Skip to content

[dashboards] Open Brain Dashboard Pro — Next.js 16 + iron-session#209

Merged
justfinethanku merged 23 commits into
NateBJones-Projects:mainfrom
alanshurafa:contrib/alanshurafa/open-brain-dashboard
May 22, 2026
Merged

[dashboards] Open Brain Dashboard Pro — Next.js 16 + iron-session#209
justfinethanku merged 23 commits into
NateBJones-Projects:mainfrom
alanshurafa:contrib/alanshurafa/open-brain-dashboard

Conversation

@alanshurafa
Copy link
Copy Markdown
Collaborator

What this adds

`dashboards/open-brain-dashboard-pro/` — Next.js 16 + Tailwind + iron-session web UI for Open Brain. Features:

  • Dashboard stats + recent activity + quick capture
  • Browse (paginated with filters)
  • Detail view with inline edit + linked reflections
  • Semantic + full-text search
  • Audit (low-quality thoughts, bulk delete with server-side re-verification)
  • Duplicates resolver (batch selection survives pagination via `Map`-based state)
  • Ingest (smart-ingest dashboard)

Auth + security

  • iron-session encrypted cookies (`SESSION_SECRET` 32+ chars; app refuses to start if missing)
  • `proxy.ts` at project root (Next.js 16 convention — `middleware.ts` is deprecated)
  • Server-side `exclude_restricted` enforcement from `session.restrictedUnlocked` (not client-trusted)
  • Bulk-delete routes capped at 50 IDs, re-verified server-side
  • `ApiError` message sanitized — full upstream body stays in `upstreamBody` logged server-only
  • Ingest preflight distinguishes 4xx (403 denied) from 5xx (503 retryable)

Deployment note

`proxy.ts` is Next.js 16's new convention. Known issue (vercel/next.js#86122): proxy.ts doesn't execute behind Cloudflare Proxy in some setups. If deploying behind Cloudflare, revert to `middleware.ts` (still works with deprecation warning).

Prerequisites

Review history

5 fix rounds + 3 Codex verify rounds + 1 Claude review round. `npm run lint` + `tsc --noEmit` + `npm run build` pass. Final Codex review clean.

See `dashboards/open-brain-dashboard-pro/README.md`.

Adds a third dashboard flavor: Next.js App Router, Tailwind, iron-session auth, with Browse/Detail/Search/Audit/Ingest views. Fully env-configurable — no hardcoded project URLs. Degrades gracefully for optional REST endpoints (reflections, ingestion-jobs).
…6-v5v3

npm audit flagged GHSA-q4gf-8mx6-v5v3 as high-severity DoS affecting
next<16.2.3; fix available in 16.2.4. eslint-config-next pinned to
match. Lockfile regeneration required by deployer (npm install /
npm ci) — not run here per contrib brief.
…errors

Move setLoading(true) calls OUT of useEffect bodies. Event handlers
(page change, threshold change, reload triggers) now stage the
loading flag synchronously; effects only transition to false on
fetch completion. Uses AbortController to cancel in-flight requests
on unmount. Also addresses WR-03 (duplicates batch partial-failure
feedback) and IN-06 (fetchIngestionJobs shape tolerance).
…sev items

- IN-01/P3: remove unused @tailwindcss/typography, react-markdown,
  remark-gfm from package.json; update README tech stack.
- IN-02: delete components/QuickCapture.tsx (replaced by AddToBrain).
- IN-05: annotate metadata.json services field with a TODO for the
  folder slug post-merge.
- IN-06: make fetchIngestionJobs tolerate both { jobs: [...] } and
  bare-array shapes.
- IN-07: use != undefined for numeric filters in lib/api.ts so
  importance_min=0, threshold=0, and days=0 are preserved.
@github-actions github-actions Bot added the dashboard Contribution: frontend template label Apr 19, 2026
@alanshurafa alanshurafa added area: dashboard Review area: dashboard/frontend risk: auth-security Touches auth, secrets, permissions, or security-sensitive behavior review: ready-for-maintainer Community reviewer recommends maintainer review alan-reviewed Reviewed by Alan Shurafa in Community Reviewer role labels May 20, 2026
@alanshurafa
Copy link
Copy Markdown
Collaborator Author

Mergeable, no conflicts against main. No blockers from my side; ready whenever it reaches the queue.

@justfinethanku
Copy link
Copy Markdown
Collaborator

Thank God, we need more dashboards. Genuinely. Tidied this before merge by moving the exact Next.js pin from 16.2.4 to 16.2.6, adding the dashboard lockfile for reproducible installs, and updating the REST API dependency metadata now that integrations/open-brain-rest exists on main.

@justfinethanku justfinethanku merged commit 0b91c39 into NateBJones-Projects:main May 22, 2026
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

alan-reviewed Reviewed by Alan Shurafa in Community Reviewer role area: dashboard Review area: dashboard/frontend dashboard Contribution: frontend template review: ready-for-maintainer Community reviewer recommends maintainer review risk: auth-security Touches auth, secrets, permissions, or security-sensitive behavior

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants