feat(dashboard): Embedded Isometric System Dashboard by Tuntii · Pull Request #176 · Tuntii/RustAPI

Tuntii · 2026-05-12T20:24:47Z

Summary

Adds a self-contained, feature-gated admin dashboard at /__rustapi/dashboard behind the core-dashboard feature flag (disabled by default, zero cost when off).

New Files

File	Purpose
`dashboard/metrics.rs`	`DashboardMetrics` — atomic UltraFast/Fast/Full counters + per-route `dashmap`
`dashboard/config.rs`	`DashboardConfig` builder (`.admin_token()`, `.path()`, `.title()`)
`dashboard/auth.rs`	`DashboardAuth::check()` — Bearer token guard
`dashboard/routes.rs`	`dispatch()` — 4 endpoints (HTML + 3 JSON)
`dashboard/dashboard.html`	~500-line dark glassmorphism SPA
`tests/dashboard_tests.rs`	16 integration tests

Endpoints

Method	Path	Auth	Returns
`GET`	`/__rustapi/dashboard`	None	HTML SPA
`GET`	`/__rustapi/dashboard/api/snapshot`	Bearer	Full JSON snapshot
`GET`	`/__rustapi/dashboard/api/routes`	Bearer	Route inventory
`GET`	`/__rustapi/dashboard/api/metrics`	Bearer	Live counters

UI Highlights

Isometric canvas — 3D-style blocks for UltraFast / Fast / Full execution paths (vanilla JS, no library)
Stat cards — total requests, error rate, avg latency, uptime
RPS sparkline — Chart.js 4.4 (CDN)
Route table — per-route hit bars + avg latency
Auto-refresh every 3 seconds; Bearer token via URL ?token= or header input

Execution-Path Tracking

server.rs now classifies each request into the same three paths used internally and records it on the DashboardMetrics atomics. Instrumentation is wrapped in #[cfg(feature = "dashboard")] — zero impact when disabled, including on the UltraFast path.

Usage

[dependencies]
rustapi-rs = { version = "*", features = ["core-dashboard"] }

RustApi::new()
    .route("/api/users", get(list_users))
    .dashboard(
        DashboardConfig::new()
            .admin_token("my-secret-token")
            .title("My API Dashboard"),
    )
    .run("127.0.0.1:8080")
    .await?;

Then open http://localhost:8080/__rustapi/dashboard?token=my-secret-token in your browser.

Checklist

cargo check --workspace — PASS
cargo clippy -p rustapi-core --features dashboard -- -D warnings — PASS
cargo fmt --all -- --check — PASS
cargo test -p rustapi-core --features dashboard --test dashboard_tests — 16/16 PASS
Public API snapshot updated (api/public/rustapi-rs.all-features.txt)
Feature disabled by default (no breaking change)

Adds a self-contained, feature-gated admin dashboard surface under `/__rustapi/dashboard` behind the `core-dashboard` feature flag. What's new: - `rustapi-core/dashboard` module with DashboardMetrics, DashboardConfig, DashboardAuth, routes::dispatch(), and dashboard.html SPA - DashboardMetrics: zero-overhead atomic counters for three execution paths (UltraFast / Fast / Full), per-route hit counts via dashmap - DashboardConfig builder: .admin_token(), .path(), .title() - Four endpoints: HTML SPA (no auth), /api/snapshot, /api/routes, /api/metrics (Bearer token auth) - Dark glassmorphism SPA with isometric execution-path canvas, stat cards, RPS sparkline (Chart.js 4.4 CDN), auto-refresh 3s - server.rs: execution-path instrumentation (cfg-gated, zero cost off) - app.rs: .dashboard(DashboardConfig) builder + apply_dashboard() - rustapi-rs facade: core-dashboard feature, re-exports, prelude, full bundle - Public API snapshot updated - 16 integration tests (config, metrics, auth, dispatch endpoints) Usage: rustapi-rs = { version = "*", features = ["core-dashboard"] } RustApi::new() .route("/api/users", get(list_users)) .dashboard(DashboardConfig::new().admin_token("secret")) .run("127.0.0.1:8080") .await

Copilot

Pull request overview

Adds a new feature-gated embedded admin dashboard to RustAPI, exposing an HTML SPA plus JSON endpoints and instrumenting the server hot-path to collect execution-path and per-route metrics.

