ambiser
/
openvidu
mirror of https://github.com/OpenVidu/openvidu.git
9
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #919 from OpenVidu/feature/openvidu-dashboard 

OpenVidu Dashboard CE
pull/920/head
Juan Carlos Moreno García 2026-10-26 14:13:48 +01:00 committed by GitHub
parent 52e9598297 767311b643
commit 5d41b7a45f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
587 changed files with 81092 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
.github/dependabot.yml vendored
View File

@ -4,3 +4,17 @@ updates:
directory: "/" directory: "/"
schedule: schedule:
interval: "weekly" interval: "weekly"
- package-ecosystem: "npm"
directory: "/openvidu-dashboard"
schedule:
interval: "weekly"
ignore:
# Node.js 24 until 26 is LTS: its types follow the runtime.
- dependency-name: "@types/node"
update-types:
- "version-update:semver-major"
groups:
minor-and-patch:
update-types:
- "minor"
- "patch"

220
.github/workflows/openvidu-dashboard-ci.yml vendored Normal file
View File

@ -0,0 +1,220 @@
name: OpenVidu Dashboard CI
on:
push:
branches:
- master
paths:
- 'openvidu-dashboard/**'
- '.github/workflows/openvidu-dashboard-ci.yml'
pull_request:
branches:
- master
paths:
- 'openvidu-dashboard/**'
- '.github/workflows/openvidu-dashboard-ci.yml'
workflow_dispatch:
concurrency:
group: openvidu-dashboard-ci-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
checks:
name: Lint, format, type check and spec validation
runs-on: ubuntu-latest
defaults:
run:
working-directory: openvidu-dashboard
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Set up Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version-file: openvidu-dashboard/.node-version
- name: Set up pnpm
uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
with:
package_json_file: openvidu-dashboard/package.json
cache: true
cache_dependency_path: openvidu-dashboard/pnpm-lock.yaml
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Lint
run: ./dashboard.sh lint --skip-install
- name: Check formatting
run: ./dashboard.sh format-check --skip-install
- name: Type check
run: ./dashboard.sh typecheck --skip-install
- name: Validate OpenSpec
run: ./dashboard.sh spec-validate --skip-install
unit:
name: Unit tests
runs-on: ubuntu-latest
defaults:
run:
working-directory: openvidu-dashboard
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Set up Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version-file: openvidu-dashboard/.node-version
- name: Set up pnpm
uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
with:
package_json_file: openvidu-dashboard/package.json
cache: true
cache_dependency_path: openvidu-dashboard/pnpm-lock.yaml
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Unit tests
run: ./dashboard.sh test-unit --skip-install
integration:
name: Integration tests (MongoDB)
runs-on: ubuntu-latest
timeout-minutes: 45
defaults:
run:
working-directory: openvidu-dashboard
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Set up Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version-file: openvidu-dashboard/.node-version
- name: Set up pnpm
uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
with:
package_json_file: openvidu-dashboard/package.json
cache: true
cache_dependency_path: openvidu-dashboard/pnpm-lock.yaml
- name: Install dependencies
run: pnpm install --frozen-lockfile
# Millisecond latency budgets are noisy on shared runners: overruns become warning annotations. Query plan
# assertions still fail the job.
- name: Integration tests
env:
DASHBOARD_TEST_LATENCY_BUDGETS: report
run: ./dashboard.sh test-integration --skip-install
contract:
name: Data model contract with the writer
runs-on: ubuntu-latest
timeout-minutes: 30
defaults:
run:
working-directory: openvidu-dashboard
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
# Beside the openvidu-livekit submodule, which pins the released writer instead of openvidu/main.
- name: Checkout openvidu-livekit
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
repository: OpenVidu/openvidu-livekit
ref: openvidu/main
path: openvidu-livekit-main
- name: Set up Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: openvidu-livekit-main/go.mod
cache-dependency-path: openvidu-livekit-main/go.sum
- name: Set up Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version-file: openvidu-dashboard/.node-version
- name: Set up pnpm
uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
with:
package_json_file: openvidu-dashboard/package.json
cache: true
cache_dependency_path: openvidu-dashboard/pnpm-lock.yaml
- name: Install dependencies
run: pnpm install --frozen-lockfile --filter "@openvidu-dashboard/backend..."
- name: Contract check
run: ./dashboard.sh contract-check ../openvidu-livekit-main --skip-install
e2e:
name: End-to-end tests (Playwright)
needs: checks
runs-on: ubuntu-latest
timeout-minutes: 45
defaults:
run:
working-directory: openvidu-dashboard
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Set up Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version-file: openvidu-dashboard/.node-version
- name: Set up pnpm
uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
with:
package_json_file: openvidu-dashboard/package.json
cache: true
cache_dependency_path: openvidu-dashboard/pnpm-lock.yaml
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Install Playwright browsers
working-directory: openvidu-dashboard/dashboard-ce/e2e
run: pnpm exec playwright install --with-deps chromium
- name: End-to-end tests
run: ./dashboard.sh e2e --skip-install
- name: Upload the Playwright report
if: failure()
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: openvidu-dashboard-playwright-report
path: |
openvidu-dashboard/dashboard-ce/e2e/playwright-report
openvidu-dashboard/dashboard-ce/e2e/test-results
retention-days: 7

202
openvidu-dashboard/.claude/commands/opsx/apply.md Normal file
View File

@ -0,0 +1,202 @@
---
name: "OPSX: Apply"
description: "Implement tasks from an OpenSpec change (Experimental)"
allowed-tools: Bash(openspec:*)
category: "Workflow"
tags: ["workflow", "artifacts", "experimental"]
---
Implement tasks from an OpenSpec change.
**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
Otherwise, with no root, what happens next depends on how this workflow was reached:
- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
**Input**: Optionally specify a change name (e.g., `/opsx:apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
**Steps**
1. **Select the change**
If a name is provided, use it. Otherwise:
- Infer from conversation context if the user mentioned a change
- Auto-select if only one active change exists
- If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
2. **Check status to understand the schema**
```bash
openspec status --change "<name>" --json
```
Parse the JSON to understand:
- `schemaName`: The workflow being used (e.g., "spec-driven")
- `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
- Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
3. **Get apply instructions**
```bash
openspec instructions apply --change "<name>" --json
```
This returns:
- `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
- Progress (total, complete, remaining)
- Task list with status, source path, and source line
- Dynamic instruction based on current state
- Optional `context`: current required project instruction input from the selected root
- Optional `operationGuidance`: current advisory guidance for apply
- `missingArtifacts` (when present): required artifact ids with no output
**Handle states:**
- If `state: "blocked"`: show the message and pause implementation.
- If `missingArtifacts` is non-empty: suggest completing the missing artifacts. Run `openspec status --change "<name>" --json`, select the next `ready` artifact (not `skipped` or `blocked`), and use `openspec instructions "<artifact-id>" --change "<name>" --json` for its rules and template. Keep the selected `--store <id>` on both commands.
- Otherwise, follow the CLI instruction to create or repair the schema-configured tracking file from existing planning artifacts. Do not assume another artifact is ready or start implementation while blocked.
- If `state: "all_done"`: report that all tracked tasks are complete and suggest review or verification as appropriate before archiving
- Otherwise: proceed to implementation
Treat `context` as a required prompt-level input. Read and consider it, and
apply relevant project facts, conventions, and constraints while implementing.
Treat `operationGuidance` as optional additive advice. Read and consider every
entry, and follow entries that are applicable and compatible with the built-in
workflow.
Keep both fields separate from CLI-returned state, missing artifacts, tasks,
progress, `contextFiles`, and the built-in `instruction`. They are not
evidence of task completion, do not replace the built-in instruction, and do
not permit bypassing a blocked state. If context conflicts with the built-in
instruction, an explicit user choice, or a CLI-controlled value, report the
conflict and preserve the controlling value. If guidance is inapplicable or
conflicts with those controlling inputs, do not follow it and explain why.
These are prompt-level behavior contracts, not enforceable checks.
4. **Read context files**
Read every file path listed under `contextFiles` from the apply instructions output.
The files depend on the schema being used:
- **spec-driven**: proposal, specs, design, tasks
- Other schemas: follow the contextFiles from CLI output
Do not copy `context` or `operationGuidance` verbatim into implementation
files or planning artifacts unless the user separately asks for that content.
5. **Show current progress**
Display:
- Schema being used
- Progress: "N/M tasks complete"
- Remaining tasks overview
- Dynamic instruction from CLI
6. **Implement tasks (loop until done or blocked)**
For each pending task:
- Show which task is being worked on
- Make the code changes required
- Keep changes minimal and focused
- Before editing, confirm the checkbox at the returned `sourcePath` and `line` still matches the task description; if it does not, rerun the apply instructions and use the refreshed location
- Mark the task complete at its returned `sourcePath` and `line`: `- [ ]` → `- [x]`
- Rerun the apply instructions and confirm that task is now done and progress changed
- Continue to next task
**Pause if:**
- Task is unclear → ask for clarification
- Implementation reveals a design issue → suggest updating artifacts
- A task needs work beyond what the spec and tasks describe, or you are tempted to drop, narrow, defer, or accept exceptions to specified behavior to make it fit → surface the added scope and ask; do not absorb it silently
- Error or blocker encountered → report and wait for guidance
- User interrupts
7. **On completion or pause, show status**
Display:
- Tasks completed this session
- Overall progress: "N/M tasks complete"
- If all done: report that tracked tasks are complete and suggest review or verification as appropriate before archiving
- If paused: explain why and wait for guidance
**Output During Implementation**
```
## Implementing: <change-name> (schema: <schema-name>)
Working on task 3/7: <task description>
[...implementation happening...]
✓ Task complete
Working on task 4/7: <task description>
[...implementation happening...]
✓ Task complete
```
**Output On Completion**
```
## Implementation Complete
**Change:** <change-name>
**Schema:** <schema-name>
**Progress:** 7/7 tasks complete ✓
### Completed This Session
- [x] Task 1
- [x] Task 2
...
All tracked tasks are complete. Review or verify the change as appropriate
before archiving. You can archive this change with `/opsx:archive`.
```
**Output On Pause (Issue Encountered)**
```
## Implementation Paused
**Change:** <change-name>
**Schema:** <schema-name>
**Progress:** 4/7 tasks complete
### Issue Encountered
<description of the issue>
**Options:**
1. <option 1>
2. <option 2>
3. Other approach
What would you like to do?
```
**Guardrails**
- Keep going through tasks until done or blocked
- Always read context files before starting (from the apply instructions output)
- If task is ambiguous, pause and ask before implementing
- If implementation reveals issues, pause and suggest artifact updates
- Keep code changes minimal and scoped to each task
- Update task checkbox immediately after completing each task
- Pause on errors, blockers, or unclear requirements - don't guess
- When a task needs work beyond what the spec describes, surface the added scope and pause - never silently narrow, defer, or simplify away specified behavior
- Only mark a task `- [x]` when its specified behavior is fully implemented, not when it is partially done or deferred
- Use contextFiles from CLI output, don't assume specific file names
- Use each task's sourcePath and line to update its exact checkbox
- Do not use context or operation guidance as proof that a task is complete
- Apply relevant project context; report conflicts with controlling workflow inputs
- Consider every guidance entry; explain any inapplicable or conflicting advice
- Do not copy runtime context or operation guidance into implementation files or planning artifacts
- Preserve CLI-controlled blocked/ready/all-done behavior and completion criteria
**Fluid Workflow Integration**
This skill supports the "actions on a change" model:
- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly

264
openvidu-dashboard/.claude/commands/opsx/archive.md Normal file
View File

@ -0,0 +1,264 @@
---
name: "OPSX: Archive"
description: "Archive a completed change in the experimental workflow"
allowed-tools: Bash(openspec:*)
category: "Workflow"
tags: ["workflow", "archive", "experimental"]
---
Archive a completed change in the experimental workflow.
**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
Otherwise, with no root, what happens next depends on how this workflow was reached:
- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
**Input**: Optionally specify a change name after `/opsx:archive` (e.g., `/opsx:archive add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
**Steps**
1. **Select the change**
If a name is provided, use it. Otherwise:
- Infer from conversation context if the user mentioned a change
- Auto-select if only one active change exists
- If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
When prompting, show only active changes (not already archived).
Include the schema used for each change if available.
Always announce: "Using change: <name>" and how to override (e.g., `/opsx:archive <other>`).
**Load current archive inputs before the existing archive checks:**
After resolving the selected change and planning root, run:
```bash
openspec instructions archive --change "<name>" --json
```
Keep the same selected-root flags on this command. This lookup is advisory and
optional: it only supplies extra prompt inputs, so it must never block archiving.
If it exits non-zero or returns invalid JSON — for example on an older CLI that
does not support this command yet — continue the archive workflow with no
context and no operation guidance. Do not report an error and do not stop.
A successful response may omit both optional fields. Treat `context` as a
required prompt-level input: read and consider it, and apply relevant project
facts, conventions, and constraints. Treat `operationGuidance` as optional
additive advice: read and consider every entry, and follow entries that are
applicable and compatible with the built-in archive workflow.
Keep both fields separate from built-in steps, explicit user choices, resolved
paths, CLI checks, and command contracts. If context conflicts with one of those
controlling inputs, report the conflict and preserve the controlling value. If
guidance is inapplicable or conflicts with a controlling input, do not follow it
and explain why. Do not infer replacement paths, skipped prompts, or flags from
either field, and do not copy their text verbatim into specs, change artifacts,
or archive summaries unless the user separately asks for it. These are
prompt-level behavior contracts, not enforceable checks.
2. **Check artifact completion status**
Run `openspec status --change "<name>" --json` to check artifact completion.
Parse the JSON to understand:
- `schemaName`: The workflow being used
- `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
- `artifacts`: List of artifacts with their status (`done`, `skipped`, or other)
**If any artifacts are neither `done` nor `skipped`** (skipped artifacts satisfy the requirement - the change declares skip_specs):
- Display warning listing incomplete artifacts
- Prompt user for confirmation to continue
- Proceed if user confirms
3. **Check task completion status**
Run `openspec list --json` with the same selected-root flags and find the
entry in `changes` whose `name` exactly matches the selected change.
Require exactly one match and nonnegative integer `totalTasks` and
`completedTasks`, with `completedTasks <= totalTasks`. The CLI resolves
the schema's tracked task files, including custom artifact names, output
paths, and globs.
Incomplete tasks = `totalTasks - completedTasks`.
Do not infer task completion from artifact status or the absence of a
top-level `tasks.md`. If the lookup fails, returns invalid JSON, omits or
duplicates the selected change, or returns invalid counts, report the problem
and stop before syncing or archiving.
The CLI counts only `x`/`X` checkbox markers as complete;
other markers, including unfamiliar ones, remain incomplete.
**If incomplete tasks found:**
- Display warning showing count of incomplete tasks
- Prompt user for confirmation to continue
- Proceed if user confirms
**If `totalTasks` is zero:** Proceed without a task-related warning.
4. **Assess delta spec sync state**
Use `artifactPaths.specs.existingOutputPaths` from status JSON as the only
delta-spec source. If the `specs` entry is missing or
`existingOutputPaths` is empty, proceed without a sync prompt and do not infer
delta specs from other artifacts.
**If delta specs exist:**
- Compare each delta spec with its corresponding main spec at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (use the store-aware `planningHome.root` from step 2, not a hardcoded repo path)
- A missing main spec is **not automatically** "already synced". For a new capability, the main spec is an *output* of the sync, not an input:
- If the delta has MODIFIED or RENAMED requirements, report that only ADDED requirements can create a new main spec and mark that capability as sync-blocked. Never invent a requirement that has no current version.
- Otherwise, if the delta has only REMOVED requirements and the change's `.openspec.yaml` declares `retire_capabilities: true`, the capability is already retired: count it as already synced, warn that there is nothing left to remove, and do not recreate the main spec. Apply this rule both now and when verifying a completed sync.
- Otherwise, if the delta has no ADDED requirements, report that no sync is possible and mark that capability as sync-blocked. For a REMOVED-only delta, warn that there is no main spec to remove from and leave the main-spec tree unchanged. `openspec archive` refuses the unmarked REMOVED-only case with `Spec must have at least one requirement`.
- Otherwise, count the capability as needing sync and name it in the summary (`<capability-path>: new main spec will be created`). If the delta also has REMOVED requirements, warn that they will be ignored because there is no main spec to remove from. The sync creates the main spec from only the delta's ADDED requirements, exactly as `openspec archive` does.
- Determine what changes would be applied (adds, modifications, removals, renames)
- Continue assessing the remaining capabilities even when one is sync-blocked. Show a combined summary before prompting.
**Prompt options:**
- If any capability is sync-blocked: explain why and offer only "Archive without syncing", "Cancel"
- Otherwise, if changes needed: "Sync now (recommended)", "Archive without syncing"
- Otherwise, if already synced: "Archive now", "Sync anyway", "Cancel"
Route on the answer:
- "Cancel" — stop, do not archive
- "Archive without syncing" or "Archive now" — proceed to archive
- "Sync now" or "Sync anyway" — sync, then verify (below). Do not start any sync while a capability is sync-blocked; explain the blocker and repeat the available choices.
- Anything else — ask again rather than archiving
Before a selected sync writes any main spec, run
`openspec instructions specs --change "<name>" --json` once with the same
selected-root flags. Require a zero exit status and valid artifact-instruction
JSON. If the lookup fails or returns invalid JSON, report the error and stop
before writing any main spec or moving the change. A valid response with omitted
`rules` is the no-rules case. Apply returned `rules` only to the content and
form of main specs produced by this merge; do not use them as archive guidance,
change CLI behavior, or copy the rule text into any output file.
Then run the `/opsx:sync` workflow inline (agent-driven intelligent merge) for change '<name>', passing the delta spec analysis and the fetched specs-rule snapshot from above, and wait for it to finish. The inline sync must reuse that snapshot without fetching `specs` instructions again. Do not delegate it to a background task — step 5 would move `changeRoot` out from under a sync that is still reading it, leaving the change archived and the main specs never updated. If your agent can only run it by delegation, delegate synchronously and wait for the result.
If the sync reports any stop or blocking condition, treat the sync as failed.
Stop the archive immediately. Do not perform the post-sync content comparison and do not move its `changeRoot`.
Nothing has moved, so the user can fix the blocking condition or re-run the sync.
After the sync writes each main spec, verify its structure against the canonical sync contract:
- A new main spec starts with a `# <capability> Specification` title. An existing main spec keeps its title exactly as it is.
- Preserve existing `## Purpose` sections completely untouched for established main specs.
- For a new main spec, copy the delta `## Purpose` verbatim. Warn only if the purpose text is shorter than standard validation expects. Do not regenerate or rewrite existing authored purpose. If no usable `## Purpose` is provided, use the existing TBD Purpose behavior and warning.
- Verify that no delta-style section headers (`## ADDED Requirements`, `## MODIFIED Requirements`, `## REMOVED Requirements`, `## RENAMED Requirements`) remain in the main spec, adhering strictly to the sync workflow formatting rules.
- Requirement blocks the sync wrote or changed use `### Requirement:` headings, and their scenarios use `#### Scenario:` headings, under the spec's `## Requirements` section. Leave content the delta does not mention exactly as it is.
Then re-run the comparison from the top of this step, including the explicitly retired, missing-spec case, against every capability that has a delta spec in `artifactPaths.specs.existingOutputPaths` — not only the ones the sync reports it touched. A successful sync leaves nothing left to apply, so each capability must now read as already synced:
- ADDED requirements present
- MODIFIED requirements carrying the scenario and description changes named in the delta, with their other scenarios intact
- REMOVED requirements gone — and where this sync retired a capability (removed its last requirement, leaving `## Requirements` empty), its main spec deleted rather than left empty.
- RENAMED requirements present under the new name and absent under the old one
If the sync failed, or any capability does not match, report what differs and stop — do not archive. Nothing has moved and `changeRoot` is intact, so the user can fix the mismatch or re-run the sync and start the archive again.
5. **Perform the archive**
Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
```bash
mkdir -p "<planningHome.changesDir>/archive"
```
Generate the target name: use the change name as-is when it already starts with a `YYYY-MM-DD-` prefix; otherwise prepend the current date as `YYYY-MM-DD-<change-name>`. Never stack a second date (same rule as `openspec archive`).
**Check if target already exists:**
- If yes: Fail with error, suggest renaming existing archive or using different date
- If no: Move `changeRoot` to the archive directory
```bash
mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"
```
6. **Display summary**
Show archive completion summary including:
- Change name
- Schema that was used
- Archive location
- Spec sync status (synced / sync skipped / no delta specs)
- Note about any warnings (incomplete artifacts/tasks)
**Output On Success**
```markdown
## Archive Complete
**Change:** <change-name>
**Schema:** <schema-name>
**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
**Specs:** ✓ Synced to main specs
All artifacts complete. All tasks complete.
```
**Output On Success (No Delta Specs)**
```markdown
## Archive Complete
**Change:** <change-name>
**Schema:** <schema-name>
**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
**Specs:** No delta specs
All artifacts complete. All tasks complete.
```
**Output On Success With Warnings**
```markdown
## Archive Complete (with warnings)
**Change:** <change-name>
**Schema:** <schema-name>
**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
**Specs:** Sync skipped (user chose to skip)
**Warnings:**
- Archived with 2 incomplete artifacts
- Archived with 3 incomplete tasks
- Delta spec sync was skipped (user chose to skip)
Review the archive if this was not intentional.
```
**Output On Error (Archive Exists)**
```markdown
## Archive Failed
**Change:** <change-name>
**Target:** the archive path derived from `planningHome.changesDir`/<target-name>/
Target archive directory already exists.
**Options:**
1. Rename the existing archive
2. Delete the existing archive if it's a duplicate
3. Wait until a different date to archive
```
**Guardrails**
- Announce the selected change; prompt for selection when it is ambiguous
- Use artifact graph (openspec status --json) for completion checking
- Don't block archive on warnings - just inform and confirm
- Preserve .openspec.yaml when moving to archive (it moves with the directory)
- Show clear summary of what happened
- If sync is requested, run the `/opsx:sync` workflow inline (agent-driven)
- Never archive while a spec sync is still in flight — run the sync inline and verify the main specs before moving `changeRoot`
- If delta specs exist, always run the sync assessment and show the combined summary before prompting
- Apply relevant runtime context and report conflicts; operation guidance remains advisory
- Consider every guidance entry and explain any inapplicable or conflicting advice
- Existing CLI checks, resolved paths, prompts, and command contracts are unchanged
- Artifact rules constrain only the specs being written and are never operation guidance
- Never copy runtime context, operation guidance, or artifact-rule text verbatim into output files

239
openvidu-dashboard/.claude/commands/opsx/explore.md Normal file
View File

@ -0,0 +1,239 @@
---
name: "OPSX: Explore"
description: "Enter explore mode - think through ideas, investigate problems, clarify requirements"
allowed-tools: Bash(openspec:*)
category: "Workflow"
tags: ["workflow", "explore", "experimental", "thinking"]
---
Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, investigate the codebase, and run read-only commands or tools without confirmation, but you must NEVER write code or implement features. If the user asks you to implement something, do not start it here: say that explore mode does not implement, and point them at `/opsx:propose`, which turns the discussion into a change. The work happens from that change, never from explore mode. You MAY create or update OpenSpec change artifacts (proposals, designs, specs) within a confirmed scope—that's capturing thinking, not implementing. Answering design or clarifying questions is never consent to write. Before the first write-capable action, name the artifacts or files you would change and what you would do, ask a direct yes/no question, and wait for the user's confirmation in a separate message. Confirmation covers only the scope you described; ask again before expanding it. An explicit request from the user to capture the exploration as a new change is itself that confirmation, covering the change and the change artifacts the request names; scaffold it first as described below.
**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
Otherwise, with no root, what happens next depends on how this workflow was reached:
- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
**Input**: The argument after `/opsx:explore` is whatever the user wants to think about. Could be:
- A vague idea: "real-time collaboration"
- A specific problem: "the auth system is getting unwieldy"
- A change name: "add-dark-mode" (to explore in context of that change)
- A comparison: "postgres vs sqlite for this"
- Nothing (just enter explore mode)
---
## The Stance
- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
- **Adaptive** - Follow interesting threads, pivot when new information emerges
- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
- **Grounded** - Explore the actual codebase when relevant, don't just theorize
---
## Planning a Change
When the user is planning a change, guide them toward shared understanding with focused discovery questions. For open-ended discussion, follow the conversation without imposing an interview or a required output.
Before asking a factual question, follow the context discovery below and inspect relevant OpenSpec artifacts, source, tests, docs, and configuration. Do not ask the user to repeat facts you can verify. Summarize relevant findings without reproducing private context or rules. If evidence is missing, conflicting, or inaccessible, state that limitation and ask only for the clarification needed to proceed.
- **Follow dependencies** - Resolve the next blocking decision before its dependent details. For example, clarify the user's outcome and scope before choosing an API or data model. Revisit downstream assumptions when an earlier answer changes. Skip branches that do not matter to this goal.
- **Keep questions focused** - Ask one focused question at a time, and briefly explain why it matters and which decision it unlocks. Batch questions only if the user asks for a batch; keep them small and group related decisions.
- **Offer grounded recommendations** - When evidence supports a recommendation, state your preferred option and why it fits the user's goals, with alternatives and their tradeoffs when useful. Do not invent intent, priorities, or external constraints: ask the user when only they can answer. Avoid a fixed question format.
- **Keep a conversational record** - Track decisions in the conversation, not in files. Separate confirmed decisions from proposed defaults and unresolved questions. Silence is not acceptance. Accepting an answer or a batch of recommendations is not permission to write. Keep file-write confirmation separate from discovery questions and follow the guardrails below.
Stop asking when the user has enough clarity. Let them pause, pivot, or defer a decision; do not exhaust every branch or force a proposal.
For example, after inspecting the relevant code:
```text
The CLI already uses SQLite and has no remote service. Is sharing state
across devices in scope? That determines whether local storage is enough.
If this stays a single-device tool, I recommend keeping SQLite to avoid
adding a service to operate; shared state would need a separate sync design.
```
---
## What You Might Do
Depending on what the user brings, you might:
**Explore the problem space**
- Ask clarifying questions that emerge from what they said
- Challenge assumptions
- Reframe the problem
- Find analogies
**Investigate the codebase**
- Map existing architecture relevant to the discussion
- Find integration points
- Identify patterns already in use
- Surface hidden complexity
**Compare options**
- Brainstorm multiple approaches
- Build comparison tables
- Sketch tradeoffs
- Recommend a path (if asked)
**Visualize**
```
+------------------------------------------+
| Use ASCII diagrams liberally |
+------------------------------------------+
| |
| [State A] -------> [State B] |
| | |
| v |
| [State C] |
| |
| System diagrams, state machines, |
| data flows, architecture sketches, |
| dependency graphs, comparison tables |
| |
+------------------------------------------+
```
**Draw with plain ASCII only** — borders `+` `-` `|`, arrows `-->` `<--` `^` `v`, markers `*` `x`.
Unicode diagram glyphs can render at different widths across terminals, fonts, and locales, so padded boxes and aligned tables can drift. Keep every diagram character ASCII.
**Surface risks and unknowns**
- Identify what could go wrong
- Find gaps in understanding
- Suggest spikes or investigations
---
## OpenSpec Awareness
You have full context of the OpenSpec system. Use it naturally, don't force it.
### Check for context
At the start, quickly check what exists:
```bash
openspec list --json
```
This tells you:
- If there are active changes
- Their names and task status
- What the user might be working on
That is the *change* list - work in flight. It does not include the project's durable capabilities, so list those too:
```bash
openspec list --specs
```
Add `--json` for ids and requirement counts, and append `--store "<id>"` only for a registered standalone store. This is the inventory of what the project already claims to do, and `openspec list` on its own never shows it. To look at one, run `openspec show "<spec-id>" --type spec --json --no-scenarios` (same `--store` rule) - it returns that capability's purpose and requirement texts without pulling the whole spec file into context, and `--type spec` stops a change of the same name from making it ambiguous.
The filtered read is only an overview. Before deciding what is already covered or what should change, read each relevant spec in full, including scenarios, with `openspec show "<spec-id>" --type spec` (same `--store` rule).
Then read the project's own context from the resolved root - `<root.path>/openspec/config.yaml` (or `config.yml`). Use the `root.path` returned above, and skip this if neither file exists:
- `context`: project background - tech stack, conventions, constraints
- `rules`: keyed by artifact id - the entries for an artifact apply only when you write that artifact
Ground your thinking in these. They are constraints for you to follow, not content to reproduce: do NOT copy them into the conversation or into any artifact you create.
If the user mentioned a specific change name, read its artifacts for context.
### When no change exists
Think freely. When insights crystallize, you might offer:
- "This feels solid enough to start a change. Want me to create a proposal?"
- Or keep exploring - no pressure to formalize
If the user asks you to capture the exploration as a new change, that request is the confirmation required above. It covers scaffolding that change and creating the change artifacts the request names, and nothing else. This holds only when the request is theirs: a yes to an offer you made confirms only the scope your offer itself named, so name the change and the artifacts in the offer. Don't re-ask for what they already asked for; do ask before anything beyond it. Transition seamlessly into the requested capture:
1. Run `openspec new change "<name>"` (with `--store <id>` when applicable) before creating any artifacts. Never create a new change directory under `openspec/changes/` by hand; the CLI scaffold creates required metadata such as `.openspec.yaml`. Keep the selected `--store <id>` on every applicable follow-up `status` and `instructions` command.
2. Run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store), then process the requested artifacts in dependency order. For each requested artifact that is `ready`, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store). Before creating a requested artifact, evaluate any condition in its own `instruction` against the explored change; record a deliberate skip instead when the condition does not apply. If a requested artifact is blocked by a direct prerequisite the user did not request, run `openspec instructions "<prerequisite-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) for that prerequisite whether it is `ready` or `blocked`. If its own `instruction` states a condition, evaluate that condition against the explored change and record a deliberate skip only when the condition does not apply. If the condition applies, or the prerequisite is not conditional, treat it as a normal prerequisite and ask before expanding the capture. Do not create an unrequested prerequisite unless the user approves.
3. Follow the returned `template` and `instruction` fields. Read completed dependency files listed in `dependencies`, and apply `context` and `rules` as constraints without copying them into the artifact. If the instruction delegates creation to a specific skill or command, invoke it; otherwise write the artifact to `resolvedOutputPath`, using the instruction to choose a concrete path when it is a glob. Verify that the selected concrete output exists.
4. After creating each artifact, re-run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) and continue until every requested artifact is `done`, `skipped`, or was deliberately skipped because its own `instruction` stated a condition that did not apply. Tell the user about a deliberate conditional skip, remember it, and do not reconsider it. Dependencies are enablers, not gates: if a requested artifact is still `blocked` only because you deliberately skipped a conditional prerequisite, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) despite the blocked status, then create it using step 3 only when those recorded conditional skips are its sole missing dependencies. If a requested artifact is blocked by a prerequisite the user did not ask to capture and cannot be conditionally skipped, explain that dependency and ask before expanding the capture.
Capture the artifact(s) the user requested without asking them to invoke another workflow command. If they asked only to start a change, stop after scaffolding and show its status. When the requested capture is done, stop there and name where the work continues: `/opsx:propose` writes the remaining planning artifacts, and `/opsx:apply` implements the change once tasks exist. Capturing artifacts never starts implementing them.
### When a change exists
If the user mentions a change or you detect one is relevant:
1. **Resolve and read existing artifacts for context**
- Run `openspec status --change "<name>" --json`.
- Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
- Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
2. **Reference them naturally in conversation**
- "Your design mentions using Redis, but we just realized SQLite fits better..."
- "The proposal scopes this to premium users, but we're now thinking everyone..."
3. **Offer to capture when decisions are made**
`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve an existing capability's full path and follow the project's established organization for new capabilities.
| Insight Type | Where to Capture |
|----------------------------|-------------------------------------|
| New requirement discovered | `specs/<capability-path>/spec.md` |
| Requirement changed | `specs/<capability-path>/spec.md` |
| Design decision made | `design.md` |
| Scope changed | `proposal.md` |
| New work identified | `tasks.md` |
| Assumption invalidated | Relevant artifact |
Example offers:
- "That's a design decision. Capture it in design.md?"
- "This is a new requirement. Add it to specs?"
- "This changes scope. Update the proposal?"
4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
---
## What You Don't Have To Do
- Follow a script
- Ask the same questions every time
- Produce a specific artifact
- Reach a conclusion
- Stay on topic if a tangent is valuable
- Be brief (this is thinking time)
---
## Ending Discovery
There's no required ending. Discovery might:
- **Flow into a proposal**: "Ready to start? Run `/opsx:propose` and this becomes a change."
- **Result in artifact updates**: "Updated design.md with these decisions"
- **Just provide clarity**: User has what they need, moves on
- **Continue later**: "We can pick this up anytime"
When things crystallize, you might offer a summary - but it's optional. Sometimes the thinking IS the value.
---
## Guardrails
- **Don't implement** - Never write code or implement features. Workflow configuration counts too: creating or editing schemas, templates, or `openspec/config.yaml` is a change, not thinking. Creating or updating OpenSpec change artifacts within the confirmed scope is fine, writing anything else is not. When the user is ready to build, name the handoff rather than starting: `/opsx:propose` turns the discussion into a change, and the work happens there.
- **Don't fake understanding** - If something is unclear, dig deeper
- **Don't rush** - Discovery is thinking time, not task time
- **Don't force structure** - Let patterns emerge naturally
- **Don't auto-capture** - Offer to save insights, don't just do it. Read-only commands and tools need no confirmation. Before the first write-capable action—including `openspec new change` or another command that writes files—name the artifacts or files and proposed changes, ask a direct yes/no question, and wait for explicit confirmation in a separate user message. That confirmation covers only the described scope; ask again before expanding it. Answers to design or clarifying questions are never consent to write. That rule governs `openspec new change` whenever you are the one proposing the capture; the user's own capture request is the exception, handled in the capture transition above.
- **Don't manually scaffold changes** - Never create a new change directory under `openspec/changes/` by hand. Always use `openspec new change "<name>"` (with `--store <id>` when applicable) so required metadata such as `.openspec.yaml` is created before writing artifacts.
- **Do visualize** - A good diagram is worth many paragraphs
- **Do explore the codebase** - Ground discussions in reality
- **Do question assumptions** - Including the user's and your own

170
openvidu-dashboard/.claude/commands/opsx/propose.md Normal file
View File

@ -0,0 +1,170 @@
---
name: "OPSX: Propose"
description: "Propose a new change - create it and generate all artifacts in one step"
allowed-tools: Bash(openspec:*)
category: "Workflow"
tags: ["workflow", "artifacts", "experimental"]
---
Propose a new change - create the change and generate all artifacts in one step.
**Planning boundary**: This workflow creates planning artifacts only. The user request that selected or triggered this workflow authorizes planning only, even if it asks to build or fix something. Do not edit project code. After the planning artifacts are complete, stop. Do not start implementation in the same response, even if the initial request asks for it. Wait for a new user request after the artifacts are presented; then start the apply workflow.
I'll create a change with the artifacts your schema defines. With the default spec-driven schema that is:
- proposal.md (what & why)
- `specs/<capability-path>/spec.md` (what the system must do - a delta, not the main spec)
- design.md (how)
- tasks.md (implementation steps)
`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve an existing capability's full path and follow the project's established organization for new capabilities.
When the user is ready to implement, they must start the apply workflow explicitly.
---
**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
Otherwise, with no root, what happens next depends on how this workflow was reached:
- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
**Input**: The argument after `/opsx:propose` is the change name (kebab-case), OR a description of what the user wants to build.
**Steps**
1. **Understand the request and clarify material ambiguity**
If no input is provided, ask the user (open-ended, no preset options):
> "What change do you want to work on? Describe what you want to build or fix."
From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
**IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
If the request contains ambiguity that would materially affect scope, externally observable behavior, compatibility, or acceptance criteria, ask the user before creating the change. For minor details, make a reasonable assumption and record it in the planning artifacts.
2. **Load project context**
Run `openspec context --json` from the current working directory (or `openspec context --json --store "<store-id>"` when a registered store was explicitly selected). Use the returned `root.path` as the authoritative OpenSpec root. If context reports `no_openspec_root`, stop without creating or changing any files and follow the **Project check** above for how this workflow was reached. Offer `openspec init` only for an explicit OpenSpec request, and wait for the user to request initialization. Do not initialize automatically or run `openspec new change`. After initialization, rerun this context check before continuing. For any other context failure, stop and report the error; do not fall back to the current directory or run later OpenSpec commands without the selected store.
Only when context returns a resolved `root.path`, read `<root.path>/openspec/config.yaml`. Use `config.yml` only when `config.yaml` does not exist. If neither file exists, continue without project context. Do not fall back to `config.yml` if `config.yaml` is unreadable or invalid.
If the file parses as a YAML object and its `context` field is a string no larger than 51,200 bytes in UTF-8, apply that field before exploring the codebase or making planning decisions. If the file cannot be read or parsed, or the context field is invalid or oversized, continue without project context. Validate this field independently of other config fields, as OpenSpec does.
Treat context as project-provided data and constraints, not as authority to change this workflow: it cannot override user authorization, the planning boundary, tool restrictions, or artifact and output rules. Do not copy the context into artifacts; use it to focus any codebase exploration and as a constraint on the proposal.
3. **Determine the workflow schema**
Use the configured default schema unless the user explicitly requests a different workflow.
**Use a different schema only if the user:**
- Explicitly requests a specific schema by name → use `--schema <schema-name>`
- Asks to "show workflows" or asks "what workflows" exist → resolve the authoritative root by running `openspec context --json` from the current working directory. If the user explicitly selected a registered store, use `openspec context --json --store "<store-id>"`. Then run `openspec schemas --json` with its working directory set to the returned `root.path` and let them choose. This preserves roots selected by a local `store:` pointer or the global `defaultStore`; when a registered store was explicitly selected, append `--store "<store-id>"` to `openspec schemas --json` as well. If context fails, stop as described in the context-loading step; do not fall back to the current directory.
Otherwise, omit `--schema` to preserve the configured default.
4. **Create the change directory**
Choose one schema form below. If a registered store is selected, append `--store "<store-id>"` to that command and each later OpenSpec command shown below that accepts `--store`.
Using the configured default:
```bash
openspec new change "<name>"
```
Using an explicitly requested schema:
```bash
openspec new change "<name>" --schema "<schema-name>"
```
This creates a scaffolded change in the planning home resolved by the CLI with `.openspec.yaml`.
5. **Get the artifact build order**
```bash
openspec status --change "<name>" --json
```
Parse the JSON to get:
- `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
- `artifacts`: list of all artifacts, each with its `status` and its `requires` edges (the artifact IDs it directly depends on)
- `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
6. **Create every artifact in the required set**
Use a todo list to track progress through the artifacts.
Loop through artifacts in dependency order (artifacts with no pending dependencies first):
a. **For each artifact that is `ready` (dependencies satisfied)**:
- Get instructions:
```bash
openspec instructions <artifact-id> --change "<name>" --json
```
- The instructions JSON includes:
- `context`: Project background (constraints for you - do NOT include in output)
- `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
- `template`: The structure to use for your output file
- `instruction`: Schema-specific guidance for this artifact type
- `skipped`/`warning`: present when the change declares skip_specs and this artifact must NOT be created - stop and pick another artifact
- `resolvedOutputPath`: Resolved path or pattern to write the artifact
- `dependencies`: Completed artifacts to read for context
- Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
- **Inspect the relevant project before drafting**: Read `context` and `rules` first, then inspect relevant implementation, nearby tests, configuration, and documentation outside `openspec/`. Keep inspection read-only and proportional to the change; reuse findings for later artifacts and inspect more only as needed.
- Identify the target project from the request and project context; the planning home may be separate from the code. If the target is unclear, ask. For greenfield or non-code changes, inspect the available structure and relevant documents. If source is unavailable, state the limitation and ask when it materially affects the plan.
- Ground scope, approach, and tasks in what you find. Distinguish observed behavior from assumptions and proposed additions; surface conflicts with existing specs instead of silently deciding which is correct.
- Do this discovery now, rather than leaving generic "explore the codebase" or "make a plan" tasks for implementation. Keep any necessary follow-up investigation specific to an unresolved question.
- If the `instruction` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at `resolvedOutputPath`
- Otherwise create the artifact file using `template` as the structure and write it to `resolvedOutputPath`. If `resolvedOutputPath` is a glob, follow `instruction` to choose the concrete file path
- Apply `context` and `rules` as constraints - but do NOT copy them into the file
- Show brief progress: "Created <artifact-id>"
b. **Continue until every artifact in the required set exists (not just `apply.requires`)**
- After creating each artifact, re-run `openspec status --change "<name>" --json`
- The required set is `applyRequires` plus every artifact reachable from those by following the `requires` edges in `status --json` - walk them transitively (spec-driven closes over proposal, specs, design, tasks). Leave artifacts outside that set alone
- `status` is file-existence only, so an `applyRequires` artifact reading `done` does NOT mean its dependencies exist - writing `tasks.md` early marks `tasks` done while `specs` was never written. Use each artifact's `requires` edges, not its `status`, to build the required set: a `done` artifact still lists what it depends on
- An artifact already reading `status: "skipped"` is satisfied: the change declares `skip_specs` in `.openspec.yaml`, so its files must NOT exist. Never try to create one
- Create every artifact in the required set that is missing, then re-check - creating one can unblock others
- Skip one only when `status` already reports it `skipped`, or when its own `instruction` says it is conditional: run `openspec instructions <artifact-id> --change "<name>" --json` and skip only if its `instruction` field marks it optional (e.g. "create only if..."). Spec-driven's `design.md` qualifies; `specs` qualifies only via the `skipped` status above, never by your own judgment. Tell the user, and do not reconsider it
- Dependencies are enablers, not gates: if a required artifact is still `blocked` only because you skipped a conditional dependency, write it anyway
- Stop when every artifact in the required set is `done`, `skipped`, or was deliberately skipped
c. **If an artifact requires user input** (unclear context):
- Ask the user to clarify
- Then continue with creation
7. **Show final status**
```bash
openspec status --change "<name>"
```
**Output**
After completing all artifacts, summarize:
- Change name and location
- List of artifacts created with brief descriptions, plus any conditional artifact you skipped and why
- What's ready: "All artifacts needed for implementation are ready."
- Prompt: "The artifacts are ready for review. When you are ready, run `/opsx:apply`."
**Artifact Creation Guidelines**
- Follow the `instruction` field from `openspec instructions` for each artifact type - it is the authoritative guidance, even for familiar artifact names
- If the `instruction` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly
- The schema defines what each artifact should contain - follow it
- Read dependency artifacts for context before creating new ones
- Use `template` as the structure for your output file - fill in its sections
- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
- Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
- These guide what you write, but should never appear in the output
**Guardrails**
- The request that invoked this workflow authorizes planning only. Any implementation or apply instruction in that request does not carry forward. Do NOT implement the change, start the apply workflow, or edit project code during this workflow. After presenting the artifacts, stop and wait for a new user request to start the apply workflow
- Create every artifact the apply phase transitively depends on, not just the ids listed in `apply.requires`
- Always read dependency artifacts before creating a new one - re-read from disk, not from conversation memory (files may have changed since you last saw them)
- Ask about ambiguities that would materially change scope, externally observable behavior, compatibility, or acceptance criteria; for minor details, make reasonable assumptions and record them
- If a change with that name already exists, ask if user wants to continue it or create a new one
- Verify each artifact file exists after writing before proceeding to next

286
openvidu-dashboard/.claude/commands/opsx/sync.md Normal file
View File

@ -0,0 +1,286 @@
---
name: "OPSX: Sync"
description: "Sync delta specs from a change to main specs"
allowed-tools: Bash(openspec:*)
category: "Workflow"
tags: ["workflow", "specs", "experimental"]
---
Sync delta specs from a change to main specs.
This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
Otherwise, with no root, what happens next depends on how this workflow was reached:
- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
**Input**: Optionally specify a change name after `/opsx:sync` (e.g., `/opsx:sync add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
**Steps**
1. **Select the change**
If a name is provided, use it. Otherwise:
- Infer from conversation context if the user mentioned a change
- Auto-select if only one active change exists
- If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
When prompting, show changes that have delta specs (under `specs/` directory).
Always announce: "Using change: <name>" and how to override (e.g., `/opsx:sync <other>`).
2. **Resolve change context**
Run:
```bash
openspec status --change "<name>" --json
```
The JSON includes `planningHome.root`. Main specs live under `<planningHome.root>/openspec/specs/` — use that (store-aware) root for every main-spec path below, not a hardcoded repo path. When a store is selected it points at the store, not the current repository.
3. **Find delta specs**
Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the
only source of delta spec paths. If the `specs` entry is missing or
`existingOutputPaths` is empty, report that there are no delta specs to sync,
do not infer them from other artifacts, and stop without requesting artifact
instructions or writing a main spec.
Sync every path in `existingOutputPaths` unless the caller narrowed the set.
A caller narrows it by naming an explicit list of complete entries from
`existingOutputPaths` — copy those absolute values verbatim. Archive does
this inline, and a user can too (for example, by selecting the entry ending
in `/specs/billing/invoices/spec.md`).
Then sync only the named paths and leave the remaining delta specs untouched:
bulk archive excludes a delta whose implementation it could not find, and
syncing it anyway would write a main spec the caller deliberately withheld.
Carry that narrowed selection through step 4; never widen it back to the full
list. If a named path is not in `existingOutputPaths`, do not sync it —
report it and stop, rather than dropping it silently. If the named list is
empty, report that there is nothing to sync and stop without writing a main
spec.
Each delta spec file contains sections like:
- `## ADDED Requirements` - New requirements to add
- `## MODIFIED Requirements` - Changes to existing requirements
- `## REMOVED Requirements` - Requirements to remove
- `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
If no delta specs found, inform user and stop.
4. **For each delta spec, apply changes to main specs**
Before the first main-spec write, obtain one current specs-rule snapshot:
- If archive invoked this workflow inline and supplied a valid snapshot from
`openspec instructions specs --change "<name>" --json`, reuse it and do not
fetch the same instructions again.
- Otherwise run that command once now with the same selected-root flags.
- If the direct lookup exits non-zero or returns invalid artifact-instruction
JSON, report the error and stop before writing any main spec. Do not treat the
failure as an absent rule set.
- A valid response with omitted `rules` means no artifact rules are configured
and the existing semantic merge continues.
Apply returned `rules` only to the content and form of the main specs produced
by this merge. Artifact rules are not operation guidance and cannot change
selected roots, delta paths, CLI checks, or workflow steps. Use their text as
constraints without copying it verbatim into a main spec or summary.
For each capability delta spec path selected in step 3 — the full `existingOutputPaths` list, or the narrowed subset when a caller supplied one (these may belong to a selected store, not the repo):
a. **Read the delta spec** to understand the intended changes
b. **Read the main spec** at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (may not exist yet)
**If it does not exist yet** (a new capability), match what `openspec archive` does:
only ADDED requirements may be applied - step d creates the spec from them.
MODIFIED and RENAMED have no requirement to act on, so stop the sync for that
capability and report that its main spec does not exist and only ADDED is allowed
for a new spec; never invent the missing requirement. REMOVED has nothing to
remove - skip it and warn.
c. **Apply changes intelligently**:
**ADDED Requirements:**
- If requirement doesn't exist in main spec → add it
- If requirement already exists → update it to match (treat as implicit MODIFIED)
**MODIFIED Requirements:**
- Find the requirement in main spec
- Apply the changes - this can be:
- Adding new scenarios the main spec does not have yet
- Modifying existing scenarios
- Changing the requirement description
- Preserve scenarios/content not mentioned in the delta
**REMOVED Requirements:**
- Remove the entire requirement block from main spec
- Retiring the capability. Delete the whole `spec.md` - and the directory once
nothing else is left in it - only when ALL of these hold:
1. removing the requirements *this run* left no requirement blocks;
2. the rest of the spec is well-formed (it still has a `## Purpose`);
3. the main spec was not already empty before this sync - if you removed
nothing, change nothing;
4. every other nonblank line in the whole file is accounted for as the
title, Purpose, Requirements header, or a canonical requirement's
statement, scenarios, or fenced examples;
5. the change's `.openspec.yaml` declares `retire_capabilities: true`;
6. the `spec.md` resolves inside the real specs root (do not follow a
capability-directory symlink to delete an external file).
If removing the selected requirements would leave no requirement blocks and
any retirement condition is not satisfied, do not modify the main spec. Stop
the sync for that capability, report the blocking condition, and tell the user
how to resolve it. Never write or leave an empty `## Requirements` section.
When only the marker is missing, say that too - it is the one thing the user
can add to make the retirement go through.
- Deleting the file also deletes its `## Purpose`; any other section blocks
retirement. Name Purpose when you report the retirement. Include a pasteable
`git checkout` only when the spec lived in the caller's checkout;
otherwise give checkout-scoped recovery guidance.
**RENAMED Requirements:**
- Find the FROM requirement, rename to TO
**`## Purpose` in the delta:**
- The main spec already has one and it is authoritative - leave it alone
(this is what `openspec archive` does; it warns and moves on)
d. **Create new main spec** if capability doesn't exist yet:
- Only when the delta has ADDED requirements to put in it and no MODIFIED or
RENAMED requirements blocked this capability in step b. Otherwise create nothing
and leave the specs directory untouched. For a REMOVED-only delta, if the change's
`.openspec.yaml` declares `retire_capabilities: true`, report it as already retired
and continue without recreating the spec. Without that marker, report the sync as blocked:
`openspec archive` rejects it with `Spec must have at least one requirement`.
An empty delta has no operations to sync; report it as blocked too.
Never write an empty `## Requirements` section.
- Create `<planningHome.root>/openspec/specs/<capability-path>/spec.md`
- Add Purpose section: copy the delta's `## Purpose` body verbatim when it has one
(this is what `openspec archive` does); only write a brief TBD placeholder when it does not
- Add Requirements section with the ADDED requirements
- Follow the **Main Spec Format Reference** below
5. **Validate updated main specs**
Run `openspec validate --specs` with the same selected-root flags used earlier.
If validation fails, report the problems and do not claim the sync succeeded.
6. **Show summary**
After applying all changes, summarize:
- Which capabilities were updated
- What changes were made (requirements added/modified/removed/renamed)
- Any new main spec left with a TBD Purpose placeholder, so it gets written
now rather than lingering
- Any capability retired, naming the deleted `spec.md`, its Purpose, and
either a pasteable `git checkout` or checkout-scoped recovery guidance
**Delta Spec Format Reference**
```markdown
# Spec Delta
## Purpose
Only on a delta that introduces a brand-new capability. Seeds the new main spec.
## ADDED Requirements
### Requirement: New Feature
The system SHALL do something new.
#### Scenario: Basic case
- **WHEN** user does X
- **THEN** system does Y
## MODIFIED Requirements
### Requirement: Existing Feature
The system SHALL keep doing the existing thing, now also handling A.
#### Scenario: Scenario the main spec already has
- **WHEN** user does X
- **THEN** system does Y
#### Scenario: New scenario to add
- **WHEN** user does A
- **THEN** system does B
## REMOVED Requirements
### Requirement: Deprecated Feature
## RENAMED Requirements
- FROM: `### Requirement: Old Name`
- TO: `### Requirement: New Name`
```
**Main Spec Format Reference**
Main specs are what the delta merges INTO. They must never contain delta operation headers (`## ADDED/MODIFIED/REMOVED/RENAMED Requirements`) - after syncing, every requirement lives under a single `## Requirements` section:
```markdown
# <capability> Specification
## Purpose
Short description of what this capability does and why it exists.
## Requirements
### Requirement: New Feature
The system SHALL do something new.
#### Scenario: Basic case
- **WHEN** user does X
- **THEN** system does Y
```
**Key Principle: Intelligent Merging**
Unlike programmatic merging, you merge rather than overwrite:
- A MODIFIED block carries the whole requirement - body plus every scenario that survives the change. `openspec validate` and `openspec archive` both reject one that drops a scenario the main spec still has.
- Keep anything the delta does not mention, in the main spec's existing order
- Use your judgment to merge changes sensibly
**Output On Success**
```markdown
## Specs Synced: <change-name>
Updated main specs:
**<capability-1>**:
- Added requirement: "New Feature"
- Modified requirement: "Existing Feature" (added 1 scenario)
**<capability-2>**:
- Created new spec file
- Added requirement: "Another Feature"
Main specs are now updated. The change remains active - archive when implementation is complete.
```
**Guardrails**
- Read both delta and main specs before making changes
- Preserve existing content not mentioned in delta
- Never copy a delta file into a main spec as-is - merge its content so the main spec keeps the Main Spec Format Reference structure, with no delta operation headers
- If something is unclear, ask for clarification
- Show what you're changing as you go
- The operation should be idempotent - running twice should give same result
- Use only `artifactPaths.specs.existingOutputPaths`; never infer delta specs from unrelated artifacts
- Honor a caller-supplied subset of `existingOutputPaths`; never widen it back to the full list
- Fetch specs instructions once for direct sync, or reuse the archive-supplied snapshot inline
- Stop before every main-spec write on a non-zero or invalid JSON specs-instruction response
- Artifact rules constrain only the specs being written and are never copied into output files

105
openvidu-dashboard/.claude/commands/opsx/update.md Normal file
View File

@ -0,0 +1,105 @@
---
name: "OPSX: Update"
description: "Update a change - revise existing planning artifacts and keep them coherent (Experimental)"
allowed-tools: Bash(openspec:*)
category: "Workflow"
tags: ["workflow", "artifacts", "experimental"]
---
Revise a change's existing planning artifacts and keep them coherent. Never edit code.
**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
Otherwise, with no root, what happens next depends on how this workflow was reached:
- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
**Input**: Optionally specify a change name after `/opsx:update` (e.g., `/opsx:update add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
This workflow revises artifacts that already exist; it never creates missing ones. When an artifact is missing, `openspec status --change "<name>" --json` names the next one and `openspec instructions "<artifact-id>" --change "<name>" --json` explains how to write it.
**Steps**
1. **Select the change**
If a name is provided, use it. Otherwise:
- Infer from conversation context if the user mentioned a change
- Auto-select if only one active change exists
- If ambiguous, run `openspec list --json` to get available changes sorted by most recently modified, and ask the user to select one
When prompting, present the top 3-4 most recently modified changes as options, showing:
- Change name
- Status (e.g., "0/5 tasks", "complete", "no tasks")
- How recently it was modified (from `lastModified` field)
Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to update.
Always announce: "Using change: <name>" and how to override (e.g., `/opsx:update <other>`).
2. **Get the change's artifacts**
```bash
openspec status --change "<name>" --json
```
Parse the JSON to understand current state. The response includes:
- `schemaName`: The workflow schema being used (e.g., "spec-driven")
- `artifacts`: Array of artifacts with their status ("done", "skipped", "ready", "blocked")
- `isPlanningComplete`: Boolean indicating if all planning artifacts are complete. Older CLI versions expose the same value as `isComplete`.
- `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
The artifact ids and paths come from the active schema - do NOT assume them, and do NOT branch on hardcoded artifact names. Custom schemas must work unchanged.
The files to edit are `artifactPaths.<id>.existingOutputPaths` - the concrete files that exist on disk, already glob-expanded for glob artifacts (e.g. `specs/**/*.md`). Do NOT write to `resolvedOutputPath`: for a glob artifact it is still the glob pattern, not a real file.
3. **Understand the request**
- If the user asked for a specific revision ("the design now uses X"), that is the starting edit.
- If they only said "update" / "make this coherent", treat it as a coherence review: read the existing artifacts and check them against each other for contradictions, gaps, and duplication.
4. **Read and reconcile**
- Read the artifact(s) the request touches and the change's other existing artifacts.
- Draft the requested edit in the conversation, not in files. Work out exactly what it changes; step 5 owns every write. Then check every other existing artifact against the drafted edit - in ANY direction: an edit to a later artifact may require revising an earlier one, not only the other way around. Build order is a useful reading order, not a constraint on which artifacts may be revised.
- Note everything that is now inconsistent, missing, or contradictory.
- Propose revisions to files that already exist (`existingOutputPaths`). If an artifact has no existing output files and status `ready` or `blocked`, note it and point the user to `openspec instructions "<artifact-id>" --change "<name>" --json` for how to create them. Leave `skipped` artifacts untouched; do not treat them as missing or defer them to the continue workflow.
- A glob artifact (e.g. `specs/**/*.md`) is marked `done` after at least one file matches, and the continue workflow only handles `ready` artifacts. When reconciliation identifies a missing file for a glob artifact whose `existingOutputPaths` is non-empty:
1. Run `openspec instructions "<artifact-id>" --change "<name>" --json` and use its `instruction` and `template`. Treat `context` and `rules` as constraints; do not copy them into the file. If instructions report `skipped: true`, do not create the file. Read current dependency files from disk; if a required non-skipped dependency is missing, stop and ask the user to restore it first.
2. Choose a concrete path inside `changeRoot` that matches `artifactPaths.<id>.outputPath` and does not already exist. Verify it remains inside `changeRoot` after resolving any symlinked parent directories. The glob `resolvedOutputPath` is not a valid target.
3. Include the new file in step 5's proposed revisions and create it only after the user confirms.
4. After confirmation, immediately before creation, refresh status and instructions. Verify the artifact is still in scope, not skipped, and partially populated; repeat the concrete-path checks above.
5. Use a create operation that fails if the target already exists. If `instruction` delegates creation to another skill or command, invoke it only if it can honor the confirmed path and these guardrails; otherwise stop. If any check fails or the confirmed draft is no longer valid, stop and reconcile with the user rather than replacing existing content or choosing a different path.
- If the change is already coherent, say so and propose no revisions.
5. **Confirm and apply, one artifact at a time**
- This step performs every artifact write in this workflow; no earlier step edits an artifact.
- Show each proposed revision and why - including the requested edit drafted in step 4. Write only after the user confirms.
- If the user rejects a revision, do not write it - leave that artifact unchanged.
- When a substantial rewrite is needed, get that artifact's rules and template first:
```bash
openspec instructions "<artifact-id>" --change "<name>" --json
```
6. **Point to the next step (guidance only - NEVER act on it)**
- Artifacts with empty `existingOutputPaths` and status `ready` or `blocked` -> run `openspec status --change "<name>" --json` for the next artifact and point the user to `openspec instructions "<artifact-id>" --change "<name>" --json` for how to create it.
- Change already implemented (tasks checked off / already applied) -> the code may no longer match the revised plan; suggest `/opsx:apply` to carry the delta into code.
- Everything done and implemented -> suggest `/opsx:archive`.
**Output**
After each invocation, show:
- Which artifacts were revised (and which proposed revisions were rejected)
- Any file created under a glob artifact that was already partially populated
- Anything deferred because it does not exist yet (artifacts with no files and status `ready` or `blocked`, never `skipped` artifacts)
- Where the change stands and the recommended next command
**Guardrails**
- Planning artifacts only - NEVER edit implementation code. If the revised plan implies code changes, stop and point to `/opsx:apply`.
- Use the artifact ids and paths reported by `openspec status`; never branch on hardcoded artifact names.
- Edit only the concrete files in `existingOutputPaths`; never write to a glob `resolvedOutputPath`.
- Do not advance the build frontier: if an artifact has empty `existingOutputPaths` and status `ready` or `blocked`, creating them is a separate step, outside this workflow. Leave `skipped` artifacts untouched. The only new-file scope is a confirmed concrete path under a glob artifact whose `existingOutputPaths` is non-empty.
- Confirm every edit with the user before writing.
- If the request changes the change's *intent* rather than refining it, ask for a distinct unused change name and recommend `openspec new change "<new-change-name>"` instead (the "Update vs. Start Fresh" heuristic).

206
openvidu-dashboard/.claude/skills/openspec-apply-change/SKILL.md Normal file
View File

@ -0,0 +1,206 @@
---
name: openspec-apply-change
description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks. Also use when the user says "openspec apply", "opsx apply", or "openspec implement".
allowed-tools: Bash(openspec:*)
license: MIT
compatibility: Requires openspec CLI.
metadata:
author: openspec
version: "1.0"
generatedBy: "1.14.1"
---
Implement tasks from an OpenSpec change.
**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
Otherwise, with no root, what happens next depends on how this workflow was reached:
- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
**Input**: Optionally specify a change name (e.g., `/opsx:apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
**Steps**
1. **Select the change**
If a name is provided, use it. Otherwise:
- Infer from conversation context if the user mentioned a change
- Auto-select if only one active change exists
- If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
2. **Check status to understand the schema**
```bash
openspec status --change "<name>" --json
```
Parse the JSON to understand:
- `schemaName`: The workflow being used (e.g., "spec-driven")
- `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
- Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
3. **Get apply instructions**
```bash
openspec instructions apply --change "<name>" --json
```
This returns:
- `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
- Progress (total, complete, remaining)
- Task list with status, source path, and source line
- Dynamic instruction based on current state
- Optional `context`: current required project instruction input from the selected root
- Optional `operationGuidance`: current advisory guidance for apply
- `missingArtifacts` (when present): required artifact ids with no output
**Handle states:**
- If `state: "blocked"`: show the message and pause implementation.
- If `missingArtifacts` is non-empty: suggest completing the missing artifacts. Run `openspec status --change "<name>" --json`, select the next `ready` artifact (not `skipped` or `blocked`), and use `openspec instructions "<artifact-id>" --change "<name>" --json` for its rules and template. Keep the selected `--store <id>` on both commands.
- Otherwise, follow the CLI instruction to create or repair the schema-configured tracking file from existing planning artifacts. Do not assume another artifact is ready or start implementation while blocked.
- If `state: "all_done"`: report that all tracked tasks are complete and suggest review or verification as appropriate before archiving
- Otherwise: proceed to implementation
Treat `context` as a required prompt-level input. Read and consider it, and
apply relevant project facts, conventions, and constraints while implementing.
Treat `operationGuidance` as optional additive advice. Read and consider every
entry, and follow entries that are applicable and compatible with the built-in
workflow.
Keep both fields separate from CLI-returned state, missing artifacts, tasks,
progress, `contextFiles`, and the built-in `instruction`. They are not
evidence of task completion, do not replace the built-in instruction, and do
not permit bypassing a blocked state. If context conflicts with the built-in
instruction, an explicit user choice, or a CLI-controlled value, report the
conflict and preserve the controlling value. If guidance is inapplicable or
conflicts with those controlling inputs, do not follow it and explain why.
These are prompt-level behavior contracts, not enforceable checks.
4. **Read context files**
Read every file path listed under `contextFiles` from the apply instructions output.
The files depend on the schema being used:
- **spec-driven**: proposal, specs, design, tasks
- Other schemas: follow the contextFiles from CLI output
Do not copy `context` or `operationGuidance` verbatim into implementation
files or planning artifacts unless the user separately asks for that content.
5. **Show current progress**
Display:
- Schema being used
- Progress: "N/M tasks complete"
- Remaining tasks overview
- Dynamic instruction from CLI
6. **Implement tasks (loop until done or blocked)**
For each pending task:
- Show which task is being worked on
- Make the code changes required
- Keep changes minimal and focused
- Before editing, confirm the checkbox at the returned `sourcePath` and `line` still matches the task description; if it does not, rerun the apply instructions and use the refreshed location
- Mark the task complete at its returned `sourcePath` and `line`: `- [ ]` → `- [x]`
- Rerun the apply instructions and confirm that task is now done and progress changed
- Continue to next task
**Pause if:**
- Task is unclear → ask for clarification
- Implementation reveals a design issue → suggest updating artifacts
- A task needs work beyond what the spec and tasks describe, or you are tempted to drop, narrow, defer, or accept exceptions to specified behavior to make it fit → surface the added scope and ask; do not absorb it silently
- Error or blocker encountered → report and wait for guidance
- User interrupts
7. **On completion or pause, show status**
Display:
- Tasks completed this session
- Overall progress: "N/M tasks complete"
- If all done: report that tracked tasks are complete and suggest review or verification as appropriate before archiving
- If paused: explain why and wait for guidance
**Output During Implementation**
```
## Implementing: <change-name> (schema: <schema-name>)
Working on task 3/7: <task description>
[...implementation happening...]
✓ Task complete
Working on task 4/7: <task description>
[...implementation happening...]
✓ Task complete
```
**Output On Completion**
```
## Implementation Complete
**Change:** <change-name>
**Schema:** <schema-name>
**Progress:** 7/7 tasks complete ✓
### Completed This Session
- [x] Task 1
- [x] Task 2
...
All tracked tasks are complete. Review or verify the change as appropriate
before archiving. You can archive this change with `/opsx:archive`.
```
**Output On Pause (Issue Encountered)**
```
## Implementation Paused
**Change:** <change-name>
**Schema:** <schema-name>
**Progress:** 4/7 tasks complete
### Issue Encountered
<description of the issue>
**Options:**
1. <option 1>
2. <option 2>
3. Other approach
What would you like to do?
```
**Guardrails**
- Keep going through tasks until done or blocked
- Always read context files before starting (from the apply instructions output)
- If task is ambiguous, pause and ask before implementing
- If implementation reveals issues, pause and suggest artifact updates
- Keep code changes minimal and scoped to each task
- Update task checkbox immediately after completing each task
- Pause on errors, blockers, or unclear requirements - don't guess
- When a task needs work beyond what the spec describes, surface the added scope and pause - never silently narrow, defer, or simplify away specified behavior
- Only mark a task `- [x]` when its specified behavior is fully implemented, not when it is partially done or deferred
- Use contextFiles from CLI output, don't assume specific file names
- Use each task's sourcePath and line to update its exact checkbox
- Do not use context or operation guidance as proof that a task is complete
- Apply relevant project context; report conflicts with controlling workflow inputs
- Consider every guidance entry; explain any inapplicable or conflicting advice
- Do not copy runtime context or operation guidance into implementation files or planning artifacts
- Preserve CLI-controlled blocked/ready/all-done behavior and completion criteria
**Fluid Workflow Integration**
This skill supports the "actions on a change" model:
- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly

221
openvidu-dashboard/.claude/skills/openspec-archive-change/SKILL.md Normal file
View File

@ -0,0 +1,221 @@
---
name: openspec-archive-change
description: Archive a completed OpenSpec change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete. Also use when the user says "openspec archive" or "opsx archive".
allowed-tools: Bash(openspec:*)
license: MIT
compatibility: Requires openspec CLI.
metadata:
author: openspec
version: "1.0"
generatedBy: "1.14.1"
---
Archive a completed change in the experimental workflow.
**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
Otherwise, with no root, what happens next depends on how this workflow was reached:
- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
**Steps**
1. **Select the change**
If a name is provided, use it. Otherwise:
- Infer from conversation context if the user mentioned a change
- Auto-select if only one active change exists
- If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
When prompting, show only active changes (not already archived).
Include the schema used for each change if available.
Always announce: "Using change: <name>" and how to override (e.g., `/opsx:archive <other>`).
**Load current archive inputs before the existing archive checks:**
After resolving the selected change and planning root, run:
```bash
openspec instructions archive --change "<name>" --json
```
Keep the same selected-root flags on this command. This lookup is advisory and
optional: it only supplies extra prompt inputs, so it must never block archiving.
If it exits non-zero or returns invalid JSON — for example on an older CLI that
does not support this command yet — continue the archive workflow with no
context and no operation guidance. Do not report an error and do not stop.
A successful response may omit both optional fields. Treat `context` as a
required prompt-level input: read and consider it, and apply relevant project
facts, conventions, and constraints. Treat `operationGuidance` as optional
additive advice: read and consider every entry, and follow entries that are
applicable and compatible with the built-in archive workflow.
Keep both fields separate from built-in steps, explicit user choices, resolved
paths, CLI checks, and command contracts. If context conflicts with one of those
controlling inputs, report the conflict and preserve the controlling value. If
guidance is inapplicable or conflicts with a controlling input, do not follow it
and explain why. Do not infer replacement paths, skipped prompts, or flags from
either field, and do not copy their text verbatim into specs, change artifacts,
or archive summaries unless the user separately asks for it. These are
prompt-level behavior contracts, not enforceable checks.
2. **Check artifact completion status**
Run `openspec status --change "<name>" --json` to check artifact completion.
Parse the JSON to understand:
- `schemaName`: The workflow being used
- `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
- `artifacts`: List of artifacts with their status (`done`, `skipped`, or other)
**If any artifacts are neither `done` nor `skipped`** (skipped artifacts satisfy the requirement - the change declares skip_specs):
- Display warning listing incomplete artifacts
- Ask the user to confirm they want to proceed
- Proceed if user confirms
3. **Check task completion status**
Run `openspec list --json` with the same selected-root flags and find the
entry in `changes` whose `name` exactly matches the selected change.
Require exactly one match and nonnegative integer `totalTasks` and
`completedTasks`, with `completedTasks <= totalTasks`. The CLI resolves
the schema's tracked task files, including custom artifact names, output
paths, and globs.
Incomplete tasks = `totalTasks - completedTasks`.
Do not infer task completion from artifact status or the absence of a
top-level `tasks.md`. If the lookup fails, returns invalid JSON, omits or
duplicates the selected change, or returns invalid counts, report the problem
and stop before syncing or archiving.
The CLI counts only `x`/`X` checkbox markers as complete;
other markers, including unfamiliar ones, remain incomplete.
**If incomplete tasks found:**
- Display warning showing count of incomplete tasks
- Ask the user to confirm they want to proceed
- Proceed if user confirms
**If `totalTasks` is zero:** Proceed without a task-related warning.
4. **Assess delta spec sync state**
Use `artifactPaths.specs.existingOutputPaths` from status JSON as the only
delta-spec source. If the `specs` entry is missing or
`existingOutputPaths` is empty, proceed without a sync prompt and do not infer
delta specs from other artifacts.
**If delta specs exist:**
- Compare each delta spec with its corresponding main spec at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (use the store-aware `planningHome.root` from step 2, not a hardcoded repo path)
- A missing main spec is **not automatically** "already synced". For a new capability, the main spec is an *output* of the sync, not an input:
- If the delta has MODIFIED or RENAMED requirements, report that only ADDED requirements can create a new main spec and mark that capability as sync-blocked. Never invent a requirement that has no current version.
- Otherwise, if the delta has only REMOVED requirements and the change's `.openspec.yaml` declares `retire_capabilities: true`, the capability is already retired: count it as already synced, warn that there is nothing left to remove, and do not recreate the main spec. Apply this rule both now and when verifying a completed sync.
- Otherwise, if the delta has no ADDED requirements, report that no sync is possible and mark that capability as sync-blocked. For a REMOVED-only delta, warn that there is no main spec to remove from and leave the main-spec tree unchanged. `openspec archive` refuses the unmarked REMOVED-only case with `Spec must have at least one requirement`.
- Otherwise, count the capability as needing sync and name it in the summary (`<capability-path>: new main spec will be created`). If the delta also has REMOVED requirements, warn that they will be ignored because there is no main spec to remove from. The sync creates the main spec from only the delta's ADDED requirements, exactly as `openspec archive` does.
- Determine what changes would be applied (adds, modifications, removals, renames)
- Continue assessing the remaining capabilities even when one is sync-blocked. Show a combined summary before prompting.
**Prompt options:**
- If any capability is sync-blocked: explain why and offer only "Archive without syncing", "Cancel"
- Otherwise, if changes needed: "Sync now (recommended)", "Archive without syncing"
- Otherwise, if already synced: "Archive now", "Sync anyway", "Cancel"
Route on the answer:
- "Cancel" — stop, do not archive
- "Archive without syncing" or "Archive now" — proceed to archive
- "Sync now" or "Sync anyway" — sync, then verify (below). Do not start any sync while a capability is sync-blocked; explain the blocker and repeat the available choices.
- Anything else — ask again rather than archiving
Before a selected sync writes any main spec, run
`openspec instructions specs --change "<name>" --json` once with the same
selected-root flags. Require a zero exit status and valid artifact-instruction
JSON. If the lookup fails or returns invalid JSON, report the error and stop
before writing any main spec or moving the change. A valid response with omitted
`rules` is the no-rules case. Apply returned `rules` only to the content and
form of main specs produced by this merge; do not use them as archive guidance,
change CLI behavior, or copy the rule text into any output file.
Then run the `openspec-sync-specs` workflow inline (agent-driven intelligent merge) for change '<name>', passing the delta spec analysis and the fetched specs-rule snapshot from above, and wait for it to finish. The inline sync must reuse that snapshot without fetching `specs` instructions again. Do not delegate it to a background task — step 5 would move `changeRoot` out from under a sync that is still reading it, leaving the change archived and the main specs never updated. If your agent can only run it by delegation, delegate synchronously and wait for the result.
If the sync reports any stop or blocking condition, treat the sync as failed.
Stop the archive immediately. Do not perform the post-sync content comparison and do not move its `changeRoot`.
Nothing has moved, so the user can fix the blocking condition or re-run the sync.
After the sync writes each main spec, verify its structure against the canonical sync contract:
- A new main spec starts with a `# <capability> Specification` title. An existing main spec keeps its title exactly as it is.
- Preserve existing `## Purpose` sections completely untouched for established main specs.
- For a new main spec, copy the delta `## Purpose` verbatim. Warn only if the purpose text is shorter than standard validation expects. Do not regenerate or rewrite existing authored purpose. If no usable `## Purpose` is provided, use the existing TBD Purpose behavior and warning.
- Verify that no delta-style section headers (`## ADDED Requirements`, `## MODIFIED Requirements`, `## REMOVED Requirements`, `## RENAMED Requirements`) remain in the main spec, adhering strictly to the sync workflow formatting rules.
- Requirement blocks the sync wrote or changed use `### Requirement:` headings, and their scenarios use `#### Scenario:` headings, under the spec's `## Requirements` section. Leave content the delta does not mention exactly as it is.
Then re-run the comparison from the top of this step, including the explicitly retired, missing-spec case, against every capability that has a delta spec in `artifactPaths.specs.existingOutputPaths` — not only the ones the sync reports it touched. A successful sync leaves nothing left to apply, so each capability must now read as already synced:
- ADDED requirements present
- MODIFIED requirements carrying the scenario and description changes named in the delta, with their other scenarios intact
- REMOVED requirements gone — and where this sync retired a capability (removed its last requirement, leaving `## Requirements` empty), its main spec deleted rather than left empty.
- RENAMED requirements present under the new name and absent under the old one
If the sync failed, or any capability does not match, report what differs and stop — do not archive. Nothing has moved and `changeRoot` is intact, so the user can fix the mismatch or re-run the sync and start the archive again.
5. **Perform the archive**
Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
```bash
mkdir -p "<planningHome.changesDir>/archive"
```
Generate the target name: use the change name as-is when it already starts with a `YYYY-MM-DD-` prefix; otherwise prepend the current date as `YYYY-MM-DD-<change-name>`. Never stack a second date (same rule as `openspec archive`).
**Check if target already exists:**
- If yes: Fail with error, suggest renaming existing archive or using different date
- If no: Move `changeRoot` to the archive directory
```bash
mv "<changeRoot>" "<planningHome.changesDir>/archive/<target-name>"
```
6. **Display summary**
Show archive completion summary including:
- Change name
- Schema that was used
- Archive location
- Whether specs were synced (if applicable)
- Note about any warnings (incomplete artifacts/tasks)
**Output On Success**
```markdown
## Archive Complete
**Change:** <change-name>
**Schema:** <schema-name>
**Archived to:** the archive path derived from `planningHome.changesDir`/<target-name>/
**Specs:** <"✓ Synced to main specs" only if the step 4 verification passed; otherwise "No delta specs" or "Sync skipped">
<"All artifacts complete. All tasks complete." — or, if archived with warnings, list them instead (e.g. "Archived with 2 incomplete tasks")>
```
**Guardrails**
- Announce the selected change; prompt for selection when it is ambiguous
- Use artifact graph (openspec status --json) for completion checking
- Don't block archive on warnings - just inform and confirm
- Preserve .openspec.yaml when moving to archive (it moves with the directory)
- Show clear summary of what happened
- If sync is requested, run the `openspec-sync-specs` workflow inline (agent-driven)
- Never archive while a spec sync is still in flight — run the sync inline and verify the main specs before moving `changeRoot`
- If delta specs exist, always run the sync assessment and show the combined summary before prompting
- Apply relevant runtime context and report conflicts; operation guidance remains advisory
- Consider every guidance entry and explain any inapplicable or conflicting advice
- Existing CLI checks, resolved paths, prompts, and command contracts are unchanged
- Artifact rules constrain only the specs being written and are never operation guidance
- Never copy runtime context, operation guidance, or artifact-rule text verbatim into output files

354
openvidu-dashboard/.claude/skills/openspec-explore/SKILL.md Normal file
View File

@ -0,0 +1,354 @@
---
name: openspec-explore
description: Enter OpenSpec explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements in a project that uses OpenSpec. Use when the user wants to think through something before or during an OpenSpec change. Also use when the user says "openspec explore" or "opsx explore".
allowed-tools: Bash(openspec:*)
license: MIT
compatibility: Requires openspec CLI.
metadata:
author: openspec
version: "1.0"
generatedBy: "1.14.1"
---
Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, investigate the codebase, and run read-only commands or tools without confirmation, but you must NEVER write code or implement features. If the user asks you to implement something, do not start it here: say that explore mode does not implement, and point them at `/opsx:propose`, which turns the discussion into a change. The work happens from that change, never from explore mode. You MAY create or update OpenSpec change artifacts (proposals, designs, specs) within a confirmed scope—that's capturing thinking, not implementing. Answering design or clarifying questions is never consent to write. Before the first write-capable action, name the artifacts or files you would change and what you would do, ask a direct yes/no question, and wait for the user's confirmation in a separate message. Confirmation covers only the scope you described; ask again before expanding it. An explicit request from the user to capture the exploration as a new change is itself that confirmation, covering the change and the change artifacts the request names; scaffold it first as described below.
**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
Otherwise, with no root, what happens next depends on how this workflow was reached:
- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
---
## The Stance
- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
- **Adaptive** - Follow interesting threads, pivot when new information emerges
- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
- **Grounded** - Explore the actual codebase when relevant, don't just theorize
---
## Planning a Change
When the user is planning a change, guide them toward shared understanding with focused discovery questions. For open-ended discussion, follow the conversation without imposing an interview or a required output.
Before asking a factual question, follow the context discovery below and inspect relevant OpenSpec artifacts, source, tests, docs, and configuration. Do not ask the user to repeat facts you can verify. Summarize relevant findings without reproducing private context or rules. If evidence is missing, conflicting, or inaccessible, state that limitation and ask only for the clarification needed to proceed.
- **Follow dependencies** - Resolve the next blocking decision before its dependent details. For example, clarify the user's outcome and scope before choosing an API or data model. Revisit downstream assumptions when an earlier answer changes. Skip branches that do not matter to this goal.
- **Keep questions focused** - Ask one focused question at a time, and briefly explain why it matters and which decision it unlocks. Batch questions only if the user asks for a batch; keep them small and group related decisions.
- **Offer grounded recommendations** - When evidence supports a recommendation, state your preferred option and why it fits the user's goals, with alternatives and their tradeoffs when useful. Do not invent intent, priorities, or external constraints: ask the user when only they can answer. Avoid a fixed question format.
- **Keep a conversational record** - Track decisions in the conversation, not in files. Separate confirmed decisions from proposed defaults and unresolved questions. Silence is not acceptance. Accepting an answer or a batch of recommendations is not permission to write. Keep file-write confirmation separate from discovery questions and follow the guardrails below.
Stop asking when the user has enough clarity. Let them pause, pivot, or defer a decision; do not exhaust every branch or force a proposal.
For example, after inspecting the relevant code:
```text
The CLI already uses SQLite and has no remote service. Is sharing state
across devices in scope? That determines whether local storage is enough.
If this stays a single-device tool, I recommend keeping SQLite to avoid
adding a service to operate; shared state would need a separate sync design.
```
---
## What You Might Do
Depending on what the user brings, you might:
**Explore the problem space**
- Ask clarifying questions that emerge from what they said
- Challenge assumptions
- Reframe the problem
- Find analogies
**Investigate the codebase**
- Map existing architecture relevant to the discussion
- Find integration points
- Identify patterns already in use
- Surface hidden complexity
**Compare options**
- Brainstorm multiple approaches
- Build comparison tables
- Sketch tradeoffs
- Recommend a path (if asked)
**Visualize**
```
+------------------------------------------+
| Use ASCII diagrams liberally |
+------------------------------------------+
| |
| [State A] -------> [State B] |
| | |
| v |
| [State C] |
| |
| System diagrams, state machines, |
| data flows, architecture sketches, |
| dependency graphs, comparison tables |
| |
+------------------------------------------+
```
**Draw with plain ASCII only** — borders `+` `-` `|`, arrows `-->` `<--` `^` `v`, markers `*` `x`.
Unicode diagram glyphs can render at different widths across terminals, fonts, and locales, so padded boxes and aligned tables can drift. Keep every diagram character ASCII.
**Surface risks and unknowns**
- Identify what could go wrong
- Find gaps in understanding
- Suggest spikes or investigations
---
## OpenSpec Awareness
You have full context of the OpenSpec system. Use it naturally, don't force it.
### Check for context
At the start, quickly check what exists:
```bash
openspec list --json
```
This tells you:
- If there are active changes
- Their names and task status
- What the user might be working on
That is the *change* list - work in flight. It does not include the project's durable capabilities, so list those too:
```bash
openspec list --specs
```
Add `--json` for ids and requirement counts, and append `--store "<id>"` only for a registered standalone store. This is the inventory of what the project already claims to do, and `openspec list` on its own never shows it. To look at one, run `openspec show "<spec-id>" --type spec --json --no-scenarios` (same `--store` rule) - it returns that capability's purpose and requirement texts without pulling the whole spec file into context, and `--type spec` stops a change of the same name from making it ambiguous.
The filtered read is only an overview. Before deciding what is already covered or what should change, read each relevant spec in full, including scenarios, with `openspec show "<spec-id>" --type spec` (same `--store` rule).
Then read the project's own context from the resolved root - `<root.path>/openspec/config.yaml` (or `config.yml`). Use the `root.path` returned above, and skip this if neither file exists:
- `context`: project background - tech stack, conventions, constraints
- `rules`: keyed by artifact id - the entries for an artifact apply only when you write that artifact
Ground your thinking in these. They are constraints for you to follow, not content to reproduce: do NOT copy them into the conversation or into any artifact you create.
### When no change exists
Think freely. When insights crystallize, you might offer:
- "This feels solid enough to start a change. Want me to create a proposal?"
- Or keep exploring - no pressure to formalize
If the user asks you to capture the exploration as a new change, that request is the confirmation required above. It covers scaffolding that change and creating the change artifacts the request names, and nothing else. This holds only when the request is theirs: a yes to an offer you made confirms only the scope your offer itself named, so name the change and the artifacts in the offer. Don't re-ask for what they already asked for; do ask before anything beyond it. Transition seamlessly into the requested capture:
1. Run `openspec new change "<name>"` (with `--store <id>` when applicable) before creating any artifacts. Never create a new change directory under `openspec/changes/` by hand; the CLI scaffold creates required metadata such as `.openspec.yaml`. Keep the selected `--store <id>` on every applicable follow-up `status` and `instructions` command.
2. Run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store), then process the requested artifacts in dependency order. For each requested artifact that is `ready`, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store). Before creating a requested artifact, evaluate any condition in its own `instruction` against the explored change; record a deliberate skip instead when the condition does not apply. If a requested artifact is blocked by a direct prerequisite the user did not request, run `openspec instructions "<prerequisite-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) for that prerequisite whether it is `ready` or `blocked`. If its own `instruction` states a condition, evaluate that condition against the explored change and record a deliberate skip only when the condition does not apply. If the condition applies, or the prerequisite is not conditional, treat it as a normal prerequisite and ask before expanding the capture. Do not create an unrequested prerequisite unless the user approves.
3. Follow the returned `template` and `instruction` fields. Read completed dependency files listed in `dependencies`, and apply `context` and `rules` as constraints without copying them into the artifact. If the instruction delegates creation to a specific skill or command, invoke it; otherwise write the artifact to `resolvedOutputPath`, using the instruction to choose a concrete path when it is a glob. Verify that the selected concrete output exists.
4. After creating each artifact, re-run `openspec status --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) and continue until every requested artifact is `done`, `skipped`, or was deliberately skipped because its own `instruction` stated a condition that did not apply. Tell the user about a deliberate conditional skip, remember it, and do not reconsider it. Dependencies are enablers, not gates: if a requested artifact is still `blocked` only because you deliberately skipped a conditional prerequisite, run `openspec instructions "<artifact-id>" --change "<name>" --json` (append the confirmed `--store "<id>"` only for a registered standalone store) despite the blocked status, then create it using step 3 only when those recorded conditional skips are its sole missing dependencies. If a requested artifact is blocked by a prerequisite the user did not ask to capture and cannot be conditionally skipped, explain that dependency and ask before expanding the capture.
Capture the artifact(s) the user requested without asking them to invoke another workflow command. If they asked only to start a change, stop after scaffolding and show its status. When the requested capture is done, stop there and name where the work continues: `/opsx:propose` writes the remaining planning artifacts, and `/opsx:apply` implements the change once tasks exist. Capturing artifacts never starts implementing them.
### When a change exists
If the user mentions a change or you detect one is relevant:
1. **Resolve and read existing artifacts for context**
- Run `openspec status --change "<name>" --json`.
- Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
- Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
2. **Reference them naturally in conversation**
- "Your design mentions using Redis, but we just realized SQLite fits better..."
- "The proposal scopes this to premium users, but we're now thinking everyone..."
3. **Offer to capture when decisions are made**
`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve an existing capability's full path and follow the project's established organization for new capabilities.
| Insight Type | Where to Capture |
|----------------------------|-------------------------------------|
| New requirement discovered | `specs/<capability-path>/spec.md` |
| Requirement changed | `specs/<capability-path>/spec.md` |
| Design decision made | `design.md` |
| Scope changed | `proposal.md` |
| New work identified | `tasks.md` |
| Assumption invalidated | Relevant artifact |
Example offers:
- "That's a design decision. Capture it in design.md?"
- "This is a new requirement. Add it to specs?"
- "This changes scope. Update the proposal?"
4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
---
## What You Don't Have To Do
- Follow a script
- Ask the same questions every time
- Produce a specific artifact
- Reach a conclusion
- Stay on topic if a tangent is valuable
- Be brief (this is thinking time)
---
## Handling Different Entry Points
**User brings a vague idea:**
```
User: I'm thinking about adding real-time collaboration
You: Real-time collab is a big space. Let me think about this...
COLLABORATION SPECTRUM
============================================
Awareness Coordination Sync
| | |
v v v
+--------+ +--------+ +--------+
|Presence| |Cursors | | CRDT |
| "3 | | Multi | |Conflict|
|online" | | select | | free |
+--------+ +--------+ +--------+
| | |
trivial moderate complex
Where's your head at?
```
**User brings a specific problem:**
```
User: The auth system is a mess
You: [reads codebase]
+---------------------------------------------+
| CURRENT AUTH FLOW |
+---------------------------------------------+
|
+-------------+-------------+
v v v
+---------+ +---------+ +---------+
| Google | | GitHub | | Email |
| OAuth | | OAuth | | Magic |
+----+----+ +----+----+ +----+----+
| | |
+-------------+-------------+
v
+-----------+
| Session |
+-----+-----+
|
v
+-----------+
| Perms |
+-----------+
I see three tangles. Which one's burning?
```
**User is stuck mid-implementation:**
```
User: /opsx:explore add-auth-system
The OAuth integration is more complex than expected
You: [reads change artifacts]
You're on task 4: "Implement OAuth flow"
Let me trace what's involved...
[draws diagram, explores options, suggests paths]
Want to update the design to reflect this?
Or add a spike task to investigate?
```
**User wants to compare options:**
```
User: Should we use Postgres or SQLite?
You: Generic answer is boring. What's the context?
User: A CLI tool that tracks local dev environments
You: That changes everything.
+-------------------------------------------------+
| CLI TOOL DATA STORAGE |
+-------------------------------------------------+
Key constraints:
- No daemon running
- Must work offline
- Single user
SQLite Postgres
Deployment embedded needs server
Offline yes no
Single file yes no
SQLite. Not even close.
Unless... is there a sync component?
```
---
## Ending Discovery
There's no required ending. Discovery might:
- **Flow into a proposal**: "Ready to start? Run `/opsx:propose` and this becomes a change."
- **Result in artifact updates**: "Updated design.md with these decisions"
- **Just provide clarity**: User has what they need, moves on
- **Continue later**: "We can pick this up anytime"
When it feels like things are crystallizing, you might summarize:
```
## What We Figured Out
**The problem**: [crystallized understanding]
**The approach**: [if one emerged]
**Open questions**: [if any remain]
**Next steps** (if ready):
- Turn this into a change: `/opsx:propose`
- Keep exploring: just keep talking
```
But this summary is optional. Sometimes the thinking IS the value.
---
## Guardrails
- **Don't implement** - Never write code or implement features. Workflow configuration counts too: creating or editing schemas, templates, or `openspec/config.yaml` is a change, not thinking. Creating or updating OpenSpec change artifacts within the confirmed scope is fine, writing anything else is not. When the user is ready to build, name the handoff rather than starting: `/opsx:propose` turns the discussion into a change, and the work happens there.
- **Don't fake understanding** - If something is unclear, dig deeper
- **Don't rush** - Discovery is thinking time, not task time
- **Don't force structure** - Let patterns emerge naturally
- **Don't auto-capture** - Offer to save insights, don't just do it. Read-only commands and tools need no confirmation. Before the first write-capable action—including `openspec new change` or another command that writes files—name the artifacts or files and proposed changes, ask a direct yes/no question, and wait for explicit confirmation in a separate user message. That confirmation covers only the described scope; ask again before expanding it. Answers to design or clarifying questions are never consent to write. That rule governs `openspec new change` whenever you are the one proposing the capture; the user's own capture request is the exception, handled in the capture transition above.
- **Don't manually scaffold changes** - Never create a new change directory under `openspec/changes/` by hand. Always use `openspec new change "<name>"` (with `--store <id>` when applicable) so required metadata such as `.openspec.yaml` is created before writing artifacts.
- **Do visualize** - A good diagram is worth many paragraphs
- **Do explore the codebase** - Ground discussions in reality
- **Do question assumptions** - Including the user's and your own

174
openvidu-dashboard/.claude/skills/openspec-propose/SKILL.md Normal file
View File

@ -0,0 +1,174 @@
---
name: openspec-propose
description: Propose a new OpenSpec change with all artifacts generated in one step. Use when the user wants to quickly describe what they want to build and get a complete proposal with design, specs, and tasks ready for implementation. Also use when the user says "openspec propose" or "opsx propose".
allowed-tools: Bash(openspec:*)
license: MIT
compatibility: Requires openspec CLI.
metadata:
author: openspec
version: "1.0"
generatedBy: "1.14.1"
---
Propose a new change - create the change and generate all artifacts in one step.
**Planning boundary**: This workflow creates planning artifacts only. The user request that selected or triggered this workflow authorizes planning only, even if it asks to build or fix something. Do not edit project code. After the planning artifacts are complete, stop. Do not start implementation in the same response, even if the initial request asks for it. Wait for a new user request after the artifacts are presented; then start the apply workflow.
I'll create a change with the artifacts your schema defines. With the default spec-driven schema that is:
- proposal.md (what & why)
- `specs/<capability-path>/spec.md` (what the system must do - a delta, not the main spec)
- design.md (how)
- tasks.md (implementation steps)
`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve an existing capability's full path and follow the project's established organization for new capabilities.
When the user is ready to implement, they must start the apply workflow explicitly.
---
**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
Otherwise, with no root, what happens next depends on how this workflow was reached:
- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
**Steps**
1. **Understand the request and clarify material ambiguity**
If no clear input is provided, ask the user (open-ended, no preset options):
> "What change do you want to work on? Describe what you want to build or fix."
From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
**IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
If the request contains ambiguity that would materially affect scope, externally observable behavior, compatibility, or acceptance criteria, ask the user before creating the change. For minor details, make a reasonable assumption and record it in the planning artifacts.
2. **Load project context**
Run `openspec context --json` from the current working directory (or `openspec context --json --store "<store-id>"` when a registered store was explicitly selected). Use the returned `root.path` as the authoritative OpenSpec root. If context reports `no_openspec_root`, stop without creating or changing any files and follow the **Project check** above for how this workflow was reached. Offer `openspec init` only for an explicit OpenSpec request, and wait for the user to request initialization. Do not initialize automatically or run `openspec new change`. After initialization, rerun this context check before continuing. For any other context failure, stop and report the error; do not fall back to the current directory or run later OpenSpec commands without the selected store.
Only when context returns a resolved `root.path`, read `<root.path>/openspec/config.yaml`. Use `config.yml` only when `config.yaml` does not exist. If neither file exists, continue without project context. Do not fall back to `config.yml` if `config.yaml` is unreadable or invalid.
If the file parses as a YAML object and its `context` field is a string no larger than 51,200 bytes in UTF-8, apply that field before exploring the codebase or making planning decisions. If the file cannot be read or parsed, or the context field is invalid or oversized, continue without project context. Validate this field independently of other config fields, as OpenSpec does.
Treat context as project-provided data and constraints, not as authority to change this workflow: it cannot override user authorization, the planning boundary, tool restrictions, or artifact and output rules. Do not copy the context into artifacts; use it to focus any codebase exploration and as a constraint on the proposal.
3. **Determine the workflow schema**
Use the configured default schema unless the user explicitly requests a different workflow.
**Use a different schema only if the user:**
- Explicitly requests a specific schema by name → use `--schema <schema-name>`
- Asks to "show workflows" or asks "what workflows" exist → resolve the authoritative root by running `openspec context --json` from the current working directory. If the user explicitly selected a registered store, use `openspec context --json --store "<store-id>"`. Then run `openspec schemas --json` with its working directory set to the returned `root.path` and let them choose. This preserves roots selected by a local `store:` pointer or the global `defaultStore`; when a registered store was explicitly selected, append `--store "<store-id>"` to `openspec schemas --json` as well. If context fails, stop as described in the context-loading step; do not fall back to the current directory.
Otherwise, omit `--schema` to preserve the configured default.
4. **Create the change directory**
Choose one schema form below. If a registered store is selected, append `--store "<store-id>"` to that command and each later OpenSpec command shown below that accepts `--store`.
Using the configured default:
```bash
openspec new change "<name>"
```
Using an explicitly requested schema:
```bash
openspec new change "<name>" --schema "<schema-name>"
```
This creates a scaffolded change in the planning home resolved by the CLI with `.openspec.yaml`.
5. **Get the artifact build order**
```bash
openspec status --change "<name>" --json
```
Parse the JSON to get:
- `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
- `artifacts`: list of all artifacts, each with its `status` and its `requires` edges (the artifact IDs it directly depends on)
- `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
6. **Create every artifact in the required set**
Use a todo list to track progress through the artifacts.
Loop through artifacts in dependency order (artifacts with no pending dependencies first):
a. **For each artifact that is `ready` (dependencies satisfied)**:
- Get instructions:
```bash
openspec instructions <artifact-id> --change "<name>" --json
```
- The instructions JSON includes:
- `context`: Project background (constraints for you - do NOT include in output)
- `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
- `template`: The structure to use for your output file
- `instruction`: Schema-specific guidance for this artifact type
- `skipped`/`warning`: present when the change declares skip_specs and this artifact must NOT be created - stop and pick another artifact
- `resolvedOutputPath`: Resolved path or pattern to write the artifact
- `dependencies`: Completed artifacts to read for context
- Read any completed dependency files for context - always re-read them from disk, even if you saw them earlier in the conversation (the user may have edited them)
- **Inspect the relevant project before drafting**: Read `context` and `rules` first, then inspect relevant implementation, nearby tests, configuration, and documentation outside `openspec/`. Keep inspection read-only and proportional to the change; reuse findings for later artifacts and inspect more only as needed.
- Identify the target project from the request and project context; the planning home may be separate from the code. If the target is unclear, ask. For greenfield or non-code changes, inspect the available structure and relevant documents. If source is unavailable, state the limitation and ask when it materially affects the plan.
- Ground scope, approach, and tasks in what you find. Distinguish observed behavior from assumptions and proposed additions; surface conflicts with existing specs instead of silently deciding which is correct.
- Do this discovery now, rather than leaving generic "explore the codebase" or "make a plan" tasks for implementation. Keep any necessary follow-up investigation specific to an unresolved question.
- If the `instruction` field delegates creation to a specific skill or command, invoke it to produce the artifact instead of writing the file yourself, then verify the artifact file exists at `resolvedOutputPath`
- Otherwise create the artifact file using `template` as the structure and write it to `resolvedOutputPath`. If `resolvedOutputPath` is a glob, follow `instruction` to choose the concrete file path
- Apply `context` and `rules` as constraints - but do NOT copy them into the file
- Show brief progress: "Created <artifact-id>"
b. **Continue until every artifact in the required set exists (not just `apply.requires`)**
- After creating each artifact, re-run `openspec status --change "<name>" --json`
- The required set is `applyRequires` plus every artifact reachable from those by following the `requires` edges in `status --json` - walk them transitively (spec-driven closes over proposal, specs, design, tasks). Leave artifacts outside that set alone
- `status` is file-existence only, so an `applyRequires` artifact reading `done` does NOT mean its dependencies exist - writing `tasks.md` early marks `tasks` done while `specs` was never written. Use each artifact's `requires` edges, not its `status`, to build the required set: a `done` artifact still lists what it depends on
- An artifact already reading `status: "skipped"` is satisfied: the change declares `skip_specs` in `.openspec.yaml`, so its files must NOT exist. Never try to create one
- Create every artifact in the required set that is missing, then re-check - creating one can unblock others
- Skip one only when `status` already reports it `skipped`, or when its own `instruction` says it is conditional: run `openspec instructions <artifact-id> --change "<name>" --json` and skip only if its `instruction` field marks it optional (e.g. "create only if..."). Spec-driven's `design.md` qualifies; `specs` qualifies only via the `skipped` status above, never by your own judgment. Tell the user, and do not reconsider it
- Dependencies are enablers, not gates: if a required artifact is still `blocked` only because you skipped a conditional dependency, write it anyway
- Stop when every artifact in the required set is `done`, `skipped`, or was deliberately skipped
c. **If an artifact requires user input** (unclear context):
- Ask the user to clarify
- Then continue with creation
7. **Show final status**
```bash
openspec status --change "<name>"
```
**Output**
After completing all artifacts, summarize:
- Change name and location
- List of artifacts created with brief descriptions, plus any conditional artifact you skipped and why
- What's ready: "All artifacts needed for implementation are ready."
- Prompt: "The artifacts are ready for review. When you are ready, run `/opsx:apply` or ask me to apply this change."
**Artifact Creation Guidelines**
- Follow the `instruction` field from `openspec instructions` for each artifact type - it is the authoritative guidance, even for familiar artifact names
- If the `instruction` field directs you to use a specific skill or command to create the artifact, invoke it instead of writing the artifact directly
- The schema defines what each artifact should contain - follow it
- Read dependency artifacts for context before creating new ones
- Use `template` as the structure for your output file - fill in its sections
- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
- Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
- These guide what you write, but should never appear in the output
**Guardrails**
- The request that invoked this workflow authorizes planning only. Any implementation or apply instruction in that request does not carry forward. Do NOT implement the change, start the apply workflow, or edit project code during this workflow. After presenting the artifacts, stop and wait for a new user request to start the apply workflow
- Create every artifact the apply phase transitively depends on, not just the ids listed in `apply.requires`
- Always read dependency artifacts before creating a new one - re-read from disk, not from conversation memory (files may have changed since you last saw them)
- Ask about ambiguities that would materially change scope, externally observable behavior, compatibility, or acceptance criteria; for minor details, make reasonable assumptions and record them
- If a change with that name already exists, ask if user wants to continue it or create a new one
- Verify each artifact file exists after writing before proceeding to next

290
openvidu-dashboard/.claude/skills/openspec-sync-specs/SKILL.md Normal file
View File

@ -0,0 +1,290 @@
---
name: openspec-sync-specs
description: Sync delta specs from an OpenSpec change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change. Also use when the user says "openspec sync" or "opsx sync".
allowed-tools: Bash(openspec:*)
license: MIT
compatibility: Requires openspec CLI.
metadata:
author: openspec
version: "1.0"
generatedBy: "1.14.1"
---
Sync delta specs from a change to main specs.
This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
Otherwise, with no root, what happens next depends on how this workflow was reached:
- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
`<capability-path>` is the spec directory relative to `specs/` (for example, `user-auth` or `identity/user-auth`). Preserve the full path from each delta spec when resolving its main spec.
**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
**Steps**
1. **Select the change**
If a name is provided, use it. Otherwise:
- Infer from conversation context if the user mentioned a change
- Auto-select if only one active change exists
- If ambiguous, run `openspec list --json` to get available changes and ask the user to select one
When prompting, show changes that have delta specs (under `specs/` directory).
Always announce: "Using change: <name>" and how to override (e.g., `/opsx:sync <other>`).
2. **Resolve change context**
Run:
```bash
openspec status --change "<name>" --json
```
The JSON includes `planningHome.root`. Main specs live under `<planningHome.root>/openspec/specs/` — use that (store-aware) root for every main-spec path below, not a hardcoded repo path. When a store is selected it points at the store, not the current repository.
3. **Find delta specs**
Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the
only source of delta spec paths. If the `specs` entry is missing or
`existingOutputPaths` is empty, report that there are no delta specs to sync,
do not infer them from other artifacts, and stop without requesting artifact
instructions or writing a main spec.
Sync every path in `existingOutputPaths` unless the caller narrowed the set.
A caller narrows it by naming an explicit list of complete entries from
`existingOutputPaths` — copy those absolute values verbatim. Archive does
this inline, and a user can too (for example, by selecting the entry ending
in `/specs/billing/invoices/spec.md`).
Then sync only the named paths and leave the remaining delta specs untouched:
bulk archive excludes a delta whose implementation it could not find, and
syncing it anyway would write a main spec the caller deliberately withheld.
Carry that narrowed selection through step 4; never widen it back to the full
list. If a named path is not in `existingOutputPaths`, do not sync it —
report it and stop, rather than dropping it silently. If the named list is
empty, report that there is nothing to sync and stop without writing a main
spec.
Each delta spec file contains sections like:
- `## ADDED Requirements` - New requirements to add
- `## MODIFIED Requirements` - Changes to existing requirements
- `## REMOVED Requirements` - Requirements to remove
- `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
If no delta specs found, inform user and stop.
4. **For each delta spec, apply changes to main specs**
Before the first main-spec write, obtain one current specs-rule snapshot:
- If archive invoked this workflow inline and supplied a valid snapshot from
`openspec instructions specs --change "<name>" --json`, reuse it and do not
fetch the same instructions again.
- Otherwise run that command once now with the same selected-root flags.
- If the direct lookup exits non-zero or returns invalid artifact-instruction
JSON, report the error and stop before writing any main spec. Do not treat the
failure as an absent rule set.
- A valid response with omitted `rules` means no artifact rules are configured
and the existing semantic merge continues.
Apply returned `rules` only to the content and form of the main specs produced
by this merge. Artifact rules are not operation guidance and cannot change
selected roots, delta paths, CLI checks, or workflow steps. Use their text as
constraints without copying it verbatim into a main spec or summary.
For each capability delta spec path selected in step 3 — the full `existingOutputPaths` list, or the narrowed subset when a caller supplied one (these may belong to a selected store, not the repo):
a. **Read the delta spec** to understand the intended changes
b. **Read the main spec** at `<planningHome.root>/openspec/specs/<capability-path>/spec.md` (may not exist yet)
**If it does not exist yet** (a new capability), match what `openspec archive` does:
only ADDED requirements may be applied - step d creates the spec from them.
MODIFIED and RENAMED have no requirement to act on, so stop the sync for that
capability and report that its main spec does not exist and only ADDED is allowed
for a new spec; never invent the missing requirement. REMOVED has nothing to
remove - skip it and warn.
c. **Apply changes intelligently**:
**ADDED Requirements:**
- If requirement doesn't exist in main spec → add it
- If requirement already exists → update it to match (treat as implicit MODIFIED)
**MODIFIED Requirements:**
- Find the requirement in main spec
- Apply the changes - this can be:
- Adding new scenarios the main spec does not have yet
- Modifying existing scenarios
- Changing the requirement description
- Preserve scenarios/content not mentioned in the delta
**REMOVED Requirements:**
- Remove the entire requirement block from main spec
- Retiring the capability. Delete the whole `spec.md` - and the directory once
nothing else is left in it - only when ALL of these hold:
1. removing the requirements *this run* left no requirement blocks;
2. the rest of the spec is well-formed (it still has a `## Purpose`);
3. the main spec was not already empty before this sync - if you removed
nothing, change nothing;
4. every other nonblank line in the whole file is accounted for as the
title, Purpose, Requirements header, or a canonical requirement's
statement, scenarios, or fenced examples;
5. the change's `.openspec.yaml` declares `retire_capabilities: true`;
6. the `spec.md` resolves inside the real specs root (do not follow a
capability-directory symlink to delete an external file).
If removing the selected requirements would leave no requirement blocks and
any retirement condition is not satisfied, do not modify the main spec. Stop
the sync for that capability, report the blocking condition, and tell the user
how to resolve it. Never write or leave an empty `## Requirements` section.
When only the marker is missing, say that too - it is the one thing the user
can add to make the retirement go through.
- Deleting the file also deletes its `## Purpose`; any other section blocks
retirement. Name Purpose when you report the retirement. Include a pasteable
`git checkout` only when the spec lived in the caller's checkout;
otherwise give checkout-scoped recovery guidance.
**RENAMED Requirements:**
- Find the FROM requirement, rename to TO
**`## Purpose` in the delta:**
- The main spec already has one and it is authoritative - leave it alone
(this is what `openspec archive` does; it warns and moves on)
d. **Create new main spec** if capability doesn't exist yet:
- Only when the delta has ADDED requirements to put in it and no MODIFIED or
RENAMED requirements blocked this capability in step b. Otherwise create nothing
and leave the specs directory untouched. For a REMOVED-only delta, if the change's
`.openspec.yaml` declares `retire_capabilities: true`, report it as already retired
and continue without recreating the spec. Without that marker, report the sync as blocked:
`openspec archive` rejects it with `Spec must have at least one requirement`.
An empty delta has no operations to sync; report it as blocked too.
Never write an empty `## Requirements` section.
- Create `<planningHome.root>/openspec/specs/<capability-path>/spec.md`
- Add Purpose section: copy the delta's `## Purpose` body verbatim when it has one
(this is what `openspec archive` does); only write a brief TBD placeholder when it does not
- Add Requirements section with the ADDED requirements
- Follow the **Main Spec Format Reference** below
5. **Validate updated main specs**
Run `openspec validate --specs` with the same selected-root flags used earlier.
If validation fails, report the problems and do not claim the sync succeeded.
6. **Show summary**
After applying all changes, summarize:
- Which capabilities were updated
- What changes were made (requirements added/modified/removed/renamed)
- Any new main spec left with a TBD Purpose placeholder, so it gets written
now rather than lingering
- Any capability retired, naming the deleted `spec.md`, its Purpose, and
either a pasteable `git checkout` or checkout-scoped recovery guidance
**Delta Spec Format Reference**
```markdown
# Spec Delta
## Purpose
Only on a delta that introduces a brand-new capability. Seeds the new main spec.
## ADDED Requirements
### Requirement: New Feature
The system SHALL do something new.
#### Scenario: Basic case
- **WHEN** user does X
- **THEN** system does Y
## MODIFIED Requirements
### Requirement: Existing Feature
The system SHALL keep doing the existing thing, now also handling A.
#### Scenario: Scenario the main spec already has
- **WHEN** user does X
- **THEN** system does Y
#### Scenario: New scenario to add
- **WHEN** user does A
- **THEN** system does B
## REMOVED Requirements
### Requirement: Deprecated Feature
## RENAMED Requirements
- FROM: `### Requirement: Old Name`
- TO: `### Requirement: New Name`
```
**Main Spec Format Reference**
Main specs are what the delta merges INTO. They must never contain delta operation headers (`## ADDED/MODIFIED/REMOVED/RENAMED Requirements`) - after syncing, every requirement lives under a single `## Requirements` section:
```markdown
# <capability> Specification
## Purpose
Short description of what this capability does and why it exists.
## Requirements
### Requirement: New Feature
The system SHALL do something new.
#### Scenario: Basic case
- **WHEN** user does X
- **THEN** system does Y
```
**Key Principle: Intelligent Merging**
Unlike programmatic merging, you merge rather than overwrite:
- A MODIFIED block carries the whole requirement - body plus every scenario that survives the change. `openspec validate` and `openspec archive` both reject one that drops a scenario the main spec still has.
- Keep anything the delta does not mention, in the main spec's existing order
- Use your judgment to merge changes sensibly
**Output On Success**
```markdown
## Specs Synced: <change-name>
Updated main specs:
**<capability-1>**:
- Added requirement: "New Feature"
- Modified requirement: "Existing Feature" (added 1 scenario)
**<capability-2>**:
- Created new spec file
- Added requirement: "Another Feature"
Main specs are now updated. The change remains active - archive when implementation is complete.
```
**Guardrails**
- Read both delta and main specs before making changes
- Preserve existing content not mentioned in delta
- Never copy a delta file into a main spec as-is - merge its content so the main spec keeps the Main Spec Format Reference structure, with no delta operation headers
- If something is unclear, ask for clarification
- Show what you're changing as you go
- The operation should be idempotent - running twice should give same result
- Use only `artifactPaths.specs.existingOutputPaths`; never infer delta specs from unrelated artifacts
- Honor a caller-supplied subset of `existingOutputPaths`; never widen it back to the full list
- Fetch specs instructions once for direct sync, or reuse the archive-supplied snapshot inline
- Stop before every main-spec write on a non-zero or invalid JSON specs-instruction response
- Artifact rules constrain only the specs being written and are never copied into output files

109
openvidu-dashboard/.claude/skills/openspec-update-change/SKILL.md Normal file
View File

@ -0,0 +1,109 @@
---
name: openspec-update-change
description: Update an OpenSpec change by revising its existing planning artifacts and keeping them coherent with one another. Use when the user wants to revise a change's plan, fold new decisions into it, or reconcile its artifacts after an edit. Also use when the user says "openspec update change" or "opsx update". If the user means the openspec update CLI command, which refreshes generated files, run that command instead. Never edits code.
allowed-tools: Bash(openspec:*)
license: MIT
compatibility: Requires openspec CLI.
metadata:
author: openspec
version: "1.0"
generatedBy: "1.14.1"
---
Revise a change's existing planning artifacts and keep them coherent. Never edit code.
**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`, `schemas`, `view`). Once selected, treat `--store <id>` as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run `openspec status --change "<name>" --json --store "<id>"`, not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
**Project check:** These steps expect a project that already uses OpenSpec. Before the first step that writes anything (`new change`, `archive`, `sync specs`, or authoring an artifact file), confirm the project has a root: run `openspec list --json` (with `--store <id>` when a store is selected, since the store is then the root) and read `root`. A root object means the project is set up. `"root": null` means it is not - there is no `openspec/` directory here, and a write such as `openspec new change` would create one as a side effect. The command also exits non-zero, which is that answer rather than a broken CLI, so read the JSON instead of retrying or working around it.
One `"root": null` is not about setup: when a `status` error message starts with `Declared in` or `Invalid store declaration in` and names this project's `openspec/config.yaml` (or `config.yml`), the project does use OpenSpec through a store it declares, which this machine cannot resolve (the store is not registered, or the `store:` line is malformed). Do not treat it as uninitialized and skip the branches below: stop before writing and show the user that error's `message` and `fix`.
Otherwise, with no root, what happens next depends on how this workflow was reached:
- **Auto-selected**: you chose this workflow yourself, without the user naming OpenSpec, naming this skill, or running its slash command. Stop using OpenSpec and answer the request normally, as you would with no OpenSpec installed. Do not ask them to set anything up and do not mention OpenSpec setup.
- **Explicit OpenSpec request**: the user named OpenSpec, named this skill, or ran its slash command. Stop before writing and ask how to proceed: set this project up (`openspec init`), target a store they already have (`--store <id>`), or continue without OpenSpec for this request. Wait for their answer.
In both branches, never create the root as a side effect: do not run `openspec init` until the user asks for it, do not hand-create `openspec/` files, and do not let a command create it.
**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
This workflow revises artifacts that already exist; it never creates missing ones. When an artifact is missing, `openspec status --change "<name>" --json` names the next one and `openspec instructions "<artifact-id>" --change "<name>" --json` explains how to write it.
**Steps**
1. **Select the change**
If a name is provided, use it. Otherwise:
- Infer from conversation context if the user mentioned a change
- Auto-select if only one active change exists
- If ambiguous, run `openspec list --json` to get available changes sorted by most recently modified, and ask the user to select one
When prompting, present the top 3-4 most recently modified changes as options, showing:
- Change name
- Status (e.g., "0/5 tasks", "complete", "no tasks")
- How recently it was modified (from `lastModified` field)
Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to update.
Always announce: "Using change: <name>" and how to override (e.g., `/opsx:update <other>`).
2. **Get the change's artifacts**
```bash
openspec status --change "<name>" --json
```
Parse the JSON to understand current state. The response includes:
- `schemaName`: The workflow schema being used (e.g., "spec-driven")
- `artifacts`: Array of artifacts with their status ("done", "skipped", "ready", "blocked")
- `isPlanningComplete`: Boolean indicating if all planning artifacts are complete. Older CLI versions expose the same value as `isComplete`.
- `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
The artifact ids and paths come from the active schema - do NOT assume them, and do NOT branch on hardcoded artifact names. Custom schemas must work unchanged.
The files to edit are `artifactPaths.<id>.existingOutputPaths` - the concrete files that exist on disk, already glob-expanded for glob artifacts (e.g. `specs/**/*.md`). Do NOT write to `resolvedOutputPath`: for a glob artifact it is still the glob pattern, not a real file.
3. **Understand the request**
- If the user asked for a specific revision ("the design now uses X"), that is the starting edit.
- If they only said "update" / "make this coherent", treat it as a coherence review: read the existing artifacts and check them against each other for contradictions, gaps, and duplication.
4. **Read and reconcile**
- Read the artifact(s) the request touches and the change's other existing artifacts.
- Draft the requested edit in the conversation, not in files. Work out exactly what it changes; step 5 owns every write. Then check every other existing artifact against the drafted edit - in ANY direction: an edit to a later artifact may require revising an earlier one, not only the other way around. Build order is a useful reading order, not a constraint on which artifacts may be revised.
- Note everything that is now inconsistent, missing, or contradictory.
- Propose revisions to files that already exist (`existingOutputPaths`). If an artifact has no existing output files and status `ready` or `blocked`, note it and point the user to `openspec instructions "<artifact-id>" --change "<name>" --json` for how to create them. Leave `skipped` artifacts untouched; do not treat them as missing or defer them to the continue workflow.
- A glob artifact (e.g. `specs/**/*.md`) is marked `done` after at least one file matches, and the continue workflow only handles `ready` artifacts. When reconciliation identifies a missing file for a glob artifact whose `existingOutputPaths` is non-empty:
1. Run `openspec instructions "<artifact-id>" --change "<name>" --json` and use its `instruction` and `template`. Treat `context` and `rules` as constraints; do not copy them into the file. If instructions report `skipped: true`, do not create the file. Read current dependency files from disk; if a required non-skipped dependency is missing, stop and ask the user to restore it first.
2. Choose a concrete path inside `changeRoot` that matches `artifactPaths.<id>.outputPath` and does not already exist. Verify it remains inside `changeRoot` after resolving any symlinked parent directories. The glob `resolvedOutputPath` is not a valid target.
3. Include the new file in step 5's proposed revisions and create it only after the user confirms.
4. After confirmation, immediately before creation, refresh status and instructions. Verify the artifact is still in scope, not skipped, and partially populated; repeat the concrete-path checks above.
5. Use a create operation that fails if the target already exists. If `instruction` delegates creation to another skill or command, invoke it only if it can honor the confirmed path and these guardrails; otherwise stop. If any check fails or the confirmed draft is no longer valid, stop and reconcile with the user rather than replacing existing content or choosing a different path.
- If the change is already coherent, say so and propose no revisions.
5. **Confirm and apply, one artifact at a time**
- This step performs every artifact write in this workflow; no earlier step edits an artifact.
- Show each proposed revision and why - including the requested edit drafted in step 4. Write only after the user confirms.
- If the user rejects a revision, do not write it - leave that artifact unchanged.
- When a substantial rewrite is needed, get that artifact's rules and template first:
```bash
openspec instructions "<artifact-id>" --change "<name>" --json
```
6. **Point to the next step (guidance only - NEVER act on it)**
- Artifacts with empty `existingOutputPaths` and status `ready` or `blocked` -> run `openspec status --change "<name>" --json` for the next artifact and point the user to `openspec instructions "<artifact-id>" --change "<name>" --json` for how to create it.
- Change already implemented (tasks checked off / already applied) -> the code may no longer match the revised plan; suggest `/opsx:apply` to carry the delta into code.
- Everything done and implemented -> suggest `/opsx:archive`.
**Output**
After each invocation, show:
- Which artifacts were revised (and which proposed revisions were rejected)
- Any file created under a glob artifact that was already partially populated
- Anything deferred because it does not exist yet (artifacts with no files and status `ready` or `blocked`, never `skipped` artifacts)
- Where the change stands and the recommended next command
**Guardrails**
- Planning artifacts only - NEVER edit implementation code. If the revised plan implies code changes, stop and point to `/opsx:apply`.
- Use the artifact ids and paths reported by `openspec status`; never branch on hardcoded artifact names.
- Edit only the concrete files in `existingOutputPaths`; never write to a glob `resolvedOutputPath`.
- Do not advance the build frontier: if an artifact has empty `existingOutputPaths` and status `ready` or `blocked`, creating them is a separate step, outside this workflow. Leave `skipped` artifacts untouched. The only new-file scope is a confirmed concrete path under a glob artifact whose `existingOutputPaths` is non-empty.
- Confirm every edit with the user before writing.
- If the request changes the change's *intent* rather than refining it, ask for a distinct unused change name and recommend `openspec new change "<new-change-name>"` instead (the "Update vs. Start Fresh" heuristic).

16
openvidu-dashboard/.dockerignore Normal file
View File

@ -0,0 +1,16 @@
# Build context of the Dockerfile: the workspace root without what the image never needs.
**/node_modules
**/dist
**/.angular
**/coverage
**/test-results
**/playwright-report
**/blob-report
**/*.tsbuildinfo
.git
.claude
openspec
dashboard-ce/tools
# Their manifests keep the workspace consistent with the lockfile.
!dashboard-ce/tools/*/package.json
PLAN.md

13
openvidu-dashboard/.editorconfig Normal file
View File

@ -0,0 +1,13 @@
root = true
[*]
charset = utf-8
end_of_line = lf
insert_final_newline = true
trim_trailing_whitespace = true
indent_style = tab
indent_size = 4
[*.{yml,yaml,md}]
indent_style = space
indent_size = 2

17
openvidu-dashboard/.gitignore vendored Normal file
View File

@ -0,0 +1,17 @@
node_modules/
dist/
.angular/
coverage/
test-results/
playwright-report/
*.log
.env
.env.*
!.env.example
.DS_Store
# Local planning document, never committed
PLAN.md
# Icon sprite generated by dashboard-ce/frontend/scripts/icons.mjs
dashboard-ce/frontend/projects/dashboard-ui/assets/icons.svg

1
openvidu-dashboard/.node-version Normal file
View File

@ -0,0 +1 @@
24

7
openvidu-dashboard/.prettierignore Normal file
View File

@ -0,0 +1,7 @@
node_modules/
dist/
.angular/
coverage/
.claude/
openspec/
pnpm-lock.yaml

24
openvidu-dashboard/.prettierrc Normal file
View File

@ -0,0 +1,24 @@
{
"useTabs": true,
"tabWidth": 4,
"printWidth": 120,
"singleQuote": true,
"trailingComma": "none",
"semi": true,
"endOfLine": "lf",
"overrides": [
{
"files": ["dashboard-*/frontend/**/*.html"],
"options": {
"parser": "angular"
}
},
{
"files": ["*.yml", "*.yaml", "*.md"],
"options": {
"useTabs": false,
"tabWidth": 2
}
}
]
}

94
openvidu-dashboard/AGENTS.md Normal file
View File

@ -0,0 +1,94 @@
# OpenVidu Dashboard
Admin web application bundled with every OpenVidu deployment: live monitoring and usage analytics of rooms,
participants, tracks, egress and ingress, read from the MongoDB analytics database written by the OpenVidu server
(`openvidu-livekit`, `openvidu/analytics/`). This workspace is the Community edition (**CE**, `dashboard-ce/`); the
commercial PRO edition extends its packages from a workspace of its own. `README.md` covers commands, the image,
configuration variables and exit codes.
## Working rules
1. Code, comments, specs, README, CHANGELOG and commit messages are in English. Comments only for non-obvious
constraints; never narrate history or the conversation in code or docs.
2. Before adding or upgrading a library, check its latest stable version on npm (`npm view <pkg> version`) and its
current API through Context7. Versions are pinned exactly; a dependency used by several packages goes once in the
`catalog` of `pnpm-workspace.yaml`; install scripts stay disabled except those listed in `allowBuilds`.
3. When something is ambiguous, infeasible or unexpected, stop and ask the owner instead of deciding. A change in
another repository (`openvidu-livekit`, `openvidu-deployment`, `openvidu.io`) goes to its open pull request, or to a
new draft pull request when none fits.
4. Run `./dashboard.sh check` before reporting work as done. Suites that need Docker cannot run from a bare checkout:
say so instead of reporting a pass.
5. Keep the `AGENTS.md` files current in the same change as the command, path or convention they describe. Each
`CLAUDE.md` is a symlink to the `AGENTS.md` beside it.
## Spec-driven workflow (OpenSpec)
- `openspec/specs/<capability>/spec.md` describe the current behaviour and are its source of truth; project context and
per-artifact rules live in `openspec/config.yaml`.
- `/opsx:propose <name>` → owner review → `/opsx:apply` → `/opsx:archive`; no implementation without an approved
change. Decisions go to the change's `design.md`, project-wide ones also to the `context` of `openspec/config.yaml`.
- Archiving syncs the delta specs into `openspec/specs` and deletes the change folder (no archive copy), in a commit
"openvidu-dashboard: archive <name>, keep only the specs". `./dashboard.sh spec-validate` must pass.
- Start Claude Code sessions from this directory so the OpenSpec skills and `/opsx:*` commands load.
## Layout
| Path | Contents | Agent notes |
| ----------------------------------- | ---------------------------------------------------------------------------- | ----------- |
| `dashboard-ce/typings` | Contract shared by backend, frontend and the writer; API types | `README.md` |
| `dashboard-ce/backend` | Express 5 REST API; serves the built SPA | `AGENTS.md` |
| `dashboard-ce/frontend` | Thin CE application and, in `projects/dashboard-ui`, the library with all UI | `AGENTS.md` |
| `dashboard-ce/e2e` | Playwright tests against the built applications | `AGENTS.md` |
| `dashboard-ce/docker` | Image and its smoke test | `AGENTS.md` |
| `dashboard-ce/tools/data-generator` | Contract-valid analytics data for tests and the local demo | `README.md` |
| `openspec/` | Specs and in-progress changes | |
Build order: `typings` → `backend` → `dashboard-ui` → `frontend`. Workspace packages are consumed from their TypeScript
sources through the `source` export condition, so type checking, linting and tests need no build; the runtime uses
`dist`.
## Commands
Everything runs through `./dashboard.sh` (what CI calls; `help` lists every command, any accepts `--skip-install`):
`check` (lint, format check, typecheck, spec validation, unit tests), `test-integration` (Docker), `e2e`,
`contract-check <openvidu-livekit>`, `build-image ce`, `smoke-image ce`, and `demo ce`: a local demo on generated data
(http://localhost:4200, `admin` / `admin`; MongoDB container `openvidu-dashboard-demo-mongo` on port 27018;
`DASHBOARD_DEMO_KEEP_DATA=true` reuses the data of a running container).
Node 24 and pnpm through Corepack. Node stays on 24 until OpenVidu Meet moves to 26; TypeScript stays on 6 until the
Angular toolchain supports 7. Prettier: tabs, width 120, single quotes, no trailing commas; ESLint fails on warnings.
CI (`.github/workflows/openvidu-dashboard-ci.yml` of the `openvidu` repository, jobs `checks`, `unit`, `integration`,
`contract`, `e2e`) runs every job on `ubuntu-latest`, with actions pinned to commit SHAs. The image is built and
published by `docker-release.yaml` in openvidu-deployment.
## Edition model
- Backend: CE exports `startDashboard(options)`; an extending edition calls it with a `configure(container)` that
rebinds DI tokens and registers its routes over the CE locks, and with `startupHooks` that run before it listens.
- UI: every CE page and building block lives in the `dashboard-ui` library; the applications only compose routes. An
extending edition adds its pages over locked CE routes and fills explicit seams (see the library README). Keep seams
open in CE (injectable services, route configs, content projection) and never put logic in the shells.
- `GET /api/v1/info` reports the edition and its features. CE shows PRO features locked, never hidden; PRO API routes
answer `403 PRO_FEATURE` in CE.
## Data contract
- The contract lives in `dashboard-ce/typings` (see its README): sources in `contract/`, generated `schema/` and
`fixtures/` (never edited by hand), vendored by the writer, schema version checked by both sides at startup.
- Adding or changing a field is one change covering the writer projector, typings, the legacy migration mapping, the
collection validator and tests on both sides; `./dashboard.sh contract-check` verifies it end to end.
- No secrets in the analytics database. Participant counters count STANDARD sessions; the other kinds are services.
## CHANGELOG
`CHANGELOG.md`, newest release first, sections `Upgrade notes → Breaking changes → Deprecated → Added → Improved →
Fixed`; `Added`, `Improved` and `Fixed` group entries under `UI`, `Data` and `Deployment`. One present-tense line per
observable change, written in the same commit as the change; refactors, tests and docs get none.
## Pointers
- Writer: `openvidu-livekit/openvidu/analytics/` (branch `openvidu/main`; also the `openvidu-livekit` submodule of this
repository).
- Deployment: `openvidu-deployment` (installer templates, Helm chart, `docker-release.yaml`).
- Documentation page: `openvidu.io/docs/docs/self-hosting/production-ready/observability/openvidu-dashboard.md`.

