Files

MechaCat02 cd20ffb580 test(dashboard): add e2e cross-cutting security spec (B8)

Five tests covering platform-wide guarantees: expired-token
redirect, HttpOnly session cookie, bootstrap password not leaked
into the DOM after login, missing-app slug fails gracefully, and
an XSS-sink probe across the main authed routes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-28 07:43:51 +02:00

src

fix(dashboard): redirect after a member removes themselves

2026-05-27 22:00:13 +02:00

static

feat(dashboard): scaffold SvelteKit SPA for control plane

2026-05-22 23:28:03 +02:00

tests/e2e

test(dashboard): add e2e cross-cutting security spec (B8)

2026-05-28 07:43:51 +02:00

.prettierignore

test(dashboard): add Playwright e2e scaffolding with smoke spec

2026-05-28 07:03:44 +02:00

.prettierrc

feat(dashboard): scaffold SvelteKit SPA for control plane

2026-05-22 23:28:03 +02:00

eslint.config.js

feat(dashboard): scaffold SvelteKit SPA for control plane

2026-05-22 23:28:03 +02:00

package-lock.json

test(dashboard): add Playwright e2e scaffolding with smoke spec

2026-05-28 07:03:44 +02:00

package.json

test(dashboard): add Playwright e2e scaffolding with smoke spec

2026-05-28 07:03:44 +02:00

playwright.config.ts

test(dashboard): add Playwright e2e scaffolding with smoke spec

2026-05-28 07:03:44 +02:00

README.md

feat(dashboard): scaffold SvelteKit SPA for control plane

2026-05-22 23:28:03 +02:00

svelte.config.js

feat: custom routing — bind scripts to your own URLs

2026-05-23 18:18:16 +02:00

tsconfig.json

feat(dashboard): scaffold SvelteKit SPA for control plane

2026-05-22 23:28:03 +02:00

vite.config.ts

feat(dashboard): scaffold SvelteKit SPA for control plane

2026-05-22 23:28:03 +02:00

vitest.config.ts

feat(dashboard): hand-rolled Rhai parser + symbol table + Vitest

2026-05-23 23:38:15 +02:00

README.md

PiCloud Dashboard

SvelteKit SPA for the PiCloud control plane.

Stack

SvelteKit 2 with adapter-static (SPA fallback)
Svelte 5 (runes)
TypeScript
Vite

Scripts

npm install
npm run dev      # vite dev server on :5173, proxies /api → PICLOUD_API
npm run build    # static SPA bundle into ./build/
npm run check    # svelte-check
npm run lint
npm run format

By default npm run dev proxies /api/* and /healthz to http://127.0.0.1:18080. Override with PICLOUD_API=http://host:port npm run dev.

How it fits in

In production Caddy serves the contents of ./build/ as static files and falls back to index.html for client-side routing. The dashboard only talks to the control plane (/api/admin/* on the manager); data-plane invocations go through /api/execute/* on the orchestrator and are not issued from the dashboard directly during MVP.