Changes:

Introduces rustapi-core dashboard module (config/auth/metrics/routes + embedded HTML) and wires it into RustApi and request handling under a feature flag.
Exposes dashboard types through rustapi-rs (core-dashboard feature) and updates the all-features public API snapshot.
Adds dashmap as an optional dependency and includes integration tests for the dashboard module.

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
crates/rustapi-rs/src/lib.rs	Adds `dashboard` module + re-exports under `core-dashboard` (also changes legacy root alias surface).
crates/rustapi-rs/Cargo.toml	Adds `core-dashboard` feature and includes it in `full`.
crates/rustapi-core/tests/dashboard_tests.rs	Adds integration tests for config, metrics, auth behavior, and dispatch routing.
crates/rustapi-core/src/server.rs	Adds metrics timing + execution-path classification + request recording (feature-gated).
crates/rustapi-core/src/lib.rs	Exposes `dashboard` module and re-exports dashboard types when enabled.
crates/rustapi-core/src/dashboard/routes.rs	Adds dispatch + handlers for HTML + JSON endpoints.
crates/rustapi-core/src/dashboard/mod.rs	Adds module entry point and re-exports dashboard types.
crates/rustapi-core/src/dashboard/metrics.rs	Adds atomic counters + per-route DashMap + snapshot builder.
crates/rustapi-core/src/dashboard/dashboard.html	Adds embedded SPA (Chart.js + isometric canvas + auto-refresh).
crates/rustapi-core/src/dashboard/config.rs	Adds builder-style `DashboardConfig` (token/path/title).
crates/rustapi-core/src/dashboard/auth.rs	Adds Bearer-token guard for JSON endpoints.
crates/rustapi-core/src/app.rs	Adds `.dashboard()` API and registers dashboard routes + state.
crates/rustapi-core/Cargo.toml	Adds optional `dashmap` dependency and `dashboard` feature.
Cargo.lock	Locks `dashmap` addition.
api/public/rustapi-rs.all-features.txt	Updates published all-features API surface to include dashboard exports.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+/// Dashboard module: embedded isometric system dashboard.
+#[cfg(feature = "core-dashboard")]
+pub mod dashboard {
+    pub use rustapi_core::dashboard::{DashboardConfig, DashboardMetrics, DashboardSnapshot};
 }


+        // Register dashboard routes
+        let prefix = config.path.trim_end_matches('/').to_owned();
+


+        let entry = self.route_counters.entry(path.to_string()).or_default();
+        entry.hits.fetch_add(1, Ordering::Relaxed);
+        entry
+            .total_latency_ms
+            .fetch_add(duration_ms, Ordering::Relaxed);
+        if is_error {
+            entry.errors.fetch_add(1, Ordering::Relaxed);
+        }


+    match (method, suffix) {
+        // HTML page — no auth required (browsers can't easily send Bearer headers)
+        ("GET", "" | "index.html") => Some(serve_html()),
+


Tuntii · 2026-05-13T16:33:56Z

+function getToken() {
+  // 1. URL ?token=
+  const p = new URLSearchParams(window.location.search);
+  if (p.has('token')) return p.get('token');
+  // 2. Input field
+  const inp = document.getElementById('token-input').value.trim();
+  return inp || null;
+}


@copilot apply changes based on this feedback

Applied in commit 802d1d6:

Token URL stripping: getToken() now only reads from the input field. On DOMContentLoaded, if ?token= is present it is moved into the password input and immediately stripped from the address bar via history.replaceState — it will not appear in browser history or server logs.

Strict referrer policy: Added <meta name="referrer" content="no-referrer"> so no Referer header is sent on any sub-requests.

Removed CDN dependency: Dropped the Chart.js <script> tag entirely and replaced the RPS sparkline with a self-contained Canvas 2D implementation (drawRpsChart()), so no third-party asset can receive the token via Referer.

+/// Returns `Ok(())` if the token is valid or if `expected` is `None` (no auth configured).
+/// Returns an HTTP 401/403 response on failure.