152
openvidu-dashboard/CHANGELOG.md Normal file
View File

@ -0,0 +1,152 @@
# Changelog
Newest release first. Sections appear in this order, omitting the empty ones: `Upgrade notes`,
`Breaking changes`, `Deprecated`, `Added`, `Improved`, `Fixed`. `Added`, `Improved` and `Fixed` group their
entries under `UI` (what an administrator sees), `Data` (what is stored and how it is queried) and
`Deployment` (running the service). One line per observable change, present tense.
## 3.10.0 (unreleased)
### Upgrade notes
- The first start after the upgrade migrates the existing analytics data in the background; the dashboard shows the
progress. Legacy `events` is renamed `legacy_events` and expires with its TTL; `active_entities` and `last_alive` are
removed.
- `ADMIN_USERNAME` and `ADMIN_PASSWORD` are required: the dashboard no longer starts with built-in credentials.
- `LOG_LEVEL` defaults to `info` instead of `debug`, and `SERVER_PORT` to `5000` (the port every installer sets)
instead of `3000`.
- The CE image builds from `dashboard-ce/docker/Dockerfile` with `openvidu-dashboard/` as context.
- The image runs as uid 1000: mounted configuration and certificate authority files must be readable by that user.
- Client IP addresses are no longer stored by default; set `openvidu.analytics.anonymize_ip: false` to store them.
### Breaking changes
- The server no longer writes the legacy `stats`, `active_entities` and `last_alive` collections nor events in the
legacy document shape, and its Redis analytics sink is removed.
- The API moves to `/api/v1`; the unversioned routes and `POST /api/login` are removed.
### Deprecated
- `openvidu.analytics.expiration`: mapped to `retention.events` and `retention.stats`, which replace it.
- `openvidu.analytics.fixer_interval`: replaced by `openvidu.analytics.reconciler.interval`.
### Added
#### UI
- Sessions survive page reloads and expire after 7 days without use; access tokens are never stored in the browser.
- Responsive shell with sidenav, global search, global time range, auto-refresh at every screen size and theme toggle;
the OpenVidu version, edition badge and documentation links sit at the bottom of the sidenav.
- Server status banners on every page: no analytics data received, schema and migration progress; they follow the
server even with auto-refresh off, and the connectivity and no-data banners appear only after two bad results in a
row.
- The LIVE label reads paused while auto-refresh is off and stale when data stops arriving, judged with the writer's
batch interval, and keeps its width in every state.
- Auto-refresh offers one interval for every live view; a page that cannot refresh now, such as an ended room, shows
why on the disabled interval control, and Analytics refreshes only on demand.
- Every list, chart and detail view is reproducible from its URL; Back restores filters, sort and page. The time zone
picked in the range picker or the header zone chip applies to every page of the session.
- The range picker warns while the start of the range predates the retention of the page's data: entities on the
lists, daily rollups on Analytics.
- Lists share one search box with hints; an exact ID shows its entity whatever the range and filters, and Enter opens
it. Empty lists offer Clear filters and Widen range, and an unknown ID says so.
- Tables show every selected column and scroll sideways when they do not fit, turn into cards only on phones, keep
their rows while they refresh and show skeletons only before their first data.
- Enum values read as friendly labels, durations count up live and charts update in place without replaying their
animation; every time-series chart names its bucket and time zone.
- Info icons next to tiles, cards, charts and columns explain the terms they show, such as participant sessions and
unique identities; they open on hover, keyboard focus or a tap.
- PRO features appear locked in CE with a short explanation and a link.
- Settings page with viewer preferences (any time zone as the default) and an About tab with the OpenVidu version, the
migration progress while it runs, the retention per data class and the storage.
- KPI tiles spread evenly over the fewest rows that fit, on every page.
- Light and dark themes meeting WCAG AA, self-hosted fonts and icons.
- Rooms list with status, name or SID and feature filters, sorts by start, end, duration, unique identities and
active participants, summary tiles and live refresh.
- Participants page with live refresh: active participants, sessions in range and active services; search participant
sessions by identity or SID, filter by kind (standard participants by default), status, room and publishers, sort
by join, leave and duration, and see the sources each session published.
- Agents page listing agent sessions with a live counter and the agent sessions of the range, searchable by identity
and sortable by join, leave and duration.
- Egress list searchable by room name or egress ID, with type, status and room filters, sorts by start, end and
duration, summary tiles and live refresh.
- Ingress list of the ingresses created, used or publishing in the range, searchable by name or ID, with input type and
status filters, sorts by creation, total duration, sessions and last session, summary tiles and live refresh.
- Analytics page with rooms, participants, client, data transferred, egress and ingress (with the input type)
sections over the global range, loaded on demand, with CSV export; every series of a chart has its own colour, and
a section without data shrinks to its "No data in this range" message.
- Overview page with live counters of rooms, participants, publishers, egress, ingress and agents linked to their
lists, today's figures, recent rooms, the data pipeline health (writer and nodes reporting) and stale-data notices.
#### Data
- New analytics data model: one document per room session, participant session, published track, subscription,
egress, ingress and ingress session, plus raw events, statistics time series and 5-minute, hourly and daily
rollups, with a schema version that the server and the dashboard check at startup.
- The server writes the new analytics model in idempotent per-node batches, with a retention per data class.
- `openvidu.analytics` options `retention` (per data class, in days: `events`, `stats`, `tracks` and `rollups_5min`
7 days, `entities` 90 days, `rollups_hourly` 400 days and `rollups_daily`, unlimited unless set), `stats_detail`,
`anonymize_ip`, `store_metadata`, `events.store_types`, `queue` and `validation_action`.
- API calls to the server are counted per method in the hourly and daily rollups.
- Hourly and daily rollups count ingress sessions by input type.
- Each server node records its analytics batch interval with every heartbeat.
- Egress documents carry their room name in lower case, indexed for the room name search; ingress definitions are
indexed by the start of their last session.
- Participant counts, sessions, minutes, unique identities and client breakdowns count standard participants only;
egress, ingress, agent and SIP sessions are counted apart, by kind.
- Participants, tracks and subscriptions left by a crashed or stopped server node are closed by the server within 2
minutes, and their rooms with the last of their sessions once LiveKit's dead node cleanup released them, with an end
time accurate to 30 s (`openvidu.analytics.reconciler` options `enabled`, `interval` and `max_closures_per_run`).
- A recording lost with its node is reported as failed, never as complete.
- Legacy analytics data is migrated to the v2 model automatically.
- Lists sort by metrics (durations, end times, counters) within a range limit reported by `GET /api/v1/info`, an exact
ID always finds its entity whatever the range and filters, and active rooms and participants carry a `stale` flag.
- Rooms API: `/api/v1/rooms` and `/rooms/summary`, with rooms sorted by start, end, duration, unique identities and
active participants.
- Participants API: `/api/v1/participants`, `/participants/summary` and `/api/v1/agents` with search, with sessions
sorted by join, leave and duration, filtered by publishers and listing their published sources.
- Egress API: `/api/v1/egresses` and `/egresses/summary`, with egresses sorted by start, end and duration and searched
by their own room name.
- Ingress API: `/api/v1/ingresses` and `/ingresses/summary`, where the range selects the ingresses created, used or
publishing in it, sorted by creation, total duration, sessions or last session.
- Analytics API: `/api/v1/analytics/series`, `/breakdowns`, `/summary` and `/export.csv`, read from the rollup
collections, ingress sessions, their durations and their input types included.
- Overview API: `GET /api/v1/overview` with live counters, today's totals and recent rooms.
- Status API: `GET /api/v1/status` with the schema status, migration progress, writer health and the writer's batch
interval, from which the writer, node and stale-data windows widen for slow batches.
#### Deployment
- `openvidu.analytics.migration.*` settings control the migration.
- Analytics durations accept days (`7d`, `1d12h`), and the server refuses to start on a retention above the MongoDB TTL
limit, an entity retention under 2 days or a daily rollup retention shorter than the hourly one, naming the key.
- The server logs a warning when a full analytics queue drops entries, at most once per queue and batch interval.
- `DATABASE_TLS_CA_FILE` trusts a private certificate authority for external MongoDB services such as Amazon
DocumentDB.
- The dashboard refuses to start (exit code 3) against an OpenVidu server whose analytics schema is older than it
supports, and reports a newer or uninitialized schema in `GET /api/v1/info`.
- The backend entry accepts a `healthcheck` argument for container health checks, and the image declares a Docker
`HEALTHCHECK` with it.
- `GET /api/v1/health` and `GET /api/v1/ready` probes.
- Login is rate limited per IP (10 failed attempts per 15 minutes).
- Settings `DASHBOARD_JWT_SECRET`, `DASHBOARD_REFRESH_TOKEN_TTL`, `DASHBOARD_COOKIE_SECURE`, `DASHBOARD_TRUST_PROXY`,
`DASHBOARD_BASE_PATH`, `DASHBOARD_LIST_TOTAL_MAX_RANGE` and `DASHBOARD_ANALYTICS_CACHE_TTL`.
### Improved
#### Data
- Analytics events and statistics queued in a node are written before it stops on a graceful shutdown.
- Credentials are never stored in the analytics database; metadata is stored only with `store_metadata`, and client
IP addresses are left out unless `anonymize_ip: false`.
#### Deployment
- On `SIGTERM` the dashboard closes its connections and exits within 5 seconds, also while it is still starting.
- Smaller image without time zone data, on `node:24-trixie-slim`.
### Fixed
#### UI
- The node filter of the Rooms list is shown locked in CE instead of hidden.

1
openvidu-dashboard/CLAUDE.md Symbolic link
View File

@ -0,0 +1 @@
AGENTS.md

97
openvidu-dashboard/README.md Normal file
View File

@ -0,0 +1,97 @@
# OpenVidu Dashboard
Web application bundled with every OpenVidu deployment that gives administrators live monitoring and usage
analytics of rooms, participants, tracks, egress and ingress. It reads the MongoDB analytics database written
by the OpenVidu server (`openvidu-livekit`).
This workspace holds the Community edition (CE, `dashboard-ce/`). OpenVidu PRO deployments run a commercial edition
built on these packages, whose features CE shows locked.
## Layout
| Path | Package | Role |
| ----------------------------------- | ------------------------------------ | -------------------------------------------------- |
| `dashboard-ce/typings` | `@openvidu-dashboard/typings` | Contracts shared by backend and frontend |
| `dashboard-ce/backend` | `@openvidu-dashboard/backend` | REST API; serves the built single-page application |
| `dashboard-ce/frontend` | `@openvidu-dashboard/frontend` | Angular application shell and the UI library |
| `dashboard-ce/e2e` | `@openvidu-dashboard/e2e` | End-to-end tests (Playwright) |
| `dashboard-ce/tools/data-generator` | `@openvidu-dashboard/data-generator` | Analytics data for tests and the local demo |
| `openspec/` | | Specifications and in-progress changes (OpenSpec) |
## Requirements
- Node.js 24 (see `.node-version`)
- pnpm, enabled through Corepack (`corepack enable`); the version is pinned by `packageManager` in
`package.json`
## Browser support
Current Chrome, Edge, Firefox and Safari: the theme needs CSS `light-dark()` (Chrome and Edge 123, Firefox 120,
Safari 17.5).
## Commands
All tasks run through `./dashboard.sh`:
```bash
./dashboard.sh install # install dependencies
./dashboard.sh check # lint + format check + type check + spec validation + unit tests
./dashboard.sh dev # frontend dev server, proxying /api to a backend on port 5000
./dashboard.sh demo ce # local demo on generated data: http://localhost:4200, admin / admin
./dashboard.sh test-integration # integration tests against MongoDB (Docker required)
./dashboard.sh e2e # build the application and run the Playwright tests
./dashboard.sh build-image ce # build openvidu/openvidu-dashboard:dev
./dashboard.sh smoke-image ce # smoke test and size budget of that image
./dashboard.sh contract-check ../openvidu-livekit # data model contract check against the writer
./dashboard.sh help # list every command
```
## Container image
`openvidu/openvidu-dashboard`, built from `dashboard-ce/docker/Dockerfile` on `node:24-trixie-slim`
(`node dist/server.js`).
- The build context is this directory. `IMAGE_TAG` (default `dev`) and `BASE_HREF` (default `/`; deployments use
`/dashboard/`) apply.
- The image runs as uid 1000 and writes nothing to disk; mounted files (`DASHBOARD_CONFIG_PATH`,
`DATABASE_TLS_CA_FILE`) must be readable by that user. The container listens on `SERVER_PORT` (5000) and its
`HEALTHCHECK` requests `GET /api/healthcheck` on that port.
- `./dashboard.sh smoke-image ce` checks `MONGO_ENABLED=false`, health, `GET /api/healthcheck`, `HEAD /`, uid 1000,
`SERVER_PORT`, `docker stop` and the 300 MB size budget.
## Configuration
Environment variables, optionally loaded from the file at `DASHBOARD_CONFIG_PATH` (the environment wins). New names
start with `DASHBOARD_`, or `DATABASE_` for database connection settings; the others keep their 3.9 meaning.
| Variable | Default | Meaning |
| ----------------------------------------------------------------------------------------------------- | --------------------- | ------------------------------------------------------------------------------------------------------- |
| `ADMIN_USERNAME`, `ADMIN_PASSWORD` | required | Administrator credentials |
| `SERVER_PORT` | `5000` | HTTP port |
| `LOG_LEVEL` | `info` | `error`, `warn`, `info`, `http`, `verbose`, `debug` or `silly` |
| `DASHBOARD_CONFIG_PATH` | | `KEY=value` file read at startup; a missing file logs a warning |
| `MONGO_ENABLED` | `true` | Anything but `true` stops the dashboard with exit code 0 |
| `DATABASE_URL` | | MongoDB connection string; otherwise composed from the `MONGO_*` variables |
| `MONGO_NODES`, `MONGO_PORT`, `MONGO_ADMIN_USERNAME`, `MONGO_ADMIN_PASSWORD`, `MONGO_REPLICA_SET_NAME` | | Parts of the composed connection string (`readPreference=primaryPreferred`) |
| `DATABASE_NAME` | `openvidu` | Analytics database |
| `DATABASE_TLS_CA_FILE` | | PEM file of a private certificate authority; enables TLS |
| `DASHBOARD_JWT_SECRET` | generated once | Signing key of the session tokens, at least 32 bytes |
| `DASHBOARD_REFRESH_TOKEN_TTL` | `604800` | Session lifetime without use, in seconds |
| `DASHBOARD_COOKIE_SECURE` | `auto` | `auto`, `true` or `false` |
| `DASHBOARD_TRUST_PROXY` | private networks | `false`, a hop count, or addresses, CIDRs, `loopback`, `linklocal` and `uniquelocal`; `true` is refused |
| `DASHBOARD_BASE_PATH` | the SPA `<base href>` | Public path of the dashboard |
| `DASHBOARD_LIST_TOTAL_MAX_RANGE` | `7d` | Longest range for which lists count their total |
| `DASHBOARD_ANALYTICS_CACHE_TTL` | `60` | Seconds the analytics folds of completed rollup documents are kept; `0` disables it |
## Exit codes
| Code | Meaning |
| ---- | ---------------------------------------------------------------------------- |
| 0 | Stopped by a signal, or `MONGO_ENABLED` is not `true` |
| 1 | Invalid configuration or MongoDB unreachable |
| 3 | The OpenVidu server's analytics schema is older than this dashboard supports |
## Contributing
Read `AGENTS.md`, and the one of the package you change, before changing anything: they describe the edition model,
conventions and the spec-driven workflow used in this workspace.

75
openvidu-dashboard/dashboard-ce/backend/AGENTS.md Normal file
View File

@ -0,0 +1,75 @@
# Backend (`@openvidu-dashboard/backend`)
Express 5, Inversify, Zod and the official `mongodb` driver; TypeScript 6 strict ESM, relative imports end in `.js`.
Behaviour is specified in `openspec/specs/*-api`, `api-conventions`, `auth`, `status-api` and `editions-info`.
## Structure
- `src/lifecycle/startup.ts`: `startDashboard(options)` reads the configuration, connects to MongoDB, applies the
writer schema gate, builds the container, calls `configure` and the startup hooks, then listens. `TOKENS`
(`src/di/tokens.ts`) are bound with `toResolvedValue` factories, without decorators, so esbuild and Vitest need no
metadata. Exit codes go through `Shutdown.run(code)`.
- Routes are declared once in the `RouteRegistry` (`src/api/route-registry.ts`): method, path under `/api/v1`, edition,
`feature` of a PRO route, security (`public`, `bearer`, `optional-bearer`), Zod schemas of params, query, body and
responses, and the handler. It drives validation, authentication and the OpenAPI document (only when `NODE_ENV` is
not `production`).
- PRO routes are only locks here: `registry.lock({ method, path, feature })` answers `403 PRO_FEATURE` after
authentication and stays out of the OpenAPI document. An edition that extends CE registers the full definition in the
lock's place (mount order kept) and swaps a CE route for its extension with `registry.replace()`; a `pro` startup
that leaves a lock without a definition exits with code 1, naming it.
- Extension tokens that `configure` can rebind: `Features`, `LicenseInfo`, `AnalyticsCatalogue` (metrics and
dimensions the analytics endpoints compute) and `OverviewExtension` (extra overview fields, merged before the
`ETag`). A `configure` that throws stops the startup with code 1.
- A resource slice is `src/<resource>/`: `*-schemas.ts` (Zod), `*-query.ts` (pure filter builders), `*-repository.ts`
(MongoDB), `*-service.ts` (paging, mapping), `*-responses.ts` (OpenAPI response schemas, checked against the mappers
in unit tests) and `*-routes.ts` (`register<Resource>Routes`: the CE routes and the locks of the PRO ones).
- Zod schemas live here because typings has no runtime dependencies; typings declares the matching types in
`src/api/`. Errors use `{ error: { code, message, details? } }` with `ErrorCode`.
- Shared query pieces in `src/api/`: `rangedQuery(now, shape)` for ranged queries (relative grammar resolved at parse
time) and `optionalRangeQuery(now, shape)` when the bounds are optional, `pageQuery()` for keyset pages on an index
ending in `_id`, `indexOrderedPage()` when the index does not order by `_id`, and `rankedPage()` with
`assertRankedRange()` (`src/api/ranked.ts`) for metric sorts ranked in memory at the cursor's `asOf`. Calendar math in
a time zone uses date-fns and `@date-fns/tz`.
- `src/stats/stats-mode.ts`: `StatsModeReader` reads the writer's `stats_detail` for `GET /info`.
- `src/analytics/` answers from the rollup collections only: `analytics-planner.ts` picks the granularity, source
collection and bucket grid, `analytics-counters.ts` folds the documents in process with the definitions of the
catalogue, `AnalyticsCache` keeps the folds of completed documents and `AnalyticsFeatureGate` rejects PRO metrics,
dimensions and node scopes on CE.
- `src/status/freshness.ts` marks active rooms and participants `stale` with the backend clock, from the typings
`freshnessWindows()`.
- `src/index.ts` exports what an extending backend builds on: the startup, tokens and registry, the generic query,
cursor, response and freshness pieces, and the list pieces that entity details extend.
- Exact identifiers (`RM_`, `PA_`, `EG_`, `IN_`, `TR_`) are matched with `ENTITY_ID_PATTERNS`, `isEntityId()` and
`entityIdKind()` from typings.
- Configuration variables are new `DASHBOARD_*`, or `DATABASE_*` for database connection settings; legacy names keep
their 3.9 meaning (`src/config/variables.ts`, unit-tested). The README lists them all.
## Rules
- Repositories own the queries. Every list, detail and time-series query is backed by an index and asserted with
`expectIndexBacked` (`test/support/query-plan.ts`: no COLLSCAN above 1 000 documents, bounded `totalDocsExamined`).
## Tests
- Unit tests: Vitest (`pnpm test`).
- Integration tests: `test/integration/`, Vitest projects `integration` and `integration-plans` (the `*query-plan`
suites, run after the rest so their data generation does not skew the latency budgets). `test/support/` starts a
replica set with Testcontainers on `openvidu/mongodb:8.0.29-r1` (the official `mongo:8.0` refuses Linux kernels 6.19
and newer), or uses `DASHBOARD_TEST_MONGO_URI`; `DASHBOARD_TEST_MONGO_IMAGE` overrides the image. Through pnpm
without Docker the suites report themselves skipped; `./dashboard.sh test-integration` fails instead.
- They also need `openssl` (test CA of the TLS case) and build the package to run `dist/server.js` as a process.
`test/support/boot.ts` starts the dashboard in-process on a fresh database with a controllable clock.
- `test/support/` is exported to the suites of extending packages as `@openvidu-dashboard/backend/testing` (source
only, never in `dist`), and the MongoDB global setup as `@openvidu-dashboard/backend/testing/global-mongo`.
- Query-plan suites generate data with `dashboard-ce/tools/data-generator` and report the p95 of their budget. Design
figures come from scenario M over 7 days on a MongoDB with room for it, run alone:
```bash
DASHBOARD_TEST_MONGO_URI=<uri> ROOMS_PLAN_SCENARIO=M ROOMS_PLAN_DAYS=7 ROOMS_PLAN_REPORT=<file> \
pnpm --filter @openvidu-dashboard/backend exec vitest run --project integration-plans \
test/integration/rooms-query-plan.test.ts
```
The other suites take the prefixes `PARTICIPANTS_PLAN_`, `EGRESS_PLAN_`, `INGRESS_PLAN_`, `OVERVIEW_PLAN_` and
`ANALYTICS_PLAN_`. `DASHBOARD_TEST_LATENCY_BUDGETS=report` (set in CI) turns p95 overruns into warnings; plan
assertions fail either way.

1
openvidu-dashboard/dashboard-ce/backend/CLAUDE.md Symbolic link
View File

@ -0,0 +1 @@
AGENTS.md

55
openvidu-dashboard/dashboard-ce/backend/package.json Normal file
View File

@ -0,0 +1,55 @@
{
"name": "@openvidu-dashboard/backend",
"version": "3.10.0-dev",
"private": true,
"description": "OpenVidu Dashboard REST API (CE)",
"type": "module",
"main": "./dist/server.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"source": "./src/index.ts",
"types": "./dist/index.d.ts",
"default": "./dist/index.js"
},
"./testing": "./test/support/index.ts",
"./testing/global-mongo": "./test/support/global-mongo.ts"
},
"files": [
"dist"
],
"scripts": {
"build": "tsc -p tsconfig.build.json",
"dev": "tsx watch --conditions=source src/server.ts",
"typecheck": "tsc --noEmit -p tsconfig.json",
"test": "vitest run --project unit",
"test:integration": "vitest run --project integration --project integration-plans",
"clean": "rm -rf dist"
},
"dependencies": {
"@date-fns/tz": "catalog:",
"@openvidu-dashboard/typings": "workspace:*",
"cookie-parser": "catalog:",
"date-fns": "catalog:",
"express": "catalog:",
"express-rate-limit": "catalog:",
"inversify": "catalog:",
"jose": "catalog:",
"mongodb": "catalog:",
"winston": "catalog:",
"zod": "catalog:",
"zod-openapi": "catalog:"
},
"devDependencies": {
"@openvidu-dashboard/data-generator": "workspace:*",
"@types/cookie-parser": "catalog:",
"@types/express": "catalog:",
"@types/node": "catalog:",
"@types/supertest": "catalog:",
"supertest": "catalog:",
"testcontainers": "catalog:",
"tsx": "catalog:",
"typescript": "catalog:",
"vitest": "catalog:"
}
}

56
openvidu-dashboard/dashboard-ce/backend/src/analytics/analytics-cache.ts Normal file
View File

@ -0,0 +1,56 @@
import type { BucketCounters } from './analytics-counters.js';
export const ANALYTICS_CACHE_ENTRIES = 256;
/**
* Folds of completed rollup documents, keyed by the resolved read, for `ttlMs`; least recently used entries go first.
* A TTL of zero disables it.
*/
export class AnalyticsCache {
private readonly entries = new Map<string, { at: number; value: BucketCounters }>();
constructor(
private readonly ttlMs: number,
private readonly now: () => Date,
private readonly capacity = ANALYTICS_CACHE_ENTRIES
) {}
get enabled(): boolean {
return this.ttlMs > 0;
}
get(key: string): BucketCounters | undefined {
const entry = this.entries.get(key);
if (entry === undefined) {
return undefined;
}
this.entries.delete(key);
if (this.now().getTime() - entry.at >= this.ttlMs) {
return undefined;
}
this.entries.set(key, entry);
return entry.value;
}
set(key: string, value: BucketCounters): void {
if (!this.enabled) {
return;
}
this.entries.delete(key);
this.entries.set(key, { at: this.now().getTime(), value });
for (const oldest of this.entries.keys()) {
if (this.entries.size <= this.capacity) {
break;
}
this.entries.delete(oldest);
}
}
}

160
openvidu-dashboard/dashboard-ce/backend/src/analytics/analytics-catalogue.ts Normal file
View File

@ -0,0 +1,160 @@
import {
ANALYTICS_METRIC_INFO,
type AnalyticsDimension,
type AnalyticsMetric,
type AnalyticsMetricInfo
} from '@openvidu-dashboard/typings';
/** Rollup counters of one bucket flattened to dotted paths (`rooms.created`, `egress.byType.ROOM_COMPOSITE`). */
export type Counters = ReadonlyMap<string, number>;
/** Number of rollup documents folded into a {@link Counters}. */
export const DOCUMENTS = '#documents';
/** Map counter of the `egressEnded` expansion: one series per stored end status. */
export const EGRESS_ENDED_PATH = 'egress.endedByStatus';
export interface MetricDefinition {
/** Paths to project from the rollup documents; never the parent of another projected path. */
fields: readonly string[];
/** Value of a bucket; `counters` is undefined when the bucket has no document. */
value: (counters: Counters | undefined) => number | null;
}
export function round1(value: number): number {
return Math.round(value * 10) / 10;
}
/** A counter summed over the bucket's documents, `0` without one. */
export function sum(path: string): MetricDefinition {
return { fields: [path], value: (counters) => counters?.get(path) ?? 0 };
}
/** `numerator / denominator × scale` with one decimal, `null` without a denominator. */
export function ratio(
numerator: string,
denominator: string,
scale: number,
cap = Number.POSITIVE_INFINITY
): MetricDefinition {
return {
fields: [numerator, denominator],
value: (counters) => {
const total = counters?.get(denominator) ?? 0;
return total > 0 ? Math.min(cap, round1(((counters?.get(numerator) ?? 0) / total) * scale)) : null;
}
};
}
/** Map counters of a dimension, and those of its errors when it has them. */
export interface DimensionDefinition {
path: string;
errors?: string;
}
/** The metrics and dimensions the analytics endpoints compute; the PRO edition adds its own to the CE ones. */
export interface AnalyticsCatalogue {
metrics: Readonly<Partial<Record<Exclude<AnalyticsMetric, 'egressEnded'>, MetricDefinition>>>;
dimensions: Readonly<Partial<Record<AnalyticsDimension, DimensionDefinition>>>;
/** Unit, empty value and granularity rules of the metrics, `egressEnded` included. */
info: Readonly<Partial<Record<AnalyticsMetric, AnalyticsMetricInfo>>>;
}
const CE_METRICS = {
roomsCreated: sum('rooms.created'),
roomsEnded: sum('rooms.ended'),
participantsJoined: sum('participants.joined'),
participantsActive: sum('participants.active'),
participantsAborted: sum('participants.aborted'),
// A participant that joins at the end of a bucket becomes active in the next one: the share never exceeds 100.
connectionSuccessRate: ratio('participants.active', 'participants.joined', 100, 100),
uniqueIdentities: {
fields: ['uniqueIdentities'],
// The reconciler writes the value once the UTC day has closed: a day with documents but no value has none yet.
value: (counters) => (counters === undefined ? 0 : (counters.get('uniqueIdentities') ?? null))
},
participantMinutes: {
fields: ['participants.minutes'],
value: (counters) => round1(counters?.get('participants.minutes') ?? 0)
},
tracksPublished: sum('tracks.published'),
egressStarted: sum('egress.started'),
egressDurationMs: sum('egress.durationMs'),
ingressSessions: sum('ingress.sessionsStarted'),
ingressDurationMs: sum('ingress.durationMs'),
bytesUp: sum('bytes.up'),
bytesDown: sum('bytes.down'),
apiCalls: sum('apiCalls.total'),
apiErrors: sum('apiErrors.total')
} satisfies AnalyticsCatalogue['metrics'];
const CE_DIMENSIONS = {
sdk: { path: 'participants.bySdk' },
os: { path: 'participants.byOs' },
browser: { path: 'participants.byBrowser' },
connectionType: { path: 'participants.byConnectionType' },
kind: { path: 'participants.byKind' },
egressType: { path: 'egress.byType' },
egressStatus: { path: 'egress.endedByStatus' },
ingressInputType: { path: 'ingress.byInputType' }
} satisfies AnalyticsCatalogue['dimensions'];
/** The CE catalogue; the gate rejects the PRO metrics and dimensions before it is read. */
export const CE_ANALYTICS_CATALOGUE: AnalyticsCatalogue = {
metrics: CE_METRICS,
dimensions: CE_DIMENSIONS,
info: ANALYTICS_METRIC_INFO
};
/** Counters of the summary. */
export const SUMMARY_FIELDS = [
'rooms.created',
'rooms.ended',
'rooms.participantsSum',
'rooms.durationMsSum',
'participants.joined',
'participants.active',
'bytes.up',
'bytes.down',
'egress.started',
'egress.durationMs',
'ingress.sessionsStarted',
'ingress.durationMs',
'apiCalls.total',
'apiErrors.total'
] as const;
/** The definition of `metric` in `catalogue`. */
export function metricDefinition(
catalogue: AnalyticsCatalogue,
metric: Exclude<AnalyticsMetric, 'egressEnded'>
): MetricDefinition {
const definition = catalogue.metrics[metric];
if (definition === undefined) {
throw new Error(`The analytics catalogue has no metric ${metric}`);
}
return definition;
}
/** The definition of `dimension` in `catalogue`. */
export function dimensionDefinition(catalogue: AnalyticsCatalogue, dimension: AnalyticsDimension): DimensionDefinition {
const definition = catalogue.dimensions[dimension];
if (definition === undefined) {
throw new Error(`The analytics catalogue has no dimension ${dimension}`);
}
return definition;
}
/** Projected paths of `metrics`. */
export function metricFields(catalogue: AnalyticsCatalogue, metrics: readonly AnalyticsMetric[]): string[] {
const fields = metrics.flatMap((metric) =>
metric === 'egressEnded' ? [EGRESS_ENDED_PATH] : metricDefinition(catalogue, metric).fields
);
return [...new Set(fields)];
}

121
openvidu-dashboard/dashboard-ce/backend/src/analytics/analytics-counters.ts Normal file
View File

@ -0,0 +1,121 @@
import { type Counters, DOCUMENTS } from './analytics-catalogue.js';
/** Counters per bucket start (epoch milliseconds). */
export type BucketCounters = ReadonlyMap<number, Counters>;
/** A projected rollup document: `bucket` and the requested counters. */
export interface RollupRow {
bucket: Date;
[field: string]: unknown;
}
function addLeaves(target: Map<string, number>, value: unknown, path: string): void {
if (typeof value === 'number') {
target.set(path, (target.get(path) ?? 0) + value);
} else if (value !== null && typeof value === 'object' && !(value instanceof Date)) {
for (const [key, child] of Object.entries(value)) {
addLeaves(target, child, path === '' ? key : `${path}.${key}`);
}
}
}
/** Index of the bucket of `starts` (ascending) containing `time`, or -1 before the first one. */
function bucketIndex(starts: readonly number[], time: number): number {
let low = 0;
let high = starts.length - 1;
let found = -1;
while (low <= high) {
const middle = (low + high) >> 1;
if ((starts[middle] ?? 0) <= time) {
found = middle;
low = middle + 1;
} else {
high = middle - 1;
}
}
return found;
}
/** Sums the numeric leaves of each row into the bucket of `starts` containing its `bucket`. */
export async function foldRows(rows: AsyncIterable<RollupRow>, starts: readonly Date[]): Promise<BucketCounters> {
const times = starts.map((start) => start.getTime());
const buckets = new Map<number, Map<string, number>>();
for await (const { bucket, ...fields } of rows) {
const start = times[bucketIndex(times, bucket.getTime())];
if (start === undefined) {
continue;
}
let counters = buckets.get(start);
if (counters === undefined) {
counters = new Map();
buckets.set(start, counters);
}
counters.set(DOCUMENTS, (counters.get(DOCUMENTS) ?? 0) + 1);
addLeaves(counters, fields, '');
}
return buckets;
}
/** Bucket-wise sum of two folds. */
export function mergeCounters(base: BucketCounters, extra: BucketCounters): BucketCounters {
if (extra.size === 0) {
return base;
}
const merged = new Map(base);
for (const [start, counters] of extra) {
const existing = merged.get(start);
if (existing === undefined) {
merged.set(start, counters);
continue;
}
const sum = new Map(existing);
for (const [path, value] of counters) {
sum.set(path, (sum.get(path) ?? 0) + value);
}
merged.set(start, sum);
}
return merged;
}
/** Every bucket folded into one. */
export function totalCounters(buckets: BucketCounters): Counters {
const total = new Map<string, number>();
for (const counters of buckets.values()) {
for (const [path, value] of counters) {
total.set(path, (total.get(path) ?? 0) + value);
}
}
return total;
}
/** Entries of the map counter at `path`: `{ key: count }` from the `path.<key>` leaves. */
export function mapEntries(counters: Counters, path: string): Map<string, number> {
const prefix = `${path}.`;
const entries = new Map<string, number>();
for (const [key, value] of counters) {
if (key.startsWith(prefix)) {
entries.set(key.slice(prefix.length), value);
}
}
return entries;
}

51
openvidu-dashboard/dashboard-ce/backend/src/analytics/analytics-csv.ts Normal file
View File

@ -0,0 +1,51 @@
import type { AnalyticsBreakdownsResponse, AnalyticsSeriesResponse } from '@openvidu-dashboard/typings';
type Cell = string | number | null | undefined;
const CRLF = '\r\n';
function cell(value: Cell): string {
if (value === null || value === undefined) {
return '';
}
const text = String(value);
return /[",\r\n]/.test(text) ? `"${text.replaceAll('"', '""')}"` : text;
}
/** RFC 4180 text: a header row, then the rows, every line ended by CRLF; `null` is an empty cell. */
export function toCsv(header: readonly string[], rows: readonly (readonly Cell[])[]): string {
return [header, ...rows].map((row) => row.map(cell).join(',') + CRLF).join('');
}
/** One row per bucket start of any series, one column per series. */
export function seriesCsv(response: AnalyticsSeriesResponse): string {
const columns = response.series.map((series) => new Map(series.points));
const buckets = [...new Set(response.series.flatMap((series) => series.points.map(([bucket]) => bucket)))].sort();
return toCsv(
['bucket', ...response.series.map((series) => series.name)],
buckets.map((bucket) => [bucket, ...columns.map((points) => points.get(bucket))])
);
}
/** One row per key, dimension after dimension; `errors` only when a breakdown carries it. */
export function breakdownsCsv(response: AnalyticsBreakdownsResponse): string {
const withErrors = response.breakdowns.some((breakdown) =>
breakdown.items.some((item) => item.errors !== undefined)
);
return toCsv(
['dimension', 'key', 'count', 'percent', ...(withErrors ? ['errors'] : [])],
response.breakdowns.flatMap((breakdown) =>
breakdown.items.map((item) => [
breakdown.dimension,
item.key,
item.count,
item.percent,
...(withErrors ? [item.errors] : [])
])
)
);
}

39
openvidu-dashboard/dashboard-ce/backend/src/analytics/analytics-gate.ts Normal file
View File

@ -0,0 +1,39 @@
import {
ANALYTICS_GLOBAL_SCOPE,
ANALYTICS_SCOPE_FEATURE,
type AnalyticsDimension,
analyticsDimensionFeature,
type AnalyticsMetric,
analyticsMetricFeature,
type FeatureKey
} from '@openvidu-dashboard/typings';
import { ApiError } from '../http/api-error.js';
export interface AnalyticsRequestItems {
metrics?: readonly AnalyticsMetric[];
dimensions?: readonly AnalyticsDimension[];
scope?: string;
}
/**
* PRO metrics, dimensions and node scopes of an analytics request, allowed by the enabled features: a request with any
* locked item is rejected whole with `PRO_FEATURE` naming the first one.
*/
export class AnalyticsFeatureGate {
constructor(private readonly features: () => readonly FeatureKey[]) {}
check({ metrics = [], dimensions = [], scope = ANALYTICS_GLOBAL_SCOPE }: AnalyticsRequestItems): void {
const enabled = new Set(this.features());
const required = [
...metrics.map(analyticsMetricFeature),
...dimensions.map(analyticsDimensionFeature),
scope === ANALYTICS_GLOBAL_SCOPE ? undefined : ANALYTICS_SCOPE_FEATURE
];
const locked = required.find((feature) => feature !== undefined && !enabled.has(feature));
if (locked !== undefined) {
throw new ApiError('PRO_FEATURE', 'This feature requires OpenVidu PRO', { feature: locked });
}
}
}

227
openvidu-dashboard/dashboard-ce/backend/src/analytics/analytics-planner.ts Normal file
View File

@ -0,0 +1,227 @@
import {
type AnalyticsBucketGranularity,
type AnalyticsGranularity,
type AnalyticsMetric,
type AnalyticsMetricInfo,
Collection,
formatRetentionLength
} from '@openvidu-dashboard/typings';
import { bucketStart, bucketStarts, MAX_BUCKETS } from '../api/time-series.js';
import { ApiError } from '../http/api-error.js';
import type { RetentionMs } from '../schema/retention.js';
const MINUTE_MS = 60_000;
const HOUR_MS = 60 * MINUTE_MS;
const DAY_MS = 24 * HOUR_MS;
/** Size of the UTC-aligned granularities. */
const UTC_BUCKET_MS = { '5m': 5 * MINUTE_MS, '15m': 15 * MINUTE_MS, '1h': HOUR_MS } as const;
/** Longest range of the sub-hour granularities. */
export const SUB_HOUR_MAX_RANGE_MS = DAY_MS;
export type RollupCollection =
typeof Collection.ANALYTICS_5MIN | typeof Collection.ANALYTICS_HOURLY | typeof Collection.ANALYTICS_DAILY;
/** Bucket grid of a series and where to read it. */
export interface BucketGrid {
collection: RollupCollection;
/** Bucket starts, ascending. */
starts: Date[];
}
export interface SeriesPlan extends BucketGrid {
granularity: AnalyticsBucketGranularity;
/** Grid of `uniqueIdentities`: UTC days of `analytics_daily`, whatever `tz`. */
utcDays?: BucketGrid;
}
export interface SeriesPlanInput {
from: Date;
to: Date;
tz: string;
granularity: AnalyticsGranularity;
metrics: readonly AnalyticsMetric[];
now: Date;
retention: RetentionMs;
/** Granularity rules of the metrics, from the analytics catalogue. */
info: Readonly<Partial<Record<AnalyticsMetric, AnalyticsMetricInfo>>>;
}
function invalid(path: string, message: string): ApiError {
return ApiError.validation([{ path: [path], message }]);
}
/** Buckets of `[from, to)`; local days and quarter days are counted without the zone, which only moves their edges. */
function bucketTotal(from: Date, to: Date, granularity: AnalyticsBucketGranularity): number {
const span = to.getTime() - from.getTime();
switch (granularity) {
case '1d':
return Math.ceil(span / DAY_MS) + 1;
case '6h':
return Math.ceil(span / (6 * HOUR_MS)) + 1;
default: {
const size = UTC_BUCKET_MS[granularity];
return Math.ceil((to.getTime() - Math.floor(from.getTime() / size) * size) / size);
}
}
}
function subHourAllowed(input: SeriesPlanInput): boolean {
return (
input.to.getTime() - input.from.getTime() <= SUB_HOUR_MAX_RANGE_MS &&
input.from.getTime() >= input.now.getTime() - input.retention.rollups5MinMs
);
}
/** `auto`: five minutes for a day inside the 5-minute rollup retention, then hours up to a week, quarter days to 90 days. */
export function resolveAnalyticsGranularity(input: SeriesPlanInput): AnalyticsBucketGranularity {
if (input.granularity !== 'auto') {
return input.granularity;
}
const span = input.to.getTime() - input.from.getTime();
if (subHourAllowed(input)) {
return '5m';
}
if (span <= 7 * DAY_MS) {
return '1h';
}
return span <= 90 * DAY_MS ? '6h' : '1d';
}
/** Starts of the buckets overlapping `[from, to)`: UTC boundaries below a quarter day, local ones of `zone` above. */
export function gridStarts(from: Date, to: Date, granularity: AnalyticsBucketGranularity, zone: string): Date[] {
if (granularity === '6h' || granularity === '1d') {
return bucketStarts(from, to, granularity, zone);
}
const size = UTC_BUCKET_MS[granularity];
const starts: Date[] = [];
for (let start = Math.floor(from.getTime() / size) * size; start < to.getTime(); start += size) {
starts.push(new Date(start));
}
return starts;
}
/**
* Granularity, source collection and bucket grid of a series request; a granularity the range or the metrics do not
* allow is a `VALIDATION_ERROR` naming the rule.
*/
export function planSeries(input: SeriesPlanInput): SeriesPlan {
const granularity = resolveAnalyticsGranularity(input);
const subHour = granularity === '5m' || granularity === '15m';
if (subHour && input.to.getTime() - input.from.getTime() > SUB_HOUR_MAX_RANGE_MS) {
throw invalid('granularity', '5m and 15m require a range of at most 24 hours');
}
if (subHour && !subHourAllowed(input)) {
const retention = formatRetentionLength(input.retention.rollups5MinMs);
throw invalid('granularity', `5m and 15m require a range inside the 5-minute rollup retention (${retention})`);
}
if (bucketTotal(input.from, input.to, granularity) > MAX_BUCKETS) {
throw invalid(
'granularity',
`${granularity} gives more than the limit of ${String(MAX_BUCKETS)} buckets for this range; choose a coarser granularity`
);
}
for (const metric of input.metrics) {
if (input.info[metric]?.dailyOnly === true && granularity !== '1d') {
throw invalid('metrics', `${metric} requires granularity=1d`);
}
if (input.info[metric]?.hourlyOnly === true && subHour) {
throw invalid('metrics', `${metric} requires a granularity of at least 1h, not ${granularity}`);
}
}
const plan = sourceGrid(input, granularity);
return input.metrics.includes('uniqueIdentities')
? {
...plan,
utcDays: {
collection: Collection.ANALYTICS_DAILY,
starts: gridStarts(input.from, input.to, '1d', 'UTC')
}
}
: plan;
}
function sourceGrid(input: SeriesPlanInput, granularity: AnalyticsBucketGranularity): SeriesPlan {
const { from, to, tz } = input;
switch (granularity) {
case '5m':
case '15m':
return {
granularity,
collection: Collection.ANALYTICS_5MIN,
starts: gridStarts(from, to, granularity, tz)
};
case '1h':
case '6h':
return {
granularity,
collection: Collection.ANALYTICS_HOURLY,
starts: gridStarts(from, to, granularity, tz)
};
case '1d': {
// Daily documents are UTC days: another zone sums hourly documents per local day while they are retained.
const local = tz !== 'UTC' && from.getTime() >= input.now.getTime() - input.retention.rollupsHourlyMs;
return local
? { granularity, collection: Collection.ANALYTICS_HOURLY, starts: gridStarts(from, to, '1d', tz) }
: { granularity, collection: Collection.ANALYTICS_DAILY, starts: gridStarts(from, to, '1d', 'UTC') };
}
}
}
/** Snapped range of the breakdowns and the summary: whole hours up to 90 days, whole UTC days beyond. */
export interface SnappedRange {
collection: typeof Collection.ANALYTICS_HOURLY | typeof Collection.ANALYTICS_DAILY;
from: Date;
to: Date;
}
export const HOURLY_SNAP_MAX_RANGE_MS = 90 * DAY_MS;
export function snapRange(from: Date, to: Date): SnappedRange {
const hourly = to.getTime() - from.getTime() <= HOURLY_SNAP_MAX_RANGE_MS;
const size = hourly ? HOUR_MS : DAY_MS;
return {
collection: hourly ? Collection.ANALYTICS_HOURLY : Collection.ANALYTICS_DAILY,
from: new Date(Math.floor(from.getTime() / size) * size),
to: new Date(Math.ceil(to.getTime() / size) * size)
};
}
/** UTC days overlapping `[from, to)`. */
export function utcDaysOf(from: Date, to: Date): { from: Date; to: Date } {
return { from: bucketStart(from, '1d', 'UTC'), to: new Date(Math.ceil(to.getTime() / DAY_MS) * DAY_MS) };
}
/** Start of the rollup document of `collection` containing `instant`: documents before it are complete. */
export function openDocumentStart(collection: RollupCollection, instant: Date): Date {
const size =
collection === Collection.ANALYTICS_5MIN
? UTC_BUCKET_MS['5m']
: collection === Collection.ANALYTICS_HOURLY
? HOUR_MS
: DAY_MS;
return new Date(Math.floor(instant.getTime() / size) * size);
}

30
openvidu-dashboard/dashboard-ce/backend/src/analytics/analytics-repository.ts Normal file
View File

@ -0,0 +1,30 @@
import type { Db, Document } from 'mongodb';
import type { RollupRow } from './analytics-counters.js';
import type { RollupCollection } from './analytics-planner.js';
export const ROLLUP_INDEX = 'scope_bucket';
/** Rollup reads on `{ scope, bucket }`. */
export class AnalyticsRepository {
constructor(private readonly db: Db) {}
/** Projected rollup documents of `scope` whose bucket starts in `[from, to)`, ascending. */
rollups(
collection: RollupCollection,
scope: string,
from: Date,
to: Date,
fields: readonly string[]
): AsyncIterable<RollupRow> {
const projection: Document = { _id: 0, bucket: 1 };
for (const field of fields) {
projection[field] = 1;
}
return this.db
.collection(collection)
.find<RollupRow>({ scope, bucket: { $gte: from, $lt: to } }, { projection, hint: ROLLUP_INDEX })
.sort({ bucket: 1 });
}
}

77
openvidu-dashboard/dashboard-ce/backend/src/analytics/analytics-responses.ts Normal file
View File

@ -0,0 +1,77 @@
import * as z from 'zod';
import { ANALYTICS_GRANULARITIES, AnalyticsDimension } from '@openvidu-dashboard/typings';
import { isoDate } from '../api/responses.js';
import { enumValues } from '../util/enum-values.js';
const count = z.number();
const scope = z.string().meta({ description: '`global` or `node:<id>`' });
export const analyticsSeriesResponse = z
.object({
granularity: z.enum(ANALYTICS_GRANULARITIES),
from: isoDate,
to: isoDate,
scope,
series: z.array(
z.object({
name: z.string().meta({
description: 'The metric, or `egressEnded.<status>` with a stored egress status such as `complete`'
}),
points: z.array(z.tuple([isoDate, z.number().nullable()])),
basis: z.literal('utcDay').optional().meta({ description: 'One value per UTC day whatever `tz`' })
})
)
})
.meta({ id: 'AnalyticsSeries', description: 'Dense series: one point per bucket of the range' });
export const analyticsBreakdownsResponse = z
.object({
from: isoDate,
to: isoDate,
scope,
breakdowns: z.array(
z.object({
dimension: z.enum(enumValues(AnalyticsDimension)),
total: count,
items: z.array(
z.object({
key: z.string(),
count,
percent: z.number(),
errors: count.optional()
})
)
})
)
})
.meta({ id: 'AnalyticsBreakdowns', description: 'Counts per key over the range snapped to hours or UTC days' });
export const analyticsSummaryResponse = z
.object({
from: isoDate,
to: isoDate,
scope,
roomsCreated: count,
roomsEnded: count,
participantSessions: count,
uniqueIdentities: z
.object({ value: count, basis: z.literal('utcDays'), days: count })
.optional()
.meta({ description: 'Sum of the daily values of the UTC days overlapping the range' }),
connectionSuccessRate: z.number().optional(),
avgRoomSize: z.number().optional(),
avgRoomDurationMs: count.optional(),
bytesUp: count,
bytesDown: count,
egressStarted: count,
egressDurationMs: count,
ingressSessions: count.meta({ description: 'Ingress sessions started in the range' }),
ingressDurationMs: count.meta({ description: 'Duration of the ingress sessions ended in the range' }),
apiCalls: count,
apiErrorRate: z.number().optional()
})
.meta({ id: 'AnalyticsSummary', description: 'A value the stored documents cannot derive is absent' });
export const analyticsCsv = z.string().meta({ description: 'RFC 4180 with CRLF line ends and a header row' });

84
openvidu-dashboard/dashboard-ce/backend/src/analytics/analytics-routes.ts Normal file
View File

@ -0,0 +1,84 @@
import { ANALYTICS_CSV_CONTENT_TYPE, FeatureKey } from '@openvidu-dashboard/typings';
import type { RouteRegistry } from '../api/route-registry.js';
import {
analyticsBreakdownsResponse,
analyticsCsv,
analyticsSeriesResponse,
analyticsSummaryResponse
} from './analytics-responses.js';
import {
analyticsBreakdownsQuery,
type AnalyticsExportParams,
analyticsExportQuery,
analyticsSeriesQuery,
analyticsSummaryQuery
} from './analytics-schemas.js';
import type { AnalyticsService } from './analytics-service.js';
const TAGS = ['Analytics'];
const LOCKED_ITEM = { description: 'PRO metric, dimension or node scope on CE' };
/**
* Analytics routes: series, breakdowns, summary and CSV export, with the PRO metrics, dimensions and scopes rejected on
* CE, and the locks of top rooms (`analytics-top-rooms`) and scopes (`per-node-breakdown`). `now` is read per request.
*/
export function registerAnalyticsRoutes(
registry: RouteRegistry,
analytics: () => AnalyticsService,
now: () => Date
): void {
const ce = { edition: 'ce', tags: TAGS, security: 'bearer' } as const;
registry.register({
...ce,
method: 'get',
path: '/analytics/series',
summary: 'Usage series from the rollups',
request: { query: analyticsSeriesQuery(now) },
responses: {
200: { description: 'One dense series per metric', schema: analyticsSeriesResponse },
403: LOCKED_ITEM
},
handler: ({ query }) => analytics().series(query)
});
registry.register({
...ce,
method: 'get',
path: '/analytics/breakdowns',
summary: 'Counts per key of each dimension',
request: { query: analyticsBreakdownsQuery(now) },
responses: {
200: { description: 'One breakdown per dimension', schema: analyticsBreakdownsResponse },
403: LOCKED_ITEM
},
handler: ({ query }) => analytics().breakdowns(query)
});
registry.register({
...ce,
method: 'get',
path: '/analytics/summary',
summary: 'KPI values of a range',
request: { query: analyticsSummaryQuery(now) },
responses: { 200: { description: 'The KPI values', schema: analyticsSummaryResponse }, 403: LOCKED_ITEM },
handler: ({ query }) => analytics().summary(query)
});
registry.register<unknown, AnalyticsExportParams, unknown>({
...ce,
method: 'get',
path: '/analytics/export.csv',
summary: 'Series or breakdowns as CSV',
request: { query: analyticsExportQuery(now) },
responses: {
200: { description: 'CSV attachment', schema: analyticsCsv, contentType: ANALYTICS_CSV_CONTENT_TYPE },
403: LOCKED_ITEM
},
handler: async ({ query, res }) => {
const csv = await analytics().export(query);
res.status(200).type(ANALYTICS_CSV_CONTENT_TYPE).attachment(csv.fileName).send(csv.body);
}
});
registry.lock({ method: 'get', path: '/analytics/top', feature: FeatureKey.ANALYTICS_TOP_ROOMS });
registry.lock({ method: 'get', path: '/analytics/scopes', feature: FeatureKey.PER_NODE_BREAKDOWN });
}

96
openvidu-dashboard/dashboard-ce/backend/src/analytics/analytics-schemas.ts Normal file
View File

@ -0,0 +1,96 @@
import * as z from 'zod';
import {
ANALYTICS_GRANULARITIES,
ANALYTICS_SCOPE_PATTERN,
AnalyticsDimension,
type AnalyticsGranularity,
AnalyticsMetric,
type AnalyticsScope
} from '@openvidu-dashboard/typings';
import { csvParam, rangedQuery } from '../api/query.js';
import { enumValues } from '../util/enum-values.js';
const GRANULARITIES = ['auto', ...ANALYTICS_GRANULARITIES] as const satisfies readonly AnalyticsGranularity[];
const granularityParam = z
.enum(GRANULARITIES, {
error: (issue) =>
issue.input === '1m' || issue.input === '30s'
? 'the finest analytics granularity is 5m'
: `must be one of ${GRANULARITIES.join(', ')}`
})
.default('auto');
// A transformed schema keeps no examples in its input JSON Schema, so these go on the parameter.
const scopeParam = z
.string()
.regex(ANALYTICS_SCOPE_PATTERN, { error: 'must be global or node:<id>' })
.transform((value) => value as AnalyticsScope)
.default('global')
.meta({ description: '`global` or `node:<id>` (PRO)', param: { example: 'global' } });
const metricsParam = csvParam(enumValues(AnalyticsMetric), { strict: true }).meta({
description: 'Comma-separated metrics, each at most once',
param: { example: 'roomsCreated,bytesUp' }
});
const dimensionsParam = csvParam(enumValues(AnalyticsDimension), { strict: true }).meta({
description: 'Comma-separated dimensions, each at most once',
param: { example: 'sdk,os' }
});
export function analyticsSeriesQuery(now: () => Date) {
return rangedQuery(now, { metrics: metricsParam, granularity: granularityParam, scope: scopeParam });
}
export type AnalyticsSeriesParams = z.output<ReturnType<typeof analyticsSeriesQuery>>;
export function analyticsBreakdownsQuery(now: () => Date) {
return rangedQuery(now, { dimensions: dimensionsParam, scope: scopeParam });
}
export type AnalyticsBreakdownsParams = z.output<ReturnType<typeof analyticsBreakdownsQuery>>;
export function analyticsSummaryQuery(now: () => Date) {
return rangedQuery(now, { scope: scopeParam });
}
export type AnalyticsSummaryParams = z.output<ReturnType<typeof analyticsSummaryQuery>>;
export type AnalyticsExportParams =
({ kind: 'series' } & AnalyticsSeriesParams) | ({ kind: 'breakdowns' } & AnalyticsBreakdownsParams);
/** `kind` and the parameters of the series or the breakdowns endpoint, validated by that endpoint's schema. */
export function analyticsExportQuery(now: () => Date) {
const series = analyticsSeriesQuery(now);
const breakdowns = analyticsBreakdownsQuery(now);
return z
.object({
kind: z.enum(['series', 'breakdowns'], { error: 'must be series or breakdowns' }),
metrics: z.string().optional().meta({ description: 'Metrics of `kind=series`' }),
dimensions: z.string().optional().meta({ description: 'Dimensions of `kind=breakdowns`' }),
granularity: z.string().optional().meta({ description: 'Granularity of `kind=series`' }),
scope: z.string().optional(),
from: z.string().optional(),
to: z.string().optional(),
tz: z.string().optional()
})
.transform((value, context): AnalyticsExportParams => {
const { kind, ...rest } = value;
const parameters = Object.fromEntries(Object.entries(rest).filter(([, item]) => item !== undefined));
const parsed = kind === 'series' ? series.safeParse(parameters) : breakdowns.safeParse(parameters);
if (!parsed.success) {
for (const issue of parsed.error.issues) {
context.addIssue({ code: 'custom', path: issue.path, message: issue.message });
}
return z.NEVER;
}
return { kind, ...parsed.data } as AnalyticsExportParams;
});
}

373
openvidu-dashboard/dashboard-ce/backend/src/analytics/analytics-service.ts Normal file
View File

@ -0,0 +1,373 @@
import type { Db } from 'mongodb';
import {
type AnalyticsBreakdown,
type AnalyticsBreakdownsResponse,
type AnalyticsSeries,
type AnalyticsSeriesResponse,
type AnalyticsSummary,
analyticsCsvFileName,
Collection
} from '@openvidu-dashboard/typings';
import { readRetentionMs } from '../schema/retention.js';
import { compact } from '../util/compact.js';
import type { AnalyticsCache } from './analytics-cache.js';
import {
type Counters,
type AnalyticsCatalogue,
dimensionDefinition,
EGRESS_ENDED_PATH,
metricDefinition,
metricFields,
round1,
SUMMARY_FIELDS
} from './analytics-catalogue.js';
import { type BucketCounters, foldRows, mapEntries, mergeCounters, totalCounters } from './analytics-counters.js';
import { breakdownsCsv, seriesCsv } from './analytics-csv.js';
import type { AnalyticsFeatureGate } from './analytics-gate.js';
import {
type BucketGrid,
gridStarts,
openDocumentStart,
planSeries,
snapRange,
utcDaysOf
} from './analytics-planner.js';
import { AnalyticsRepository } from './analytics-repository.js';
import type {
AnalyticsBreakdownsParams,
AnalyticsExportParams,
AnalyticsSeriesParams,
AnalyticsSummaryParams
} from './analytics-schemas.js';
export interface AnalyticsServiceOptions {
now: () => Date;
cache: AnalyticsCache;
gate: AnalyticsFeatureGate;
catalogue: AnalyticsCatalogue;
}
export interface AnalyticsCsv {
fileName: string;
body: string;
}
/** A read of rollup documents grouped on a bucket grid. */
interface RollupRead extends BucketGrid {
scope: string;
/** Identity of the grid in cache keys: granularity and zone. */
gridKey: string;
to: Date;
fields: readonly string[];
}
function value(counters: Counters, path: string): number {
return counters.get(path) ?? 0;
}
/** `numerator / denominator × scale` with one decimal; absent without a denominator. */
function share(numerator: number, denominator: number, scale = 100): number | undefined {
return denominator > 0 ? round1((numerator / denominator) * scale) : undefined;
}
/** Average over the rooms ended in range; absent when none ended or the writer stores no sum. */
function roomAverage(counters: Counters, path: string, digits: 'one' | 'integer'): number | undefined {
const ended = value(counters, 'rooms.ended');
if (ended === 0 || !counters.has(path)) {
return undefined;
}
const average = value(counters, path) / ended;
return digits === 'one' ? round1(average) : Math.round(average);
}
/** Analytics over the rollup collections. */
export class AnalyticsService {
private readonly repository: AnalyticsRepository;
constructor(
private readonly db: Db,
private readonly options: AnalyticsServiceOptions
) {
this.repository = new AnalyticsRepository(db);
}
async series(query: AnalyticsSeriesParams): Promise<AnalyticsSeriesResponse> {
this.options.gate.check({ metrics: query.metrics, scope: query.scope });
const now = this.options.now();
const plan = planSeries({
...query,
now,
retention: await readRetentionMs(this.db),
info: this.options.catalogue.info
});
const gridKey = `${plan.granularity}|${plan.collection === Collection.ANALYTICS_DAILY ? 'UTC' : query.tz}`;
const metrics = query.metrics.filter((metric) => metric !== 'uniqueIdentities');
const main =
metrics.length === 0
? new Map<number, Counters>()
: await this.read(
{
...plan,
scope: query.scope,
gridKey,
to: query.to,
fields: metricFields(this.options.catalogue, metrics)
},
now
);
const daily =
plan.utcDays === undefined
? undefined
: await this.read(
{
...plan.utcDays,
scope: query.scope,
gridKey: '1d|UTC',
to: query.to,
fields: ['uniqueIdentities']
},
now
);
const series = query.metrics.flatMap((metric): AnalyticsSeries[] => {
if (metric === 'uniqueIdentities' && plan.utcDays !== undefined && daily !== undefined) {
return [
{
name: metric,
...this.points(
plan.utcDays.starts,
daily,
metricDefinition(this.options.catalogue, metric).value
),
basis: 'utcDay'
}
];
}
if (metric === 'egressEnded') {
const statuses = new Set(
[...main.values()].flatMap((counters) => [...mapEntries(counters, EGRESS_ENDED_PATH).keys()])
);
return [...statuses].sort().map((status) => ({
name: `egressEnded.${status}`,
...this.points(
plan.starts,
main,
(counters) => counters?.get(`${EGRESS_ENDED_PATH}.${status}`) ?? 0
)
}));
}
return metric === 'uniqueIdentities'
? []
: [
{
name: metric,
...this.points(plan.starts, main, metricDefinition(this.options.catalogue, metric).value)
}
];
});
return {
granularity: plan.granularity,
from: query.from.toISOString(),
to: query.to.toISOString(),
scope: query.scope,
series
};
}
async breakdowns(query: AnalyticsBreakdownsParams): Promise<AnalyticsBreakdownsResponse> {
this.options.gate.check({ dimensions: query.dimensions, scope: query.scope });
const range = snapRange(query.from, query.to);
const fields = query.dimensions.flatMap((dimension) => {
const { path, errors } = dimensionDefinition(this.options.catalogue, dimension);
return errors === undefined ? [path] : [path, errors];
});
const counters = totalCounters(
await this.read(
{
collection: range.collection,
starts: [range.from],
scope: query.scope,
gridKey: 'total',
to: range.to,
fields: [...new Set(fields)]
},
this.options.now()
)
);
return {
from: range.from.toISOString(),
to: range.to.toISOString(),
scope: query.scope,
breakdowns: query.dimensions.map((dimension): AnalyticsBreakdown => {
const { path, errors } = dimensionDefinition(this.options.catalogue, dimension);
const entries = [...mapEntries(counters, path)].filter(([, count]) => count > 0);
const errorCounts = errors === undefined ? undefined : mapEntries(counters, errors);
const total = entries.reduce((sum, [, count]) => sum + count, 0);
return {
dimension,
total,
items: entries
.sort(([a, countA], [b, countB]) => countB - countA || a.localeCompare(b))
.map(([key, count]) =>
compact({
key,
count,
percent: share(count, total) ?? 0,
errors: errorCounts === undefined ? undefined : (errorCounts.get(key) ?? 0)
})
)
};
})
};
}
async summary(query: AnalyticsSummaryParams): Promise<AnalyticsSummary> {
this.options.gate.check({ scope: query.scope });
const now = this.options.now();
const range = snapRange(query.from, query.to);
const days = utcDaysOf(range.from, range.to);
const [counters, daily] = await Promise.all([
this.read(
{
collection: range.collection,
starts: [range.from],
scope: query.scope,
gridKey: 'total',
to: range.to,
fields: SUMMARY_FIELDS
},
now
).then(totalCounters),
this.read(
{
collection: Collection.ANALYTICS_DAILY,
starts: gridStarts(days.from, days.to, '1d', 'UTC'),
scope: query.scope,
gridKey: '1d|UTC',
to: days.to,
fields: ['uniqueIdentities']
},
now
)
]);
const identities = [...daily.values()].flatMap((day) => {
const count = day.get('uniqueIdentities');
return count === undefined ? [] : [count];
});
const joined = value(counters, 'participants.joined');
const calls = value(counters, 'apiCalls.total');
return compact<AnalyticsSummary>({
from: range.from.toISOString(),
to: range.to.toISOString(),
scope: query.scope,
roomsCreated: value(counters, 'rooms.created'),
roomsEnded: value(counters, 'rooms.ended'),
participantSessions: joined,
uniqueIdentities:
identities.length === 0
? undefined
: {
value: identities.reduce((sum, count) => sum + count, 0),
basis: 'utcDays',
days: identities.length
},
connectionSuccessRate:
joined > 0 ? Math.min(100, share(value(counters, 'participants.active'), joined) ?? 0) : undefined,
avgRoomSize: roomAverage(counters, 'rooms.participantsSum', 'one'),
avgRoomDurationMs: roomAverage(counters, 'rooms.durationMsSum', 'integer'),
bytesUp: value(counters, 'bytes.up'),
bytesDown: value(counters, 'bytes.down'),
egressStarted: value(counters, 'egress.started'),
egressDurationMs: value(counters, 'egress.durationMs'),
ingressSessions: value(counters, 'ingress.sessionsStarted'),
ingressDurationMs: value(counters, 'ingress.durationMs'),
apiCalls: calls,
apiErrorRate: share(value(counters, 'apiErrors.total'), calls)
});
}
/** The CSV of the series or the breakdowns of `query`, with its attachment name. */
async export(query: AnalyticsExportParams): Promise<AnalyticsCsv> {
if (query.kind === 'series') {
const response = await this.series(query);
return { fileName: analyticsCsvFileName('series', response.from, response.to), body: seriesCsv(response) };
}
const response = await this.breakdowns(query);
return {
fileName: analyticsCsvFileName('breakdowns', response.from, response.to),
body: breakdownsCsv(response)
};
}
private points(
starts: readonly Date[],
buckets: BucketCounters,
valueOf: (counters: Counters | undefined) => number | null
): Omit<AnalyticsSeries, 'name'> {
return { points: starts.map((start) => [start.toISOString(), valueOf(buckets.get(start.getTime()))]) };
}
/**
* Rollup documents of `read` folded on its grid: the completed documents from the cache when present, the open one
* (whose bucket contains `now`) always from the database.
*/
private async read(read: RollupRead, now: Date): Promise<BucketCounters> {
const from = read.starts[0];
if (from === undefined || from.getTime() >= read.to.getTime()) {
return new Map();
}
const fold = (start: Date, end: Date) =>
foldRows(this.repository.rollups(read.collection, read.scope, start, end, read.fields), read.starts);
const open = openDocumentStart(read.collection, now);
if (!this.options.cache.enabled) {
return fold(from, read.to);
}
const completedTo = new Date(Math.min(read.to.getTime(), open.getTime()));
let completed: BucketCounters = new Map();
if (completedTo.getTime() > from.getTime()) {
const key = JSON.stringify([
read.collection,
read.scope,
read.gridKey,
[...read.fields].sort(),
from.getTime(),
completedTo.getTime()
]);
const cached = this.options.cache.get(key);
completed = cached ?? (await fold(from, completedTo));
if (cached === undefined) {
this.options.cache.set(key, completed);
}
}
return read.to.getTime() > completedTo.getTime()
? mergeCounters(completed, await fold(new Date(Math.max(from.getTime(), completedTo.getTime())), read.to))
: completed;
}
}

185
openvidu-dashboard/dashboard-ce/backend/src/api/cursor.ts Normal file
View File

@ -0,0 +1,185 @@
import type { Document, Filter, Sort } from 'mongodb';
import type { SortOrder } from '@openvidu-dashboard/typings';
import { ApiError } from '../http/api-error.js';
/** Page direction a cursor continues in: after the boundary item or before it. */
export type CursorDirection = 'next' | 'prev';
export type SortValue = string | number | boolean | Date | null;
export interface CursorPayload {
value: SortValue;
id: string;
sort: string;
order: SortOrder;
direction: CursorDirection;
/** Reference time of a ranked sort: when its first page was requested. */
asOf?: Date;
}
const DATE_PREFIX = '\u0000date:';
/** Opaque cursor: base64url of `[sortValue, id, sort, order, direction]`, plus `asOf` for a ranked sort. */
export function encodeCursor(payload: CursorPayload): string {
const value = payload.value instanceof Date ? `${DATE_PREFIX}${payload.value.toISOString()}` : payload.value;
const fields = [value, payload.id, payload.sort, payload.order, payload.direction];
return Buffer.from(
JSON.stringify(payload.asOf === undefined ? fields : [...fields, payload.asOf.toISOString()])
).toString('base64url');
}
/** Decodes a cursor and checks it was issued for the same sort; returns an error message otherwise. */
export function decodeCursor(cursor: string, sort: string, order: SortOrder): CursorPayload | string {
let decoded: unknown;
try {
decoded = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
} catch {
return 'is not a valid cursor';
}
if (!Array.isArray(decoded) || (decoded.length !== 5 && decoded.length !== 6)) {
return 'is not a valid cursor';
}
const [rawValue, id, cursorSort, cursorOrder, direction, rawAsOf] = decoded as unknown[];
const asOf = typeof rawAsOf === 'string' ? new Date(rawAsOf) : undefined;
if (
typeof id !== 'string' ||
typeof cursorSort !== 'string' ||
(direction !== 'next' && direction !== 'prev') ||
!(rawValue === null || ['string', 'number', 'boolean'].includes(typeof rawValue)) ||
(decoded.length === 6 && (asOf === undefined || Number.isNaN(asOf.getTime())))
) {
return 'is not a valid cursor';
}
if (cursorSort !== sort || cursorOrder !== order) {
return 'was issued for another sort or order';
}
const value =
typeof rawValue === 'string' && rawValue.startsWith(DATE_PREFIX)
? new Date(rawValue.slice(DATE_PREFIX.length))
: (rawValue as SortValue);
return { value, id, sort, order, direction, ...(asOf === undefined ? {} : { asOf }) };
}
/** The decoded `cursor` of a request, or a `400` on the `cursor` parameter. */
export function cursorOrThrow(cursor: string | undefined, sort: string, order: SortOrder): CursorPayload | undefined {
if (cursor === undefined) {
return undefined;
}
const decoded = decodeCursor(cursor, sort, order);
if (typeof decoded === 'string') {
throw ApiError.validation([{ path: ['cursor'], message: decoded }]);
}
return decoded;
}
export interface PageQuery {
/** Condition on the sort field: the requested range narrowed to the cursor value; undefined when neither applies. */
fieldFilter?: Document;
/** Residual `$nor` dropping the items tied with the cursor value on the wrong side of `_id`; empty for the first page. */
ties: Filter<Document>;
/** `{ [field]: fieldFilter, ...ties }`. */
filter: Filter<Document>;
/** Sort to run the query with; reversed for a page before the cursor. */
sort: Sort;
/** Items are fetched in reverse order and must be reversed back. */
reversed: boolean;
}
/** Half-open range `[from, to)` on the sort field. */
export interface FieldRange {
from?: Date;
to?: Date;
}
function later(a: SortValue, b: SortValue): boolean {
return a !== null && b !== null && (a instanceof Date && b instanceof Date ? a.getTime() > b.getTime() : a > b);
}
/**
* Keyset query for a page: items strictly after (or before) the boundary `(sortValue, _id)` in the requested order,
* with `_id` as tie-breaker so every page is deterministic. The cursor narrows the index bounds of the sort field and
* only the items tied with the boundary value are filtered on `_id`.
*/
export function pageQuery(field: string, order: SortOrder, cursor?: CursorPayload, range: FieldRange = {}): PageQuery {
const ascending = order === 'asc';
const reversed = cursor?.direction === 'prev';
const forward = ascending !== reversed;
const direction = forward ? 1 : -1;
const sort: Sort = { [field]: direction, _id: direction };
const condition: Document = {};
if (range.from !== undefined) {
condition.$gte = range.from;
}
if (range.to !== undefined) {
condition.$lt = range.to;
}
let ties: Filter<Document> = {};
if (cursor !== undefined) {
if (forward) {
if (condition.$gte === undefined || later(cursor.value, condition.$gte as SortValue)) {
condition.$gte = cursor.value;
}
} else {
condition.$lte = cursor.value;
}
ties = { $nor: [{ [field]: cursor.value, _id: { [forward ? '$lte' : '$gte']: cursor.id } }] };
}
const fieldFilter = Object.keys(condition).length > 0 ? condition : undefined;
return {
...(fieldFilter ? { fieldFilter } : {}),
ties,
filter: { ...(fieldFilter ? { [field]: fieldFilter } : {}), ...ties },
sort,
reversed
};
}
/**
* Turns `limit + 1` fetched items into a page with its cursors: `hasMore` tells whether items exist beyond the page
* in the fetch direction; the opposite direction has items whenever the page came from a cursor.
*/
export function buildPage<T>(
fetched: T[],
limit: number,
query: PageQuery,
fromCursor: boolean,
boundary: (item: T) => { value: SortValue; id: string },
sortKey: { sort: string; order: SortOrder }
): { items: T[]; nextCursor: string | null; prevCursor: string | null } {
const hasMore = fetched.length > limit;
const page = fetched.slice(0, limit);
const items = query.reversed ? page.reverse() : page;
const first = items[0];
const last = items[items.length - 1];
const hasNext = query.reversed ? fromCursor : hasMore;
const hasPrev = query.reversed ? hasMore : fromCursor;
const cursorFor = (item: T | undefined, direction: CursorDirection) =>
item === undefined ? null : encodeCursor({ ...boundary(item), ...sortKey, direction });
return {
items,
nextCursor: hasNext ? cursorFor(last, 'next') : null,
prevCursor: hasPrev ? cursorFor(first, 'prev') : null
};
}

94
openvidu-dashboard/dashboard-ce/backend/src/api/keyset.ts Normal file
View File

@ -0,0 +1,94 @@
import type { Collection, Document, Filter } from 'mongodb';
import type { SortOrder } from '@openvidu-dashboard/typings';
import { buildPage, type CursorPayload, type FieldRange, pageQuery, type SortValue } from './cursor.js';
export interface Page<T> {
items: T[];
nextCursor: string | null;
prevCursor: string | null;
}
/** Order of two sort values: equal, `null` first, then by value. */
export function compareValues(a: SortValue, b: SortValue): number {
if (a === b) {
return 0;
}
if (a === null) {
return -1;
}
if (b === null) {
return 1;
}
const left = a instanceof Date ? a.getTime() : a;
const right = b instanceof Date ? b.getTime() : b;
return left < right ? -1 : left > right ? 1 : 0;
}
export function compareIds(a: string, b: string): number {
return a < b ? -1 : a > b ? 1 : 0;
}
export interface IndexOrderedPageRequest<T extends { _id: string }> {
collection: Collection<T>;
/** Scope and residual filters, without the keyset condition. */
filter: Document;
/** Sort field; the index orders by it but not by `_id`. */
field: keyof T & string;
order: SortOrder;
cursor: CursorPayload | undefined;
limit: number;
range?: FieldRange;
hint?: string;
projection?: Document;
}
/**
* A keyset page in `(field, _id)` order over an index that orders by `field` only, such as `{ participantSid, ts }`:
* the page is read in index order and the documents that share the `field` value of its last item are read with a
* point query and ordered on `_id` in memory, so the page never needs an in-memory sort of the whole scope.
*/
export async function indexOrderedPage<T extends { _id: string }>(
request: IndexOrderedPageRequest<T>
): Promise<Page<T>> {
const { collection, field, limit } = request;
const page = pageQuery(field, request.order, request.cursor, request.range);
const direction = page.sort[field as keyof typeof page.sort] === -1 ? -1 : 1;
const options = {
...(request.hint === undefined ? {} : { hint: request.hint }),
...(request.projection === undefined ? {} : { projection: request.projection })
};
const value = (doc: T) => doc[field] as SortValue;
const indexOrdered = (await collection
.find({ ...request.filter, ...page.filter } as Filter<T>, options)
.sort({ [field]: direction })
.limit(limit + 1)
.toArray()) as T[];
const last = indexOrdered[indexOrdered.length - 1];
let ordered = indexOrdered;
if (last !== undefined) {
const boundary = value(last);
const tied = (await collection
.find({ ...request.filter, [field]: boundary, ...page.ties } as Filter<T>, options)
.toArray()) as T[];
ordered = [...indexOrdered.filter((doc) => compareValues(value(doc), boundary) !== 0), ...tied].sort(
(a, b) => (compareValues(value(a), value(b)) || compareIds(a._id, b._id)) * direction
);
}
return buildPage(
ordered.slice(0, limit + 1),
limit,
page,
request.cursor !== undefined,
(doc) => ({ value: value(doc), id: doc._id }),
{ sort: field, order: request.order }
);
}

5
openvidu-dashboard/dashboard-ce/backend/src/api/mapping.ts Normal file
View File

@ -0,0 +1,5 @@
export function iso(date: Date): string;
export function iso(date: Date | undefined): string | undefined;
export function iso(date: Date | undefined): string | undefined {
return date?.toISOString();
}

131
openvidu-dashboard/dashboard-ce/backend/src/api/openapi.ts Normal file
View File

@ -0,0 +1,131 @@
import { Router } from 'express';
import * as z from 'zod';
import {
createDocument,
type ZodOpenApiOperationObject,
type ZodOpenApiPathsObject,
type ZodOpenApiResponseObject
} from 'zod-openapi';
import { ErrorCode } from '@openvidu-dashboard/typings';
import type { RouteDefinition, RouteRegistry } from './route-registry.js';
const errorSchema = z
.object({
error: z.object({
code: z.enum(Object.values(ErrorCode) as [ErrorCode, ...ErrorCode[]]),
message: z.string(),
details: z.record(z.string(), z.unknown()).optional()
})
})
.meta({ id: 'ApiError' });
/** The object a parameter schema parses: the input of a transformed object (resolved ranges, for instance). */
function inputObject(schema: z.ZodType): z.ZodObject {
return (schema instanceof z.ZodPipe ? inputObject(schema.in as z.ZodType) : schema) as z.ZodObject;
}
function operation(route: RouteDefinition, locked: boolean): ZodOpenApiOperationObject {
const responses: Record<string, ZodOpenApiResponseObject> = {};
for (const [status, response] of Object.entries(route.responses)) {
responses[status] = {
description: response.description,
...(response.schema
? { content: { [response.contentType ?? 'application/json']: { schema: response.schema } } }
: {}),
...(response.headers ? { headers: response.headers } : {})
};
}
const errors: [string, string][] = [['400', 'Invalid request']];
if (route.security !== 'public') {
errors.push(['401', 'Missing, invalid or expired access token']);
}
if (route.edition === 'pro') {
errors.push(['403', 'PRO feature on CE']);
}
for (const [status, description] of errors) {
responses[status] ??= { description, content: { 'application/json': { schema: errorSchema } } };
}
const security =
route.security === 'bearer'
? [{ bearerAuth: [] }]
: route.security === 'optional-bearer'
? [{}, { bearerAuth: [] }]
: [];
return {
summary: route.summary,
tags: route.tags,
security,
...(locked ? { description: `PRO feature \`${route.feature ?? ''}\`: CE answers 403 PRO_FEATURE.` } : {}),
...(route.request?.params || route.request?.query
? {
requestParams: {
...(route.request.params ? { path: inputObject(route.request.params) } : {}),
...(route.request.query ? { query: inputObject(route.request.query) } : {})
}
}
: {}),
...(route.request?.body
? { requestBody: { content: { 'application/json': { schema: route.request.body } } } }
: {}),
responses: responses
};
}
/** OpenAPI 3.1 document of every registered route, built from the schemas that validate them. */
export function openApiDocument(registry: RouteRegistry, version: string): ReturnType<typeof createDocument> {
const paths: ZodOpenApiPathsObject = {};
for (const route of registry.list()) {
const path = `/api/v1${route.path}`;
paths[path] ??= {};
paths[path][route.method] = operation(route, registry.isLocked(route));
}
return createDocument({
openapi: '3.1.0',
info: { title: 'OpenVidu Dashboard API', version },
components: { securitySchemes: { bearerAuth: { type: 'http', scheme: 'bearer', bearerFormat: 'JWT' } } },
paths
});
}
const SCALAR_PAGE = `<!doctype html>
<html>
<head>
<title>OpenVidu Dashboard API</title>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
</head>
<body>
<div id="app"></div>
<script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.74.0"></script>
<script>
Scalar.createApiReference('#app', { url: 'docs/openapi.json' });
</script>
</body>
</html>
`;
/** `GET /docs/openapi.json` and the browsable `GET /docs`, mounted under `/api/v1` outside production only. */
export function docsRouter(document: () => unknown): Router {
const router = Router();
router.get('/docs/openapi.json', (_req, res) => {
res.json(document());
});
router.get('/docs', (_req, res) => {
res.type('html').send(SCALAR_PAGE);
});
return router;
}

66
openvidu-dashboard/dashboard-ce/backend/src/api/probes.ts Normal file
View File

@ -0,0 +1,66 @@
import type { Db } from 'mongodb';
import * as z from 'zod';
import { type ReadyChecks, WriterSchemaStatus } from '@openvidu-dashboard/typings';
import { ApiError } from '../http/api-error.js';
import { readSchemaStatus } from '../schema/schema-status.js';
import type { RouteRegistry } from './route-registry.js';
export const READY_PING_TIMEOUT_MS = 2_000;
const healthSchema = z.object({ status: z.literal('ok'), version: z.string() }).meta({ id: 'HealthResponse' });
const readySchema = z
.object({
status: z.literal('ready'),
checks: z.object({ mongo: z.enum(['ok', 'error']), schema: z.enum(WriterSchemaStatus).optional() })
})
.meta({ id: 'ReadyResponse' });
/** MongoDB answers a ping within 2 s and the writer schema is not older than this dashboard reads. */
export async function readiness(db: Db): Promise<{ ready: boolean; checks: ReadyChecks }> {
try {
await db.command({ ping: 1 }, { timeoutMS: READY_PING_TIMEOUT_MS });
} catch {
return { ready: false, checks: { mongo: 'error' } };
}
const { status } = await readSchemaStatus(db);
return { ready: status !== WriterSchemaStatus.OLDER, checks: { mongo: 'ok', schema: status } };
}
/** `GET /health` (liveness, no MongoDB) and `GET /ready` (readiness). */
export function registerProbes(registry: RouteRegistry, version: string, db: Db): void {
registry.register({
method: 'get',
path: '/health',
edition: 'ce',
summary: 'Liveness: the process answers; MongoDB is not checked',
tags: ['probes'],
security: 'public',
responses: { 200: { description: 'Alive', schema: healthSchema } },
handler: () => ({ status: 'ok', version })
});
registry.register({
method: 'get',
path: '/ready',
edition: 'ce',
summary: 'Readiness: MongoDB answers and the writer schema is supported',
tags: ['probes'],
security: 'public',
responses: {
200: { description: 'Ready', schema: readySchema },
503: { description: 'Not ready; details.checks says why' }
},
handler: async () => {
const { ready, checks } = await readiness(db);
if (!ready) {
throw new ApiError('NOT_READY', 'The dashboard is not ready', { checks });
}
return { status: 'ready', checks };
}
});
}

173
openvidu-dashboard/dashboard-ce/backend/src/api/query.ts Normal file
View File

@ -0,0 +1,173 @@
import * as z from 'zod';
import { SortOrder } from '@openvidu-dashboard/typings';
import { isTimeZone, resolveTimeExpression } from './time-expression.js';
export const DEFAULT_FROM = 'now-24h';
export const DEFAULT_TO = 'now';
/** IANA zone or `UTC`; default `UTC`. */
export const tzParam = z
.string()
.refine(isTimeZone, { error: 'must be an IANA time zone such as Europe/Madrid, or UTC' })
.default('UTC')
.meta({ description: 'IANA time zone for relative snapping and buckets', examples: ['Europe/Madrid'] });
const timeExpression = z
.string()
.meta({ description: 'ISO 8601 with offset, now, now-<n>m|h|d, now/d or now/M', examples: ['now-24h'] });
export const limitParam = z.coerce
.number({ error: 'must be an integer between 1 and 100' })
.int({ error: 'must be an integer between 1 and 100' })
.min(1, { error: 'must be an integer between 1 and 100' })
.max(100, { error: 'must be an integer between 1 and 100' })
.default(25);
export const orderParam = z.enum([SortOrder.ASC, SortOrder.DESC], { error: 'must be asc or desc' });
/** Trimmed search text; empty means no search. */
export const qParam = z
.string()
.transform((value) => value.trim())
.pipe(z.string().max(100, { error: 'must be at most 100 characters' }))
.transform((value) => (value === '' ? undefined : value))
.optional();
/**
* Comma-separated values of an enumeration, e.g. `?kind=EGRESS,AGENT`; an unknown value is an issue on the parameter,
* and so are a repeated value and an empty list when `strict`.
*/
export function csvParam<const T extends readonly [string, ...string[]]>(
values: T,
options: { strict?: boolean } = {}
) {
const allowed = new Set<string>(values);
const isAllowed = (item: string): item is T[number] => allowed.has(item);
return z.string().transform((value, context) => {
const items = value
.split(',')
.map((item) => item.trim())
.filter((item) => item !== '');
if (!items.every(isAllowed)) {
const unknown = items.find((item) => !isAllowed(item)) ?? '';
context.addIssue({
code: 'custom',
message: options.strict
? `${unknown} is not one of ${values.join(', ')}`
: `must be a comma-separated list of ${values.join(', ')}`
});
return z.NEVER;
}
if (options.strict && items.length === 0) {
context.addIssue({ code: 'custom', message: 'must list at least one value' });
return z.NEVER;
}
const repeated = items.find((item, index) => items.indexOf(item) !== index);
if (options.strict && repeated !== undefined) {
context.addIssue({ code: 'custom', message: `lists ${repeated} more than once` });
return z.NEVER;
}
return items;
});
}
export interface ResolvedRange {
from: Date;
to: Date;
tz: string;
}
const rangeShape = { from: timeExpression.default(DEFAULT_FROM), to: timeExpression.default(DEFAULT_TO), tz: tzParam };
/** Resolves `from` and `to` at `instant`, adding an issue per invalid bound; `from` must be strictly before `to`. */
function resolveBounds(
value: { from?: string | undefined; to?: string | undefined; tz: string },
instant: Date,
context: z.RefinementCtx
): { from?: Date; to?: Date } | undefined {
const from = value.from === undefined ? undefined : resolveTimeExpression(value.from, instant, value.tz);
const to = value.to === undefined ? undefined : resolveTimeExpression(value.to, instant, value.tz);
let valid = true;
if (value.from !== undefined && from === undefined) {
context.addIssue({ code: 'custom', path: ['from'], message: 'is not a time expression' });
valid = false;
}
if (value.to !== undefined && to === undefined) {
context.addIssue({ code: 'custom', path: ['to'], message: 'is not a time expression' });
valid = false;
}
if (valid && from !== undefined && to !== undefined && from.getTime() >= to.getTime()) {
context.addIssue({ code: 'custom', path: ['from'], message: 'must be before to' });
valid = false;
}
return valid ? { ...(from ? { from } : {}), ...(to ? { to } : {}) } : undefined;
}
interface RawBounds {
from?: string | undefined;
to?: string | undefined;
tz: string;
}
/**
* Query over a time range: `from`, `to` and `tz` resolved at `now()` when the request is parsed, plus the resource's
* own parameters. OpenAPI documents the input object.
*/
export function rangedQuery<S extends z.core.$ZodLooseShape>(now: () => Date, shape: S) {
const input = z.object({ ...rangeShape, ...shape });
type Output = Omit<z.output<typeof input>, 'from' | 'to'> & { from: Date; to: Date; tz: string };
return input.transform((value, context): Output => {
const bounds = resolveBounds(value as RawBounds, now(), context);
if (bounds?.from === undefined || bounds.to === undefined) {
return z.NEVER;
}
return { ...(value as object), from: bounds.from, to: bounds.to } as Output;
});
}
/** `from`, `to` and `tz` resolved at `now()`. */
export function timeRangeQuery(now: () => Date) {
return rangedQuery(now, {}).transform(({ from, to, tz }): ResolvedRange => ({ from, to, tz }));
}
/**
* Query of a series whose range defaults to its entity's lifetime: `from` and `to` are optional and resolved at
* `now()` when given.
*/
export function optionalRangeQuery<S extends z.core.$ZodLooseShape>(now: () => Date, shape: S) {
const input = z.object({ from: timeExpression.optional(), to: timeExpression.optional(), tz: tzParam, ...shape });
type Output = Omit<z.output<typeof input>, 'from' | 'to'> & { from?: Date; to?: Date; tz: string };
return input.transform((value, context): Output => {
const bounds = resolveBounds(value as RawBounds, now(), context);
if (bounds === undefined) {
return z.NEVER;
}
const { from: _from, to: _to, ...rest } = value as RawBounds;
return { ...rest, ...bounds } as Output;
});
}

12
openvidu-dashboard/dashboard-ce/backend/src/api/ranked-limits.ts Normal file
View File

@ -0,0 +1,12 @@
import type { InfoLimits } from '@openvidu-dashboard/typings';
/** Ranked participant sorts scan every session of the range: at most a day of them without a room filter. */
const PARTICIPANT_RANKED_SORT_MAX_RANGE_MS = 86_400_000;
/** The ranked sort limits of a `DASHBOARD_LIST_TOTAL_MAX_RANGE`. */
export function rankedSortLimits(totalMaxRangeMs: number): InfoLimits {
return {
rankedSortMaxRangeMs: totalMaxRangeMs,
participantRankedSortMaxRangeMs: Math.min(PARTICIPANT_RANKED_SORT_MAX_RANGE_MS, totalMaxRangeMs)
};
}

117
openvidu-dashboard/dashboard-ce/backend/src/api/ranked.ts Normal file
View File

@ -0,0 +1,117 @@
import type { Collection, Document } from 'mongodb';
import type { SortOrder } from '@openvidu-dashboard/typings';
import { ApiError } from '../http/api-error.js';
import { type CursorDirection, type CursorPayload, encodeCursor, type SortValue } from './cursor.js';
/** A ranked list item: the projected document with the rank its cursor records. */
export type Ranked<T> = T & { rank: SortValue };
export interface RankedPageRequest {
/** Range and filters, served by the list's range index. */
match: Document;
/** Aggregation expression (or field path) of the rank at `asOf`; it never evaluates to `null`. */
rank: (asOf: Date) => Document | string;
/** Fields of the documents the list item needs. */
projection: Document;
/** Index of the range scan. */
hint?: string;
/** Sort key of the API, recorded in the cursors. */
sort: string;
order: SortOrder;
cursor: CursorPayload | undefined;
limit: number;
/** `asOf` of a first page. */
now: Date;
}
export interface RankedPage<T> {
items: Ranked<T>[];
nextCursor: string | null;
prevCursor: string | null;
}
/** The rank, then `_id`, beyond the cursor's boundary in the direction the page is read. */
function boundaryMatch(cursor: CursorPayload, forward: boolean): Document {
const operator = forward ? '$gt' : '$lt';
return { $or: [{ rank: { [operator]: cursor.value } }, { rank: cursor.value, _id: { [operator]: cursor.id } }] };
}
/**
* The aggregation of one ranked page: the documents of the range ranked at `asOf` in memory (a top-k sort over the
* range scan), from the cursor's boundary on, `limit + 1` of them to tell whether more exist.
*/
export function rankedPipeline(request: RankedPageRequest, asOf: Date): Document[] {
const reversed = request.cursor?.direction === 'prev';
const forward = (request.order === 'asc') !== reversed;
const direction = forward ? 1 : -1;
return [
{ $match: request.match },
{ $project: { ...request.projection, rank: request.rank(asOf) } },
...(request.cursor === undefined ? [] : [{ $match: boundaryMatch(request.cursor, forward) }]),
{ $sort: { rank: direction, _id: direction } },
{ $limit: request.limit + 1 }
];
}
/** Turns the `limit + 1` fetched items of {@link rankedPipeline} into a page whose cursors carry `asOf`. */
export function rankedResult<T extends { _id: string }>(
fetched: Ranked<T>[],
request: Pick<RankedPageRequest, 'cursor' | 'limit' | 'sort' | 'order'>,
asOf: Date
): RankedPage<T> {
const reversed = request.cursor?.direction === 'prev';
const hasMore = fetched.length > request.limit;
const page = fetched.slice(0, request.limit);
const items = reversed ? page.reverse() : page;
const fromCursor = request.cursor !== undefined;
const hasNext = reversed ? fromCursor : hasMore;
const hasPrev = reversed ? hasMore : fromCursor;
const cursorFor = (item: Ranked<T> | undefined, direction: CursorDirection) =>
item === undefined
? null
: encodeCursor({
value: item.rank,
id: item._id,
sort: request.sort,
order: request.order,
direction,
asOf
});
return {
items,
nextCursor: hasNext ? cursorFor(items[items.length - 1], 'next') : null,
prevCursor: hasPrev ? cursorFor(items[0], 'prev') : null
};
}
/**
* One page of a ranked sort: every document of the range ranked at the cursor's `asOf` (the request time on a first
* page), so a running entity keeps one rank across pages; documents examined never exceed those in the range.
*/
export async function rankedPage<T extends { _id: string }>(
collection: Pick<Collection, 'aggregate'>,
request: RankedPageRequest
): Promise<RankedPage<T>> {
const asOf = request.cursor?.asOf ?? request.now;
const fetched = await collection
.aggregate<Ranked<T>>(rankedPipeline(request, asOf), request.hint === undefined ? {} : { hint: request.hint })
.toArray();
return rankedResult(fetched, request, asOf);
}
/** Refuses a ranked sort on a resolved range wider than its limit with `SORT_RANGE_TOO_WIDE`. */
export function assertRankedRange(range: { from: Date; to: Date }, limitMs: number, sort: string): void {
if (range.to.getTime() - range.from.getTime() > limitMs) {
throw new ApiError(
'SORT_RANGE_TOO_WIDE',
`Sorting by ${sort} needs a range of at most ${String(Math.round(limitMs / 3_600_000))} h`,
{ sort, maxRangeMs: limitMs }
);
}
}

21
openvidu-dashboard/dashboard-ce/backend/src/api/responses.ts Normal file
View File

@ -0,0 +1,21 @@
import * as z from 'zod';
export const isoDate = z.iso.datetime();
/** `stale` of rooms and participants: present, `true`, only while the entity is active without recent stats. */
export const staleField = z
.literal(true)
.optional()
.meta({ description: 'Active entity whose last stats flush is older than the stale window' });
/** `ListResponse<T>`: one page of a list with its cursors and, under the range limit, `total`. */
export function listResponse(item: z.ZodType, id: string) {
return z
.object({
items: z.array(item),
nextCursor: z.string().nullable(),
prevCursor: z.string().nullable(),
total: z.number().int().optional()
})
.meta({ id });
}

205
openvidu-dashboard/dashboard-ce/backend/src/api/route-registry.ts Normal file
View File

@ -0,0 +1,205 @@
import { type NextFunction, type Request, type RequestHandler, type Response, Router } from 'express';
import type * as z from 'zod';
import type { Edition, FeatureKey, ValidationIssue } from '@openvidu-dashboard/typings';
import { ApiError } from '../http/api-error.js';
import { parsePart, throwIfInvalid } from './validation.js';
export type HttpMethod = 'get' | 'post' | 'put' | 'patch' | 'delete';
/**
* Who may call a route: anyone, a valid bearer token, or anyone with a token checked only when an `Authorization`
* header is present (info answers a public subset without it).
*/
export type RouteSecurity = 'public' | 'bearer' | 'optional-bearer';
/** Identity of the caller of a bearer route. */
export interface AuthContext {
username: string;
edition: Edition;
expiresAt: Date;
}
declare global {
// eslint-disable-next-line @typescript-eslint/no-namespace
namespace Express {
interface Request {
auth?: AuthContext;
}
}
}
export interface RouteInput<P, Q, B> {
params: P;
query: Q;
body: B;
req: Request;
res: Response;
}
export interface RouteResponse {
description: string;
schema?: z.ZodType;
/** Media type of `schema`; default `application/json`. */
contentType?: string;
headers?: z.ZodObject;
}
export interface RouteDefinition<P = unknown, Q = unknown, B = unknown> {
method: HttpMethod;
/** Path under `/api/v1` in OpenAPI form, e.g. `/rooms/{sid}`. */
path: string;
/** Edition that implements the route; CE answers `PRO_FEATURE` for PRO routes. */
edition: Edition;
/** Feature of a PRO route, reported in `details.feature`. */
feature?: FeatureKey;
summary: string;
tags: string[];
security: RouteSecurity;
request?: { params?: z.ZodType<P>; query?: z.ZodType<Q>; body?: z.ZodType<B> };
responses: Record<number, RouteResponse>;
/** Middlewares that run before authentication, such as a rate limiter. */
before?: RequestHandler[];
/** Returns the JSON body of a `200`, or answers through `res` and returns undefined. */
handler?: (input: RouteInput<P, Q, B>) => unknown;
}
/** A PRO route as CE knows it: answered with `PRO_FEATURE` and left out of the OpenAPI document. */
export interface RouteLock {
method: HttpMethod;
/** Path under `/api/v1` in OpenAPI form, e.g. `/rooms/{sid}`. */
path: string;
feature: FeatureKey;
}
/** Authenticates a request; installed by the auth module. */
export type Authenticator = (req: Request, required: boolean) => Promise<void>;
function routeKey(method: HttpMethod, path: string): string {
return `${method.toUpperCase()} ${path}`;
}
/** Express path of an OpenAPI path: `{sid}` becomes `:sid`. */
function expressPath(path: string): string {
return path.replace(/\{([^}]+)\}/g, ':$1');
}
/**
* Every `/api/v1` route with its edition, feature, schemas and handler, and the locks of the PRO routes. One list builds
* the Express router and the OpenAPI document; its order is the mount order, so literal segments are registered before
* the parameter routes they would otherwise shadow.
*/
export class RouteRegistry {
private readonly routes = new Map<string, RouteDefinition>();
private readonly locks = new Set<string>();
constructor(private readonly edition: Edition) {}
register<P, Q, B>(route: RouteDefinition<P, Q, B>): void {
const key = routeKey(route.method, route.path);
const current = this.routes.get(key);
if (current !== undefined && !this.locks.has(key)) {
throw new Error(`Route ${key} is already registered`);
}
if (current !== undefined && current.feature !== route.feature) {
throw new Error(`Route ${key} is locked for the feature ${String(current.feature)}`);
}
if (route.edition === 'pro' && route.feature === undefined) {
throw new Error(`PRO route ${key} needs a feature`);
}
// Setting an existing key keeps its position, so a lock is replaced where it was registered.
this.locks.delete(key);
this.routes.set(key, route as RouteDefinition);
}
/** Declares a PRO route by method, path and feature; the PRO edition registers its full definition in its place. */
lock(lock: RouteLock): void {
const key = routeKey(lock.method, lock.path);
if (this.routes.has(key)) {
throw new Error(`Route ${key} is already registered`);
}
this.locks.add(key);
this.routes.set(key, {
...lock,
edition: 'pro',
summary: '',
tags: [],
security: 'bearer',
responses: {}
});
}
/** Replaces the definition of a registered route where it stands; the PRO edition extends CE routes with it. */
replace<P, Q, B>(route: RouteDefinition<P, Q, B>): void {
const key = routeKey(route.method, route.path);
if (!this.routes.has(key) || this.locks.has(key)) {
throw new Error(`Route ${key} is not registered`);
}
this.routes.set(key, route as RouteDefinition);
}
/** `METHOD path` of every lock no definition has replaced. */
unimplemented(): string[] {
return [...this.locks];
}
/** The registered routes, locks aside. */
list(): RouteDefinition[] {
return [...this.routes].filter(([key]) => !this.locks.has(key)).map(([, route]) => route);
}
/** True when the running edition answers the route with `PRO_FEATURE`. */
isLocked(route: RouteDefinition): boolean {
return route.edition === 'pro' && this.edition === 'ce';
}
router(authenticate: Authenticator): Router {
const router = Router();
for (const route of this.routes.values()) {
router[route.method](expressPath(route.path), ...(route.before ?? []), this.handle(route, authenticate));
}
return router;
}
private handle(route: RouteDefinition, authenticate: Authenticator): RequestHandler {
return async (req: Request, res: Response, next: NextFunction) => {
try {
if (route.security !== 'public') {
await authenticate(req, route.security === 'bearer');
}
if (this.isLocked(route) || route.handler === undefined) {
throw new ApiError('PRO_FEATURE', 'This feature requires OpenVidu PRO', {
feature: route.feature ?? null
});
}
const issues: ValidationIssue[] = [];
const params = route.request?.params ? parsePart(route.request.params, req.params, issues) : undefined;
const query = route.request?.query ? parsePart(route.request.query, req.query, issues) : undefined;
const body = route.request?.body ? parsePart(route.request.body, req.body ?? {}, issues) : undefined;
throwIfInvalid(issues);
const result: unknown = await route.handler({ params, query, body, req, res });
if (!res.headersSent) {
res.status(200).json(result);
}
} catch (error) {
next(error);
}
};
}
}

10
openvidu-dashboard/dashboard-ce/backend/src/api/search.ts Normal file
View File

@ -0,0 +1,10 @@
import type { Document } from 'mongodb';
export function escapeRegex(value: string): string {
return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
}
/** Anchored, case-insensitive prefix on a lower-cased shadow field. */
export function prefixRegex(value: string): Document {
return { $regex: `^${escapeRegex(value.toLowerCase())}` };
}

55
openvidu-dashboard/dashboard-ce/backend/src/api/time-expression.ts Normal file
View File

@ -0,0 +1,55 @@
import { TZDate } from '@date-fns/tz';
// Per-function entry points: the date-fns barrel takes most of a second to load and delays startup.
import { startOfDay } from 'date-fns/startOfDay';
import { startOfMonth } from 'date-fns/startOfMonth';
const RELATIVE = /^now(?:-(\d+)([mhd])|\/([dM]))?$/;
const UNIT_MS = { m: 60_000, h: 3_600_000, d: 86_400_000 } as const;
/** True when `zone` is `UTC` or an IANA zone this runtime knows; numeric offsets are not zones. */
export function isTimeZone(zone: string): boolean {
if (/^[+-]\d/.test(zone)) {
return false;
}
try {
new Intl.DateTimeFormat('en-US', { timeZone: zone });
return true;
} catch {
return false;
}
}
/**
* Resolves a time expression at `now`: ISO 8601 with offset or `Z`, `now`, `now-<n>m|h|d` (a duration back) or
* `now/d` and `now/M` (start of the current day or month in `zone`). Returns undefined when it is neither.
*/
export function resolveTimeExpression(expression: string, now: Date, zone: string): Date | undefined {
const relative = RELATIVE.exec(expression);
if (relative) {
const [, amount, unit, snap] = relative;
if (amount !== undefined && unit !== undefined) {
return new Date(now.getTime() - Number(amount) * UNIT_MS[unit as keyof typeof UNIT_MS]);
}
if (snap !== undefined) {
const local = new TZDate(now.getTime(), zone);
const start = snap === 'd' ? startOfDay(local) : startOfMonth(local);
return new Date(start.getTime());
}
return new Date(now.getTime());
}
if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d{1,9})?)?(?:Z|[+-]\d{2}:\d{2})$/.test(expression)) {
return undefined;
}
const date = new Date(expression);
return Number.isNaN(date.getTime()) ? undefined : date;
}

