feat: Phase 3b — proper Web UI for memories, projects, settings
Replaces the debug /me + /connect pages with a real authed app shell.
Pages
- / — anonymous landing; redirects to /dashboard once signed in
- /dashboard — recent memories + top projects, quick "new memory" action
- /memories — searchable list with hybrid (vector+FTS+tags) scoring;
per-result rank breakdown shown inline
- /memories/[id] — view + inline edit toggle + delete
- /memories/new — create form with project autocomplete
- /projects — list with memory counts and last-activity
- /projects/[key] — that project's memories
- /settings — read-only Authentik profile + link to tokens
- /settings/tokens — list / create / revoke CLI tokens
Old URLs preserved as redirects:
- /me → /dashboard
- /connect → /settings/tokens
Stack additions
- Tailwind v4 with CSS-first @theme tokens (dark only for now)
- App shell in app/(authed)/ — auth guard + top nav with global search box
- Lightweight UI primitives in app/_components/ui/ (Button, Input, Card,
Badge, EmptyState, Container, PageHeader)
- Search logic extracted from MCP tool into lib/memories.ts so Web UI and
MCP both call the same RRF code path
- Memory CRUD via Server Actions in lib/memory-actions.ts; audit_log
rows are tagged actor='web' to distinguish from MCP writes
Per-token revoke
- New cli_tokens table (id, user_id, jti unique, name, created_at,
last_used_at, expires_at, revoked_at) — migration 0001_cli_tokens.sql
- mintCliToken now records jti + name; verifyCliToken enforces revocation
for tracked tokens. Legacy tokens minted before this change (no jti)
are accepted on signature alone until they expire naturally.
- /settings/tokens lists active + revoked tokens with one-click revoke
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 4.7
@@ -0,0 +1,78 @@
|
||||
import Link from "next/link";
|
||||
import { eq } from "drizzle-orm";
|
||||
import { auth } from "@/auth";
|
||||
import { db } from "@/lib/db/client";
|
||||
import { users } from "@/lib/db/schema";
|
||||
import { Container, PageHeader } from "@/app/_components/ui/container";
|
||||
import { Card, CardBody, CardHeader } from "@/app/_components/ui/card";
|
||||
import { Button } from "@/app/_components/ui/button";
|
||||
|
||||
export const dynamic = "force-dynamic";
|
||||
|
||||
export default async function SettingsPage() {
|
||||
const session = await auth();
|
||||
const userId = session!.user.id;
|
||||
|
||||
const userRow = await db
|
||||
.select()
|
||||
.from(users)
|
||||
.where(eq(users.id, userId))
|
||||
.limit(1);
|
||||
const user = userRow[0];
|
||||
|
||||
return (
|
||||
<Container className="pt-6 max-w-3xl">
|
||||
<PageHeader title="Settings" />
|
||||
|
||||
<div className="space-y-6">
|
||||
<Card>
|
||||
<CardHeader className="text-sm font-medium text-fg">Profile</CardHeader>
|
||||
<CardBody className="space-y-2 text-sm">
|
||||
<Field label="Name" value={user?.name} />
|
||||
<Field label="Email" value={user?.email} />
|
||||
<Field label="Internal user id" value={user?.id} mono />
|
||||
<Field label="OIDC issuer" value={user?.oidcIss} mono />
|
||||
<Field label="OIDC sub" value={user?.oidcSub} mono />
|
||||
<Field
|
||||
label="Joined"
|
||||
value={user?.createdAt ? new Date(user.createdAt).toLocaleString() : null}
|
||||
/>
|
||||
</CardBody>
|
||||
</Card>
|
||||
|
||||
<Card>
|
||||
<CardHeader className="flex items-center">
|
||||
<span className="text-sm font-medium text-fg flex-1">CLI tokens</span>
|
||||
<Link href="/settings/tokens" className="no-underline">
|
||||
<Button variant="secondary" size="sm">Manage tokens</Button>
|
||||
</Link>
|
||||
</CardHeader>
|
||||
<CardBody className="text-sm text-fg-muted">
|
||||
Bearer tokens for headless/automated MCP clients. Visit{" "}
|
||||
<Link href="/settings/tokens">/settings/tokens</Link> to generate
|
||||
and revoke them.
