okengine 0.14.1 → 0.16.0

package/src/console/ui-next/src/features/access/state/access-selection.ts

@@ -0,0 +1,84 @@
+/**
+ * Access page URL search — selected key + sheet action.
+ */
+
+import { useNavigate, useSearch } from "@tanstack/react-router";
+import { useCallback } from "react";
+
+/** Sheet opened from the URL. */
+export type AccessAction = "create" | "edit" | "refresh" | "revoke" | "rotate";
+
+/** Search params for `/access`. */
+export interface AccessSearch {
+  readonly q?: string;
+  readonly key?: string;
+  readonly action?: AccessAction;
+}
+
+/**
+ * Validate Access search params from the router.
+ *
+ * @param search - Raw search object
+ */
+export function validateAccessSearch(search: Record<string, unknown>): AccessSearch {
+  const q = typeof search.q === "string" && search.q.length > 0 ? search.q : undefined;
+  const key = typeof search.key === "string" && search.key.length > 0 ? search.key : undefined;
+  const action =
+    search.action === "create" ||
+    search.action === "edit" ||
+    search.action === "refresh" ||
+    search.action === "revoke" ||
+    search.action === "rotate"
+      ? search.action
+      : undefined;
+  return {
+    ...(q !== undefined ? { q } : {}),
+    ...(key !== undefined ? { key } : {}),
+    ...(action !== undefined ? { action } : {}),
+  };
+}
+
+/**
+ * Read + write the Access page selection from the URL.
+ */
+export function useAccessSelection(): {
+  readonly query: string;
+  readonly selectedKey: string | null;
+  readonly action: AccessAction | null;
+  readonly setQuery: (q: string) => void;
+  readonly setSelectedKey: (key: string | null) => void;
+  readonly setAction: (action: AccessAction | null) => void;
+} {
+  const search = useSearch({ strict: false }) as AccessSearch;
+  const navigate = useNavigate();
+
+  const query = typeof search.q === "string" ? search.q : "";
+  const selectedKey = typeof search.key === "string" ? search.key : null;
+  const action = search.action ?? null;
+
+  const patch = useCallback(
+    (next: Partial<AccessSearch>) => {
+      void navigate({
+        to: ".",
+        search: (prev: Record<string, unknown>) => validateAccessSearch({ ...prev, ...next }),
+        replace: true,
+      });
+    },
+    [navigate],
+  );
+
+  return {
+    query,
+    selectedKey,
+    action,
+    setQuery: (q) => {
+      patch({ q: q.length > 0 ? q : undefined });
+    },
+    setSelectedKey: (key) => {
+      patch({ key: key ?? undefined, action: undefined });
+    },
+    setAction: (next) => {
+      patch({ action: next ?? undefined });
+    },
+  };
+}

package/src/console/ui-next/src/features/auth/auth-redirect.test.ts

@@ -18,6 +18,7 @@ describe("sanitizeReturnTo", () => {
     expect(sanitizeReturnTo("/vault?name=STRIPE_KEY&action=rotate")).toBe(
       "/vault?name=STRIPE_KEY&action=rotate",
     );
+    expect(sanitizeReturnTo("/access?key=key_1")).toBe("/access?key=key_1");
     expect(sanitizeReturnTo("/observability?window=7d")).toBe("/observability?window=7d");
     expect(sanitizeReturnTo("/monitoring?window=7d")).toBe("/observability?window=7d");
   });
@@ -107,6 +108,10 @@ describe("afterAuthLocation", () => {
       to: "/vault",
       search: { name: "STRIPE_KEY", action: "rotate-master" },
     });
+    expect(afterAuthLocation("/access?key=key_1")).toEqual({
+      to: "/access",
+      search: { key: "key_1" },
+    });
     expect(afterAuthLocation("/observability?window=7d&run=r1")).toEqual({
       to: "/observability",
       search: { window: "7d", run: "r1" },

package/src/console/ui-next/src/features/auth/auth-redirect.ts

@@ -2,7 +2,7 @@
  * Post-auth return path — keep the operator on the module they were in
  * after a session expires, instead of always landing on `/overview`.
  *
- * Only `/overview`, `/flows`, `/store`, `/vault`, and `/observability` (plus their
+ * Only `/overview`, `/flows`, `/store`, `/vault`, `/access`, and `/observability` (plus their
  * search) are legal. `/monitoring` is rewritten to `/observability`. Anything else
  * is dropped so `?next=` cannot be an open redirect.
  */
@@ -15,12 +15,20 @@ import {
   type ObservabilitySearch,
 } from "../observability/state/observability-selection.ts";
 import { validateVaultSearch, type VaultSearch } from "../vault/state/vault-selection.ts";
+import { validateAccessSearch, type AccessSearch } from "../access/state/access-selection.ts";
 