+            Some(value) if value.starts_with("Bearer ") => {
+                let token = &value["Bearer ".len()..];
+                if token == expected {
+                    Ok(())
+                } else {
+                    Err(json_response(
+                        StatusCode::UNAUTHORIZED,
+                        json!({
+                            "error": "unauthorized",
+                            "message": "Invalid admin token"
+                        }),
+                    ))
+                }
+            }
+            Some(_) => Err(json_response(
+                StatusCode::UNAUTHORIZED,
+                json!({
+                    "error": "unauthorized",
+                    "message": "Expected 'Authorization: Bearer <token>'"
+                }),
+            )),


+    /// Create a dashboard configuration with secure defaults.
+    pub fn new() -> Self {
+        Self {
+            admin_token: None,
+            path: "/__rustapi/dashboard".to_string(),
+            title: "RustAPI System Dashboard".to_string(),
+        }


+    /// Override the URL prefix for the dashboard.
+    ///
+    /// Must start with `/`. Default: `"/__rustapi/dashboard"`.
+    pub fn path(mut self, path: impl Into<String>) -> Self {
+        self.path = path.into();
+        self


… release-drafter v7 token/autolabeler

Add a repository hook and PowerShell guardrail script that runs on PreToolUse. The hook (.github/hooks/rustapi-guardrails.json) invokes .github/scripts/copilot_guardrails.ps1 cross-platform (powershell/pwsh) with a 10s timeout. The script parses the incoming JSON payload, emits contextual reminders for public API, changelogs, examples, and Rust source changes, and detects potentially destructive terminal/git commands (e.g. git push, reset --hard, git clean, gh pr merge, recursive deletions). When dangerous patterns are found it returns a permissionDecision 'ask' with a reason; otherwise it returns non-blocking reminder messages via the systemMessage field.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

… referrer policy Agent-Logs-Url: https://github.com/Tuntii/RustAPI/sessions/c570ed7b-0217-4b5b-a1c2-4e5d05ea977e Co-authored-by: Tuntii <121901995+Tuntii@users.noreply.github.com>

Copilot AI review requested due to automatic review settings May 12, 2026 20:24

Copilot started reviewing on behalf of Tuntii May 12, 2026 20:25 View session

Tuntii added enhancement New feature or request rust Pull requests that update rust code labels May 12, 2026

Copilot AI reviewed May 12, 2026

View reviewed changes

Tuntii added 2 commits May 13, 2026 02:05

fix(ci): use libmysqlclient-dev for mysqlclient-sys 0.5.1 compat; fix…

d121c74

… release-drafter v7 token/autolabeler

fix(ci): add autolabeler config section required by release-drafter v7

80f3819

github-actions Bot added the feat label May 12, 2026

Tuntii and others added 6 commits May 13, 2026 17:16

Update mod.rs

b332b56

Update mod.rs

a5c0068

Update mod.rs

9b8fae9

Potential fix for pull request finding

bc137fe

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

78bfcbc

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot started work on behalf of Tuntii May 13, 2026 16:34 View session

security(dashboard): remove CDN dependency, strip token from URL, add…

802d1d6

… referrer policy Agent-Logs-Url: https://github.com/Tuntii/RustAPI/sessions/c570ed7b-0217-4b5b-a1c2-4e5d05ea977e Co-authored-by: Tuntii <121901995+Tuntii@users.noreply.github.com>

Copilot finished work on behalf of Tuntii May 13, 2026 16:39

Update ci.yml

a29c729

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(dashboard): Embedded Isometric System Dashboard#176

feat(dashboard): Embedded Isometric System Dashboard#176
Tuntii wants to merge 11 commits into
mainfrom
feat/embedded-isometric-dashboard

Tuntii commented May 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Tuntii May 13, 2026

Uh oh!

Copilot AI May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		// Register dashboard routes
		let prefix = config.path.trim_end_matches('/').to_owned();

		/// Returns `Ok(())` if the token is valid or if `expected` is `None` (no auth configured).
		/// Returns an HTTP 401/403 response on failure.

Uh oh!

Conversation

Tuntii commented May 12, 2026

Summary

New Files

Endpoints

UI Highlights

Execution-Path Tracking

Usage

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Tuntii May 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants