feat: harden dashboard for production use #80

Merged

jesse merged 5 commits from phase-8/dashboard-ui-pr7-hardening into main 2026-05-16 16:53:29 +02:00

Conversation 0 Commits 5 Files changed 37 +2448 -305

jesse commented 2026-05-14 04:18:12 +02:00

Owner

Copy link

Summary

• Adds dashboard UI rate limiting and server-health cache coalescing without changing MCP auth behavior.
• Tightens dashboard browser RPC, CORS header handling, and CSP-safe asset behavior.
• Adds PR7 CI/docs/E2E accessibility coverage and release screenshots.

Verification

• Pre-commit hook passed: secret detection, cargo fmt --check, cargo clippy.

## Summary - Adds dashboard UI rate limiting and server-health cache coalescing without changing MCP auth behavior. - Tightens dashboard browser RPC, CORS header handling, and CSP-safe asset behavior. - Adds PR7 CI/docs/E2E accessibility coverage and release screenshots. ## Verification - Pre-commit hook passed: secret detection, cargo fmt --check, cargo clippy.

jesse added 2 commits 2026-05-14 04:18:12 +02:00

feat: harden dashboard for production use 4181475474

test: fix dashboard UI router rate-limit tests 003f23a1c8

jesse added 1 commit 2026-05-14 04:43:37 +02:00

test: install ConnectInfo on /ui requests for privacy + status smoke ... 3fe8d556cb

Group A's rate-limit fail-closed change now requires ConnectInfo<SocketAddr>
on every /ui request; without it the UI router returns HTTP 500. These two
pre-existing test files were not covered by the prior commits and broke as
collateral. Adds a loopback peer (127.0.0.1:49152) so the same-origin path
is exercised.

jesse referenced this pull request from a commit 2026-05-14 15:36:46 +02:00

fix: resolve three CI failures on PR #80

jesse added 1 commit 2026-05-14 15:36:46 +02:00

fix: resolve three CI failures on PR #80 ... 24ee23c0e8

- app.js: showGraphView/showThoughtsView/showStatsView/showImproveView all
  called detailEl.querySelector('#graph') but #graph is a sibling of
  #session-detail, not a child — always returned null, so the graph panel
  never became visible. Add module-level graphSectionEl reference and use
  it everywhere (matching the existing pattern for statsSectionEl/improveSectionEl).

- e2e/dashboard.spec.ts: polling test asserted state.healthCalls === 1
  synchronously right after the first Playwright poll resolved. With 50 ms
  polling the second call can fire before the assertion, causing a non-
  deterministic failure in CI. Relax to toBeGreaterThanOrEqual(1).

- sse.rs: extract format_sse_event / format_sse_event_with_id to
  transport/sse/format.rs, reducing sse.rs from 813 to 775 lines and
  clearing the 800-line hard ceiling enforced by file-length-gate.sh.

jesse added 1 commit 2026-05-14 16:44:10 +02:00

fix: add explicit role=dialog to auth-dialog element ... 7ec8883a2b

Native <dialog> carries implicit ARIA role but Playwright toHaveAttribute
checks the DOM attribute directly, not the computed ARIA role. The PR7
accessibility smoke test at dashboard.spec.ts:250 therefore failed with
Received: "".

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

jesse merged commit 2768544051 into main 2026-05-16 16:53:29 +02:00

jesse deleted branch phase-8/dashboard-ui-pr7-hardening 2026-05-16 16:53:29 +02:00

jesse referenced this pull request from a commit 2026-05-16 16:53:31 +02:00

feat: harden dashboard for production use (#80)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

jesse/cognix!80

No description provided.