 /** Default shell module when no safe return path is present. */
 export const DEFAULT_AFTER_AUTH = "/overview" as const;
 
 /** Shell pathnames that may be restored after login. */
-const SHELL_PATHS = new Set(["/overview", "/flows", "/store", "/vault", "/observability"]);
+const SHELL_PATHS = new Set([
+  "/overview",
+  "/flows",
+  "/store",
+  "/vault",
+  "/access",
+  "/observability",
+]);
 
 /** Retired live module — rewritten to {@link CANONICAL_OBSERVABILITY}. */
 const LEGACY_MONITORING = "/monitoring";
@@ -40,6 +48,7 @@ export type AfterAuthLocation =
   | { readonly to: "/flows"; readonly search: UnitsSearch }
   | { readonly to: "/store"; readonly search: StoreSearch }
   | { readonly to: "/vault"; readonly search: VaultSearch }
+  | { readonly to: "/access"; readonly search: AccessSearch }
   | { readonly to: "/observability"; readonly search: ObservabilitySearch };
 
 /**
@@ -111,6 +120,9 @@ export function afterAuthLocation(value: unknown): AfterAuthLocation {
   if (url.pathname === "/vault") {
     return { to: "/vault", search: validateVaultSearch(raw) };
   }
+  if (url.pathname === "/access") {
+    return { to: "/access", search: validateAccessSearch(raw) };
+  }
   if (url.pathname === CANONICAL_OBSERVABILITY) {
     return { to: "/observability", search: validateObservabilitySearch(raw) };
   }
@@ -123,6 +135,7 @@ export type AfterAuthNavigate = {
   (opts: { to: "/flows"; search: UnitsSearch }): unknown;
   (opts: { to: "/store"; search: StoreSearch }): unknown;
   (opts: { to: "/vault"; search: VaultSearch }): unknown;
+  (opts: { to: "/access"; search: AccessSearch }): unknown;
   (opts: { to: "/observability"; search: ObservabilitySearch }): unknown;
 };
 
@@ -144,6 +157,9 @@ export function goAfterAuth(navigate: AfterAuthNavigate, value: unknown): void {
     case "/vault":
       void navigate({ to: "/vault", search: dest.search });
       return;
+    case "/access":
+      void navigate({ to: "/access", search: dest.search });
+      return;
     case "/observability":
       void navigate({ to: "/observability", search: dest.search });
       return;

package/src/console/ui-next/src/features/flows/traces/http-method.ts

@@ -18,6 +18,25 @@ import type { ElementHugeIcon } from "@/lib/element-icons.ts";
 /** Known HTTP methods from Manifest `HttpTrigger.method`. */
 export type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS" | "QUERY";
 
+/**
+ * Whether the verb carries a JSON request body on the wire.
+ *
+ * Matches the HTTP compiler (`GET` / `HEAD` / `DELETE` are path-or-query
+ * only) and the typed client (`GET` / `HEAD` leftover fields → query).
+ *
+ * @param method - HTTP method string (case-insensitive) or null
+ */
+export function httpMethodHasBody(method: string | null | undefined): boolean {
+  switch ((method ?? "").toUpperCase()) {
+    case "GET":
+    case "HEAD":
+    case "DELETE":
+      return false;
+    default:
+      return true;
+  }
+}
+
 /**
  * Units-tree display rank: GET → POST → QUERY → PATCH/PUT → DELETE.
  *

package/src/console/ui-next/src/features/flows/traces/trace-detail.test.ts

@@ -8,6 +8,7 @@ import { ELEMENT_ICONS } from "@/lib/element-icons.ts";
 import { EDGE_STROKE } from "../graph/flow-graph-theme.ts";
 import {
   httpMethodBadgeClass,
+  httpMethodHasBody,
   httpMethodIcon,
   httpMethodRailClass,
   httpMethodSortRank,
@@ -110,6 +111,23 @@ describe("effectKindIcon", () => {
   });
 });
 
