Files
PiCloud/dashboard/src/routes/apps/[slug]/files/+page.svelte
MechaCat02 05ed9b00bb fix(stage-6): dashboard hardening + audit Lows cherry-pick
Closes 4 dashboard hardening findings and 5 of the Lows from the audit.

Dashboard hardening:
- Subtabs no longer re-fetch the app via api.apps.get on every page
  load. users/files/dead-letters drop the fetch outright (the variable
  was set but never read); queues + queues/[name] now consume the
  layout's AppContext via getContext for the page title. The layout's
  reloadApp() owns the historical-slug redirect — subtab-local redirect
  blocks are removed so there's no race.
- The global :global(details > summary::before) chevron is now scoped
  to details.chevron. The script editor's "Advanced sandbox" details
  and the inbound-email-shape help-text both opt in; the script
  exec-list logs no longer inherit a spurious chevron.
- deriveTab now matches the path segment by anchored ===, so a future
  /apps/<slug>/queues-archived route wouldn't activate the queues tab.

Lows cherry-pick:
- ExecError gains Serialize/Deserialize derives + a snake_case tag so
  RemoteExecutorClient (cluster mode v1.3+) can round-trip the variant.
- triggers_api rejects queue triggers whose visibility_timeout_secs is
  below the dispatcher's per-message executor budget; with no minimum
  the reclaim task races the handler and the queue silently
  double-delivers. Existing test using 5s updated to 30s.
- New migration 0040: execution_logs.script_id cascade switched from
  ON DELETE CASCADE to ON DELETE SET NULL so deleting a script no
  longer wipes the forensic history that motivated the delete.
- New migration 0041: dead_letters composite index on
  (app_id, created_at DESC) so the "list all" dashboard view stops
  falling back to seqscan + sort when unresolved=false.
- Schema snapshot re-blessed.

Deferred to v1.2: the ExecRequest principal serde(skip) marker
(documented in-place; the cluster-mode PR will introduce the wire-safe
snapshot at that point) and the `pic --help` mention of
`picloud admin reset-password` (one-line follow-up).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-06-10 21:50:58 +02:00