|
||||
</CardBody>
|
||||
</Card>
|
||||
</div>
|
||||
</Container>
|
||||
);
|
||||
}
|
||||
|
||||
function Field({
|
||||
label,
|
||||
value,
|
||||
mono,
|
||||
}: {
|
||||
label: string;
|
||||
value: string | null | undefined;
|
||||
mono?: boolean;
|
||||
}) {
|
||||
return (
|
||||
<div className="flex items-baseline gap-3">
|
||||
<span className="text-fg-muted w-36 shrink-0">{label}</span>
|
||||
<span className={`${mono ? "font-mono text-xs" : "text-sm"} text-fg break-all`}>
|
||||
{value ?? <span className="text-fg-subtle">—</span>}
|
||||
</span>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,162 @@
|
||||
import { revalidatePath } from "next/cache";
|
||||
import { and, desc, eq, isNull } from "drizzle-orm";
|
||||
import { auth } from "@/auth";
|
||||
import { db } from "@/lib/db/client";
|
||||
import { cliTokens, users } from "@/lib/db/schema";
|
||||
import {
|
||||
mintCliToken,
|
||||
revokeCliToken,
|
||||
CLI_TOKEN_TTL_SECONDS,
|
||||
} from "@/lib/auth/cli-token";
|
||||
import { Container, PageHeader } from "@/app/_components/ui/container";
|
||||
import { Card, CardBody, CardHeader } from "@/app/_components/ui/card";
|
||||
import { Badge } from "@/app/_components/ui/badge";
|
||||
import { EmptyState } from "@/app/_components/ui/empty-state";
|
||||
import TokensManager from "./tokens-manager";
|
||||
|
||||
export const dynamic = "force-dynamic";
|
||||
|
||||
async function createTokenAction(_prev: { token: string | null; error: string | null }, formData: FormData): Promise<{ token: string | null; error: string | null }> {
|
||||
"use server";
|
||||
try {
|
||||
const session = await auth();
|
||||
if (!session?.user?.id) return { token: null, error: "not authenticated" };
|
||||
|
||||
const name = String(formData.get("name") ?? "").trim() || `Token ${new Date().toISOString().slice(0, 10)}`;
|
||||
|
||||
const userRow = await db
|
||||
.select({
|
||||
oidcIss: users.oidcIss,
|
||||
oidcSub: users.oidcSub,
|
||||
email: users.email,
|
||||
name: users.name,
|
||||
})
|
||||
.from(users)
|
||||
.where(eq(users.id, session.user.id))
|
||||
.limit(1);
|
||||
const u = userRow[0];
|
||||
if (!u) return { token: null, error: "user row not found" };
|
||||
|
||||
const minted = await mintCliToken(
|
||||
{
|
||||
userId: session.user.id,
|
||||
oidcIss: u.oidcIss,
|
||||
oidcSub: u.oidcSub,
|
||||
email: u.email,
|
||||
name: u.name,
|
||||
},
|
||||
{ tokenName: name },
|
||||
);
|
||||
|
||||
revalidatePath("/settings/tokens");
|
||||
return { token: minted.token, error: null };
|
||||
} catch (e) {
|
||||
return { token: null, error: e instanceof Error ? e.message : "unknown error" };
|
||||
}
|
||||
}
|
||||
|
||||
async function revokeTokenAction(formData: FormData) {
|
||||
"use server";
|
||||
const session = await auth();
|
||||
if (!session?.user?.id) throw new Error("not authenticated");
|
||||
const tokenId = String(formData.get("tokenId") ?? "");
|
||||
await revokeCliToken(session.user.id, tokenId);
|
||||
revalidatePath("/settings/tokens");
|
||||
}
|
||||
|
||||
export default async function TokensPage() {
|
||||
const session = await auth();
|
||||
const userId = session!.user.id;
|
||||
|
||||
const tokens = await db
|
||||
.select({
|
||||
id: cliTokens.id,
|
||||
name: cliTokens.name,
|
||||
jti: cliTokens.jti,
|
||||
createdAt: cliTokens.createdAt,
|
||||
lastUsedAt: cliTokens.lastUsedAt,
|
||||
expiresAt: cliTokens.expiresAt,
|
||||
revokedAt: cliTokens.revokedAt,
|
||||
})
|
||||
.from(cliTokens)
|
||||
.where(eq(cliTokens.userId, userId))
|
||||
.orderBy(desc(cliTokens.createdAt));
|
||||
|
||||
const active = tokens.filter((t) => !t.revokedAt && t.expiresAt > new Date());
|
||||
const inactive = tokens.filter((t) => t.revokedAt || t.expiresAt <= new Date());
|
||||
const ttlDays = Math.floor(CLI_TOKEN_TTL_SECONDS / 86400);
|
||||
|
||||
return (
|
||||
<Container className="pt-6 max-w-3xl">
|
||||
<PageHeader
|
||||
title="CLI tokens"
|
||||
description={`Long-lived bearer tokens for MCP clients without browser access. ${ttlDays}-day expiry per token.`}
|
||||
/>
|
||||
|
||||
<Card className="mb-6">
|
||||
<CardHeader className="text-sm font-medium text-fg">Generate a new token</CardHeader>
|
||||
<CardBody>
|
||||
<TokensManager action={createTokenAction} ttlDays={ttlDays} />