+describe("httpMethodHasBody", () => {
+  test("GET, HEAD, and DELETE are path/query only", () => {
+    expect(httpMethodHasBody("GET")).toBe(false);
+    expect(httpMethodHasBody("HEAD")).toBe(false);
+    expect(httpMethodHasBody("DELETE")).toBe(false);
+    expect(httpMethodHasBody("get")).toBe(false);
+  });
+
+  test("POST, PUT, PATCH, QUERY, and OPTIONS carry JSON", () => {
+    expect(httpMethodHasBody("POST")).toBe(true);
+    expect(httpMethodHasBody("PUT")).toBe(true);
+    expect(httpMethodHasBody("PATCH")).toBe(true);
+    expect(httpMethodHasBody("QUERY")).toBe(true);
+    expect(httpMethodHasBody("OPTIONS")).toBe(true);
+  });
+});
+
 describe("httpMethodBadgeClass", () => {
   test("assigns distinct accents per method", () => {
     expect(httpMethodBadgeClass("GET")).toContain("emerald");
@@ -352,7 +370,7 @@ describe("Sheet Replay path", () => {
           ok: true as const,
           rootId: run.id,
           dryRun: false,
-          at: 1,
+          at: "2026-08-21T09:36:51.525Z",
           flow: run.flow,
         },
         error: null,

package/src/console/ui-next/src/features/flows/traces/traces-pane.tsx

@@ -15,6 +15,7 @@ import {
   EXPLORER_STRIP_TOKEN_IDLE_CLASS,
   EXPLORER_TOOLBAR_CLASS,
 } from "@/components/explorer/explorer-chrome.ts";
+import { AgentDisclosure } from "@/components/agents/agent-disclosure.tsx";
 import { ExplorerSearch } from "@/components/explorer/explorer-search.tsx";
 import {
   Empty,
@@ -236,10 +237,16 @@ export function TracesPane({
         ) : null}
       </div>
 
-      {runs.length > 0 && advancedOpen ? (
-        <div id="traces-advanced-panel">
+      {runs.length > 0 ? (
+        <AgentDisclosure
+          id="traces-advanced-panel"
+          role="region"
+          aria-label="Advanced filters"
+          open={advancedOpen}
+          className="shrink-0"
+        >
           <AdvancedFilters query={filters.advanced} runs={runs} onChange={setAdvanced} />
-        </div>
+        </AgentDisclosure>
       ) : null}
 
       <div className="flex min-h-0 flex-1 flex-col overflow-y-auto">

package/src/console/ui-next/src/features/not-found/not-found-page.tsx

@@ -6,7 +6,7 @@ import { authLabelClassName } from "@/components/auth-card";
 import { ConsoleChrome } from "@/components/console-chrome";
 
 /**
- * 404 for any path that is not `/`, `/overview`, `/flows`, `/store`, `/vault`, or `/observability`.
+ * 404 for any path that is not `/`, `/overview`, `/flows`, `/store`, `/vault`, `/access`, or `/observability`.
  */
 export function NotFoundPage() {
   return (

package/src/console/ui-next/src/features/store/detail/browse-section.tsx

@@ -55,6 +55,7 @@ import { ToolbarTip } from "@/components/ui/toolbar-tip.tsx";
 import { buildStoreGridModel, type StoreGridRow } from "../lib/grid-model.ts";
 import { parseIndexQuery } from "../lib/index-query.ts";
 import { childCatalogKind, groupSqlChildren, isSqlCatalogChild } from "../lib/sql-catalog.ts";
+import { QueryGateMenu } from "../query/query-gate-menu.tsx";
 import { TouchedByLists } from "./touched-by-section.tsx";
 
 /** Browse page sizes offered in the Rows select. */
@@ -116,6 +117,10 @@ export function BrowseSection({
   const [indexOpen, setIndexOpen] = useState(false);
   const [triggerOpen, setTriggerOpen] = useState(false);
   const [insertOpen, setInsertOpen] = useState(false);
+  const [rlsAs, setRlsAs] = useState<{ asGate: string | null; asUserId: string | null }>({
+    asGate: null,
+    asUserId: null,
+  });
 
   const debouncedIndexText = useDebouncedValue(indexText, INDEX_SEARCH_DEBOUNCE_MS);
   const indexQuery = useMemo(() => parseIndexQuery(debouncedIndexText), [debouncedIndexText]);
@@ -133,8 +138,25 @@ export function BrowseSection({
         : {}),
       ...(store.facet === "index" && indexQuery.kind === "text" ? { q: indexQuery.q, topK } : {}),
       ...(store.facet === "sql" && !piiMasked ? { revealPii: true } : {}),
+      ...(store.facet === "sql" && !isSqlCatalogChild(child) && rlsAs.asGate
+        ? { asGate: rlsAs.asGate }
+        : {}),
+      ...(store.facet === "sql" && !isSqlCatalogChild(child) && rlsAs.asUserId
+        ? { asUserId: rlsAs.asUserId }
+        : {}),
     };
-  }, [store.ref, store.facet, child.name, tenant, tenantReady, limit, indexQuery, topK, piiMasked]);
+  }, [
+    store.ref,
+    store.facet,
+    child,
+    tenant,
+    tenantReady,
+    limit,
+    indexQuery,
+    topK,
+    piiMasked,
+    rlsAs,
+  ]);
 
   const browse = useStoreQuery(queryInput, tenantReady);
   const deleteMutation = useStoreDelete();
@@ -191,6 +213,8 @@ export function BrowseSection({
               c.key === "with_check" ||
               c.key === "command" ||
               c.key === "permissive",
+            ...(c.key === "origin" ? { label: "Origin" } : {}),
+            ...(c.key === "code" ? { label: "Code" } : {}),
           })),
       };
     }
@@ -269,6 +293,9 @@ export function BrowseSection({
 
   const toolbarExtras = (
     <>
+      {store.facet === "sql" && !isSqlCatalogChild(child) ? (
+        <QueryGateMenu manifest={manifest} value={rlsAs} onChange={setRlsAs} />
+      ) : null}
       <Tooltip>
         <TooltipTrigger
           render={(props) => (
@@ -576,9 +603,26 @@ export function BrowseSection({
             }
             insertOpen={insertOpen}
             onInsertOpenChange={setInsertOpen}
+            asGate={rlsAs.asGate}
+            asUserId={rlsAs.asUserId}
             onDeleteRows={
               authReadOnly || extensionCatalog ? undefined : (rows) => setDeleting(rows)
             }
+            onViewportContextMenu={
+              store.ref === "sql:oke_console"
+                ? undefined
+                : policyCatalog
+                  ? () => setPolicyOpen(true)
+                  : functionCatalog
+                    ? () => setFunctionOpen(true)
+                    : indexCatalog
+                      ? () => setIndexOpen(true)
+                      : triggerCatalog
+                        ? () => setTriggerOpen(true)
+                        : store.facet === "sql" && !isSqlCatalogChild(child)
+                          ? () => setInsertOpen(true)
+                          : undefined
+            }
           />
         </div>
       ) : null}

package/src/console/ui-next/src/features/store/detail/resource-panel.tsx

@@ -9,6 +9,8 @@ import {
   CheckmarkCircle02Icon,
   Folder01Icon,
   SecurityCheckIcon,
+  ShieldEnergyIcon,
+  ShieldOff,
   Timer01Icon,
 } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
@@ -24,8 +26,13 @@ import { formatDuration } from "@/features/flows/traces/format-duration.ts";
 import { cn } from "@/lib/utils";
 import { filesDriverLabel, filesDriverOrigin } from "../lib/files-origin.ts";
 import { latestReplicaLagFromRuns } from "../lib/replica-lag.ts";
-import { isSqlCatalogChild, storeChildLabel } from "../lib/sql-catalog.ts";
-import { STORE_FACET_SPECS } from "../lib/store-tree.ts";
+import {
+  isSqlCatalogChild,
+  storeChildLabel,
+  storeChildRlsPolicyCount,
+  storeChildShowsRls,
+} from "../lib/sql-catalog.ts";
+import { resourceHeaderChildRef, STORE_FACET_SPECS } from "../lib/store-tree.ts";
 import { BrowseSection } from "./browse-section.tsx";
 
 /** Props for {@link ResourcePanel}. */
@@ -77,7 +84,12 @@ export function ResourcePanel({
   const lagTone = lagMs != null ? durationTone(lagMs) : null;
 
   const files = store.facet === "files";
-  const showStatus = Boolean(drift || lagMs !== null || store.contentAddressed || piiCount > 0);
+  const showsRls = storeChildShowsRls(child);
+  const rlsOn = child.rls === true;
+  const rlsCount = storeChildRlsPolicyCount(child, manifest, store.name);
+  const showStatus = Boolean(
+    drift || lagMs !== null || store.contentAddressed || piiCount > 0 || showsRls,
+  );
 
   return (
     <div className="flex h-full min-h-0 flex-col overflow-hidden" data-slot="resource-panel">
@@ -124,18 +136,7 @@ export function ResourcePanel({
                 <CopyInlineButton value={child.effectRef} label="Copy effect ref" />
               </>
             ) : (
-              <>
-                <span className="shrink-0 font-mono text-[11px] leading-none text-muted-foreground">
-                  {store.ref}
-                </span>
-                <span aria-hidden className="text-border">
-                  ·
-                </span>
-                <code className="min-w-0 truncate font-mono text-[11px] leading-none text-foreground/70">
-                  {child.effectRef}
-                </code>
-                <CopyInlineButton value={child.effectRef} label="Copy effect ref" />
-              </>
+              <ResourceRefSubtitle storeRef={store.ref} effectRef={child.effectRef} />
             )}
           </>
         }
@@ -154,6 +155,30 @@ export function ResourcePanel({
                 </StatusChip>
               ) : null}
               {store.contentAddressed ? <StatusChip>content-addressed</StatusChip> : null}
+              {showsRls ? (
+                <StatusChip
+                  tone={rlsOn ? "emerald" : "neutral"}
+                  icon={
+                    <HugeiconsIcon
+                      icon={rlsOn ? ShieldEnergyIcon : ShieldOff}
+                      className="size-3"
+                      aria-hidden
+                    />
+                  }
+                  title={
+                    rlsOn
+                      ? rlsCount > 0
+                        ? `Row-level security enabled · ${rlsCount} ${rlsCount === 1 ? "policy" : "policies"}`
+                        : "Row-level security enabled"
+                      : "Row-level security disabled"
+                  }
+                  role="status"
+                  data-slot="resource-rls"
+                  data-rls={rlsOn ? "on" : "off"}
+                >
+                  {rlsOn && rlsCount > 0 ? `${rlsCount} RLS` : "RLS"}
+                </StatusChip>
+              ) : null}
               {piiCount > 0 ? (
                 <StatusChip
                   tone={piiMasked ? "sky" : "amber"}
@@ -233,6 +258,34 @@ export function ResourcePanel({
   );
 }
 
+function ResourceRefSubtitle({
+  storeRef,
+  effectRef,
+}: {
+  readonly storeRef: string;
+  readonly effectRef: string;
+}): JSX.Element {
+  const childRef = resourceHeaderChildRef(storeRef, effectRef);
+  return (
+    <>
+      <span className="shrink-0 font-mono text-[11px] leading-none text-muted-foreground">
+        {storeRef}
+      </span>
+      {childRef ? (
+        <>
+          <span aria-hidden className="text-border">
+            ·
+          </span>
+          <code className="min-w-0 truncate font-mono text-[11px] leading-none text-foreground/70">
+            {childRef}
+          </code>
+        </>
+      ) : null}
+      <CopyInlineButton value={effectRef} label="Copy effect ref" />
+    </>
+  );
+}
+
 type ChipTone = "neutral" | "emerald" | "amber" | "sky";
 
 const CHIP_TONES: Record<ChipTone, string> = {
@@ -251,6 +304,7 @@ interface StatusChipProps {
   readonly role?: string;
   readonly "data-slot"?: string;
   readonly "data-drifted"?: string;
+  readonly "data-rls"?: string;
   readonly pressed?: boolean;
   readonly onClick?: () => void;
   readonly ariaLabel?: string;
@@ -270,6 +324,7 @@ function StatusChip({
   role,
   "data-slot": dataSlot,
   "data-drifted": dataDrifted,
+  "data-rls": dataRls,
   pressed,
   onClick,
   ariaLabel,
@@ -290,13 +345,20 @@ function StatusChip({
       aria-label={ariaLabel}
       data-slot={dataSlot}
       data-drifted={dataDrifted}
+      data-rls={dataRls}
       onClick={onClick}
     >
       {icon}
       {children}
     </button>
   ) : (
-    <span className={className} role={role} data-slot={dataSlot} data-drifted={dataDrifted}>
+    <span
+      className={className}
+      role={role}
+      data-slot={dataSlot}
+      data-drifted={dataDrifted}
+      data-rls={dataRls}
+    >
       {icon}
       {children}
     </span>