303 lines
7.0 KiB
Svelte

<script lang="ts">
import { base } from '$app/paths';
import { page } from '$app/state';
import { api, ApiError, type FileMeta } from '$lib/api';
import ConfirmModal from '$lib/ConfirmModal.svelte';
let slug = $derived(page.params.slug ?? '');
let collection = $state('');
let activeCollection = $state('');
let files = $state<FileMeta[]>([]);
let nextCursor = $state<string | null>(null);
let loading = $state(false);
let error = $state<string | null>(null);
let fileToRemove = $state<FileMeta | null>(null);
let removing = $state(false);
/// F-U-003: hints derived from registered `files` triggers. No
/// backend endpoint lists known collections; this is the next-best
/// approximation — operators see "we've heard about these patterns"
/// instead of having to guess.
let collectionHints = $state<string[]>([]);
async function loadCollectionHints() {
try {
const r = await api.triggers.list(slug);
const seen = new Set<string>();
for (const t of r.triggers) {
if (t.details.kind === 'files' && t.details.collection_glob) {
seen.add(t.details.collection_glob);
}
}
collectionHints = Array.from(seen).sort();
} catch {
collectionHints = [];
}
}
$effect(() => {
void slug;
void loadCollectionHints();
});
async function loadFiles(cursor?: string) {
const c = collection.trim();
if (!c) {
error = 'Enter a collection name to list its files.';
return;
}
loading = true;
error = null;
try {
const res = await api.files.list(slug, c, { cursor, limit: 100 });
if (cursor) {
files = [...files, ...res.files];
} else {
files = res.files;
activeCollection = c;
}
nextCursor = res.next_cursor;
} catch (e) {
error = e instanceof ApiError ? e.message : String(e);
} finally {
loading = false;
}
}
async function confirmRemove() {
if (!fileToRemove) return;
removing = true;
try {
await api.files.remove(slug, fileToRemove.collection, fileToRemove.id);
files = files.filter((f) => f.id !== fileToRemove!.id);
fileToRemove = null;
} catch (e) {
error = e instanceof ApiError ? e.message : String(e);
} finally {
removing = false;
}
}
function fmtTime(iso: string): string {
return new Date(iso).toLocaleString();
}
// F-U-009: best-effort clipboard copy; silently no-ops where the
// browser doesn't expose navigator.clipboard (e.g. plain-http LAN).
function copyToClipboard(text: string) {
void navigator.clipboard?.writeText(text);
}
function fmtSize(bytes: number): string {
if (bytes < 1024) return `${bytes} B`;
if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
}
</script>
<svelte:head>
<title>Files · {slug} · PiCloud</title>
</svelte:head>
<div class="panel">
<header class="panel-head">
<div>
<h2>Files</h2>
<p class="subtitle">
Browse and delete stored blobs by collection. Uploads happen from scripts via
<code>files::collection(c).create(…)</code>.
</p>
</div>
</header>
<form
class="collection-form"
onsubmit={(e) => {
e.preventDefault();
void loadFiles();
}}
>
<label>
<span>Collection</span>
<input
bind:value={collection}
placeholder="avatars"
list="files-collection-hints"
required
/>
</label>
<datalist id="files-collection-hints">
{#each collectionHints as h}
<option value={h}></option>
{/each}
</datalist>
<button type="submit" disabled={loading || !collection.trim()}>
{loading ? 'Loading…' : 'List files'}
</button>
</form>
{#if collectionHints.length > 0}
<p class="hint">
Known collection patterns from registered files triggers:
{#each collectionHints as h, i}
{#if i > 0}, {/if}
<button class="hint-chip" type="button" onclick={() => (collection = h)}>{h}</button>
{/each}
</p>
{:else}
<p class="hint">
No files triggers registered yet. Once you register a files trigger from the Triggers tab,
its collection glob will appear here as a suggestion.
</p>
{/if}
{#if error}
<div class="error">{error}</div>
{/if}
{#if activeCollection}
{#if files.length === 0 && !loading}
<p class="muted">No files in collection <code>{activeCollection}</code>.</p>
{:else}
<table>
<thead>
<tr>
<th>Name</th>
<th>Content type</th>
<th>Size</th>
<th>Created</th>
<th>ID</th>
<th></th>
</tr>
</thead>
<tbody>
{#each files as f (f.id)}
<tr>
<td>{f.name}</td>
<td><code>{f.content_type}</code></td>
<td>{fmtSize(f.size)}</td>
<td>{fmtTime(f.created_at)}</td>
<td class="mono small">
{f.id}
<button
type="button"
class="copy-btn"
title="Copy ID"
onclick={() => copyToClipboard(f.id)}
>
</button>
</td>
<td>
<a
class="secondary"
href={api.files.downloadUrl(slug, activeCollection, f.id)}
download={f.name}
>
Download
</a>
<button type="button" class="danger" onclick={() => (fileToRemove = f)}>
Delete
</button>
</td>
</tr>
{/each}
</tbody>
</table>
{#if nextCursor}
<button type="button" class="secondary" onclick={() => loadFiles(nextCursor ?? undefined)}>
Load more
</button>
{/if}
{/if}
{/if}
</div>
{#if fileToRemove}
<ConfirmModal
title="Delete file"
variant="danger"
confirmLabel="Delete file"
onConfirm={confirmRemove}
onCancel={() => (fileToRemove = null)}
>
<p>
Delete <strong>{fileToRemove.name}</strong> ({fmtSize(fileToRemove.size)}) from collection
<code>{fileToRemove.collection}</code>? This removes both the metadata row and the bytes on
disk and cannot be undone.
</p>
{#if removing}<p class="muted">Deleting…</p>{/if}
</ConfirmModal>
{/if}
<style>
.panel-head {
margin-bottom: 1rem;
}
.panel-head h2 {
margin: 0.25rem 0;
font-size: 1.125rem;
}
.subtitle {
color: var(--text-muted);
font-size: 0.9rem;
}
.collection-form {
display: flex;
align-items: flex-end;
gap: 0.75rem;
margin-bottom: 1rem;
}
.collection-form label {
display: flex;
flex-direction: column;
gap: 0.25rem;
font-size: 0.85rem;
}
table {
width: 100%;
border-collapse: collapse;
font-size: 0.9rem;
}
th,
td {
text-align: left;
padding: 0.4rem 0.6rem;
border-bottom: 1px solid var(--border);
}
.mono {
font-family: monospace;
}
.small {
font-size: 0.78rem;
}
.muted {
color: var(--text-muted);
}
.hint {
color: var(--text-muted);
font-size: 0.85rem;
margin: 0.5rem 0 1rem;
}
.hint-chip {
background: var(--bg-elevated);
color: var(--text-primary);
border: 1px solid var(--border);
border-radius: 0.25rem;
padding: 0.1rem 0.4rem;
font-size: 0.8rem;
cursor: pointer;
font-family: monospace;
}
.hint-chip:hover {
border-color: var(--color-link);
}
.error {
color: var(--color-danger);
margin: 0.5rem 0;
}
button.danger {
background: var(--color-danger-bg);
color: var(--color-danger-fg);
border: 1px solid var(--color-danger-border);
}
</style>