adonisjs-server-stats 1.16.1 → 1.17.0

package/dist/react/index.js

@@ -1,4 +1,4 @@
-import { B as s, D as t, c as r, J as u, M as g, d as o, d, S as D, T as S, e as h, a as B, u as T, f as b, g as l, h as m } from "./index-DOSlCpZ9.js";
+import { B as s, D as t, c as r, J as u, M as g, d as o, d, S as D, T as S, e as h, a as B, u as T, f as b, g as l, h as m } from "./index-LlFvooUN.js";
 export {
   s as Badge,
   t as DashboardPage,

package/dist/src/collectors/app_collector.d.ts

@@ -3,6 +3,17 @@ import type { MetricCollector } from './collector.js';
  * Queries application-specific tables for user sessions,
  * pending webhooks, and pending emails.
  *
+ * **This polls your primary database** — three `COUNT(*)` queries every
+ * collection interval (3s by default), forever. Without indexes those are
+ * full table scans on every tick. If you enable this collector, make sure
+ * these exist (a plain `sessions` count uses the primary key, the other two
+ * need their filter column indexed):
+ *
+ * ```sql
+ * CREATE INDEX webhook_events_status_index ON webhook_events (status);
+ * CREATE INDEX scheduled_emails_status_index ON scheduled_emails (status);
+ * ```
+ *
  * **Peer dependencies:** `@adonisjs/lucid`
  */
 export declare function appCollector(): MetricCollector;

package/dist/src/collectors/app_collector.js

@@ -46,6 +46,17 @@ function warnLucidMissing() {
  * Queries application-specific tables for user sessions,
  * pending webhooks, and pending emails.
  *
+ * **This polls your primary database** — three `COUNT(*)` queries every
+ * collection interval (3s by default), forever. Without indexes those are
+ * full table scans on every tick. If you enable this collector, make sure
+ * these exist (a plain `sessions` count uses the primary key, the other two
+ * need their filter column indexed):
+ *
+ * ```sql
+ * CREATE INDEX webhook_events_status_index ON webhook_events (status);
+ * CREATE INDEX scheduled_emails_status_index ON scheduled_emails (status);
+ * ```
+ *
  * **Peer dependencies:** `@adonisjs/lucid`
  */
 export function appCollector() {

package/dist/src/collectors/redis_collector.js

@@ -1,8 +1,5 @@
 import { appImport } from '../utils/app_import.js';
 import { log, dim, bold } from '../utils/logger.js';
-let warnedNotInstalled = false;
-let warnedPingFailed = false;
-let warnedConnectionError = false;
 /** Default metrics returned when Redis is unavailable. */
 const REDIS_DEFAULTS = {
     redisOk: false,
@@ -39,14 +36,14 @@ export function computeRedisMetrics(memParsed, statsParsed, dbSize) {
     };
 }
 /** Import Redis service, returning null if unavailable. */
-async function importRedis() {
+async function importRedis(warned) {
     try {
         const mod = await appImport('@adonisjs/redis/services/main');
         return mod.default;
     }
     catch {
-        if (!warnedNotInstalled) {
-            warnedNotInstalled = true;
+        if (!warned.notInstalled) {
+            warned.notInstalled = true;
             log.block(`Redis collector ${bold('skipped')} — @adonisjs/redis is not installed`, [
                 dim('Redis metrics will return defaults until the package is added.'),
                 `Run ${bold('node ace add @adonisjs/redis')} to install it.`,
@@ -56,10 +53,10 @@ async function importRedis() {
     }
 }
 /** Warn once when PING fails. */
-function warnPingFailed(pong) {
-    if (warnedPingFailed)
+function warnPingFailed(warned, pong) {
+    if (warned.pingFailed)
         return;
-    warnedPingFailed = true;
+    warned.pingFailed = true;
     log.block(`Redis collector ${bold('unhealthy')} — PING returned ${bold(String(pong))} instead of PONG`, [
         dim('Redis may be down or misconfigured.'),
         `Check your connection settings in ${bold('config/redis.ts')}.`,
@@ -71,6 +68,9 @@ function warnPingFailed(pong) {
  * **Peer dependencies:** `@adonisjs/redis`
  */
 export function redisCollector() {
+    // Closure-scoped like db_pool_collector's flags — module-level state would
+    // let the first instance's warnings suppress every later instance's.
+    const warned = { notInstalled: false, pingFailed: false, connectionError: false };
     return {
         name: 'redis',
         label: 'redis — memory, clients, keys, hit rate',
@@ -78,13 +78,13 @@ export function redisCollector() {
             return {};
         },
         async collect() {
-            const redis = await importRedis();
+            const redis = await importRedis(warned);
             if (!redis)
                 return REDIS_DEFAULTS;
             try {
                 const pong = await redis.ping();
                 if (pong !== 'PONG') {
-                    warnPingFailed(pong);
+                    warnPingFailed(warned, pong);
                     return REDIS_DEFAULTS;
                 }
                 const [memoryInfo, statsInfo, dbSize] = await Promise.all([
@@ -95,8 +95,8 @@ export function redisCollector() {
                 return computeRedisMetrics(parseRedisInfo(memoryInfo), parseRedisInfo(statsInfo), dbSize);
             }
             catch (error) {
-                if (!warnedConnectionError) {
-                    warnedConnectionError = true;
+                if (!warned.connectionError) {
+                    warned.connectionError = true;
                     const message = error instanceof Error ? error.message : String(error);
                     log.block(`Redis collector ${bold('error')} — failed to communicate with Redis`, [
                         dim(message),

package/dist/src/dashboard/cache_handlers.d.ts

@@ -1,14 +1,28 @@
 import type { InspectorManager } from './inspector_manager.js';
 import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * Access policy for cache operations, resolved by the controller from
+ * `advanced.cacheKeyPrefix` (or the SERVER_STATS_CACHE_KEY_PREFIX env var).
+ *
+ * The prefix restricts which Redis keys the dashboard may list, read, or
+ * delete so a dashboard viewer can't target arbitrary keys (sessions,
+ * rate-limit counters). Empty/unset stays unrestricted in dev for
+ * back-compat, but fails closed in production: single-key reads and deletes
+ * on a shared production Redis need a deliberate scope, not a default.
+ */
+export interface CacheAccessPolicy {
+    prefix: string;
+    inProduction: boolean;
+}
 /**
  * Handle GET /cache-stats — list cache keys and overall stats.
  */
-export declare function handleCacheStats(inspectors: InspectorManager, { request, response }: HttpContext): Promise<void>;
+export declare function handleCacheStats(inspectors: InspectorManager, { request, response }: HttpContext, policy: CacheAccessPolicy): Promise<void>;
 /**
  * Handle GET /cache-stats/:key — get a single cache key's value and metadata.
  */
-export declare function handleCacheKey(inspectors: InspectorManager, { params, response }: HttpContext): Promise<void>;
+export declare function handleCacheKey(inspectors: InspectorManager, { params, response }: HttpContext, policy: CacheAccessPolicy): Promise<void>;
 /**
  * Handle DELETE /cache-stats/:key — delete a single cache key.
  */
-export declare function handleCacheKeyDelete(inspectors: InspectorManager, { params, response }: HttpContext): Promise<void>;
+export declare function handleCacheKeyDelete(inspectors: InspectorManager, { params, response }: HttpContext, policy: CacheAccessPolicy): Promise<void>;

package/dist/src/dashboard/cache_handlers.js

@@ -1,27 +1,22 @@
 import { clamp } from '../utils/math_helpers.js';
-/**
- * Optional allow-list prefix for single-key cache operations (get/delete).
- * Restricts which Redis keys the dashboard may read or delete so an attacker
- * can't target arbitrary keys (sessions, rate-limit counters). Empty/unset
- * means unrestricted (back-compat default for local dev).
- */
-function getCacheKeyPrefix() {
-    return (process.env.SERVER_STATS_CACHE_KEY_PREFIX ?? '').trim();
-}
-/** Check whether a cache key is permitted under the configured prefix. */
-function isKeyAllowed(key) {
-    const prefix = getCacheKeyPrefix();
-    return prefix === '' || key.startsWith(prefix);
+/** Check whether a cache key is permitted under the policy. */
+function isKeyAllowed(key, policy) {
+    if (policy.prefix !== '')
+        return key.startsWith(policy.prefix);
+    return !policy.inProduction;
 }
 /**
  * Handle GET /cache-stats — list cache keys and overall stats.
  */
-export async function handleCacheStats(inspectors, { request, response }) {
+export async function handleCacheStats(inspectors, { request, response }, policy) {
     const inspector = await inspectors.getCacheInspector();
     if (!inspector)
         return response.json({ available: false, stats: null, keys: [] });
     const qs = request.qs();
-    const pattern = qs.search || qs.pattern ? `*${qs.search || qs.pattern}*` : '*';
+    // A configured prefix scopes the listing glob the same way it scopes
+    // single-key access, so keys outside the allow-list are never enumerated.
+    const search = qs.search || qs.pattern ? `*${qs.search || qs.pattern}*` : '*';
+    const pattern = policy.prefix !== '' ? `${policy.prefix}${search}` : search;
     try {
         const [stats, keyList] = await Promise.all([
             inspector.getStats(),
@@ -36,12 +31,12 @@ export async function handleCacheStats(inspectors, { request, response }) {
 /**
  * Handle GET /cache-stats/:key — get a single cache key's value and metadata.
  */
-export async function handleCacheKey(inspectors, { params, response }) {
+export async function handleCacheKey(inspectors, { params, response }, policy) {
     const inspector = await inspectors.getCacheInspector();
     if (!inspector)
         return response.notFound({ error: 'Cache not available' });
     const key = decodeURIComponent(params.key);
-    if (!isKeyAllowed(key))
+    if (!isKeyAllowed(key, policy))
         return response.forbidden({ error: 'Cache key not permitted' });
     try {
         const detail = await inspector.getKey(key);
@@ -54,12 +49,12 @@ export async function handleCacheKey(inspectors, { params, response }) {
 /**
  * Handle DELETE /cache-stats/:key — delete a single cache key.
  */
-export async function handleCacheKeyDelete(inspectors, { params, response }) {
+export async function handleCacheKeyDelete(inspectors, { params, response }, policy) {
     const inspector = await inspectors.getCacheInspector();
     if (!inspector)
         return response.notFound({ error: 'Cache not available' });
     const key = decodeURIComponent(params.key);
-    if (!isKeyAllowed(key))
+    if (!isKeyAllowed(key, policy))
         return response.forbidden({ error: 'Cache key not permitted' });
     try {
         return (await inspector.deleteKey(key))

package/dist/src/dashboard/coalesce_cache.d.ts

@@ -1,11 +1,3 @@
-/**
- * In-flight request coalescing with short-lived result caching.
- *
- * - coalesce(): prevents concurrent identical calls from executing
- *   in parallel. Only ONE executes; others get the same promise.
- * - cached(): adds a TTL layer on top of coalesce so repeat
- *   requests within the window serve stale data instantly.
- */
 export declare class CoalesceCache {
     private inflight;
     private resultCache;
@@ -20,6 +12,8 @@ export declare class CoalesceCache {
      * fall through to coalesce().
      */
     cached<T>(key: string, ttlMs: number, fn: () => Promise<T>): Promise<T>;
+    /** Drop expired entries on write; if still at the cap, drop oldest first. */
+    private evictForSpace;
     /** Clear all cached results (does not affect in-flight requests). */
     clearCache(): void;
 }

package/dist/src/dashboard/coalesce_cache.js

@@ -6,6 +6,13 @@
  * - cached(): adds a TTL layer on top of coalesce so repeat
  *   requests within the window serve stale data instantly.
  */
+/**
+ * Hard cap on retained results. Keys embed user input (search terms, filters,
+ * pagination), so without a bound a dashboard viewer could grow the heap
+ * without limit by walking distinct queries. TTLs are 1-10s, so anything past
+ * a few hundred entries is expired garbage anyway.
+ */
+const MAX_RESULT_ENTRIES = 500;
 export class CoalesceCache {
     inflight = new Map();
     resultCache = new Map();
@@ -33,6 +40,7 @@ export class CoalesceCache {
         }
         return this.coalesce(key, async () => {
             const result = await fn();
+            this.evictForSpace();
             this.resultCache.set(key, {
                 data: result,
                 expiresAt: Date.now() + ttlMs,
@@ -40,6 +48,23 @@ export class CoalesceCache {
             return result;
         });
     }
+    /** Drop expired entries on write; if still at the cap, drop oldest first. */
+    evictForSpace() {
+        if (this.resultCache.size < MAX_RESULT_ENTRIES)
+            return;
+        const now = Date.now();
+        for (const [key, entry] of this.resultCache) {
+            if (entry.expiresAt <= now)
+                this.resultCache.delete(key);
+        }
+        // Map iteration is insertion-ordered, so the front is the oldest.
+        while (this.resultCache.size >= MAX_RESULT_ENTRIES) {
+            const oldest = this.resultCache.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.resultCache.delete(oldest);
+        }
+    }
     /** Clear all cached results (does not affect in-flight requests). */
     clearCache() {
         this.resultCache.clear();

