monitor-app 2.4.0__tar.gz → 2.5.0__tar.gz

{monitor_app-2.4.0 → monitor_app-2.5.0}/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## [2.5.0] - 2026-11-08
+
+> 「準備なしで試せて、ブラウザから設定の編集と CSV の取り込みができる」ことを目標にした機能リリース。架空の物流センターの在庫画面を開く `monitor-app demo`、同じ内容でプロジェクトを作る `startproject --template warehouse`、`config.py` を書き換えずにビュー・KPI・アラートなどを編集する設定ページ(`/settings`)、ブラウザからの CSV のアップロード(`/upload`)、管理の機能だけに使う鍵 `MONITOR_ADMIN_KEY` を含む。既存のプロジェクト・`config.py`・DB・REST API・CLI はそのまま動く。挙動が変わる点は「Changed」、更新するときの注意は「Upgrade notes」を参照。
+
+### Added
+- **設定ページ(`/settings`)** — 表示(アプリの名前・見出し・更新の間隔と方式)・ビュー(タイトル・SQL・列の見出し・セルの色分け・グラフと管理限界線)・KPI・アラート・大型表示・ダッシュボードを、`config.py` を書き換えずに画面で編集する。ビュー・KPI・アラートの追加と削除もできる。テーブルの定義・`sources`・favicon は対象外(`config.py` で変える)
+  - 保存するとサーバーを止めずに反映する(ビューのキャッシュを捨て、アラートのルールを差し替え、初めてアラートを定義したら評価を始める)。開いている画面は、応答の `X-Monitor-Config` ヘッダ(SSE では `reload` イベント)で設定が変わったことを知って読み直す(大型表示も追従する。作業者の入力フォームは読み直さない)
+  - 保存するのは `config.py` との差分だけ(JSON Merge Patch)で、DB の内部テーブル `_settings` に置く(再起動しても残り、SQLite のバックアップにも入る)。画面で変えていない項目は `config.py` の値を使う。「config.py の設定に戻す」で差分を消す。`config.py` を変えて差分を重ねられなくなったときは `config.py` の設定だけで起動し、設定ページで知らせる
+  - 保存の前に `monitor-app check` と同じ点検(SQL の空実行・アラートとグラフの列・通知先)を行い、エラーがあれば保存しない(`422`)。画面が読み込んだ後にほかの人が保存していたら上書きしない(`409`)。`MONITOR_AUDIT_ENABLED=true` なら変更を監査ログに残す
+  - API: `GET/PUT/DELETE /api/settings`・`POST /api/settings/check`
+- **CSV のアップロード(`/upload`・`POST /api/upload/{table}`)** — ブラウザから CSV を選んでテーブルに取り込む。`monitor-app import-csv` と同じ処理(文字コードの自動判別・見出しの表記ゆれ・1 トランザクション・列が丸ごと無い CSV での置き換えの拒否と `force`)。追記と置き換えを選べる。送ったファイルはサーバーに残さず、監査ログ(`action=import`)に残す
+- **`MONITOR_ADMIN_KEY`** — 管理の機能(設定の編集・CSV のアップロード)だけに使う鍵。設定すると管理の機能はこの鍵でだけ使え、`MONITOR_API_KEY` を渡した作業者・閲覧者は設定を変えられない。この鍵でログインすると閲覧・書き込みもできる。未設定なら管理の機能は `MONITOR_API_KEY` で使え、どちらの鍵も無ければこの PC からだけ使える(LAN やリバースプロキシの先に公開しているときは使えない)。`monitor-app check` と起動時のログは、説明用の値・短すぎる管理者の鍵と、`.env` の綴りの誤り(エラー)も知らせる
+- ログインの画面は、ログインの後に元の画面へ戻る(`/login?next=/settings`。アプリ内のパスだけ)
+- **`monitor-app demo`** — 準備なしで、架空の物流センターの在庫画面を開く(`--host`・`--port`・`--open`)。在庫は入出庫の台帳を SQL で合計して求め、4 秒ごとに入荷・出荷・移動を足すので、KPI・グラフ・アラートがひとりでに動く。データは起動した日時を基準に作り(7 日分)、一時的な SQLite に入れて終了時に消す。作業フォルダの `.env` は読まず、メール・Webhook・バックアップ・フォルダ監視は使わない
+- **`startproject --template warehouse`** — デモと同じ `config.py`・マスタ・7 日分の架空のデータでプロジェクトを作る(入出庫の自動発生はなし)
+- **`FormDef(title=...)`** — 作業者の入力フォームの名前。フォームの見出し・ブラウザのタブの題名・トップページのリンクに出る。未指定なら今までどおり「<テーブル名> の入力」(タブの題名だけは「<テーブル名> 入力」から見出しにそろえた)。デモと雛形のフォームにも名前を付けた(`入出庫の入力`・`注文の入力`)
+
+### Changed
+- Docker イメージを何もマウントせずに起動すると、サンプルのプロジェクトの代わりに倉庫在庫のデモ(`monitor-app demo`)を起動する。`--host`・`--port` はデモに渡す。空のフォルダをマウントしたときはこれまでどおりサンプルのプロジェクトを書き込む
+
+### Security
+- 管理の機能は、Cookie で認証した要求と鍵なしの要求について、ほかのサイトのページから送られたもの(`Sec-Fetch-Site: cross-site`・`Origin` の不一致)を断る(CSRF)
+- 画面から保存するビュー・KPI の SQL は、`;` を含むものを断る(文字列・コメントの中も。末尾の `;` は除く)。PostgreSQL / MySQL の読み取り専用の制限は 1 つのトランザクションにしか効かず、psycopg・mysqlclient では 1 回で複数の文を送れるため。引用・コメントの読み方は DB ごとに違うので、引用の外かどうかでは判定しない。KPI の表示形式は値の書式だけを許す(`{0.__class__}` のような属性・添字の読み取りを断る)。新しいビュー・KPI の名前に URL や SQL を壊す文字を使えない。`config.py` に書いたものは対象外
+- CSV のアップロードで送られたファイル名は、どの OS でも Windows の規則でフォルダとドライブを取り除いて一時フォルダに置く(Windows で `D:config.py` のような名前が一時フォルダの外を指し、プロジェクトのファイルを書き換えないように)。`:` を含む名前・`CON` などの装置の名前はテーブル名の `.csv` にする
+- KPI の評価で 1 つが失敗して取り消した後、PostgreSQL / MySQL では読み取り専用の制限が外れたまま残りの KPI を実行していたのを、かけ直すようにした
+
+### Fixed
+- KPI の表示形式が値を整形できない形(`{}{}` など)のとき、`/api/kpis` が 500 になっていたのを、値をそのまま表示するようにした
+- グラフの凡例に列名(`shipped` など)が出ていたのを、ビューの列の見出し(`labels`)を使うようにした(見出しの無い列は列名のまま)
+- 一時フォルダのパス(`TMPDIR` など)に `?` が含まれるとき、`monitor-app demo`・`serve` が DB を一時フォルダの外に作って終了後も残していたのを、案内を表示して止めるようにした
+
+### Upgrade notes
+- **何もマウントしない Docker**: サンプルのプロジェクトの代わりに倉庫在庫のデモが開く(データは一時的な DB に入り、終了すると消える)。サンプルのプロジェクトを使うには、空のフォルダを `/project` にマウントする。空のフォルダには、これまでどおりサンプルのプロジェクトを書き込む(例: 空のフォルダで `docker run -p 9990:9990 -v "$PWD":/project ghcr.io/mikawa-bushi/monitor-app`)
+- **設定ページと CSV のアップロード**: `MONITOR_ADMIN_KEY` も `MONITOR_API_KEY` も無ければ、この PC からだけ使える。LAN・Docker・リバースプロキシの先に公開しているサーバーで使うには、`.env` にどちらかの鍵を書く。`MONITOR_API_KEY` だけを設定していると、その鍵を渡した作業者も設定を変え、CSV で表を置き換えられる。作業者に変えさせないなら、別の `MONITOR_ADMIN_KEY` を設定する
+- **`title` の無い `FormDef`**: ブラウザのタブの題名が「<テーブル名> 入力」から「<テーブル名> の入力」に変わった(見出しとトップページのリンクは変わらない)。タブの題名で画面を見分けている場合は、新しい題名に合わせる
+
 ## [2.4.0] - 2026-10-27
 
 > 「誰でも手元ですぐ動かせて、速く、簡単に公開できる」ことを目標にした機能リリース。設定ファイルなしでダッシュボードを開く `monitor-app serve`、SQLite の WAL 化とストリーミング取り込み・共有キャッシュによる高速化、Docker イメージと `monitor-app deploy`(API キーの生成つき)、バックアップ・保持期間・`check` の強化、公開時のセキュリティの強化を含む。既存のプロジェクト・`config.py`(v1 の dict 形式も)・DB・REST API・CLI はそのまま動く。挙動が変わる点は「Changed」、更新の手順は「Upgrade notes」を参照。

{monitor_app-2.4.0 → monitor_app-2.5.0}/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Your Name
+Copyright (c) 2025 hardwork9047
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 ...

{monitor_app-2.4.0 → monitor_app-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: monitor-app
-Version: 2.4.0
+Version: 2.5.0
 Summary: Drop in a CSV, write one config file, and get a live-updating Web UI + REST API. FastAPI-based data monitoring for shop floors and small teams.
 Project-URL: Homepage, https://github.com/mikawa-bushi/monitor-app
 Project-URL: Repository, https://github.com/mikawa-bushi/monitor-app
@@ -68,38 +68,72 @@ works on offline factory networks.
 
 ---
 
-## ✨ What's new in 2.4
-
-- **No configuration needed to start.** `monitor-app serve ./my-csv-folder` (or
-  `uvx monitor-app serve ...` without installing) infers column types, keys, charts and
-  KPI cards from your CSV files. Keep the result with `startproject --from-csv`.
-- **Much faster.** SQLite runs in WAL mode, CSV files are imported as a stream (1 million
-  rows: about 1.3× faster, 4.7 s instead of 6.0 s on the test PC, with a constant
-  memory use of about 60 MB instead of 580 MB), folder watching in append mode reads
-  only the new rows (10 rows appended to a 1-million-row file: about 1 ms, was 3 s), and
-  30 simultaneous requests for the same 10,000-row view take about 40 ms instead of
-  about 40 s because the query runs once and is shared. Unchanged data is answered with
-  `304`, and responses are gzip-compressed.
-- **Excel-friendly import.** Shift_JIS/cp932 CSV files from Excel are detected
-  automatically, Excel dates such as `2026/10/21 8:00` are understood, header spelling
-  variants are matched, and exports can carry a BOM for Excel (`?bom=1`).
-- **Safe by default.** `runserver --import-csv-if-empty` keeps rows entered in the UI
-  across restarts, an import that would wipe a column is refused, and `monitor-app check`
-  finds typos in `config.py` and `.env`, broken SQL and alert columns that never match.
-  `monitor-app deploy` writes a random API key into `.env`, and a server that listens on
-  this PC only refuses requests for foreign host names (DNS rebinding).
-- **Docker in one line.** `docker run -p 9990:9990 ghcr.io/mikawa-bushi/monitor-app`
-  (linux/amd64 and linux/arm64). Mount your project folder as is: the container runs as
-  the folder's owner.
-- **`monitor-app deploy`** writes the start-up files for Docker Compose, Linux/Raspberry
-  Pi (systemd) and Windows (Task Scheduler), plus an API key.
-- **Backups and retention.** `monitor-app backup` / `restore` (also for a damaged
-  database), scheduled backups, `Retention(keep_days=...)` and `monitor-app migrate`
-  for columns you add later.
-- **Reverse proxies.** Serve under a sub-path such as `/monitor/` (`MONITOR_ROOT_PATH`),
-  monitor `/api/health` (checks the database), JSON logs.
+## 👀 See it first: a warehouse inventory demo
+
+Open the inventory screen of a fictional distribution center, with nothing to prepare:
+
+```sh
+uvx monitor-app demo --open                                      # if installed: monitor-app demo --open
+docker run --rm -p 9990:9990 ghcr.io/mikawa-bushi/monitor-app    # with Docker (mount nothing)
+```
+
+Open http://127.0.0.1:9990 (with Docker, http://localhost:9990). What to look at:
+
+- **Stock list**: location, lot, best-before date, days left, cases and pieces. Stock is
+  the SQL sum of a ledger of stock movements.
+- **It moves on its own**: every 4 seconds a receipt, shipment or move happens, and the
+  movement history, KPI cards and charts update by themselves.
+- **Alerts**: right after start, banners show an item below safety stock and lots within
+  2 days of their best-before date. About 90 seconds later a delivery arrives and the
+  safety-stock banner clears.
+- **Other screens**: `/kiosk` (wallboard) and `/form/movements` (entry form). When the
+  demo runs on your own PC, `/settings` (edit settings in the browser) works too.
+
+The data lives in a temporary database that is deleted on exit. At start the demo
+prints where its `config.py` is. Docker shows times in UTC; add `-e TZ=Asia/Tokyo` (or
+your zone) for local time.
+
+To start your own project with the same configuration and fictional data:
+
+```sh
+monitor-app startproject my-warehouse --template warehouse
+cd my-warehouse
+monitor-app runserver --import-csv-if-empty
+```
+
+In a project, movements do not happen on their own. The project's `README.md` explains
+how to replace the data with your own.
+
+## ✨ What's new in 2.5
+
+- **A demo with nothing to prepare.** `monitor-app demo` opens the inventory screen of a
+  fictional distribution center. Every 4 seconds a receipt, shipment or move happens, so
+  the KPI cards, charts and alerts change on their own. The data lives in a temporary
+  SQLite database that is deleted on exit. Docker started with nothing mounted now runs
+  this demo instead of the sample project. Mount an empty folder to get the sample
+  project as before.
+- **Start a project from the demo.** `monitor-app startproject NAME --template warehouse`
+  writes the demo's `config.py`, master data and 7 days of fictional data.
+- **Settings page.** `/settings` edits the display options, views (SQL, column labels,
+  cell styles, charts), KPI cards, alerts, the wallboard and the dashboard without
+  editing `config.py`. A save runs the same checks as `monitor-app check`, then applies
+  at once without a restart. Only the difference from `config.py` is stored, in the
+  database.
+- **CSV upload.** `/upload` imports a CSV file into a table from the browser, with the
+  same code as `monitor-app import-csv`. Choose append or replace.
+- **`MONITOR_ADMIN_KEY`.** A key for the settings page and CSV upload only. When it is
+  set, operators who log in with `MONITOR_API_KEY` cannot change the settings. Without
+  it, `MONITOR_API_KEY` works, and with neither key the admin features work only from
+  this PC.
+- **Named entry forms.** `FormDef(title="...")` sets the form's heading, its browser tab
+  title and its link on the home page.
+- **Security.** The admin features refuse requests sent from pages on other sites
+  (CSRF). SQL saved from the browser must be one statement with no `;`, and a KPI number
+  format can only format the value. The name of an uploaded file loses its folder and
+  drive parts on every OS, so it cannot point outside the temporary folder.
 
 Full list: [CHANGELOG.md](https://github.com/mikawa-bushi/monitor-app/blob/main/CHANGELOG.md).
+Coming from 2.4? Nothing needs changing beyond the **Upgrade notes** in the CHANGELOG.
 Coming from 2.3? Read **Upgrading from 2.3.x** below.
 
 ## Features
@@ -114,6 +148,7 @@ Coming from 2.3? Read **Upgrading from 2.3.x** below.
 | Trend / SPC charts | Line and bar charts with UCL / LCL / target lines | `ViewDef(chart=ChartDef(...))` |
 | Threshold alerts | Banner, browser notification, webhook (Slack, Teams), e-mail; notified once per change, retried on failure | `alerts=[AlertRule(...)]` |
 | Operator entry forms | Touch-friendly forms generated from the table definition | `TableDef(form=FormDef(...))`, `/form/{table}` |
+| Settings and CSV upload in the browser | Edit display options, views (SQL), cell styles, charts, KPIs, alerts and the wallboard in the browser; applied without a restart, and open pages reload themselves. Upload CSV files into tables | `/settings`, `/upload` |
 | Data input | CSV import (UTF-8 or Excel cp932), folder watching (replace or append), bulk `POST` for PLC/MES/sensors, read-only `sources` (SQLite/JSONL/JSON) | `import-csv`, `MONITOR_INGEST_WATCH`, `/api/ingest/{table}` |
 | REST API | CRUD per table, view data, CSV/Excel export, OpenAPI docs | `/api/...`, `/docs`, `/redoc` |
 | Python API | Build the app from your own code, load and validate `config.py` | `create_app`, `load_config` (see **Python API**) |
@@ -311,8 +346,9 @@ Note that `--keep` adds back rows you deleted in the UI if the CSV file still co
 
 | Command | What it does | Main options |
 |---|---|---|
+| `monitor-app demo` | Warehouse inventory demo, nothing to prepare (fictional data, deleted on exit) | `--host`, `--port`, `--open` |
 | `monitor-app serve [PATH...]` | Dashboard straight from CSV files, no `config.py` | `--host`, `--port`, `--db FILE`, `--append`, `--no-watch`, `--write-config FILE`, `--open` |
-| `monitor-app startproject NAME` | Create a project folder | `--from-csv DIR`, `--deploy docker,systemd,windows` (or `all`) |
+| `monitor-app startproject NAME` | Create a project folder | `--template warehouse` (the demo's configuration and data), `--from-csv DIR`, `--deploy docker,systemd,windows` (or `all`) |
 | `monitor-app runserver` | Start the web server | `--import-csv-if-empty`, `--import-csv`, `--force`, `--host`, `--port`, `--reload`, `--config` |
 | `monitor-app check` | Check `config.py`, SQL, settings and the database tables without starting | `--data` (also the CSV files), `--strict` (warnings fail, for CI), `--fix-schema`, `--config` |
 | `monitor-app import-csv` | Import `csv/` into the database (replace) | `--keep`, `--if-empty`, `--force`, `--config` |
@@ -355,7 +391,8 @@ config = MonitorConfig(
             primary_key="id",
             indexes=[["ts"]],                                # speeds up ORDER BY / WHERE ts
             retention=Retention(keep_days=90, column="ts"),  # delete rows older than 90 days
-            form=FormDef(labels={"temp": "Temperature (°C)"},
+            form=FormDef(title="Enter readings",
+                         labels={"temp": "Temperature (°C)"},
                          choices={"line": ["L1", "L2"]}),     # entry form at /form/readings
         ),
     },
@@ -441,6 +478,58 @@ MySQL `MONITOR_DATABASE_URL`, values those databases would reject.
 The legacy v1 dict-style `config.py` (`ALLOWED_TABLES` ...) still loads; see
 **Migrating from v0.x** below.
 
+## 🖱 Change settings and upload CSV files in the browser
+
+The **⚙️ Settings** page (`/settings`) changes the following without editing
+`config.py`. Saving applies the change at once, without restarting the server,
+and open pages (the wallboard too) reload themselves.
+
+| Tab | What you can change |
+|---|---|
+| General | App name, header and footer text, refresh interval and mode |
+| Views | Title, description, group, row limit, SQL, column labels, cell styles, chart (control and target lines); add and delete views |
+| KPIs | Title, SQL, unit, target, number format, linked view; add and delete KPIs |
+| Alerts | View, column, condition, value, level, message, channels; add and delete alerts |
+| Wallboard and dashboard | Wallboard rotation, theme and views; how many charts per row on the home page and which ones |
+
+- Tables, `sources` and the favicon stay in `config.py` (changing them would
+  rebuild tables or read files on the server).
+- Only the difference from `config.py` is stored, in the database (internal
+  table `_settings`), so it survives restarts and is part of SQLite backups.
+  Fields changed in the browser win over the same fields in `config.py`; the
+  rest still come from `config.py` (a list such as the alerts is replaced as a
+  whole). **Return to config.py** deletes the stored difference.
+- Before saving, the same checks as `monitor-app check` run (dry-run of the
+  SQL, alert and chart columns, channels); errors block the save. **Check**
+  runs them without saving. SQL entered in the browser must be a single
+  `SELECT` with no `;` (not even inside quotes or comments; a trailing one is
+  fine) and runs read-only. Put SQL that needs `;` in `config.py`.
+- If someone else saved in the meantime, the save is refused and the page asks
+  you to reload. With `MONITOR_AUDIT_ENABLED=true` changes go to the audit log
+  (`/api/audit?table=_settings`).
+- If the stored difference no longer fits `config.py` (for example a view was
+  removed there), the server starts with `config.py` alone and the settings page
+  says so.
+
+**📤 Upload CSV** (`/upload`) imports a CSV file into a table with the same code
+as `monitor-app import-csv`: encoding detection (UTF-8, Excel's Shift_JIS),
+header variants, one transaction (nothing changes on failure) and refusing to
+replace a table from a CSV that lacks its columns. Choose **append** (rows whose
+key exists are skipped) or **replace** (all rows become the CSV's rows). The
+uploaded file is not kept on the server.
+
+**Who can use them.** Settings and CSV upload are *admin features*:
+
+| Configuration | Who can use the admin features |
+|---|---|
+| `MONITOR_ADMIN_KEY` set | Whoever logs in with the admin key (or sends it as `X-API-Key`). Holders of `MONITOR_API_KEY` cannot |
+| Only `MONITOR_API_KEY` | Whoever logs in with the API key (same as writes) |
+| Neither | Only this PC (`MONITOR_HOST=127.0.0.1` and no reverse-proxy settings). Disabled when the server is exposed on the LAN or behind a proxy |
+
+Requests sent from pages on other sites (CSRF) are refused. If operators log in
+with the API key to use the entry forms, set a separate `MONITOR_ADMIN_KEY` so
+they cannot change the settings.
+
 ## ⚙️ Settings (`MONITOR_*` / `.env`)
 
 Settings that differ per PC (database URL, port, passwords) do not belong in `config.py`.
@@ -466,6 +555,7 @@ setting) or set them as environment variables, which win over `.env`.
 | **Security** | | |
 | `MONITOR_API_KEY` | (unset) | Turns on authentication: writes (API, forms, ingest) need the key — `X-API-Key` header, or a login in the browser (the session lasts 12 hours). Use 16 or more random characters; `monitor-app deploy` writes one into `.env`. An empty value counts as unset. |
 | `MONITOR_PROTECT_READS` | `false` | Require the key for reading too (pages, read APIs and the API documentation). |
+| `MONITOR_ADMIN_KEY` | (unset) | Key for the admin features only (settings page, CSV upload). When set, they accept this key and nothing else; logging in with it also allows reading and writing. Unset: `MONITOR_API_KEY` works. See **Change settings and upload CSV files in the browser** above. |
 | `MONITOR_ALLOWED_HOSTS` | (unset) | Host names the server answers to (comma list; `*.example.com` matches subdomains, `*` turns the check off). Unset: a server that listens on `127.0.0.1` refuses host names other than `localhost`, its own names and IP addresses (DNS-rebinding protection); LAN, Docker and the reverse-proxy setups below are not checked. A list is enforced on every interface. |
 | `MONITOR_CORS_ORIGINS` | `[]` | Other web origins allowed to call the API, as JSON: `["http://localhost:3000"]`. Empty = same origin only. |
 | **CSV import** | | |
@@ -607,7 +697,7 @@ delays the shutdown until the container is killed.
 ### Docker
 
 ```sh
-docker run --rm -p 9990:9990 ghcr.io/mikawa-bushi/monitor-app       # demo, no files needed
+docker run --rm -p 9990:9990 ghcr.io/mikawa-bushi/monitor-app       # warehouse demo, no files needed
 ```
 
 Run your own project (the folder with `config.py`):
@@ -621,7 +711,8 @@ docker run -d --name monitor-app -p 9990:9990 -v "$PWD":/project \
 (Windows PowerShell: `-v "${PWD}:/project"`.) The container switches to the owner of the
 mounted folder and drops all Linux capabilities, so the database and backups belong to
 you on the host whatever your user id is. It starts `runserver --import-csv-if-empty`, so
-rows entered in the UI survive updates. An empty folder gets the sample project.
+rows entered in the UI survive updates. An empty folder gets the sample project. With
+nothing mounted, the warehouse demo above runs on a temporary database.
 For a hardened container add `--cap-drop ALL --cap-add SETUID --cap-add SETGID
 --cap-add CHOWN --security-opt no-new-privileges` (the generated `compose.yaml` sets
 these). `docker run --rm ghcr.io/mikawa-bushi/monitor-app --version` prints the version.
@@ -641,13 +732,13 @@ docker compose pull && docker compose up -d     # update to the newest image
   deleting rows needs the key (log in on the page, or send `X-API-Key`).
 - `.env` is read by the app inside the container as usual. The generated `compose.yaml`
   also takes `MONITOR_PORT` (port on the host), `TZ` (for example `TZ=Asia/Tokyo`),
-  `MONITOR_IMAGE` (image name) and `MONITOR_IMAGE_TAG` (for example `2.4.0` to stay on a
+  `MONITOR_IMAGE` (image name) and `MONITOR_IMAGE_TAG` (for example `2.5.0` to stay on a
   version) from `.env`.
 - Other commands run the same way as the folder's owner:
   `docker compose run --rm monitor-app check`, `... backup`, `... import-csv`. Do not use
   `docker compose exec monitor-app monitor-app backup`: that runs as root and the backup
   file can then only be read by root.
-- Image tags: `latest`, `2`, `2.4`, `2.4.0`; platforms `linux/amd64` and `linux/arm64`
+- Image tags: `latest`, `2`, `2.5`, `2.5.0`; platforms `linux/amd64` and `linux/arm64`
   (64-bit Raspberry Pi OS). The image has a health check (`/api/health`) and stops within
   about a second.
 - On Docker Desktop (Windows, macOS) keep `instances/` in a named volume, for speed and
@@ -788,7 +879,7 @@ curl http://127.0.0.1:9990/api/health
 ```
 
 ```json
-{"status":"ok","version":"2.4.0","database":"ok","tasks":{"alert scheduler":{"running":true,"last_tick":"2026-10-21T17:30:44+09:00","last_error":null}}}
+{"status":"ok","version":"2.5.0","database":"ok","tasks":{"alert scheduler":{"running":true,"last_tick":"2026-10-21T17:30:44+09:00","last_error":null}}}
 ```
 
 It answers `200` when the database responds to `SELECT 1` and `503` (with
@@ -804,7 +895,9 @@ It answers `200` when the database responds to `SELECT 1` and `503` (with
 | `/table/{view}` | Live table / chart page |
 | `/kiosk` | Andon wallboard (full screen, rotating) |
 | `/form/{table}` | Operator entry form |
-| `/login` | Login page (used when `MONITOR_API_KEY` is set) |
+| `/settings` | Settings page (admin feature) |
+| `/upload` | CSV upload (admin feature) |
+| `/login` | Login page (used when `MONITOR_API_KEY` or `MONITOR_ADMIN_KEY` is set) |
 | `/docs`, `/redoc` | OpenAPI documentation (these two pages load pinned Swagger UI / ReDoc versions from a CDN; login needed with `MONITOR_PROTECT_READS`; off with `MONITOR_API_DOCS=false`) |
 | `GET/POST /api/tables/{table}` | List rows (`?limit=`, `?offset=`; pages are ordered by primary key) / add a row |
 | `GET/PUT/DELETE /api/tables/{table}/{id}` | One row |
@@ -815,6 +908,9 @@ It answers `200` when the database responds to `SELECT 1` and `503` (with
 | `GET /api/views/{view}/export` | `?format=csv` or `xlsx`; `?bom=1` adds a UTF-8 BOM so Excel shows Japanese text correctly. Text that starts with `=` `+` `-` `@` is exported so that spreadsheets do not run it as a formula; `?raw=1` exports the values exactly as stored |
 | `GET /api/kpis`, `/api/alerts`, `/api/schema` | KPI values, active alerts, table definitions |
 | `GET /api/audit` | Change history (`?table=`, `?limit=`) when `MONITOR_AUDIT_ENABLED=true` |
+| `GET/PUT/DELETE /api/settings` | Settings editable in the browser / check and save (`{"settings": {...}, "revision": "..."}`; errors → `422`, saved by someone else first → `409`) / return to `config.py`. Admin feature |
+| `POST /api/settings/check` | Check without saving (same rules as `monitor-app check`). Admin feature |
+| `POST /api/upload/{table}` | CSV upload (multipart `file`, `mode=append` or `replace`, `force`). Admin feature |
 | `GET/HEAD /api/health` | Health check (see above) |
 
 With `MONITOR_API_KEY` set, send the key in the `X-API-Key` header:

{monitor_app-2.4.0 → monitor_app-2.5.0}/README.md

@@ -21,38 +21,72 @@ works on offline factory networks.
 
 ---
 
-## ✨ What's new in 2.4
-
-- **No configuration needed to start.** `monitor-app serve ./my-csv-folder` (or
-  `uvx monitor-app serve ...` without installing) infers column types, keys, charts and
-  KPI cards from your CSV files. Keep the result with `startproject --from-csv`.
-- **Much faster.** SQLite runs in WAL mode, CSV files are imported as a stream (1 million
-  rows: about 1.3× faster, 4.7 s instead of 6.0 s on the test PC, with a constant
-  memory use of about 60 MB instead of 580 MB), folder watching in append mode reads
-  only the new rows (10 rows appended to a 1-million-row file: about 1 ms, was 3 s), and
-  30 simultaneous requests for the same 10,000-row view take about 40 ms instead of
-  about 40 s because the query runs once and is shared. Unchanged data is answered with
-  `304`, and responses are gzip-compressed.
-- **Excel-friendly import.** Shift_JIS/cp932 CSV files from Excel are detected
-  automatically, Excel dates such as `2026/10/21 8:00` are understood, header spelling
-  variants are matched, and exports can carry a BOM for Excel (`?bom=1`).
-- **Safe by default.** `runserver --import-csv-if-empty` keeps rows entered in the UI
-  across restarts, an import that would wipe a column is refused, and `monitor-app check`
-  finds typos in `config.py` and `.env`, broken SQL and alert columns that never match.
-  `monitor-app deploy` writes a random API key into `.env`, and a server that listens on
-  this PC only refuses requests for foreign host names (DNS rebinding).
-- **Docker in one line.** `docker run -p 9990:9990 ghcr.io/mikawa-bushi/monitor-app`
-  (linux/amd64 and linux/arm64). Mount your project folder as is: the container runs as
-  the folder's owner.
-- **`monitor-app deploy`** writes the start-up files for Docker Compose, Linux/Raspberry
-  Pi (systemd) and Windows (Task Scheduler), plus an API key.
-- **Backups and retention.** `monitor-app backup` / `restore` (also for a damaged
-  database), scheduled backups, `Retention(keep_days=...)` and `monitor-app migrate`
-  for columns you add later.
-- **Reverse proxies.** Serve under a sub-path such as `/monitor/` (`MONITOR_ROOT_PATH`),
-  monitor `/api/health` (checks the database), JSON logs.
+## 👀 See it first: a warehouse inventory demo
+
+Open the inventory screen of a fictional distribution center, with nothing to prepare:
+
+```sh
+uvx monitor-app demo --open                                      # if installed: monitor-app demo --open
+docker run --rm -p 9990:9990 ghcr.io/mikawa-bushi/monitor-app    # with Docker (mount nothing)
+```
+
+Open http://127.0.0.1:9990 (with Docker, http://localhost:9990). What to look at:
+
+- **Stock list**: location, lot, best-before date, days left, cases and pieces. Stock is
+  the SQL sum of a ledger of stock movements.
+- **It moves on its own**: every 4 seconds a receipt, shipment or move happens, and the
+  movement history, KPI cards and charts update by themselves.
+- **Alerts**: right after start, banners show an item below safety stock and lots within
+  2 days of their best-before date. About 90 seconds later a delivery arrives and the
+  safety-stock banner clears.
+- **Other screens**: `/kiosk` (wallboard) and `/form/movements` (entry form). When the
+  demo runs on your own PC, `/settings` (edit settings in the browser) works too.
+
+The data lives in a temporary database that is deleted on exit. At start the demo
+prints where its `config.py` is. Docker shows times in UTC; add `-e TZ=Asia/Tokyo` (or
+your zone) for local time.
+
+To start your own project with the same configuration and fictional data:
+
+```sh
+monitor-app startproject my-warehouse --template warehouse
+cd my-warehouse
+monitor-app runserver --import-csv-if-empty
+```
+
+In a project, movements do not happen on their own. The project's `README.md` explains
+how to replace the data with your own.
+
+## ✨ What's new in 2.5
+
+- **A demo with nothing to prepare.** `monitor-app demo` opens the inventory screen of a
+  fictional distribution center. Every 4 seconds a receipt, shipment or move happens, so
+  the KPI cards, charts and alerts change on their own. The data lives in a temporary
+  SQLite database that is deleted on exit. Docker started with nothing mounted now runs
+  this demo instead of the sample project. Mount an empty folder to get the sample
+  project as before.
+- **Start a project from the demo.** `monitor-app startproject NAME --template warehouse`
+  writes the demo's `config.py`, master data and 7 days of fictional data.
+- **Settings page.** `/settings` edits the display options, views (SQL, column labels,
+  cell styles, charts), KPI cards, alerts, the wallboard and the dashboard without
+  editing `config.py`. A save runs the same checks as `monitor-app check`, then applies
+  at once without a restart. Only the difference from `config.py` is stored, in the
+  database.
+- **CSV upload.** `/upload` imports a CSV file into a table from the browser, with the
+  same code as `monitor-app import-csv`. Choose append or replace.
+- **`MONITOR_ADMIN_KEY`.** A key for the settings page and CSV upload only. When it is
+  set, operators who log in with `MONITOR_API_KEY` cannot change the settings. Without
+  it, `MONITOR_API_KEY` works, and with neither key the admin features work only from
+  this PC.
+- **Named entry forms.** `FormDef(title="...")` sets the form's heading, its browser tab
+  title and its link on the home page.
+- **Security.** The admin features refuse requests sent from pages on other sites
+  (CSRF). SQL saved from the browser must be one statement with no `;`, and a KPI number
+  format can only format the value. The name of an uploaded file loses its folder and
+  drive parts on every OS, so it cannot point outside the temporary folder.
 
 Full list: [CHANGELOG.md](https://github.com/mikawa-bushi/monitor-app/blob/main/CHANGELOG.md).
+Coming from 2.4? Nothing needs changing beyond the **Upgrade notes** in the CHANGELOG.
 Coming from 2.3? Read **Upgrading from 2.3.x** below.
 
 ## Features
@@ -67,6 +101,7 @@ Coming from 2.3? Read **Upgrading from 2.3.x** below.
 | Trend / SPC charts | Line and bar charts with UCL / LCL / target lines | `ViewDef(chart=ChartDef(...))` |
 | Threshold alerts | Banner, browser notification, webhook (Slack, Teams), e-mail; notified once per change, retried on failure | `alerts=[AlertRule(...)]` |
 | Operator entry forms | Touch-friendly forms generated from the table definition | `TableDef(form=FormDef(...))`, `/form/{table}` |
+| Settings and CSV upload in the browser | Edit display options, views (SQL), cell styles, charts, KPIs, alerts and the wallboard in the browser; applied without a restart, and open pages reload themselves. Upload CSV files into tables | `/settings`, `/upload` |
 | Data input | CSV import (UTF-8 or Excel cp932), folder watching (replace or append), bulk `POST` for PLC/MES/sensors, read-only `sources` (SQLite/JSONL/JSON) | `import-csv`, `MONITOR_INGEST_WATCH`, `/api/ingest/{table}` |
 | REST API | CRUD per table, view data, CSV/Excel export, OpenAPI docs | `/api/...`, `/docs`, `/redoc` |
 | Python API | Build the app from your own code, load and validate `config.py` | `create_app`, `load_config` (see **Python API**) |
@@ -264,8 +299,9 @@ Note that `--keep` adds back rows you deleted in the UI if the CSV file still co
 
 | Command | What it does | Main options |
 |---|---|---|
+| `monitor-app demo` | Warehouse inventory demo, nothing to prepare (fictional data, deleted on exit) | `--host`, `--port`, `--open` |
 | `monitor-app serve [PATH...]` | Dashboard straight from CSV files, no `config.py` | `--host`, `--port`, `--db FILE`, `--append`, `--no-watch`, `--write-config FILE`, `--open` |
-| `monitor-app startproject NAME` | Create a project folder | `--from-csv DIR`, `--deploy docker,systemd,windows` (or `all`) |
+| `monitor-app startproject NAME` | Create a project folder | `--template warehouse` (the demo's configuration and data), `--from-csv DIR`, `--deploy docker,systemd,windows` (or `all`) |
 | `monitor-app runserver` | Start the web server | `--import-csv-if-empty`, `--import-csv`, `--force`, `--host`, `--port`, `--reload`, `--config` |
 | `monitor-app check` | Check `config.py`, SQL, settings and the database tables without starting | `--data` (also the CSV files), `--strict` (warnings fail, for CI), `--fix-schema`, `--config` |
 | `monitor-app import-csv` | Import `csv/` into the database (replace) | `--keep`, `--if-empty`, `--force`, `--config` |
@@ -308,7 +344,8 @@ config = MonitorConfig(
             primary_key="id",
             indexes=[["ts"]],                                # speeds up ORDER BY / WHERE ts
             retention=Retention(keep_days=90, column="ts"),  # delete rows older than 90 days
-            form=FormDef(labels={"temp": "Temperature (°C)"},
+            form=FormDef(title="Enter readings",
+                         labels={"temp": "Temperature (°C)"},
                          choices={"line": ["L1", "L2"]}),     # entry form at /form/readings
         ),
     },
@@ -394,6 +431,58 @@ MySQL `MONITOR_DATABASE_URL`, values those databases would reject.
 The legacy v1 dict-style `config.py` (`ALLOWED_TABLES` ...) still loads; see
 **Migrating from v0.x** below.
 
+## 🖱 Change settings and upload CSV files in the browser
+
+The **⚙️ Settings** page (`/settings`) changes the following without editing
+`config.py`. Saving applies the change at once, without restarting the server,
+and open pages (the wallboard too) reload themselves.
+
+| Tab | What you can change |
+|---|---|
+| General | App name, header and footer text, refresh interval and mode |
+| Views | Title, description, group, row limit, SQL, column labels, cell styles, chart (control and target lines); add and delete views |
+| KPIs | Title, SQL, unit, target, number format, linked view; add and delete KPIs |
+| Alerts | View, column, condition, value, level, message, channels; add and delete alerts |
+| Wallboard and dashboard | Wallboard rotation, theme and views; how many charts per row on the home page and which ones |
+
+- Tables, `sources` and the favicon stay in `config.py` (changing them would
+  rebuild tables or read files on the server).
+- Only the difference from `config.py` is stored, in the database (internal
+  table `_settings`), so it survives restarts and is part of SQLite backups.
+  Fields changed in the browser win over the same fields in `config.py`; the
+  rest still come from `config.py` (a list such as the alerts is replaced as a
+  whole). **Return to config.py** deletes the stored difference.
+- Before saving, the same checks as `monitor-app check` run (dry-run of the
+  SQL, alert and chart columns, channels); errors block the save. **Check**
+  runs them without saving. SQL entered in the browser must be a single
+  `SELECT` with no `;` (not even inside quotes or comments; a trailing one is
+  fine) and runs read-only. Put SQL that needs `;` in `config.py`.
+- If someone else saved in the meantime, the save is refused and the page asks
+  you to reload. With `MONITOR_AUDIT_ENABLED=true` changes go to the audit log
+  (`/api/audit?table=_settings`).
+- If the stored difference no longer fits `config.py` (for example a view was
+  removed there), the server starts with `config.py` alone and the settings page
+  says so.
+
+**📤 Upload CSV** (`/upload`) imports a CSV file into a table with the same code
+as `monitor-app import-csv`: encoding detection (UTF-8, Excel's Shift_JIS),
+header variants, one transaction (nothing changes on failure) and refusing to
+replace a table from a CSV that lacks its columns. Choose **append** (rows whose
+key exists are skipped) or **replace** (all rows become the CSV's rows). The
+uploaded file is not kept on the server.
+
+**Who can use them.** Settings and CSV upload are *admin features*:
+
+| Configuration | Who can use the admin features |
+|---|---|
+| `MONITOR_ADMIN_KEY` set | Whoever logs in with the admin key (or sends it as `X-API-Key`). Holders of `MONITOR_API_KEY` cannot |
+| Only `MONITOR_API_KEY` | Whoever logs in with the API key (same as writes) |
+| Neither | Only this PC (`MONITOR_HOST=127.0.0.1` and no reverse-proxy settings). Disabled when the server is exposed on the LAN or behind a proxy |
+
+Requests sent from pages on other sites (CSRF) are refused. If operators log in
+with the API key to use the entry forms, set a separate `MONITOR_ADMIN_KEY` so
+they cannot change the settings.
+
 ## ⚙️ Settings (`MONITOR_*` / `.env`)
 
 Settings that differ per PC (database URL, port, passwords) do not belong in `config.py`.
@@ -419,6 +508,7 @@ setting) or set them as environment variables, which win over `.env`.
 | **Security** | | |
 | `MONITOR_API_KEY` | (unset) | Turns on authentication: writes (API, forms, ingest) need the key — `X-API-Key` header, or a login in the browser (the session lasts 12 hours). Use 16 or more random characters; `monitor-app deploy` writes one into `.env`. An empty value counts as unset. |
 | `MONITOR_PROTECT_READS` | `false` | Require the key for reading too (pages, read APIs and the API documentation). |
+| `MONITOR_ADMIN_KEY` | (unset) | Key for the admin features only (settings page, CSV upload). When set, they accept this key and nothing else; logging in with it also allows reading and writing. Unset: `MONITOR_API_KEY` works. See **Change settings and upload CSV files in the browser** above. |
 | `MONITOR_ALLOWED_HOSTS` | (unset) | Host names the server answers to (comma list; `*.example.com` matches subdomains, `*` turns the check off). Unset: a server that listens on `127.0.0.1` refuses host names other than `localhost`, its own names and IP addresses (DNS-rebinding protection); LAN, Docker and the reverse-proxy setups below are not checked. A list is enforced on every interface. |
 | `MONITOR_CORS_ORIGINS` | `[]` | Other web origins allowed to call the API, as JSON: `["http://localhost:3000"]`. Empty = same origin only. |
 | **CSV import** | | |
@@ -560,7 +650,7 @@ delays the shutdown until the container is killed.
 ### Docker
 
