f466b2a15e
Closes 4 audit findings: - Route TS interface now carries dispatch_mode (sync|async). Backend's shared::route::Route has had this since 0012_routes_dispatch_mode but the TS client silently always created sync routes and the list display dropped the field. Add a Dispatch select to the new-route form and an "ASYNC" badge in the route list. - api.files.downloadUrl pointed to a never-registered backend endpoint. The dashboard's live Download button was hitting 405. Add the GET handler (AppFilesRead + FilesRepo::head + FilesRepo::get, Content- Disposition: inline) at the same path that delete already used. - F-T-003: adminRequest's 401 handler called goto(login) without a recursion cap. If the login endpoint itself returned 401, the wrapper looped until browser nav limits. Track consecutive 401s within a 10s window and hard-reload to /login?reason=auth-loop after the third, showing the user an explanatory banner. Any 2xx resets the counter. - Login flow now honors a ?returnTo= query parameter. adminRequest and the root layout both append the current location when redirecting to /login; the login page validates the value is a same-origin admin path (no open-redirect) and goto's there after successful sign-in. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
PiCloud Dashboard
SvelteKit SPA for the PiCloud control plane.
Stack
- SvelteKit 2 with
adapter-static(SPA fallback) - Svelte 5 (runes)
- TypeScript
- Vite
Scripts
npm install
npm run dev # vite dev server on :5173, proxies /api → PICLOUD_API
npm run build # static SPA bundle into ./build/
npm run check # svelte-check
npm run lint
npm run format
By default npm run dev proxies /api/* and /healthz to
http://127.0.0.1:18080. Override with PICLOUD_API=http://host:port npm run dev.
How it fits in
In production Caddy serves the contents of ./build/ as static files and
falls back to index.html for client-side routing. The dashboard only
talks to the control plane (/api/admin/* on the manager); data-plane
invocations go through /api/execute/* on the orchestrator and are not
issued from the dashboard directly during MVP.