covara 0.6.1 → 0.7.0

package/dist/ui/middleware.js

@@ -13,6 +13,7 @@ import { layout } from "./html/layout.js";
 import { runtimeScript } from "./html/client/runtime.js";
 import { dataExplorerScript } from "./html/client/data-explorer-app.js";
 import { htmxScript } from "./html/client/htmx-vendor.js";
+import { logoSvg } from "./html/logo.js";
 import * as pages from "./html/pages/index.js";
 import { html, escapeHtml } from "./html/utils.js";
 import { emptyState } from "./html/components/index.js";
@@ -30,6 +31,28 @@ export const logError = (log) => {
     if (errorLogs.length > MAX_LOGS)
         errorLogs.pop();
 };
+// Middleware that records each request into the admin dashboard's request/error
+// log. `createCovara` mounts this automatically when the admin UI is enabled;
+// mount it yourself (early, before your routes) when wiring the admin UI by hand.
+export const createAdminRequestLogger = (options = {}) => {
+    const skip = options.skipPaths ?? ["/__covara"];
+    const reqId = () => globalThis.crypto?.randomUUID?.() ??
+        `${Date.now()}-${Math.round(Math.random() * 1e9)}`;
+    return async (c, next) => {
+        const start = Date.now();
+        await next();
+        const path = c.req.path;
+        if (skip.some((p) => path.startsWith(p)))
+            return;
+        const status = c.res?.status ?? 0;
+        const id = reqId();
+        const timestamp = Date.now();
+        logRequest({ id, method: c.req.method, path, status, duration: timestamp - start, timestamp });
+        if (status >= 500) {
+            logError({ id, timestamp, path, method: c.req.method, error: `HTTP ${status}`, statusCode: status });
+        }
+    };
+};
 export const createAdminUI = (config = {}) => {
     const router = new Hono();
     const basePath = config.basePath || "/__covara";
@@ -175,11 +198,32 @@ export const createAdminUI = (config = {}) => {
             return c.json({ entries: [], currentSeq: 0, enabled: false });
         }
     });
-    router.get("/api/subscriptions", (c) => {
+    router.get("/api/subscriptions", async (c) => {
         if (!config.getActiveSubscriptions) {
             return c.json({ subscriptions: [], enabled: false });
         }
-        return c.json({ subscriptions: config.getActiveSubscriptions(), enabled: true });
+        return c.json({ subscriptions: await config.getActiveSubscriptions(), enabled: true });
+    });
+    router.delete("/api/subscriptions/:id", async (c) => {
+        if (!config.disconnectSubscription) {
+            return c.json({ error: "Subscription management not configured" }, 501);
+        }
+        try {
+            const disconnected = await config.disconnectSubscription(c.req.param("id"));
+            if (isHtmxRequest(c)) {
+                // The Disconnect button swaps out its table row on success.
+                return disconnected
+                    ? c.html("")
+                    : c.html(html `<tr><td colspan="7" class="alert alert-error">Subscription not found</td></tr>`);
+            }
+            if (!disconnected) {
+                return c.json({ error: "Subscription not found" }, 404);
+            }
+            return c.body(null, 204);
+        }
+        catch (e) {
+            return c.json({ error: e.message }, 400);
+        }
     });
     router.post("/api/query", async (c) => {
         const { resource, filter, limit = 10 } = (await readJsonBody(c));
@@ -227,7 +271,7 @@ export const createAdminUI = (config = {}) => {
             return c.json({ error: "User management not configured" }, 501);
         }
         try {
-            const body = (await readJsonBody(c));
+            const body = (await readFlexibleBody(c));
             const user = await config.userManager.createUser(body);
             return c.json({ user }, 201);
         }
@@ -241,7 +285,7 @@ export const createAdminUI = (config = {}) => {
         }
         try {
             const userId = c.req.param("id");
-            const body = (await readJsonBody(c));
+            const body = (await readFlexibleBody(c));
             const user = await config.userManager.updateUser(userId, body);
             return c.json({ user });
         }
@@ -269,7 +313,7 @@ export const createAdminUI = (config = {}) => {
         }
         try {
             const limit = parseInt(String(c.req.query("limit"))) || 50;
-            const sessions = await config.sessionManager.listSessions(limit);
+            const sessions = (await config.sessionManager.listSessions(limit)).map(normalizeSession);
             return c.json({ sessions, enabled: true });
         }
         catch (e) {
@@ -282,7 +326,7 @@ export const createAdminUI = (config = {}) => {
         }
         try {
             const userId = c.req.param("userId");
-            const sessions = await config.sessionManager.getSessionsByUser(userId);
+            const sessions = (await config.sessionManager.getSessionsByUser(userId)).map(normalizeSession);
             return c.json({ sessions });
         }
         catch (e) {
@@ -294,14 +338,34 @@ export const createAdminUI = (config = {}) => {
             return c.json({ error: "Session management not configured" }, 501);
         }
         try {
-            const { userId, expiresIn } = (await readJsonBody(c));
+            const body = (await readFlexibleBody(c));
+            const htmx = isHtmxRequest(c);
+            const userId = typeof body.userId === "string" ? body.userId : undefined;
+            const expiresInRaw = body.expiresIn != null ? Number(body.expiresIn) : undefined;
+            // The mint form sends the TTL in seconds; convert to ms for that path.