 ```sh
-docker run --rm -p 9990:9990 ghcr.io/mikawa-bushi/monitor-app       # demo, no files needed
+docker run --rm -p 9990:9990 ghcr.io/mikawa-bushi/monitor-app       # warehouse demo, no files needed
 ```
 
 Run your own project (the folder with `config.py`):
@@ -574,7 +664,8 @@ docker run -d --name monitor-app -p 9990:9990 -v "$PWD":/project \
 (Windows PowerShell: `-v "${PWD}:/project"`.) The container switches to the owner of the
 mounted folder and drops all Linux capabilities, so the database and backups belong to
 you on the host whatever your user id is. It starts `runserver --import-csv-if-empty`, so
-rows entered in the UI survive updates. An empty folder gets the sample project.
+rows entered in the UI survive updates. An empty folder gets the sample project. With
+nothing mounted, the warehouse demo above runs on a temporary database.
 For a hardened container add `--cap-drop ALL --cap-add SETUID --cap-add SETGID
 --cap-add CHOWN --security-opt no-new-privileges` (the generated `compose.yaml` sets
 these). `docker run --rm ghcr.io/mikawa-bushi/monitor-app --version` prints the version.
@@ -594,13 +685,13 @@ docker compose pull && docker compose up -d     # update to the newest image
   deleting rows needs the key (log in on the page, or send `X-API-Key`).
 - `.env` is read by the app inside the container as usual. The generated `compose.yaml`
   also takes `MONITOR_PORT` (port on the host), `TZ` (for example `TZ=Asia/Tokyo`),
-  `MONITOR_IMAGE` (image name) and `MONITOR_IMAGE_TAG` (for example `2.4.0` to stay on a
+  `MONITOR_IMAGE` (image name) and `MONITOR_IMAGE_TAG` (for example `2.5.0` to stay on a
   version) from `.env`.
 - Other commands run the same way as the folder's owner:
   `docker compose run --rm monitor-app check`, `... backup`, `... import-csv`. Do not use
   `docker compose exec monitor-app monitor-app backup`: that runs as root and the backup
   file can then only be read by root.
-- Image tags: `latest`, `2`, `2.4`, `2.4.0`; platforms `linux/amd64` and `linux/arm64`
+- Image tags: `latest`, `2`, `2.5`, `2.5.0`; platforms `linux/amd64` and `linux/arm64`
   (64-bit Raspberry Pi OS). The image has a health check (`/api/health`) and stops within
   about a second.
 - On Docker Desktop (Windows, macOS) keep `instances/` in a named volume, for speed and
@@ -741,7 +832,7 @@ curl http://127.0.0.1:9990/api/health
 ```
 
 ```json
-{"status":"ok","version":"2.4.0","database":"ok","tasks":{"alert scheduler":{"running":true,"last_tick":"2026-10-21T17:30:44+09:00","last_error":null}}}
+{"status":"ok","version":"2.5.0","database":"ok","tasks":{"alert scheduler":{"running":true,"last_tick":"2026-10-21T17:30:44+09:00","last_error":null}}}
 ```
 