package/dist/src/dashboard/dashboard_controller.d.ts

@@ -15,6 +15,7 @@ export default class DashboardController {
     requestDetail({ params, response }: HttpContext): Promise<void>;
     queriesGrouped({ request, response }: HttpContext): Promise<void>;
     queryExplain(ctx: HttpContext): Promise<unknown>;
+    private cachePolicy;
     cacheStats(ctx: HttpContext): Promise<void>;
     cacheKey(ctx: HttpContext): Promise<void>;
     cacheKeyDelete(ctx: HttpContext): Promise<void>;

package/dist/src/dashboard/dashboard_controller.js

@@ -116,14 +116,19 @@ export default class DashboardController {
     async queryExplain(ctx) {
         return handleQueryExplain(this.dashboardStore, this.app, ctx);
     }
+    cachePolicy() {
+        const config = this.app.config.get('server_stats');
+        const prefix = config?.advanced?.cacheKeyPrefix ?? process.env.SERVER_STATS_CACHE_KEY_PREFIX ?? '';
+        return { prefix: prefix.trim(), inProduction: this.app.inProduction };
+    }
     async cacheStats(ctx) {
-        return handleCacheStats(this.inspectors, ctx);
+        return handleCacheStats(this.inspectors, ctx, this.cachePolicy());
     }
     async cacheKey(ctx) {
-        return handleCacheKey(this.inspectors, ctx);
+        return handleCacheKey(this.inspectors, ctx, this.cachePolicy());
     }
     async cacheKeyDelete(ctx) {
-        return handleCacheKeyDelete(this.inspectors, ctx);
+        return handleCacheKeyDelete(this.inspectors, ctx, this.cachePolicy());
     }
     async jobs(ctx) {
         return handleJobs(this.inspectors, ctx);

package/dist/src/dashboard/dashboard_store.d.ts

@@ -74,6 +74,5 @@ export declare class DashboardStore {
     getSavedFilters(section?: string): Promise<Record<string, unknown>[]>;
     createSavedFilter(name: string, section: string, filterConfig: Record<string, unknown>): Promise<Record<string, unknown> | null>;
     deleteSavedFilter(id: number): Promise<boolean>;
-    runExplain(queryId: number, appDb: unknown): Promise<Record<string, unknown> | null>;
     private wireEventListeners;
 }