+            // JSON API callers pass the value through unchanged.
+            const expiresIn = expiresInRaw != null && !Number.isNaN(expiresInRaw)
+                ? htmx
+                    ? expiresInRaw * 1000
+                    : expiresInRaw
+                : undefined;
             if (!userId) {
+                if (htmx) {
+                    return c.html(html `<div class="alert alert-error">userId is required</div>`);
+                }
                 return c.json({ error: "userId is required" }, 400);
             }
             const session = await config.sessionManager.createSession(userId, expiresIn);
+            if (htmx) {
+                const sessions = (await config.sessionManager.listSessions(100)).map(normalizeSession);
+                return c.html(pages.sessionsList(sessions));
+            }
             return c.json({ session }, 201);
         }
         catch (e) {
+            if (isHtmxRequest(c)) {
+                return c.html(html `<div class="alert alert-error">${escapeHtml(e.message)}</div>`);
+            }
             return c.json({ error: e.message }, 400);
         }
     });
@@ -491,6 +555,112 @@ export const createAdminUI = (config = {}) => {
     });
     // Helper to check if this is an HTMX request
     const isHtmxRequest = (c) => c.req.header('hx-request') === 'true';
+    // Read a request body whether it arrives as JSON or as a form submission
+    // (HTMX forms post application/x-www-form-urlencoded by default).
+    const readFlexibleBody = async (c) => {
+        const contentType = c.req.header("content-type") ?? "";
+        if (contentType.includes("application/json")) {
+            return (await readJsonBody(c));
+        }
+        if (contentType.includes("form-urlencoded") ||
+            contentType.includes("multipart/form-data")) {
+            return (await c.req.parseBody());
+        }
+        try {
+            return (await readJsonBody(c));
+        }
+        catch {
+            return (await c.req.parseBody());
+        }
+    };
+    // Normalize whatever shape a sessionManager returns into the canonical
+    // SessionInfo the admin pages render. Accepts common field aliases
+    // (id/sessionToken/token, expiresAt/expires) so any session store works.
+    const toIso = (v) => {
+        if (v == null)
+            return undefined;
+        if (v instanceof Date)
+            return v.toISOString();
+        if (typeof v === "number")
+            return new Date(v).toISOString();
+        return String(v);
+    };
+    const normalizeSession = (s) => ({
+        ...s,
+        id: s?.id ?? s?.sessionToken ?? s?.token ?? "",
+        userId: s?.userId ?? "",
+        createdAt: toIso(s?.createdAt) ?? "",
+        expiresAt: toIso(s?.expiresAt ?? s?.expires) ?? "",
+        // Activity metadata is captured into session.data by the auth layer
+        // (login stamps ip/user-agent; getSession stamps lastActiveAt).
+        lastActiveAt: toIso(s?.lastActiveAt ?? s?.data?.lastActiveAt),
+        ipAddress: s?.ipAddress ?? s?.data?.ipAddress,
+        userAgent: s?.userAgent ?? s?.data?.userAgent,
+    });
+    // The changelog system stores `{type, objectId, object, previousObject}`;
+    // the admin pages render `{operation, recordId, after, before}`. Accept both
+    // shapes so custom `config.changelog` providers keep working.
