+            catch (err) {
+                errors.push(err);
+            }
             // Strategy B: CJS require (works for native addons like better-sqlite3)
             try {
                 return appRequire(specifier);
             }
-            catch { }
+            catch (err) {
+                errors.push(err);
+            }
         }
         catch (err) {
             errors.push(err);
@@ -70,13 +74,17 @@ export async function appImportWithPath(specifier) {
                 const module = await import(pathToFileURL(resolved).href);
                 return { module: module, resolvedPath: resolved };
             }
-            catch { }
+            catch (err) {
+                errors.push(err);
+            }
             // Strategy B: CJS require (works for native addons like better-sqlite3)
             try {
                 const module = appRequire(specifier);
                 return { module, resolvedPath: resolved };
             }
-            catch { }
+            catch (err) {
+                errors.push(err);
+            }
         }
         catch (err) {
             errors.push(err);