 It answers `200` when the database responds to `SELECT 1` and `503` (with
@@ -757,7 +848,9 @@ It answers `200` when the database responds to `SELECT 1` and `503` (with
 | `/table/{view}` | Live table / chart page |
 | `/kiosk` | Andon wallboard (full screen, rotating) |
 | `/form/{table}` | Operator entry form |
-| `/login` | Login page (used when `MONITOR_API_KEY` is set) |
+| `/settings` | Settings page (admin feature) |
+| `/upload` | CSV upload (admin feature) |
+| `/login` | Login page (used when `MONITOR_API_KEY` or `MONITOR_ADMIN_KEY` is set) |
 | `/docs`, `/redoc` | OpenAPI documentation (these two pages load pinned Swagger UI / ReDoc versions from a CDN; login needed with `MONITOR_PROTECT_READS`; off with `MONITOR_API_DOCS=false`) |
 | `GET/POST /api/tables/{table}` | List rows (`?limit=`, `?offset=`; pages are ordered by primary key) / add a row |
 | `GET/PUT/DELETE /api/tables/{table}/{id}` | One row |
@@ -768,6 +861,9 @@ It answers `200` when the database responds to `SELECT 1` and `503` (with
 | `GET /api/views/{view}/export` | `?format=csv` or `xlsx`; `?bom=1` adds a UTF-8 BOM so Excel shows Japanese text correctly. Text that starts with `=` `+` `-` `@` is exported so that spreadsheets do not run it as a formula; `?raw=1` exports the values exactly as stored |
 | `GET /api/kpis`, `/api/alerts`, `/api/schema` | KPI values, active alerts, table definitions |
 | `GET /api/audit` | Change history (`?table=`, `?limit=`) when `MONITOR_AUDIT_ENABLED=true` |
+| `GET/PUT/DELETE /api/settings` | Settings editable in the browser / check and save (`{"settings": {...}, "revision": "..."}`; errors → `422`, saved by someone else first → `409`) / return to `config.py`. Admin feature |
+| `POST /api/settings/check` | Check without saving (same rules as `monitor-app check`). Admin feature |
+| `POST /api/upload/{table}` | CSV upload (multipart `file`, `mode=append` or `replace`, `force`). Admin feature |
 | `GET/HEAD /api/health` | Health check (see above) |
 
 With `MONITOR_API_KEY` set, send the key in the `X-API-Key` header: