portal-mojo 0.1.0

package/src/admin/incidents/IncidentDetail.tsx

@@ -0,0 +1,68 @@
+import { useQueryClient } from '@tanstack/react-query';
+import { createIncidentHistoryAdapter, useCan, useMe } from '../../client';
+import { Badge, DetailView, Eyebrow, FlatRow, KnownFieldsCard, RecordFeed, StatusPanel, fmt, toast, type Tone } from '../../ui';
+import { SECURITY_MANAGE_PERMS } from '../security-permissions';
+import { AssistantContextLauncher } from '../assistant/launchers';
+import { EvidenceCard, INCIDENT_METADATA_FIELDS, RequestResponseForensics, TraceForensics, metadataOf } from './forensics';
+import { INCIDENT_LIFECYCLE, IncidentModel, showEventDetail, useIncidentDetail, useIncidentEvents } from './models';
+import { sanitizeIncidentHistoryRow, sanitizeSecurityText } from './sanitize';
+
+function priorityTone(priority: number): Tone { return priority >= 8 ? 'danger' : priority >= 5 ? 'warning' : 'info'; }
+function statusTone(status: string): Tone { return ['resolved', 'closed'].includes(status) ? 'success' : ['new', 'open'].includes(status) ? 'danger' : status === 'investigating' ? 'warning' : 'muted'; }
+
+export function IncidentDetail({ id, onClose }: { id: number; onClose: () => void }) {
+    const queryClient = useQueryClient();
+    const query = useIncidentDetail(id);
+    const events = useIncidentEvents(id);
+    const save = IncidentModel.useSave();
+    const { can: canManage } = useCan(SECURITY_MANAGE_PERMS);
+    const { data: me } = useMe();
+    if (query.isPending) return <div className="modal-pad dim">Loading incident…</div>;
+    if (!query.data || query.error) return <div className="modal-pad text-bad">{query.error?.message ?? 'Incident not found'}</div>;
+    const incident = query.data;
+    const groupId = Number.isSafeInteger(incident.group_id) && Number(incident.group_id) > 0
+        ? Number(incident.group_id) : null;
+    const adapter = createIncidentHistoryAdapter(id, {
+        groupId,
+        sanitizeRow: sanitizeIncidentHistoryRow,
+        sanitizeText: sanitizeSecurityText,
+    });
+    const metadata = metadataOf(incident);
+    const patchStatus = async (status: string) => {
+        try {
+            await save.mutateAsync({ id, changes: { status } });
+            await queryClient.invalidateQueries({ queryKey: IncidentModel.keys.root });
+            toast.success(`Incident moved to ${status}`);
+        } catch (error) { toast.error(error instanceof Error ? error.message : 'Status update failed'); }
+    };
+    const trace = metadata.stack_trace ?? metadata.traceback;
+    return <DetailView
+        icon="bi-shield-exclamation"
+        title={incident.title || `Incident #${incident.id}`}
+        subtitle={`Incident #${incident.id} · ${incident.scope} · ${fmt.datetime(incident.created)}`}
+        chips={[
+            { text: incident.status.toUpperCase(), tone: statusTone(incident.status) },
+            { text: `P${incident.priority}`, tone: priorityTone(incident.priority) },
+            { text: incident.category, tone: 'muted' },
+            ...(metadata.do_not_delete ? [{ text: 'PROTECTED', tone: 'warning' as const }] : []),
+        ]}
+        sections={[
+            { key: 'overview', label: 'Overview', icon: 'bi-grid-1x2', render: () => <>
+                <StatusPanel tone={statusTone(incident.status)} state={incident.status.toUpperCase()} headline={incident.details || incident.title || 'No incident details'} meta={`${incident.category} · ${incident.scope}`} actions={<div className="assistant-action-row"><AssistantContextLauncher model="incident.Incident" pk={incident.id} />{canManage && <select className="input input-compact" value={incident.status} disabled={save.isPending} onChange={(event) => void patchStatus(event.target.value)} aria-label="Incident lifecycle">{INCIDENT_LIFECYCLE.map((status) => <option key={status} value={status}>{status}</option>)}</select>}</div>} />
+                <Eyebrow>Incident facts</Eyebrow>
+                <FlatRow label="State"><code>{incident.state || '—'}</code></FlatRow>
+                <FlatRow label="Source IP"><code>{incident.source_ip || '—'}</code></FlatRow>
+                <FlatRow label="Hostname"><code>{incident.hostname || '—'}</code></FlatRow>
+                <FlatRow label="Model">{incident.model_name ? `${incident.model_name} #${incident.model_id ?? '—'}` : '—'}</FlatRow>
+            </> },
+            { key: 'evidence', label: 'Evidence', icon: 'bi-funnel', render: () => <EvidenceCard metadata={{ ...metadata, model_name: incident.model_name, model_id: incident.model_id }} /> },
+            { key: 'events', label: 'Events', icon: 'bi-list-ul', render: () => events.isPending ? <p className="dim">Loading events…</p> : events.data?.rows.length ? <div className="incident-events-list">{events.data.rows.map((event) => <button type="button" className="incident-event-row" key={event.id} onClick={() => showEventDetail(event.id)}><Badge tone={event.level >= 8 ? 'danger' : event.level >= 4 ? 'warning' : 'muted'}>L{event.level}</Badge><span><strong>{event.title || event.category}</strong><small>{fmt.datetime(event.created)} · {event.details || 'No details'}</small></span></button>)}</div> : <p className="dim-italic">No events on this incident.</p> },
+            { key: 'request', label: 'Request', icon: 'bi-globe2', render: () => <RequestResponseForensics metadata={metadata} /> },
+            ...(trace ? [{ key: 'trace', label: 'Stack trace', icon: 'bi-code-square', render: () => <TraceForensics metadata={metadata} /> }] : []),
+            { key: 'history', label: 'History', icon: 'bi-chat-left-text', render: () => <RecordFeed adapter={adapter} variant="compact" showInput={canManage} currentUserId={me?.id ?? null} placeholder="Add an incident note…" attachmentUpload={{ destination: groupId == null ? {} : { groupId, use: 'uploads' }, expectedGroupId: groupId }} /> },
+            { key: 'metadata', label: 'Known fields', icon: 'bi-braces', render: () => <KnownFieldsCard data={metadata} known={[...INCIDENT_METADATA_FIELDS]} showRaw={false} emptyText="No curated forensic metadata." /> },
+        ]}
+        initialSection="overview"
+        onClose={onClose}
+    />;
+}

package/src/admin/incidents/IncidentsPage.tsx

@@ -0,0 +1,102 @@
+import { useState } from 'react';
+import { useQueryClient } from '@tanstack/react-query';
+import { createSafeExporter, useCan } from '../../client';
+import { Badge, ModelTable, fmt, modal, type BatchAction, type Column, type FilterDef, type Tone } from '../../ui';
+import { SECURITY_MANAGE_PERMS } from '../security-permissions';
+import { INCIDENT_LIFECYCLE, IncidentModel, buildIncidentMerge, showIncidentDetail, type IncidentRow } from './models';
+import { sanitizeIncidentRow } from './sanitize';
+
+function priorityTone(priority: number): Tone { return priority >= 8 ? 'danger' : priority >= 5 ? 'warning' : 'info'; }
+function statusTone(status: string): Tone { return ['resolved', 'closed'].includes(status) ? 'success' : ['new', 'open'].includes(status) ? 'danger' : status === 'investigating' ? 'warning' : 'muted'; }
+const options = (values: readonly string[]) => values.map((value) => ({ value, label: value.replaceAll('_', ' ') }));
+
+const INCIDENT_EXPORTER = createSafeExporter<IncidentRow>({
+    endpoint: IncidentModel.endpoint, filename: 'security-incidents', sanitizeRow: sanitizeIncidentRow,
+    fields: [
+        { key: 'id' }, { key: 'created' }, { key: 'status' }, { key: 'state' }, { key: 'priority' },
+        { key: 'scope' }, { key: 'category' }, { key: 'title' }, { key: 'details' },
+        { key: 'source_ip' }, { key: 'hostname' }, { key: 'group_id' },
+        { key: 'rule_id', value: (row) => row.metadata.rule_id },
+        { key: 'protected', value: (row) => Boolean(row.metadata.do_not_delete) },
+    ],
+});
+
+function MergeTargetForm({ rows, done }: { rows: IncidentRow[]; done: (value: number | null) => void }) {
+    const [target, setTarget] = useState(String(rows[0]?.id ?? ''));
+    return <form className="modal-pad" onSubmit={(event) => { event.preventDefault(); done(Number(target)); }}>
+        <h2 className="modal-title">Choose merge target</h2>
+        <p className="dim">The target survives. Every other selected incident becomes a source and is deleted after its events and tickets move.</p>
+        <label className="field"><span className="field-label">Target incident</span><select className="input" value={target} onChange={(event) => setTarget(event.target.value)}>{rows.map((row) => <option key={row.id} value={row.id}>#{row.id} · {row.title || row.details || row.category}</option>)}</select></label>
+        <div className="modal-actions"><button type="button" className="btn" onClick={() => done(null)}>Cancel</button><button type="submit" className="btn btn-primary">Merge into target</button></div>
+    </form>;
+}
+
+export function IncidentsPage() {
+    const { can: canManage } = useCan(SECURITY_MANAGE_PERMS);
+    const queryClient = useQueryClient();
+    const save = IncidentModel.useSave();
+    const merge = IncidentModel.useAction('merge');
+    const lifecycle = (status: string): BatchAction<IncidentRow> => ({
+        key: status, label: `Set ${status}`, icon: 'bi-arrow-left-right',
+        run: (row) => save.mutateAsync({ id: row.id, changes: { status } }),
+    });
+    const actions: BatchAction<IncidentRow>[] = [
+        ...['open', 'investigating', 'resolved', 'closed', 'ignored'].map(lifecycle),
+        {
+            key: 'protect', label: 'Protect', icon: 'bi-shield-fill-check',
+            run: (row) => save.mutateAsync({ id: row.id, changes: { metadata: { ...row.metadata, do_not_delete: true } } }),
+        },
+        {
+            key: 'merge', label: 'Merge', icon: 'bi-union', danger: true,
+            prepare: async (rows) => {
+                if (rows.length < 2) throw new Error('Select at least two incidents to merge.');
+                return modal.open<number | null>((done) => <MergeTargetForm rows={rows} done={done} />, { size: 'sm' });
+            },
+            runBatch: async (rows, prepared) => {
+                const spec = buildIncidentMerge(rows, Number(prepared));
+                try {
+                    await merge.mutateAsync({ id: spec.target.id, payload: spec.sourceIds });
+                } finally {
+                    for (const id of spec.sourceIds) {
+                        queryClient.removeQueries({ queryKey: IncidentModel.keys.one(id) });
+                        queryClient.removeQueries({ queryKey: ['record-feed', 'incident-history', id] });
+                    }
+                    await Promise.all([
+                        queryClient.invalidateQueries({ queryKey: IncidentModel.keys.root }),
+                        queryClient.invalidateQueries({ queryKey: ['/api/incident/event'] }),
+                        queryClient.invalidateQueries({ queryKey: ['record-feed', 'incident-history', spec.target.id] }),
+                    ]);
+                }
+            },
+        },
+    ];
+    const columns: Column<IncidentRow>[] = [
+        { key: 'id', label: 'ID', sortable: true, align: 'end', render: (row) => `#${row.id}` },
+        { key: 'status', label: 'Status', sortable: true, render: (row) => <Badge tone={statusTone(row.status)}>{row.status}</Badge> },
+        { key: 'created', label: 'Created', sortable: true, render: (row) => fmt.datetime(row.created) },
+        { key: 'scope', label: 'Scope', sortable: true },
+        { key: 'category', label: 'Category', sortable: true, render: (row) => <code>{row.category}</code> },
+        { key: 'priority', label: 'Priority', sortable: true, align: 'center', render: (row) => <Badge tone={priorityTone(row.priority)}>P{row.priority}</Badge> },
+        { key: 'title', label: 'Details', sortable: true, hideable: false, render: (row) => <span title={row.details ?? undefined}>{fmt.truncate(row.title || row.details || 'No details', 100)}</span> },
+    ];
+    const filters: FilterDef[] = [
+        { key: 'status', label: 'Lifecycle', type: 'multiselect', options: options(INCIDENT_LIFECYCLE) },
+        { key: 'created', label: 'Created', type: 'daterange' },
+        { key: 'scope', label: 'Scope', type: 'text' }, { key: 'category', label: 'Category', type: 'text' },
+        { key: 'priority', label: 'Minimum priority', type: 'number', lookup: 'gte' },
+        { key: 'priority', label: 'Maximum priority', type: 'number', lookup: 'lte' },
+        { key: 'metadata__rule_id', label: 'Rule ID', type: 'text', lookup: 'exact' },
+        { key: 'metadata__do_not_delete', label: 'Protected', type: 'boolean' },
+    ];
+    return <ModelTable
+        model={IncidentModel} title="Incidents" eyebrow="Security operations"
+        columns={columns} filters={filters} searchable searchPlaceholder="Search incident details"
+        defaultParams={{ sort: '-id', status: 'new' }}
+        presets={[{ key: 'new', label: 'New', params: { status: 'new' } }, { key: 'open', label: 'Open', params: { status: 'open' } }, { key: 'investigating', label: 'Investigating', params: { status: 'investigating' } }, { key: 'all', label: 'All', params: {} }]}
+        rowTone={(row) => row.priority >= 8 ? 'danger' : row.priority >= 5 ? 'warning' : null}
+        exporter={INCIDENT_EXPORTER} exportFormats={['csv', 'json']}
+        columnChooser persistState persistKey="admin-security-incidents" autoRefresh={30}
+        onRowClick={(row) => showIncidentDetail(row.id)}
+        {...(canManage ? { selectable: true, batchActions: actions } : {})}
+    />;
+}

package/src/admin/incidents/forensics.tsx

@@ -0,0 +1,73 @@
+import type { ReactNode } from 'react';
+import { Eyebrow, FlatRow, KnownFieldsCard, StackTraceView } from '../../ui';
+import { boundedSecurityText, sanitizeSecurityValue } from './sanitize';
+
+export function metadataOf(row: { metadata?: Record<string, unknown> }): Record<string, unknown> {
+    return sanitizeSecurityValue(row.metadata ?? {});
+}
+
+export function first(metadata: Record<string, unknown>, ...keys: string[]): unknown {
+    for (const key of keys) if (metadata[key] != null && metadata[key] !== '') return metadata[key];
+    return null;
+}
+
+function text(value: unknown): string { return value == null || value === '' ? '—' : boundedSecurityText(value, 8_000); }
+
+export function RequestResponseForensics({ metadata }: { metadata: Record<string, unknown> }) {
+    const candidates: Array<[string, unknown]> = [
+        ['Method', first(metadata, 'http_method', 'request_method', 'method')],
+        ['Status', first(metadata, 'http_status', 'response_status', 'status_code')],
+        ['Host', first(metadata, 'http_host', 'request_host', 'host')],
+        ['Path / URL', first(metadata, 'http_url', 'http_path', 'request_path', 'url')],
+        ['Protocol', first(metadata, 'http_protocol', 'protocol')],
+        ['Query string', first(metadata, 'http_query_string', 'query_string')],
+        ['User agent', first(metadata, 'http_user_agent', 'user_agent')],
+        ['Request headers', first(metadata, 'request_headers', 'headers')],
+        ['Request body', first(metadata, 'request_body', 'request_data', 'body')],
+        ['Response headers', first(metadata, 'response_headers')],
+        ['Response body', first(metadata, 'response_body', 'response_data')],
+    ];
+    const fields = candidates.filter(([, value]) => value != null && value !== '');
+    if (!fields.length) return <p className="dim-italic">No request or response context was recorded.</p>;
+    return <div className="incident-forensic-list">{fields.map(([label, value]) => (
+        <FlatRow key={label} label={label}><pre className="incident-forensic-value">{text(value)}</pre></FlatRow>
+    ))}</div>;
+}
+
+export function EvidenceCard({ metadata, extra }: { metadata: Record<string, unknown>; extra?: ReactNode }) {
+    return <>
+        <Eyebrow>Trigger and evidence</Eyebrow>
+        <KnownFieldsCard
+            data={metadata}
+            showRaw={false}
+            known={[
+                { key: 'trigger', label: 'Trigger', hideEmpty: true },
+                { key: 'action', label: 'Action', hideEmpty: true },
+                { key: 'rule_id', label: 'Rule ID', hideEmpty: true },
+                { key: 'risk_score', label: 'Risk score', hideEmpty: true },
+                { key: 'decision', label: 'Decision', hideEmpty: true },
+                { key: 'model_name', label: 'Model', hideEmpty: true },
+                { key: 'model_id', label: 'Model ID', hideEmpty: true },
+            ]}
+        />
+        {extra}
+    </>;
+}
+
+export function TraceForensics({ metadata }: { metadata: Record<string, unknown> }) {
+    const trace = first(metadata, 'stack_trace', 'traceback');
+    return <StackTraceView trace={trace ? boundedSecurityText(trace) : ''} collapseAfter={24} />;
+}
+
+export const INCIDENT_METADATA_FIELDS = [
+    { key: 'source_ip', label: 'Source IP', hideEmpty: true },
+    { key: 'hostname', label: 'Hostname', hideEmpty: true },
+    { key: 'country_code', label: 'Country', hideEmpty: true },
+    { key: 'region', label: 'Region', hideEmpty: true },
+    { key: 'city', label: 'City', hideEmpty: true },
+    { key: 'rule_id', label: 'Rule ID', hideEmpty: true },
+    { key: 'risk_score', label: 'Risk score', hideEmpty: true },
+    { key: 'decision', label: 'Decision', hideEmpty: true },
+    { key: 'muid', label: 'MUID', hideEmpty: true },
+    { key: 'duid', label: 'DUID', hideEmpty: true },
+] as const;

package/src/admin/incidents/index.ts

@@ -0,0 +1,16 @@
+import type { AdminRoute } from '../index';
+import { SECURITY_VIEW_PERMS } from '../security-permissions';
+import { EventsPage } from './EventsPage';
+import { IncidentsPage } from './IncidentsPage';
+
+export * from './models';
+export * from './sanitize';
+export * from './IncidentsPage';
+export * from './EventsPage';
+export * from './IncidentDetail';
+export * from './EventDetail';
+
+export const INCIDENTS_ADMIN_ROUTES: AdminRoute[] = [
+    { path: 'incidents', label: 'Incidents', component: IncidentsPage, permissions: SECURITY_VIEW_PERMS },
+    { path: 'events', label: 'Events', component: EventsPage, permissions: SECURITY_VIEW_PERMS },
+];

package/src/admin/incidents/models.ts

@@ -0,0 +1,113 @@
+import { useQuery } from '@tanstack/react-query';
+import { createElement } from 'react';
+import { defineModel, mojoCall, mojoList, type Params } from '../../client';
+import { modal } from '../../ui';
+import { SECURITY_DELETE_PERMS, SECURITY_MANAGE_PERMS, SECURITY_VIEW_PERMS } from '../security-permissions';
+import { sanitizeEventRow, sanitizeIncidentRow } from './sanitize';
+
+export type Relation = number | { id: number; title?: string | null; name?: string | null } | null;
+export interface IncidentRow {
+    id: number; created: number; priority: number; state: string; status: string;
+    scope: string; category: string; country_code: string | null; title: string | null;
+    details: string | null; model_name: string | null; model_id: number | null;
+    source_ip: string | null; hostname: string | null; metadata: Record<string, unknown>;
+    group_id: number | null; rule_set?: Relation; ip_info?: Record<string, unknown> | null;
+}
+export interface EventRow {
+    id: number; created: number; level: number; scope: string; category: string;
+    source_ip: string | null; hostname: string | null; uid: number | null;
+    country_code: string | null; title: string | null; details: string | null;
+    model_name: string | null; model_id: number | null; metadata: Record<string, unknown>;
+    group_id: number | null; incident?: Relation; geo_ip?: Record<string, unknown> | null;
+}
+
+const COMMON = new Set(['start', 'size', 'sort', 'search', 'dr_field', 'dr_start', 'dr_end']);
+const INCIDENT_FILTERS = new Set([
+    'id', 'id__in', 'status', 'status__in', 'state', 'scope', 'scope__icontains', 'category',
+    'category__icontains', 'category__not', 'category__startswith', 'priority', 'priority__gte',
+    'priority__lte', 'priority__gt', 'priority__lt', 'metadata__rule_id',
+    'metadata__do_not_delete', 'created__gte', 'created__lte', 'source_ip', 'model_name', 'model_id',
+]);
+const EVENT_FILTERS = new Set([
+    'id', 'incident', 'category', 'category__icontains', 'category__not', 'category__not_in',
+    'category__startswith', 'scope', 'scope__icontains', 'source_ip', 'source_ip__icontains',
+    'level', 'level__gte', 'level__lte', 'level__gt', 'level__lt', 'created__gte', 'created__lte',
+    'model_name', 'model_name__icontains', 'model_id', 'metadata__server',
+    'metadata__server__icontains', 'metadata__http_url__icontains', 'metadata__http_path__icontains',
+    'metadata__http_query_string__icontains', 'metadata__http_status', 'metadata__http_user_agent__icontains',
+    'metadata__rule_id', 'metadata__country_code', 'metadata__region', 'metadata__city__icontains',
+    'metadata__user_email',
+]);
+
+function normalize(params: Params, allowed: Set<string>, sort: string): Params {
+    const out: Params = { graph: 'default' };
+    for (const [key, value] of Object.entries(params)) {
+        if ((COMMON.has(key) || allowed.has(key)) && value != null && value !== '') out[key] = value;
+    }
+    out.sort = String(out.sort ?? sort);
+    return out;
+}
+export const normalizeIncidentListParams = (params: Params): Params => normalize(params, INCIDENT_FILTERS, '-id');
+export const normalizeEventListParams = (params: Params): Params => {
+    const out = normalize(params, EVENT_FILTERS, '-created');
+    // Day grouping requires chronological contiguity.
+    if (out.sort !== 'created' && out.sort !== '-created') out.sort = '-created';
+    return out;
+};
+
+export const IncidentModel = defineModel<IncidentRow>({
+    name: 'incident', endpoint: '/api/incident/incident',
+    permissions: { view: SECURITY_VIEW_PERMS, manage: SECURITY_MANAGE_PERMS, delete: SECURITY_DELETE_PERMS },
+    actions: { merge: { permissions: SECURITY_MANAGE_PERMS, response: 'payload' } },
+    normalizeListParams: normalizeIncidentListParams, sanitizeRow: sanitizeIncidentRow,
+});
+export const EventModel = defineModel<EventRow>({
+    name: 'event', endpoint: '/api/incident/event',
+    permissions: { view: SECURITY_VIEW_PERMS, manage: SECURITY_MANAGE_PERMS },
+    normalizeListParams: normalizeEventListParams, sanitizeRow: sanitizeEventRow,
+});
+
+export const INCIDENT_LIFECYCLE = ['pending', 'new', 'open', 'investigating', 'resolved', 'closed', 'ignored'] as const;
+
+export function incidentDetailKey(id: number) { return [IncidentModel.endpoint, 'one', id, { graph: 'detailed' }] as const; }
+export function eventDetailKey(id: number) { return [EventModel.endpoint, 'one', id, { graph: 'detailed' }] as const; }
+export function useIncidentDetail(id: number | null) {
+    return useQuery({
+        queryKey: id == null ? [IncidentModel.endpoint, 'one', null, { graph: 'detailed' }] : incidentDetailKey(id),
+        queryFn: async () => sanitizeIncidentRow((await mojoCall(`${IncidentModel.endpoint}/${id!}`, { params: { graph: 'detailed' } })).data as IncidentRow),
+        enabled: id != null,
+    });
+}
+export function useEventDetail(id: number | null) {
+    return useQuery({
+        queryKey: id == null ? [EventModel.endpoint, 'one', null, { graph: 'detailed' }] : eventDetailKey(id),
+        queryFn: async () => sanitizeEventRow((await mojoCall(`${EventModel.endpoint}/${id!}`, { params: { graph: 'detailed' } })).data as EventRow),
+        enabled: id != null,
+    });
+}
+export function useIncidentEvents(id: number | null) {
+    return useQuery({
+        queryKey: [EventModel.endpoint, { incident: id, graph: 'default', sort: '-created', size: 100 }],
+        queryFn: async () => {
+            const page = await mojoList<EventRow>(EventModel.endpoint, { incident: id!, graph: 'default', sort: '-created', size: 100 });
+            return { ...page, rows: page.rows.map(sanitizeEventRow) };
+        },
+        enabled: id != null,
+    });
+}
+
+export function buildIncidentMerge(rows: readonly IncidentRow[], targetId: number): { target: IncidentRow; sourceIds: number[] } {
+    if (rows.length < 2) throw new Error('Select at least two incidents to merge.');
+    const target = rows.find((row) => row.id === targetId);
+    if (!target) throw new Error('Choose a target from the selected incidents.');
+    const sourceIds = [...new Set(rows.map((row) => row.id).filter((id) => id !== targetId))];
+    if (!sourceIds.length) throw new Error('A merge needs at least one source incident.');
+    return { target, sourceIds };
+}
+
+export function showIncidentDetail(id: number): void {
+    void import('./IncidentDetail').then(({ IncidentDetail }) => modal.detail((close) => createElement(IncidentDetail, { id, onClose: () => close(null) })));
+}
+export function showEventDetail(id: number): void {
+    void import('./EventDetail').then(({ EventDetail }) => modal.detail((close) => createElement(EventDetail, { id, onClose: () => close(null) })));
+}

package/src/admin/incidents/sanitize.ts

@@ -0,0 +1,71 @@
+import { safeFileReference } from '../../client/record-feed';
+
+const REDACTED = '[redacted]';
+const MAX_SECURITY_TEXT = 32_000;
+const SENSITIVE_KEY = /^(?:authorization|proxy[-_]?authorization|cookie|set[-_]?cookie|password|passwd|passphrase|token|access[-_]?token|refresh[-_]?token|id[-_]?token|api[-_]?key|auth[-_]?key|client[-_]?secret|secret|credential|credentials|csrf|xsrf)(?:$|[-_])/i;
+const SENSITIVE_PARAM = /([?&;](?:password|passwd|token|access_token|refresh_token|id_token|api_key|auth_key|client_secret|secret|csrf|xsrf)=)[^&#;\s]*/gi;
+const HEADER_LINE = /^((?:authorization|proxy-authorization|cookie|set-cookie|x-api-key|x-auth-token|x-csrf-token)\s*:\s*).+$/gim;
+const AUTH_VALUE = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi;
+const JWT = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}\b/g;
+const FORM_SECRET = /(^|[&;\s])((?:password|passwd|token|access_token|refresh_token|api_key|client_secret|secret|csrf|xsrf)=)[^&;\s]*/gi;
+const LABELED_SECRET = /\b(token|password|passwd|api[ _-]?key|client[ _-]?secret|secret)(\s*(?:is|:|=)?\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
+
+function sensitiveName(key: string): boolean {
+    return SENSITIVE_KEY.test(key.trim().toLowerCase().replace(/\s+/g, '_'));
+}
+
+export function sanitizeSecurityText(value: string): string {
+    let text = value.replace(HEADER_LINE, `$1${REDACTED}`).replace(AUTH_VALUE, `$1 ${REDACTED}`).replace(JWT, REDACTED).replace(LABELED_SECRET, `$1$2${REDACTED}`);
+    text = text.replace(SENSITIVE_PARAM, `$1${REDACTED}`).replace(FORM_SECRET, `$1$2${REDACTED}`);
+    const trimmed = text.trim();
+    if ((trimmed.startsWith('{') && trimmed.endsWith('}')) || (trimmed.startsWith('[') && trimmed.endsWith(']'))) {
+        try { return JSON.stringify(sanitizeSecurityValue(JSON.parse(text))); } catch { /* conservative regex fallback above */ }
+    }
+    return text;
+}
+
+export function boundedSecurityText(value: unknown, limit = MAX_SECURITY_TEXT): string {
+    const raw = typeof value === 'string' ? value : value == null ? '' : (JSON.stringify(value, null, 2) ?? String(value));
+    const safe = sanitizeSecurityText(raw);
+    if (safe.length <= limit) return safe;
+    return `${safe.slice(0, limit)}\n… [truncated ${safe.length - limit} characters]`;
+}
+
+export function sanitizeSecurityValue<T>(value: T, seen = new WeakMap<object, unknown>()): T {
+    if (typeof value === 'string') return sanitizeSecurityText(value) as T;
+    if (value == null || typeof value !== 'object') return value;
+    if (seen.has(value as object)) return '[circular]' as T;
+    if (Array.isArray(value)) {
+        const out: unknown[] = [];
+        seen.set(value, out);
+        for (const item of value) out.push(sanitizeSecurityValue(item, seen));
+        return out as T;
+    }
+    const out: Record<string, unknown> = {};
+    seen.set(value as object, out);
+    for (const [key, item] of Object.entries(value as Record<string, unknown>)) {
+        out[key] = sensitiveName(key) ? REDACTED : sanitizeSecurityValue(item, seen);
+    }
+    return out as T;
+}
+
+function sanitizedRow<T extends Record<string, unknown>>(row: T): T {
+    // File relation objects are positively projected before recursive domain
+    // sanitization so browser/capability-bearing impostors never traverse it.
+    const rebuilt = 'media' in row ? { ...row, media: safeFileReference(row.media) } : row;
+    const safe = sanitizeSecurityValue(rebuilt) as Record<string, unknown>;
+    for (const key of ['details', 'stack_trace', 'traceback']) {
+        if (key in safe && safe[key] != null) safe[key] = boundedSecurityText(safe[key]);
+    }
+    if (safe.metadata && typeof safe.metadata === 'object') {
+        const metadata = safe.metadata as Record<string, unknown>;
+        for (const key of ['text', 'request_body', 'request_data', 'response_body', 'stack_trace', 'traceback']) {
+            if (key in metadata && metadata[key] != null) metadata[key] = boundedSecurityText(metadata[key]);
+        }
+    }
+    return safe as T;
+}
+
+export const sanitizeIncidentRow = <T,>(row: T): T => sanitizedRow(row as unknown as Record<string, unknown>) as T;
+export const sanitizeEventRow = <T,>(row: T): T => sanitizedRow(row as unknown as Record<string, unknown>) as T;
+export const sanitizeIncidentHistoryRow = <T,>(row: T): T => sanitizedRow(row as unknown as Record<string, unknown>) as T;