package/dist/src/dashboard/dashboard_store.js

@@ -4,7 +4,6 @@ import { log } from '../utils/logger.js';
 import { ChartAggregator } from './chart_aggregator.js';
 import { CoalesceCache } from './coalesce_cache.js';
 import { buildEmailRecordFromEvent } from './email_event_builder.js';
-import { executeExplain } from './explain_query.js';
 import { FlushManager } from './flush_manager.js';
 import { createKnexConnection, applyPragmas } from './knex_factory.js';
 import { autoMigrate, runRetentionCleanup } from './migrator.js';
@@ -12,6 +11,7 @@ import { fetchOverviewMetrics, fetchChartData, fetchOverviewWidgets, fetchSparkl
 import { queryRequests, queryQueries, queryQueriesGrouped, queryEvents, queryEmails, queryEmailHtml, queryLogs, queryTraces, queryTraceDetail, queryRequestDetail, } from './read_queries.js';
 import { fetchSavedFilters, insertSavedFilter, removeSavedFilter } from './saved_filter_queries.js';
 import { fetchStorageStats } from './storage_stats.js';
+import { resetWriteWarnings } from './write_queue.js';
 const EMPTY_PAGINATED = (p, pp) => ({
     data: [],
     total: 0,
@@ -77,6 +77,7 @@ export class DashboardStore {
     }
     async stop() {
         await this.flushMgr.stop();
+        resetWriteWarnings();
         if (this.retentionTimer) {
             clearInterval(this.retentionTimer);
             this.retentionTimer = null;
@@ -143,6 +144,10 @@ export class DashboardStore {
         this.flushMgr.recordLog(entry);
     }
     recordEmail(record) {
+        // Guarded here as well as in wireEventListeners: the Redis email bridge
+        // calls this directly for cross-process mail, bypassing the listeners.
+        if (this.config.capture?.emails === false)
+            return;
         this.flushMgr.recordEmail(record);
     }
     async flushWriteQueue() {
@@ -204,12 +209,15 @@ export class DashboardStore {
     async deleteSavedFilter(id) {
         return this.db ? removeSavedFilter(this.db, id) : false;
     }
-    async runExplain(queryId, appDb) {
-        if (!this.db)
-            return { error: 'Dashboard store not initialized' };
-        return executeExplain(this.db, this.cache, queryId, appDb);
-    }
     wireEventListeners() {
+        // `capture.emails: false` must stop persistence too, not just the in-memory
+        // collector — otherwise production mode stores full mail bodies while the
+        // config promises it doesn't. Undefined means an externally-constructed
+        // store without resolved capture flags; default on, matching DebugStore.
+        if (this.config.capture?.emails === false) {
+            log.info('dashboard: email capture disabled — mail listeners not wired');
+            return;
+        }
         if (!this.emitter || typeof this.emitter.on !== 'function') {
             log.warn('dashboard: emitter not available — email collection disabled');
             return;

package/dist/src/dashboard/filter_handlers.js

@@ -14,6 +14,29 @@ export async function handleSavedFilters(dashboardStore) {
         })),
     };
 }
+/**
+ * Validate saved-filter input. Returns an error message, or null when valid.
+ *
+ * Size bounds matter because these land in SQLite verbatim and the list
+ * endpoint returns every row — one oversized filter would bloat every
+ * response.
+ */
+function validateSavedFilterInput(name, section, filterConfig) {
+    if (!name || !section || !filterConfig) {
+        return 'Missing required fields: name, section, filterConfig';
+    }
+    if (typeof name !== 'string' || name.length > 100) {
+        return 'name must be a string of at most 100 chars';
+    }
+    if (typeof section !== 'string' || section.length > 50) {
+        return 'section must be a string of at most 50 chars';
+    }
+    const configJson = typeof filterConfig === 'string' ? filterConfig : JSON.stringify(filterConfig);
+    if (configJson.length > 4096) {
+        return 'filterConfig too large (max 4096 chars)';
+    }
+    return null;
+}
 /**
  * Handle POST /saved-filters — create a new saved filter.
  * Returns the response payload or null if creation fails.
@@ -24,10 +47,9 @@ export async function handleCreateSavedFilter(dashboardStore, { request, respons
     }
     try {
         const { name, section, filterConfig } = request.body();
-        if (!name || !section || !filterConfig) {
-            return response.badRequest({
-                error: 'Missing required fields: name, section, filterConfig',
-            });
+        const validationError = validateSavedFilterInput(name, section, filterConfig);
+        if (validationError) {
+            return response.badRequest({ error: validationError });
         }
         const result = await dashboardStore.createSavedFilter(name, section, typeof filterConfig === 'string' ? safeParseJson(filterConfig) : filterConfig);
         return result

package/dist/src/dashboard/flush_manager.d.ts

@@ -7,6 +7,7 @@ export declare class FlushManager {
     pendingEmails: EmailRecord[];
     private flushTimer;
     private flushing;
+    private stopped;
     private inFlight;
     private db;
     constructor(getDb: () => Knex | null);

package/dist/src/dashboard/flush_manager.js

@@ -8,6 +8,7 @@ export class FlushManager {
     pendingEmails = [];
     flushTimer = null;
     flushing = false;
+    stopped = false;
     inFlight = null;
     db;
     constructor(getDb) {
@@ -35,6 +36,10 @@ export class FlushManager {
         this.scheduleFlush();
     }
     async stop() {
+        // Block rescheduling first: an in-flight runFlush ends with a
+        // scheduleFlush() that would otherwise create a fresh, untracked timer
+        // after the clearTimeout below — outliving this "clean" shutdown.
+        this.stopped = true;
         if (this.flushTimer) {
             clearTimeout(this.flushTimer);
             this.flushTimer = null;
@@ -50,7 +55,7 @@ export class FlushManager {
             q.splice(0, Math.floor(MAX_Q / 4));
     }
     scheduleFlush() {
-        if (this.flushTimer)
+        if (this.stopped || this.flushTimer)
             return;
         this.flushTimer = setTimeout(() => {
             this.flushTimer = null;

package/dist/src/dashboard/format_helpers.d.ts

@@ -120,7 +120,3 @@ export declare function formatGroupedQuery(g: Record<string, unknown>, totalTime
     totalDuration: number;
     percentOfTotal: number;
 };
-/** Run EXPLAIN on a query, returning the plan. */
-export declare function runExplain(appDb: {
-    raw: (sql: string, bindings: unknown[]) => Promise<Record<string, unknown>>;
-}, query: Record<string, unknown>): Promise<unknown[]>;

package/dist/src/dashboard/format_helpers.js

@@ -119,22 +119,3 @@ export function formatGroupedQuery(g, totalTime) {
         percentOfTotal: totalTime > 0 ? round((g.total_duration / totalTime) * 100) : 0,
     };
 }
-/** Run EXPLAIN on a query, returning the plan. */
-export async function runExplain(appDb, query) {
-    let bindings = [];
-    if (query.bindings) {
-        try {
-            bindings = JSON.parse(query.bindings);
-        }
-        catch {
-            /* skip */
-        }
-    }
-    const explainResult = await appDb.raw(`EXPLAIN (FORMAT JSON) ${query.sql_text}`, bindings);
-    const rawRows = explainResult?.rows ??
-        (Array.isArray(explainResult) ? explainResult : []);
-    if (rawRows.length > 0 && rawRows[0]['QUERY PLAN']) {
-        return rawRows[0]['QUERY PLAN'];
-    }
-    return rawRows;
-}

package/dist/src/dashboard/integrations/config_inspector.js

@@ -102,7 +102,7 @@ function sanitizeValue(key, value, seen) {
         return redact(value);
     }
     if (typeof value === 'object' && value !== null) {
-        return sanitizeObject(value, seen);
+        return sanitizeObject(value, seen, key);
     }
     return value;
 }
@@ -110,7 +110,7 @@ function sanitizeValue(key, value, seen) {
  * Recursively sanitize an object, redacting string values whose keys
  * match sensitive patterns. Booleans and numbers are never redacted.
  */
-function sanitizeObject(obj, seen = new WeakSet()) {
+function sanitizeObject(obj, seen = new WeakSet(), parentKey = '') {
     if (obj === null || obj === undefined)
         return obj;
     if (typeof obj !== 'object')
@@ -119,7 +119,10 @@ function sanitizeObject(obj, seen = new WeakSet()) {
         return '[Circular]';
     seen.add(obj);
     if (Array.isArray(obj)) {
-        return obj.map((item) => sanitizeObject(item, seen));
+        // Route items through sanitizeValue (under the array's own key) so string
+        // elements get the value-shape checks — previously a credential inside an
+        // array survived because sanitizeObject passes primitives through.
+        return obj.map((item) => sanitizeValue(parentKey, item, seen));
     }
     const record = obj;
     const result = {};

package/dist/src/dashboard/migrator_tables.js

@@ -28,6 +28,10 @@ export async function migrateRequests(db) {
     await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_created ON server_stats_requests(created_at)`);
     await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_url ON server_stats_requests(url)`);
     await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_duration ON server_stats_requests(duration)`);
+    // Covers the overview p95 query (WHERE created_at >= ? ORDER BY duration):
+    // with only the single-column indexes SQLite sorts the whole filtered range
+    // on every 2s cache miss.
+    await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_created_duration ON server_stats_requests(created_at, duration)`);
     await db.raw(`CREATE INDEX IF NOT EXISTS idx_ss_requests_status ON server_stats_requests(status_code)`);
     try {
         await db.raw('ALTER TABLE server_stats_requests ADD COLUMN http_request_id TEXT');

package/dist/src/dashboard/paginate_helper.js

@@ -15,31 +15,41 @@ export function clampPerPage(value) {
         return 25;
     return clamp(Math.trunc(n), 1, 200);
 }
+/**
+ * Rows the COUNT is allowed to scan. Filters include leading-wildcard LIKEs
+ * that no index can serve, so an uncapped COUNT walks the entire table twice
+ * per request (count + data). Past this many matches the exact total stops
+ * being interesting — the UI just needs "lots of pages".
+ */
+const COUNT_SCAN_CAP = 10_000;
 /**
  * Execute a paginated query within a transaction.
  */
 export async function executePaginate(db, opts) {
     const perPage = clampPerPage(opts.perPage);
     return db.transaction(async (trx) => {
-        const countQuery = trx(opts.table);
+        const countSub = trx(opts.table).select(trx.raw('1')).limit(COUNT_SCAN_CAP);
         if (opts.applyFilters)
-            opts.applyFilters(countQuery);
-        const [{ count: totalRaw }] = await countQuery.count('* as count');
-        const total = Number(totalRaw);
-        const offset = (opts.page - 1) * perPage;
-        const dataQuery = trx(opts.table)
-            .orderBy('created_at', 'desc')
-            .limit(perPage)
-            .offset(offset);
+            opts.applyFilters(countSub);
+        const countRows = (await trx.count('* as count').from(countSub.as('t')));
+        const total = Number(countRows[0]?.count ?? 0);
+        // Clamp the page into the real range: an arbitrary ?page= forces a
+        // full-scan-sized OFFSET on the single sqlite connection, blocking every
+        // other dashboard read for nothing.
+        const lastPage = Math.ceil(total / perPage);
+        const requested = Number.isFinite(Number(opts.page)) ? Math.trunc(Number(opts.page)) : 1;
+        const page = clamp(requested, 1, Math.max(1, lastPage));
+        const offset = (page - 1) * perPage;
+        const dataQuery = trx(opts.table).orderBy('created_at', 'desc').limit(perPage).offset(offset);
         if (opts.applyFilters)
             opts.applyFilters(dataQuery);
         const data = await dataQuery;
         return {
             data,
             total,
-            page: opts.page,
+            page,
             perPage,
-            lastPage: Math.ceil(total / perPage),
+            lastPage,
         };
     });
 }

package/dist/src/dashboard/sensitive_patterns.d.ts

@@ -37,3 +37,40 @@ export declare function isSensitiveConfigName(name: string): boolean;
  */
 export declare function sqlMentionsSecret(sql: string): boolean;
 export declare function looksLikeCredentialValue(value: string): boolean;
+/**
+ * Redact and truncate SQL bindings before persistence.
+ *
+ * Two independent rules, because neither catches everything on its own:
+ *
+ * 1. **By statement.** If the SQL mentions a credential-shaped identifier
+ *    (`password`, `remember_token`, `otp`, ...), every binding for that
+ *    statement is redacted. Positional bindings cannot be mapped back to
+ *    columns reliably, so this is all-or-nothing per statement — coarse, but
+ *    it is the only thing that catches a short secret like a 6-digit OTP.
+ * 2. **By value shape.** Hashes, JWTs, provider key prefixes, long hex
+ *    digests, and URLs with embedded credentials are redacted wherever they
+ *    appear, regardless of the statement.
+ *
+ * Anything that survives both is truncated at {@link MAX_BINDING_LEN} so an
+ * oversized payload cannot bloat the row.
+ *
+ * Ordinary parameters — ids, flags, emails, timestamps — still pass through, so
+ * the query pane stays useful for debugging.
+ */
+export declare function sanitizeBindings(bindings: unknown, sqlText?: string): unknown;
+/**
+ * Redact a structured record (a pino log entry, an event payload) with the
+ * same key/shape rules as bindings but WITHOUT length truncation — log data
+ * carries stack traces and payload context that must stay whole.
+ */
+export declare function sanitizeRecordValues(record: unknown): unknown;
+/**
+ * Redact credential-bearing query parameters from a URL before it is stored.
+ *
+ * Request URLs are persisted with their query strings (useful for debugging
+ * pagination and filters), but a `?token=…` password-reset link or a
+ * `?signature=…` signed URL must not land in SQLite in the clear. Parameters
+ * are redacted by name (see {@link isSecretName}) or when the value itself
+ * looks like a credential; everything else passes through untouched.
+ */
+export declare function sanitizeUrlQuery(url: string): string;