Settings admin panes + Reports definitions CRUD, plus frontend-next CI (#1608) - #1619
Merged
Conversation
frontend-next has had zero CI coverage since it was scaffolded -- the "Dashboard frontend" job only ever built the legacy dashboard/frontend. Add a parallel job: npm ci, generate-routes (+ diff-check the committed routeTree.gen.ts for drift), tsc --noEmit, then a full vite build. Deliberately does not wire in port-tests/ (needs live ES over an SSH tunnel to the homeserver -- not reachable from a GitHub-hosted runner, and not appropriate to point at production data from CI); that suite stays a manual/local verification step.
Settings (#1612): add the four admin panes the legacy dashboard's settings modal had but frontend-next never got a consumer for — Services (start/stop/restart honeypot sensors/probes/workers + log viewer), Reporter stats (metrics.json passthrough glance), Configuration history (revision list + rollback), and the settings Audit log (filterable by action). Every mutation (service actions, rollback) follows the exact same client-enforced-at-the-BFF admin-gating pattern as the existing savePresentation handler, since the Rust tier itself has no admin check. Reports (#1612): replace the raw <pre>{JSON.stringify(...)}</pre> dump of report definitions with a real CRUD UI against reports_api.rs's now- complete definitions endpoints — list/create/edit/delete plus on-demand Generate, all admin-gated the same way. The generated-reports table is untouched. The definition form covers name/template/theme, a practical subset of scope (window/ip/sensor/port/signature, or job/hash for the sandbox/payload/ghidra templates), the element checklist, branding, the event appendix limit, and a daily/weekly/monthly schedule toggle; sandbox/payload/ghidra definitions save fine but surface the backend's "not yet implemented" message inline on Generate rather than a raw error, since that renderer gap is documented and out of scope here. Every new class used (metric-grid/metric__*, data-table, table-scroll, badge--*, chip/is-active, btn-*, input, note, empty, skeleton-line, code) is one already used elsewhere in this codebase — no new CSS. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
tsc --noEmit currently fails codebase-wide (65 errors, 22 files) on a pre-existing TanStack Start serialization-check pattern unrelated to this change (Record<string, unknown> for raw ES documents isn't provably JSON-serializable to the type checker, even though it always is here) -- shipping it as a blocking gate would make every future PR red from the first push. vite build stays the real, blocking gate; typecheck output is still visible in the job log for anyone touching these files. Filed #1618 to fix the root cause and flip this back.
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
The standalone `tsr generate` CLI (npm run generate-routes) and the tanstackStart() vite plugin's own route generation (used by `build`/ `dev`) disagree on one thing: the plugin also emits a `Register` SSR type augmentation block the CLI strips out. Diffing right after generate-routes flagged the committed, plugin-shaped file as stale on every single run -- confirmed by the job's first real run on #1619. Move the diff check after `build`, whose output is what's actually committed and actually ships; drop the redundant CLI step entirely.
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the last concrete functional gap in #1608's frontend port: two pages had backend APIs with zero frontend consumers.
settings.tsxgains the four admin panes the legacy dashboard's settings modal had:action: "..."strings used across the crate.reports.tsx: the report-definitions block was a raw<pre>{JSON.stringify(...)}</pre>dump with a comment saying editing needed the worker port — that port (#1610) is done andreports_api.rshas full CRUD + generate. Replaced with real create/edit/delete/generate UI, admin-gated the same way, template/theme/scope/elements/branding/schedule fields validated against the actual backend constants (MAX_REPORT_NAME=60, theme ∈ {dark,light}).Every mutation follows the existing
savePresentationadmin-gating precedent (checked at the BFF, since the Rust tier's own trust boundary is the service token, not a role check). No new CSS — every class used was already present intheme.cssand already used elsewhere in this app.CI:
frontend-nexthas had zero CI coverage since it was scaffolded (the "Dashboard frontend" job only ever built the legacydashboard/frontend). Added a parallelfrontend-nextjob: npm ci → regenerate + diff-check the committed route tree →tsc --noEmit→vite build. The typecheck step iscontinue-on-error: truefor now — it surfaces a real, pre-existing, codebase-wide issue (65 errors, 22 files) unrelated to this PR: TanStack Start's compile-time serialization check rejectsRecord<string, unknown>(used everywhere for raw ES_sourcedocs) becauseunknowncan't be proven JSON-safe, even though it always is here.vite build(esbuild, doesn't type-check) is unaffected and stays the real blocking gate. Filed #1618 to track the real fix and flip typecheck back to blocking.Verification
npm run build: clean, no errors.port-tests/backend-api.shagainst live ES: 69/69 pass.port-tests/frontend-ssr.shagainst live ES: 38/38 pass, including/settingsand/reports.Test plan
🤖 Generated with Claude Code