+    const normalizeChangelogEntry = (e) => ({
+        ...e,
+        operation: e?.operation ?? e?.type ?? "update",
+        recordId: e?.recordId ?? e?.objectId ?? "",
+        before: e?.before ?? e?.previousObject,
+        after: e?.after ?? e?.object,
+    });
+    // Build the API explorer's endpoint catalog. The path uses each resource's
+    // captured mount path (e.g. "/api/todos") so the explorer's test runner hits
+    // the real endpoint; it falls back to "/<name>" before the resource is first
+    // requested (mount paths are captured lazily on the first hit).
+    const buildApiEndpoints = () => {
+        const endpoints = [];
+        for (const resource of getAllResourcesForDisplay()) {
+            const caps = resource.capabilities || {};
+            const base = resource.mountPath ?? `/${resource.name}`;
+            endpoints.push({
+                method: "GET",
+                path: base,
+                description: `List ${resource.name} with filtering and pagination`,
+                parameters: [
+                    { name: "filter", in: "query", type: "string", description: "RSQL filter expression" },
+                    { name: "limit", in: "query", type: "number", description: "Max results (default: 50)" },
+                    { name: "cursor", in: "query", type: "string", description: "Pagination cursor" },
+                    { name: "orderBy", in: "query", type: "string", description: "Sort field:direction" },
+                ],
+            });
+            endpoints.push({
+                method: "GET",
+                path: `${base}/:id`,
+                description: `Get a single ${resource.name} by ID`,
+                parameters: [{ name: "id", in: "path", type: "string", required: true }],
+            });
+            if (caps.enableCreate) {
+                endpoints.push({
+                    method: "POST",
+                    path: base,
+                    description: `Create a new ${resource.name}`,
+                    requestBody: { contentType: "application/json" },
+                });
+            }
+            if (caps.enableUpdate) {
+                endpoints.push({
+                    method: "PATCH",
+                    path: `${base}/:id`,
+                    description: `Update a ${resource.name}`,
+                    parameters: [{ name: "id", in: "path", type: "string", required: true }],
+                    requestBody: { contentType: "application/json" },
+                });
+            }
+            if (caps.enableDelete) {
+                endpoints.push({
+                    method: "DELETE",
+                    path: `${base}/:id`,
+                    description: `Delete a ${resource.name}`,
+                    parameters: [{ name: "id", in: "path", type: "string", required: true }],
+                });
+            }
+        }
+        return endpoints;
+    };
     // Helper to send HTML response (full page or fragment for HTMX)
     const sendHtml = (c, activePage, content) => {
         if (isHtmxRequest(c)) {
@@ -509,6 +679,13 @@ export const createAdminUI = (config = {}) => {
     router.get("/ui/htmx.js", (c) => sendJs(c, htmxScript));
     router.get("/ui/covara-runtime.js", (c) => sendJs(c, runtimeScript));
     router.get("/ui/data-explorer-app.js", (c) => sendJs(c, dataExplorerScript));
+    // Logo / favicon — served outside the auth gate so the favicon also shows on
+    // the login challenge page.
+    router.get("/logo.svg", (c) => {
+        c.header("Content-Type", "image/svg+xml; charset=utf-8");
+        c.header("Cache-Control", "public, max-age=3600");
+        return c.body(logoSvg);
+    });
     // ============================================
     // HTMX UI Routes - Full Page Renders
     // ============================================
@@ -532,7 +709,7 @@ export const createAdminUI = (config = {}) => {
             }
             catch { }
         }
-        const subscriptions = config.getActiveSubscriptions?.() || [];
+        const subscriptions = (await config.getActiveSubscriptions?.()) || [];
         const content = pages.dashboardPage({
             stats: {
                 resources: resources.length,
@@ -614,7 +791,7 @@ export const createAdminUI = (config = {}) => {
         let sessions = [];
         if (config.sessionManager) {
             try {
-                sessions = await config.sessionManager.listSessions(100);
+                sessions = (await config.sessionManager.listSessions(100)).map(normalizeSession);
             }
             catch { }
         }
@@ -625,8 +802,8 @@ export const createAdminUI = (config = {}) => {
         return sendHtml(c, 'sessions', content);
     });
     // Subscriptions
-    router.get("/ui/subscriptions", (c) => {
-        const subscriptions = config.getActiveSubscriptions?.() || [];
+    router.get("/ui/subscriptions", async (c) => {
+        const subscriptions = (await config.getActiveSubscriptions?.()) || [];
         const byResource = {};
         for (const sub of subscriptions) {
             byResource[sub.resource] = (byResource[sub.resource] || 0) + 1;
@@ -648,7 +825,7 @@ export const createAdminUI = (config = {}) => {
         if (config.changelog) {
             try {
                 stats.currentSeq = await config.changelog.getCurrentSequence();
-                entries = await config.changelog.getEntries(Math.max(0, stats.currentSeq - 100), 100);
+                entries = (await config.changelog.getEntries(Math.max(0, stats.currentSeq - 100), 100)).map(normalizeChangelogEntry);
                 stats.total = entries.length;
                 for (const e of entries) {
                     if (e.operation === 'create')
@@ -695,58 +872,7 @@ export const createAdminUI = (config = {}) => {
     });
     // API Explorer
     router.get("/ui/api-explorer", (c) => {
-        const resources = getAllResourcesForDisplay();
-        const endpoints = [];
-        for (const resource of resources) {
-            const caps = resource.capabilities || {};
-            // GET list
-            endpoints.push({
-                method: 'GET',
-                path: resource.name,
-                description: `List ${resource.name} with filtering and pagination`,
-                parameters: [
-                    { name: 'filter', in: 'query', type: 'string', description: 'RSQL filter expression' },
-                    { name: 'limit', in: 'query', type: 'number', description: 'Max results (default: 50)' },
-                    { name: 'cursor', in: 'query', type: 'string', description: 'Pagination cursor' },
-                    { name: 'orderBy', in: 'query', type: 'string', description: 'Sort field:direction' },
-                ],
-            });
-            // GET single
-            endpoints.push({
-                method: 'GET',
-                path: `${resource.name}/:id`,
-                description: `Get a single ${resource.name} by ID`,
-                parameters: [
-                    { name: 'id', in: 'path', type: 'string', required: true },
-                ],
-            });
-            if (caps.enableCreate) {
-                endpoints.push({
-                    method: 'POST',
-                    path: resource.name,
-                    description: `Create a new ${resource.name}`,
-                    requestBody: { contentType: 'application/json' },
-                });
-            }
-            if (caps.enableUpdate) {
-                endpoints.push({
-                    method: 'PATCH',
-                    path: `${resource.name}/:id`,
-                    description: `Update a ${resource.name}`,
-                    parameters: [{ name: 'id', in: 'path', type: 'string', required: true }],
-                    requestBody: { contentType: 'application/json' },
-                });
-            }
-            if (caps.enableDelete) {
-                endpoints.push({
-                    method: 'DELETE',
-                    path: `${resource.name}/:id`,
-                    description: `Delete a ${resource.name}`,
-                    parameters: [{ name: 'id', in: 'path', type: 'string', required: true }],
-                });
-            }
-        }
-        const content = pages.apiExplorerPage({ endpoints, baseUrl: '' });
+        const content = pages.apiExplorerPage({ endpoints: buildApiEndpoints(), baseUrl: '' });
         return sendHtml(c, 'api-explorer', content);
     });
     // ============================================
@@ -845,7 +971,7 @@ export const createAdminUI = (config = {}) => {
             let sessions = [];
             if (config.sessionManager) {
                 try {
-                    sessions = await config.sessionManager.getSessionsByUser(id);
+                    sessions = (await config.sessionManager.getSessionsByUser(id)).map(normalizeSession);
                 }
                 catch { }
             }
@@ -873,7 +999,7 @@ export const createAdminUI = (config = {}) => {
             return c.html(pages.sessionsList([]));
         }
         try {
-            const sessions = await config.sessionManager.listSessions(100);
+            const sessions = (await config.sessionManager.listSessions(100)).map(normalizeSession);
             return c.html(pages.sessionsList(sessions));
         }
         catch (e) {
@@ -881,8 +1007,8 @@ export const createAdminUI = (config = {}) => {
         }
     });
     // Subscriptions list partial
-    router.get("/ui/subscriptions/list", (c) => {
-        const subscriptions = config.getActiveSubscriptions?.() || [];
+    router.get("/ui/subscriptions/list", async (c) => {
+        const subscriptions = (await config.getActiveSubscriptions?.()) || [];
         return c.html(pages.subscriptionsList(subscriptions));
     });
     // Changelog list partial
@@ -898,7 +1024,7 @@ export const createAdminUI = (config = {}) => {
             if (resource) {
                 entries = entries.filter((e) => e.resource?.includes(resource));
             }
-            return c.html(pages.changelogList(entries));
+            return c.html(pages.changelogList(entries.map(normalizeChangelogEntry)));
         }
         catch (e) {
             return c.html(html `<div class="alert alert-error">${escapeHtml(e.message)}</div>`);
@@ -916,7 +1042,7 @@ export const createAdminUI = (config = {}) => {
             if (!entry) {
                 return c.html(emptyState('✕', 'Entry not found', ''));
             }
-            return c.html(pages.changelogDetail({ entry }));
+            return c.html(pages.changelogDetail({ entry: normalizeChangelogEntry(entry) }));
         }
         catch (e) {
             return c.html(html `<div class="alert alert-error">${escapeHtml(e.message)}</div>`);
@@ -1151,58 +1277,142 @@ export const createAdminUI = (config = {}) => {
     // API explorer endpoint detail partial
     router.get("/ui/api-explorer/endpoint/:index", (c) => {
         const index = parseInt(c.req.param("index"));
-        const resources = getAllResourcesForDisplay();
-        const endpoints = [];
-        for (const resource of resources) {
-            const caps = resource.capabilities || {};
-            endpoints.push({
-                method: 'GET',
-                path: resource.name,
-                description: `List ${resource.name} with filtering and pagination`,
-                parameters: [
-                    { name: 'filter', in: 'query', type: 'string', description: 'RSQL filter expression' },
-                    { name: 'limit', in: 'query', type: 'number', description: 'Max results (default: 50)' },
-                    { name: 'cursor', in: 'query', type: 'string', description: 'Pagination cursor' },
-                    { name: 'orderBy', in: 'query', type: 'string', description: 'Sort field:direction' },
-                ],
-            });
-            endpoints.push({
-                method: 'GET',
-                path: `${resource.name}/:id`,
-                description: `Get a single ${resource.name} by ID`,
-                parameters: [{ name: 'id', in: 'path', type: 'string', required: true }],
-            });
-            if (caps.enableCreate) {
-                endpoints.push({
-                    method: 'POST',
-                    path: resource.name,
-                    description: `Create a new ${resource.name}`,
-                    requestBody: { contentType: 'application/json' },
-                });
+        const endpoint = buildApiEndpoints()[index];
+        if (!endpoint) {
+            return c.html(emptyState('✕', 'Endpoint not found', ''));
+        }
+        return c.html(pages.endpointDetail({ endpoint, baseUrl: '' }));
+    });
+    // API explorer request runner — performs the configured request against this
+    // same server (forwarding the caller's cookies for auth) and renders the
+    // response. The form posts method/path plus param_<name> fields and a body.
+    router.post("/ui/api-explorer/execute", async (c) => {
+        const body = (await c.req.parseBody());
+        const method = (body.method ?? "GET").toUpperCase();
+        let path = body.path ?? "";
+        const requestBody = typeof body.body === "string" ? body.body.trim() : "";
+        const query = new URLSearchParams();
+        for (const [key, value] of Object.entries(body)) {
+            if (!key.startsWith("param_"))
+                continue;
+            if (value == null || value === "")
+                continue;
+            const paramName = key.slice("param_".length);
+            if (path.includes(`:${paramName}`)) {
+                path = path.replace(`:${paramName}`, encodeURIComponent(value));
             }
-            if (caps.enableUpdate) {
-                endpoints.push({
-                    method: 'PATCH',
-                    path: `${resource.name}/:id`,
-                    description: `Update a ${resource.name}`,
-                    parameters: [{ name: 'id', in: 'path', type: 'string', required: true }],
-                    requestBody: { contentType: 'application/json' },
-                });
+            else {
+                query.set(paramName, value);
             }
-            if (caps.enableDelete) {
-                endpoints.push({
-                    method: 'DELETE',
-                    path: `${resource.name}/:id`,
-                    description: `Delete a ${resource.name}`,
-                    parameters: [{ name: 'id', in: 'path', type: 'string', required: true }],
-                });
+        }
+        const origin = new URL(c.req.url).origin;
+        const qs = query.toString();
+        const target = `${origin}${path.startsWith("/") ? "" : "/"}${path}${qs ? `?${qs}` : ""}`;
+        const headers = {};
+        const cookie = c.req.header("cookie");
+        if (cookie)
+            headers["cookie"] = cookie;
+        const auth = c.req.header("authorization");
+        if (auth)
+            headers["authorization"] = auth;
+        const init = { method, headers };
+        if (method !== "GET" && method !== "HEAD" && requestBody) {
+            headers["content-type"] = "application/json";
+            init.body = requestBody;
+        }
+        const started = Date.now();
+        try {
+            const res = await fetch(target, init);
+            const duration = Date.now() - started;
+            const text = await res.text();
+            let parsed = text;
+            try {
+                parsed = JSON.parse(text);
             }
+            catch { }
+            const resHeaders = {};
+            res.headers.forEach((value, key) => {
+                resHeaders[key] = value;
+            });
+            return c.html(pages.apiResponse({
+                status: res.status,
+                statusText: res.statusText,
+                headers: resHeaders,
+                body: parsed,
+                duration,
+            }));
         }
-        const endpoint = endpoints[index];
-        if (!endpoint) {
-            return c.html(emptyState('✕', 'Endpoint not found', ''));
+        catch (e) {
+            return c.html(pages.apiResponse({
+                status: 0,
+                statusText: "Request Failed",
+                headers: {},
+                body: "",
+                duration: Date.now() - started,
+                error: e?.message ?? String(e),
+            }));
+        }
+    });
+    // Filter tester — run an RSQL expression against a resource's live data
+    // (in-memory matching, so it exercises the same predicate logic used for
+    // subscription matching) and report which records match.
+    router.post("/ui/filter/test", async (c) => {
+        const body = (await c.req.parseBody());
+        const filter = typeof body.filter === "string" ? body.filter : "";
+        const resource = typeof body.resource === "string" ? body.resource : "";
+        if (!resource) {
+            return c.html(pages.filterTestResult({
+                filter,
+                resource,
+                matchCount: 0,
+                totalCount: 0,
+                matches: [],
+                executionTime: 0,
+                error: "Select a resource to test against",
+            }));
+        }
+        const entry = getResourceSchema(resource);
+        if (!entry) {
+            return c.html(pages.filterTestResult({
+                filter,
+                resource,
+                matchCount: 0,
+                totalCount: 0,
+                matches: [],
+                executionTime: 0,
+                error: `Unknown resource: ${resource}`,
+            }));
+        }
+        const started = Date.now();
+        try {
+            const rows = (await entry.db
+                .select()
+                .from(entry.schema)
+                .limit(500));
+            const filterer = createResourceFilter(entry.schema, {});
+            const matches = filter
+                ? rows.filter((row) => filterer.execute(filter, row))
+                : rows;
+            return c.html(pages.filterTestResult({
+                filter,
+                resource,
+                matchCount: matches.length,
+                totalCount: rows.length,
+                matches: matches.slice(0, 50),
+                executionTime: Date.now() - started,
+            }));
+        }
+        catch (e) {
+            return c.html(pages.filterTestResult({
+                filter,
+                resource,
+                matchCount: 0,
+                totalCount: 0,
+                matches: [],
+                executionTime: Date.now() - started,
+                error: e?.message ?? String(e),
+            }));
         }
-        return c.html(pages.endpointDetail({ endpoint, baseUrl: '' }));
     });
     return router;
 };