|
||||
</CardBody>
|
||||
</Card>
|
||||
|
||||
<h2 className="text-sm font-medium text-fg-muted mt-8 mb-2">Active tokens</h2>
|
||||
{active.length === 0 ? (
|
||||
<EmptyState title="No active tokens" description="Generate one above to connect a headless client." />
|
||||
) : (
|
||||
<Card>
|
||||
{active.map((t, i) => (
|
||||
<div
|
||||
key={t.id}
|
||||
className={`px-4 py-3 flex items-center gap-3 ${i > 0 ? "border-t border-border" : ""}`}
|
||||
>
|
||||
<div className="flex-1 min-w-0">
|
||||
<div className="text-sm text-fg truncate">{t.name}</div>
|
||||
<div className="text-xs text-fg-subtle">
|
||||
Created {new Date(t.createdAt).toLocaleDateString()} ·{" "}
|
||||
{t.lastUsedAt
|
||||
? `last used ${new Date(t.lastUsedAt).toLocaleString()}`
|
||||
: "never used"}
|
||||
{" · "}expires {new Date(t.expiresAt).toLocaleDateString()}
|
||||
</div>
|
||||
</div>
|
||||
<form action={revokeTokenAction}>
|
||||
<input type="hidden" name="tokenId" value={t.id} />
|
||||
<button
|
||||
type="submit"
|
||||
className="text-xs text-danger hover:underline"
|
||||
>
|
||||
Revoke
|
||||
</button>
|
||||
</form>
|
||||
</div>
|
||||
))}
|
||||
</Card>
|
||||
)}
|
||||
|
||||
{inactive.length > 0 ? (
|
||||
<>
|
||||
<h2 className="text-sm font-medium text-fg-muted mt-8 mb-2">Revoked / expired</h2>
|
||||
<Card>
|
||||
{inactive.map((t, i) => (
|
||||
<div
|
||||
key={t.id}
|
||||
className={`px-4 py-3 flex items-center gap-3 ${i > 0 ? "border-t border-border" : ""}`}
|
||||
>
|
||||
<div className="flex-1 min-w-0">
|
||||
<div className="text-sm text-fg-muted truncate">{t.name}</div>
|
||||
<div className="text-xs text-fg-subtle">
|
||||
{t.revokedAt
|
||||
? `Revoked ${new Date(t.revokedAt).toLocaleString()}`
|
||||
: `Expired ${new Date(t.expiresAt).toLocaleString()}`}
|
||||
</div>
|
||||
</div>
|
||||
<Badge tone="danger">{t.revokedAt ? "revoked" : "expired"}</Badge>
|
||||
</div>
|
||||
))}
|
||||
</Card>
|
||||
</>
|
||||
) : null}
|
||||
</Container>
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,67 @@
|
||||
"use client";
|
||||
|
||||
import { useActionState } from "react";
|
||||
import { Button } from "@/app/_components/ui/button";
|
||||
import { Input, Label } from "@/app/_components/ui/input";
|
||||
|
||||
interface State {
|
||||
token: string | null;
|
||||
error: string | null;
|
||||
}
|
||||
|
||||
interface Props {
|
||||
action: (prev: State, formData: FormData) => Promise<State>;
|
||||
ttlDays: number;
|
||||
}
|
||||
|
||||
const initial: State = { token: null, error: null };
|
||||
|
||||
export default function TokensManager({ action, ttlDays }: Props) {
|
||||
const [state, formAction, pending] = useActionState(action, initial);
|
||||
|
||||
if (state.token) {
|
||||
return (
|
||||
<div className="space-y-3">
|
||||
<div className="text-sm text-success font-medium">
|
||||
Token generated — copy now, you won't see it again
|
||||
</div>
|
||||
<pre
|
||||
className="!whitespace-pre-wrap !break-all select-all"
|
||||
style={{ userSelect: "all" }}
|
||||
>
|
||||
{state.token}
|
||||
</pre>
|
||||
<details className="text-xs text-fg-muted">
|
||||
<summary className="cursor-pointer">claude mcp add command</summary>
|
||||
<pre className="mt-2">{`claude mcp add --transport http --scope user \\
|
||||
--header "Authorization: Bearer ${state.token}" \\
|
||||
shared-memory https://memory.dnspegasus.net/api/mcp`}</pre>
|
||||
</details>
|
||||
<p className="text-xs text-fg-subtle">
|
||||
Valid for {ttlDays} days. Revoke individually below if it leaks.
|
||||
</p>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
return (
|
||||
<form action={formAction} className="flex flex-wrap items-end gap-3">
|
||||
<div className="flex-1 min-w-[200px]">
|
||||
<Label htmlFor="name" hint="optional">Token name</Label>
|
||||
<Input
|
||||
id="name"
|
||||
name="name"
|
||||
placeholder="e.g. Laptop, Headless CI, …"
|
||||
className="mt-1"
|
||||
autoComplete="off"
|
||||
/>
|
||||
</div>
|
||||
<Button type="submit" disabled={pending}>
|
||||
{pending ? "Generating…" : "Generate token"}
|
||||
</Button>
|
||||
{state.error ? (
|
||||
<p className="basis-full text-sm text-danger">error: {state.error}</p>
|
||||
) : null}
|
||||
</form>
|
||||
);
|
||||
}
|
||||
Reference in New Issue
Block a user