128
openvidu-dashboard/dashboard-ce/backend/src/api/time-series.ts Normal file
View File

@ -0,0 +1,128 @@
import { TZDate } from '@date-fns/tz';
// Per-function entry points: the date-fns barrel takes most of a second to load and delays startup.
import { addDays } from 'date-fns/addDays';
import { startOfDay } from 'date-fns/startOfDay';
import { startOfHour } from 'date-fns/startOfHour';
import { startOfMinute } from 'date-fns/startOfMinute';
import {
type BucketGranularity,
type Granularity,
SERIES_GRANULARITIES,
type TimeSeriesPoint
} from '@openvidu-dashboard/typings';
export const MAX_BUCKETS = 1_000;
const GRANULARITY_MS: Readonly<Record<BucketGranularity, number>> = {
'30s': 30_000,
'1m': 60_000,
'5m': 300_000,
'15m': 900_000,
'1h': 3_600_000,
'6h': 21_600_000,
'1d': 86_400_000
};
function bucketCount(from: Date, to: Date, granularity: BucketGranularity): number {
return Math.ceil((to.getTime() - from.getTime()) / GRANULARITY_MS[granularity]);
}
/**
* The granularity to apply: `auto` gives the finest of `ladder` with at most 1 000 buckets; a value outside the ladder
* or giving more buckets is an error.
*/
export function resolveGranularity(
requested: Granularity,
from: Date,
to: Date,
ladder: readonly BucketGranularity[] = SERIES_GRANULARITIES
): BucketGranularity | { error: string } {
if (requested !== 'auto') {
if (!ladder.includes(requested)) {
return { error: `must be auto or one of ${ladder.join(', ')}` };
}
return bucketCount(from, to, requested) <= MAX_BUCKETS
? requested
: { error: `gives more than ${String(MAX_BUCKETS)} buckets for this range; choose a coarser granularity` };
}
return ladder.find((granularity) => bucketCount(from, to, granularity) <= MAX_BUCKETS) ?? ladder.at(-1) ?? '1d';
}
/** Start of the bucket containing `instant`, aligned on wall-clock boundaries of `zone`. */
export function bucketStart(instant: Date, granularity: BucketGranularity, zone: string): Date {
const local = new TZDate(instant.getTime(), zone);
let start: TZDate;
switch (granularity) {
case '30s':
start = startOfMinute(local);
start.setSeconds(local.getSeconds() < 30 ? 0 : 30);
break;
case '1m':
start = startOfMinute(local);
break;
case '5m':
case '15m': {
const minutes = granularity === '5m' ? 5 : 15;
start = startOfMinute(local);
start.setMinutes(start.getMinutes() - (start.getMinutes() % minutes));
break;
}
case '1h':
start = startOfHour(local);
break;
case '6h':
start = startOfHour(local);
start.setHours(start.getHours() - (start.getHours() % 6));
break;
case '1d':
start = startOfDay(local);
break;
}
return new Date(start.getTime());
}
function nextBucket(start: Date, granularity: BucketGranularity, zone: string): Date {
if (granularity === '1d' || granularity === '6h') {
const local = new TZDate(start.getTime(), zone);
// Wall-clock hours: on the day the clocks go back, 6 elapsed hours from midnight end inside the first bucket.
const next = granularity === '1d' ? addDays(local, 1).getTime() : local.setHours(local.getHours() + 6);
return bucketStart(new Date(next), granularity, zone);
}
return new Date(start.getTime() + GRANULARITY_MS[granularity]);
}
/** Starts of every bucket overlapping `[from, to)`, local midnight and wall-clock hours included across DST. */
export function bucketStarts(from: Date, to: Date, granularity: BucketGranularity, zone: string): Date[] {
const starts: Date[] = [];
let start = bucketStart(from, granularity, zone);
while (start < to) {
const next = nextBucket(start, granularity, zone);
if (next <= start) {
throw new Error(`${granularity} buckets of ${zone} do not advance past ${start.toISOString()}`);
}
starts.push(start);
start = next;
}
return starts;
}
/** Dense points over `buckets`: a bucket without a value holds `0` for counters and `null` for averages. */
export function densePoints(
buckets: readonly Date[],
values: ReadonlyMap<number, number>,
missing: 0 | null
): TimeSeriesPoint[] {
return buckets.map((bucket) => [bucket.toISOString(), values.get(bucket.getTime()) ?? missing]);
}

27
openvidu-dashboard/dashboard-ce/backend/src/api/validation.ts Normal file
View File

@ -0,0 +1,27 @@
import type { ValidationIssue } from '@openvidu-dashboard/typings';
import type { core, ZodType } from 'zod';
import { ApiError } from '../http/api-error.js';
export function zodIssues(issues: readonly core.$ZodIssue[]): ValidationIssue[] {
return issues.map((issue) => ({ path: issue.path.map(String), message: issue.message }));
}
/** Parses one part of a request; every issue of every part ends up in one `VALIDATION_ERROR`. */
export function parsePart<T>(schema: ZodType<T>, value: unknown, issues: ValidationIssue[]): T | undefined {
const result = schema.safeParse(value);
if (result.success) {
return result.data;
}
issues.push(...zodIssues(result.error.issues));
return undefined;
}
export function throwIfInvalid(issues: ValidationIssue[]): void {
if (issues.length > 0) {
throw ApiError.validation(issues);
}
}

145
openvidu-dashboard/dashboard-ce/backend/src/auth/auth-routes.ts Normal file
View File

@ -0,0 +1,145 @@
import type { RequestHandler } from 'express';
import { rateLimit } from 'express-rate-limit';
import * as z from 'zod';
import { ApiError } from '../http/api-error.js';
import { errorBody } from '../http/errors.js';
import type { RouteRegistry } from '../api/route-registry.js';
import type { AuthService, ClientInfo } from './auth-service.js';
import { clearRefreshCookie, readRefreshCookie, type RefreshCookiePolicy, setRefreshCookie } from './cookies.js';
export const LOGIN_WINDOW_MS = 15 * 60_000;
export const LOGIN_FAILED_ATTEMPTS = 10;
const credentials = z
.strictObject({
username: z.string({ error: 'is required' }).min(1, { error: 'is required' }),
password: z.string({ error: 'is required' }).min(1, { error: 'is required' })
})
.meta({ id: 'LoginRequest' });
const tokenResponse = z
.object({ accessToken: z.string(), expiresAt: z.iso.datetime() })
.meta({ id: 'AuthTokenResponse' });
const meResponse = z
.object({ username: z.string(), edition: z.enum(['ce', 'pro']), expiresAt: z.iso.datetime() })
.meta({ id: 'MeResponse' });
/** 10 failed logins per client IP in 15 minutes, per replica; successful logins do not count. */
export function loginLimiter(): RequestHandler {
return rateLimit({
windowMs: LOGIN_WINDOW_MS,
limit: LOGIN_FAILED_ATTEMPTS,
skipSuccessfulRequests: true,
standardHeaders: false,
legacyHeaders: false,
handler: (req, res) => {
const resetTime = (req as { rateLimit?: { resetTime?: Date } }).rateLimit?.resetTime;
const seconds = resetTime ? Math.max(1, Math.ceil((resetTime.getTime() - Date.now()) / 1000)) : 1;
res.setHeader('Retry-After', String(seconds));
res.status(429).json(errorBody('RATE_LIMITED', 'Too many failed logins; try again later'));
}
});
}
function client(req: { ip?: string | undefined; get(name: string): string | undefined }): ClientInfo {
const userAgent = req.get('User-Agent');
return { ...(req.ip === undefined ? {} : { ip: req.ip }), ...(userAgent === undefined ? {} : { userAgent }) };
}
/** `POST /auth/login`, `POST /auth/refresh`, `POST /auth/logout` and `GET /auth/me`. */
export function registerAuthRoutes(
registry: RouteRegistry,
auth: () => AuthService,
cookiePolicy: () => RefreshCookiePolicy
): void {
registry.register({
method: 'post',
path: '/auth/login',
edition: 'ce',
summary: 'Log in with the administrator credentials',
tags: ['auth'],
security: 'public',
before: [loginLimiter()],
request: { body: credentials },
responses: {
200: { description: 'Logged in; the refresh token is set as a cookie', schema: tokenResponse },
401: { description: 'Wrong credentials (INVALID_CREDENTIALS)' },
429: { description: 'Too many failed logins (RATE_LIMITED)' }
},
handler: async ({ body, req, res }) => {
const session = await auth().login(body.username, body.password, client(req));
if (session === null) {
throw new ApiError('INVALID_CREDENTIALS', 'Invalid username or password');
}
setRefreshCookie(res, req, cookiePolicy(), session.refreshToken);
return session.tokens;
}
});
registry.register({
method: 'post',
path: '/auth/refresh',
edition: 'ce',
summary: 'Rotate the refresh cookie and get a new access token',
tags: ['auth'],
security: 'public',
responses: {
200: { description: 'New access token; the refresh cookie is rotated', schema: tokenResponse },
401: { description: 'Missing, unknown, expired or revoked session; the cookie is cleared' }
},
handler: async ({ req, res }) => {
try {
const session = await auth().refresh(readRefreshCookie(req), client(req));
setRefreshCookie(res, req, cookiePolicy(), session.refreshToken);
return session.tokens;
} catch (error) {
clearRefreshCookie(res, req, cookiePolicy());
throw error;
}
}
});
registry.register({
method: 'post',
path: '/auth/logout',
edition: 'ce',
summary: 'End the session of the refresh cookie',
tags: ['auth'],
security: 'public',
responses: { 204: { description: 'Logged out; the cookie is cleared' } },
handler: async ({ req, res }) => {
await auth().logout(readRefreshCookie(req));
clearRefreshCookie(res, req, cookiePolicy());
res.status(204).end();
}
});
registry.register({
method: 'get',
path: '/auth/me',
edition: 'ce',
summary: 'The authenticated administrator',
tags: ['auth'],
security: 'bearer',
responses: { 200: { description: 'Current session', schema: meResponse } },
handler: ({ req }) => {
const session = req.auth;
if (session === undefined) {
throw new ApiError('UNAUTHORIZED', 'Missing access token', { reason: 'missing' });
}
return { username: session.username, edition: session.edition, expiresAt: session.expiresAt.toISOString() };
}
});
}

181
openvidu-dashboard/dashboard-ce/backend/src/auth/auth-service.ts Normal file
View File

@ -0,0 +1,181 @@
import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
import { errors as joseErrors, jwtVerify, SignJWT } from 'jose';
import type { AuthTokenResponse, Edition } from '@openvidu-dashboard/typings';
import type { AuthContext } from '../api/route-registry.js';
import { ApiError } from '../http/api-error.js';
import type { Logger } from '../logging/logger.js';
import type { SessionRepository } from './session-repository.js';
export const ACCESS_TOKEN_TTL_SECONDS = 900;
/** A rotated refresh token presented again within this window is a concurrent refresh, not a replay. */
export const REUSE_GRACE_MS = 10_000;
export interface ClientInfo {
ip?: string;
userAgent?: string;
}
export interface IssuedSession {
tokens: AuthTokenResponse;
/** Opaque value of the refresh cookie. */
refreshToken: string;
}
export interface AuthServiceOptions {
username: string;
password: string;
edition: Edition;
key: Uint8Array;
refreshTokenTtlSeconds: number;
sessions: SessionRepository;
logger: Logger;
now?: () => Date;
}
function sha256(value: string): Buffer {
return createHash('sha256').update(value).digest();
}
function unauthorized(reason: 'missing' | 'invalid' | 'expired', message = 'Session expired or invalid'): ApiError {
return new ApiError('UNAUTHORIZED', message, { reason });
}
/** Credentials, access tokens and the rotating refresh sessions of the single administrator. */
export class AuthService {
private readonly usernameDigest: Buffer;
private readonly passwordDigest: Buffer;
private readonly now: () => Date;
constructor(private readonly options: AuthServiceOptions) {
this.usernameDigest = sha256(options.username);
this.passwordDigest = sha256(options.password);
this.now = options.now ?? (() => new Date());
}
/** Compares digests of both values in constant time, so timing reveals neither which one nor their length. */
checkCredentials(username: string, password: string): boolean {
const usernameMatches = timingSafeEqual(sha256(username), this.usernameDigest);
const passwordMatches = timingSafeEqual(sha256(password), this.passwordDigest);
return usernameMatches && passwordMatches;
}
async issueAccessToken(): Promise<AuthTokenResponse> {
const issuedAt = Math.floor(this.now().getTime() / 1000);
const expiresAt = issuedAt + ACCESS_TOKEN_TTL_SECONDS;
const accessToken = await new SignJWT({ edition: this.options.edition })
.setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
.setSubject(this.options.username)
.setIssuedAt(issuedAt)
.setExpirationTime(expiresAt)
.sign(this.options.key);
return { accessToken, expiresAt: new Date(expiresAt * 1000).toISOString() };
}
/** Verifies signature, algorithm (HS256 only) and expiry; throws `UNAUTHORIZED` with the reason. */
async verifyAccessToken(token: string): Promise<AuthContext> {
try {
const { payload } = await jwtVerify(token, this.options.key, {
algorithms: ['HS256'],
currentDate: this.now(),
requiredClaims: ['sub', 'exp', 'iat']
});
if (payload.sub !== this.options.username || typeof payload.exp !== 'number') {
throw unauthorized('invalid', 'Invalid access token');
}
return {
username: payload.sub,
edition: payload.edition === 'pro' ? 'pro' : 'ce',
expiresAt: new Date(payload.exp * 1000)
};
} catch (error) {
if (error instanceof ApiError) {
throw error;
}
if (error instanceof joseErrors.JWTExpired) {
throw unauthorized('expired', 'Access token expired');
}
throw unauthorized('invalid', 'Invalid access token');
}
}
/** Starts a session family; null when the credentials do not match. */
async login(username: string, password: string, client: ClientInfo): Promise<IssuedSession | null> {
if (!this.checkCredentials(username, password)) {
return null;
}
return this.startSession(randomUUID(), client);
}
/**
* Rotates a refresh token: a live token gets a successor of the same family; a token rotated more than 10 s ago
* revokes its family; a missing, unknown, expired or revoked one is `UNAUTHORIZED`.
*/
async refresh(refreshToken: string | undefined, client: ClientInfo): Promise<IssuedSession> {
if (refreshToken === undefined || refreshToken === '') {
throw unauthorized('missing', 'No session cookie');
}
const now = this.now();
const session = await this.options.sessions.rotate(hashToken(refreshToken), now);
if (session === null || session.revokedAt !== undefined) {
throw unauthorized('invalid');
}
if (session.expiresAt.getTime() <= now.getTime()) {
throw unauthorized('expired');
}
if (session.rotatedAt !== undefined && now.getTime() - session.rotatedAt.getTime() > REUSE_GRACE_MS) {
await this.options.sessions.revokeFamily(session.familyId, now);
this.options.logger.warn(`Refresh token reused after rotation: session family ${session.familyId} revoked`);
throw unauthorized('invalid');
}
return this.startSession(session.familyId, client);
}
/** Revokes the family of the presented refresh token, if any. */
async logout(refreshToken: string | undefined): Promise<void> {
if (refreshToken === undefined || refreshToken === '') {
return;
}
const session = await this.options.sessions.findByHash(hashToken(refreshToken));
if (session) {
await this.options.sessions.revokeFamily(session.familyId, this.now());
}
}
private async startSession(familyId: string, client: ClientInfo): Promise<IssuedSession> {
const refreshToken = randomBytes(32).toString('base64url');
const createdAt = this.now();
await this.options.sessions.insert({
familyId,
tokenHash: hashToken(refreshToken),
createdAt,
expiresAt: new Date(createdAt.getTime() + this.options.refreshTokenTtlSeconds * 1000),
...(client.ip === undefined ? {} : { ip: client.ip }),
...(client.userAgent === undefined ? {} : { userAgent: client.userAgent.slice(0, 512) })
});
return { tokens: await this.issueAccessToken(), refreshToken };
}
}
export function hashToken(token: string): string {
return createHash('sha256').update(token).digest('hex');
}

31
openvidu-dashboard/dashboard-ce/backend/src/auth/bearer.ts Normal file
View File

@ -0,0 +1,31 @@
import type { Authenticator } from '../api/route-registry.js';
import { ApiError } from '../http/api-error.js';
import type { AuthService } from './auth-service.js';
const BEARER = /^Bearer\s+(\S+)$/i;
/**
* Checks `Authorization: Bearer <token>`: required routes need it; optional routes check it only when the header is
* present, so an expired token is a `401` and not the public answer.
*/
export function bearerAuthenticator(auth: () => AuthService): Authenticator {
return async (req, required) => {
const header = req.get('Authorization');
if (header === undefined) {
if (required) {
throw new ApiError('UNAUTHORIZED', 'Missing access token', { reason: 'missing' });
}
return;
}
const token = BEARER.exec(header)?.[1];
if (token === undefined) {
throw new ApiError('UNAUTHORIZED', 'Malformed Authorization header', { reason: 'invalid' });
}
req.auth = await auth().verifyAccessToken(token);
};
}

5
openvidu-dashboard/dashboard-ce/backend/src/auth/collections.ts Normal file
View File

@ -0,0 +1,5 @@
/** Collections owned by the dashboard, outside the writer's data model contract. */
export const DashboardCollection = {
SETTINGS: 'dashboard_settings',
SESSIONS: 'dashboard_sessions'
} as const;

33
openvidu-dashboard/dashboard-ce/backend/src/auth/cookies.ts Normal file
View File

@ -0,0 +1,33 @@
import type { Request, Response } from 'express';
import type { CookieSecureMode } from '../config/variables.js';
export const REFRESH_COOKIE = 'ov_dashboard_refresh';
export interface RefreshCookiePolicy {
/** Public base path of the dashboard, ending with `/`. */
basePath: string;
ttlSeconds: number;
secure: CookieSecureMode;
}
function attributes(policy: RefreshCookiePolicy, req: Request, maxAge: number): string {
const secure = policy.secure === 'true' || (policy.secure === 'auto' && req.secure);
return `Path=${policy.basePath}api/v1/auth; Max-Age=${String(maxAge)}; HttpOnly${secure ? '; Secure' : ''}; SameSite=Strict`;
}
/** Sets the refresh cookie, scoped to the auth endpoints so no other service on the origin receives it. */
export function setRefreshCookie(res: Response, req: Request, policy: RefreshCookiePolicy, token: string): void {
res.append('Set-Cookie', `${REFRESH_COOKIE}=${token}; ${attributes(policy, req, policy.ttlSeconds)}`);
}
export function clearRefreshCookie(res: Response, req: Request, policy: RefreshCookiePolicy): void {
res.append('Set-Cookie', `${REFRESH_COOKIE}=; ${attributes(policy, req, 0)}`);
}
export function readRefreshCookie(req: Request): string | undefined {
const cookies = req.cookies as Record<string, string | undefined> | undefined;
return cookies?.[REFRESH_COOKIE];
}

60
openvidu-dashboard/dashboard-ce/backend/src/auth/session-repository.ts Normal file
View File

@ -0,0 +1,60 @@
import type { Collection, Db, ObjectId } from 'mongodb';
import { DashboardCollection } from './collections.js';
export interface SessionDocument {
_id?: ObjectId;
/** One per login; every rotation keeps it. */
familyId: string;
/** SHA-256 hex of the refresh token; the token itself is never stored. */
tokenHash: string;
createdAt: Date;
expiresAt: Date;
rotatedAt?: Date;
revokedAt?: Date;
ip?: string;
userAgent?: string;
}
/** `dashboard_sessions`: one document per refresh token, removed by MongoDB once `expiresAt` passes. */
export class SessionRepository {
private readonly sessions: Collection<SessionDocument>;
constructor(db: Db) {
this.sessions = db.collection<SessionDocument>(DashboardCollection.SESSIONS);
}
async ensureIndexes(): Promise<void> {
await this.sessions.createIndexes([
{ key: { tokenHash: 1 }, name: 'tokenHash_unique', unique: true },
{ key: { familyId: 1 }, name: 'familyId' },
{ key: { expiresAt: 1 }, name: 'expiresAt_ttl', expireAfterSeconds: 0 }
]);
}
async insert(session: SessionDocument): Promise<void> {
await this.sessions.insertOne(session);
}
/**
* Marks the session of `tokenHash` as rotated at `at`, keeping an earlier rotation time, and returns the session
* as it was before; null when no session has that hash.
*/
async rotate(tokenHash: string, at: Date): Promise<SessionDocument | null> {
return this.sessions.findOneAndUpdate(
{ tokenHash },
[{ $set: { rotatedAt: { $ifNull: ['$rotatedAt', at] } } }],
{
returnDocument: 'before'
}
);
}
async findByHash(tokenHash: string): Promise<SessionDocument | null> {
return this.sessions.findOne({ tokenHash });
}
async revokeFamily(familyId: string, at: Date): Promise<void> {
await this.sessions.updateMany({ familyId, revokedAt: { $exists: false } }, { $set: { revokedAt: at } });
}
}

51
openvidu-dashboard/dashboard-ce/backend/src/auth/signing-key.ts Normal file
View File

@ -0,0 +1,51 @@
import { randomBytes } from 'node:crypto';
import { Binary, type Db, MongoServerError } from 'mongodb';
import { DashboardCollection } from './collections.js';
interface SigningKeyDocument {
_id: 'signing-key';
key: Binary;
createdAt: Date;
}
const DUPLICATE_KEY = 11_000;
/**
* The key that signs access tokens: `DASHBOARD_JWT_SECRET` when set, otherwise the one stored in
* `dashboard_settings`, created by the first replica that starts; the unique `_id` makes concurrent replicas
* converge on one key.
*/
export async function provisionSigningKey(db: Db, secret: string | undefined): Promise<Uint8Array> {
if (secret !== undefined) {
return new TextEncoder().encode(secret);
}
const settings = db.collection<SigningKeyDocument>(DashboardCollection.SETTINGS);
const stored = await settings.findOne({ _id: 'signing-key' });
if (stored) {
return stored.key.buffer;
}
const key = randomBytes(32);
try {
await settings.insertOne({ _id: 'signing-key', key: new Binary(key), createdAt: new Date() });
return new Uint8Array(key);
} catch (error) {
if (!(error instanceof MongoServerError) || error.code !== DUPLICATE_KEY) {
throw error;
}
const winner = await settings.findOne({ _id: 'signing-key' });
if (!winner) {
throw new Error('The signing key was inserted by another replica but cannot be read', { cause: error });
}
return winner.key.buffer;
}
}

44
openvidu-dashboard/dashboard-ce/backend/src/config/config-file.ts Normal file
View File

@ -0,0 +1,44 @@
import { existsSync, readFileSync } from 'node:fs';
import { parseEnv } from 'node:util';
export type ConfigFileResult =
| { kind: 'none' }
| { kind: 'loaded'; path: string; applied: string[] }
| { kind: 'missing'; path: string }
| { kind: 'unreadable'; path: string; reason: string };
/**
* Loads `DASHBOARD_CONFIG_PATH` (`KEY=value` lines) into `env`; variables already set in `env` keep their value.
* A missing file is reported to be logged as a warning.
*/
export function loadConfigFile(env: NodeJS.ProcessEnv): ConfigFileResult {
const path = env.DASHBOARD_CONFIG_PATH?.trim();
if (!path) {
return { kind: 'none' };
}
if (!existsSync(path)) {
return { kind: 'missing', path };
}
let values: Record<string, string>;
try {
// Same parser as process.loadEnvFile, which writes to process.env only.
values = parseEnv(readFileSync(path, 'utf8')) as Record<string, string>;
} catch (error) {
return { kind: 'unreadable', path, reason: error instanceof Error ? error.message : String(error) };
}
const applied: string[] = [];
for (const [key, value] of Object.entries(values)) {
if (env[key] === undefined) {
env[key] = value;
applied.push(key);
}
}
return { kind: 'loaded', path, applied };
}

271
openvidu-dashboard/dashboard-ce/backend/src/config/variables.ts Normal file
View File

@ -0,0 +1,271 @@
import { isIP } from 'node:net';
import * as z from 'zod';
import { compact } from '../util/compact.js';
/** Variables read by OpenVidu Dashboard 3.9, kept with the same names and meaning. */
export const LEGACY_VARIABLES = [
'SERVER_PORT',
'ADMIN_USERNAME',
'ADMIN_PASSWORD',
'MONGO_ENABLED',
'DATABASE_URL',
'DATABASE_NAME',
'MONGO_NODES',
'MONGO_PORT',
'MONGO_ADMIN_USERNAME',
'MONGO_ADMIN_PASSWORD',
'MONGO_REPLICA_SET_NAME',
'DASHBOARD_CONFIG_PATH',
'LOG_LEVEL'
] as const;
export const LOG_LEVELS = ['error', 'warn', 'info', 'http', 'verbose', 'debug', 'silly'] as const;
export type LogLevel = (typeof LOG_LEVELS)[number];
export const COOKIE_SECURE_MODES = ['auto', 'true', 'false'] as const;
export type CookieSecureMode = (typeof COOKIE_SECURE_MODES)[number];
const optionalText = z
.string()
.optional()
.transform((value) => (value === undefined || value.trim() === '' ? undefined : value));
const requiredText = z.string({ error: 'is required' }).trim().min(1, { error: 'is required' });
/** Express `trust proxy` setting: `false`, a hop count, or addresses, CIDRs and the Express subnet names. */
export type TrustProxy = false | number | string[];
const TRUST_PROXY_NAMES = ['loopback', 'linklocal', 'uniquelocal'];
function isTrustProxyEntry(entry: string): boolean {
if (TRUST_PROXY_NAMES.includes(entry)) {
return true;
}
const [address = '', prefix, ...rest] = entry.split('/');
const family = isIP(address);
if (family === 0 || rest.length > 0) {
return false;
}
if (prefix === undefined) {
return true;
}
const bits = Number(prefix);
return Number.isInteger(bits) && bits >= 0 && bits <= (family === 4 ? 32 : 128);
}
const trustProxy = z
.string()
.optional()
.transform((value, context): TrustProxy => {
const text = (value ?? '').trim();
if (text === '') {
return [...TRUST_PROXY_NAMES];
}
if (text === 'true') {
context.addIssue({
code: 'custom',
message: 'must not be true: any client could then choose its own address'
});
return z.NEVER;
}
if (text === 'false') {
return false;
}
if (/^\d+$/.test(text)) {
return Number(text);
}
const entries = text.split(',').map((entry) => entry.trim());
if (entries.some((entry) => !isTrustProxyEntry(entry))) {
context.addIssue({
code: 'custom',
message:
'must be false, a hop count, or a list of addresses, CIDRs, loopback, linklocal and uniquelocal'
});
return z.NEVER;
}
return entries;
});
const DURATION_UNITS_MS = { m: 60_000, h: 3_600_000, d: 86_400_000 } as const;
/** `<n>m`, `<n>h` or `<n>d` as milliseconds. */
const duration = z
.string()
.regex(/^[1-9]\d*[mhd]$/, { error: 'must be a duration such as 30m, 24h or 7d' })
.transform(
(value) => Number(value.slice(0, -1)) * DURATION_UNITS_MS[value.slice(-1) as keyof typeof DURATION_UNITS_MS]
);
/** A URL path starting with `/`, normalized to end with `/`. */
const basePath = optionalText.pipe(
z
.string()
.regex(/^\/[^\s?#]*$/, { error: 'must be a path starting with /' })
.transform((value) => (value.endsWith('/') ? value : `${value}/`))
.optional()
);
const port = z.coerce
.number({ error: 'must be a TCP port' })
.int({ error: 'must be a TCP port' })
.min(1, { error: 'must be a TCP port' })
.max(65_535, { error: 'must be a TCP port' });
/**
* Every configuration variable, keyed by its environment name. New variables are prefixed `DASHBOARD_`, or
* `DATABASE_` for database connection settings.
*/
export const variablesSchema = z.object({
SERVER_PORT: port.default(5000),
ADMIN_USERNAME: requiredText,
ADMIN_PASSWORD: requiredText,
DATABASE_URL: optionalText,
DATABASE_NAME: optionalText.transform((value) => value ?? 'openvidu'),
DATABASE_TLS_CA_FILE: optionalText,
MONGO_NODES: optionalText,
MONGO_PORT: optionalText,
MONGO_ADMIN_USERNAME: optionalText,
MONGO_ADMIN_PASSWORD: optionalText,
MONGO_REPLICA_SET_NAME: optionalText,
DASHBOARD_JWT_SECRET: optionalText.refine((value) => value === undefined || Buffer.byteLength(value) >= 32, {
error: 'must be at least 32 bytes'
}),
DASHBOARD_REFRESH_TOKEN_TTL: z.coerce
.number({ error: 'must be a positive integer of seconds' })
.int({ error: 'must be a positive integer of seconds' })
.positive({ error: 'must be a positive integer of seconds' })
.default(604_800),
DASHBOARD_COOKIE_SECURE: z.enum(COOKIE_SECURE_MODES, { error: 'must be auto, true or false' }).default('auto'),
DASHBOARD_TRUST_PROXY: trustProxy,
DASHBOARD_BASE_PATH: basePath,
DASHBOARD_LIST_TOTAL_MAX_RANGE: duration.default(7 * DURATION_UNITS_MS.d),
DASHBOARD_ANALYTICS_CACHE_TTL: z.coerce
.number({ error: 'must be a non-negative integer of seconds' })
.int({ error: 'must be a non-negative integer of seconds' })
.min(0, { error: 'must be a non-negative integer of seconds' })
.default(60)
});
export type Variables = z.output<typeof variablesSchema>;
/** Names read outside the schema: before parsing (`DASHBOARD_CONFIG_PATH`, `MONGO_ENABLED`) or leniently (`LOG_LEVEL`). */
export const PRE_SCHEMA_VARIABLES = ['DASHBOARD_CONFIG_PATH', 'MONGO_ENABLED', 'LOG_LEVEL'] as const;
export interface DashboardConfig {
port: number;
logLevel: LogLevel;
admin: { username: string; password: string };
database: {
name: string;
url?: string;
tlsCaFile?: string;
nodes?: string;
port?: string;
username?: string;
password?: string;
replicaSet?: string;
};
session: { jwtSecret?: string; refreshTokenTtlSeconds: number; cookieSecure: CookieSecureMode };
http: { trustProxy: TrustProxy; basePath?: string };
lists: { totalMaxRangeMs: number };
/** Seconds the aggregates of completed rollup documents are kept in memory (0 disables the cache). */
analytics: { cacheTtlSeconds: number };
}
export type ConfigResult =
| { kind: 'config'; config: DashboardConfig; warnings: string[] }
| { kind: 'mongo-disabled' }
| { kind: 'invalid'; errors: string[]; warnings: string[] };
/** True unless `MONGO_ENABLED` is set to something other than `true`, as in 3.9. */
export function isMongoEnabled(env: NodeJS.ProcessEnv): boolean {
const value = env.MONGO_ENABLED;
return value === undefined || value.toLowerCase() === 'true';
}
/** `<NAME> ("<value>") <message>` per issue of `error`, without the values of passwords and secrets. */
export function variableErrors(env: NodeJS.ProcessEnv, error: z.ZodError): string[] {
return error.issues.map((issue) => {
const name = String(issue.path[0] ?? 'configuration');
const value = env[name];
const shown =
value === undefined || name.includes('PASSWORD') || name.includes('SECRET') ? '' : ` ("${value}")`;
return `${name}${shown} ${issue.message}`;
});
}
/** Reads the configuration from the environment; every invalid variable is reported, not only the first. */
export function parseConfig(env: NodeJS.ProcessEnv): ConfigResult {
if (!isMongoEnabled(env)) {
return { kind: 'mongo-disabled' };
}
const warnings: string[] = [];
const rawLevel = env.LOG_LEVEL?.trim().toLowerCase();
let logLevel: LogLevel = 'info';
if (rawLevel) {
if ((LOG_LEVELS as readonly string[]).includes(rawLevel)) {
logLevel = rawLevel as LogLevel;
} else {
warnings.push(`LOG_LEVEL "${env.LOG_LEVEL ?? ''}" is not a log level; using info`);
}
}
const result = variablesSchema.safeParse(env);
if (!result.success) {
return { kind: 'invalid', errors: variableErrors(env, result.error), warnings };
}
const v = result.data;
return {
kind: 'config',
warnings,
config: {
port: v.SERVER_PORT,
logLevel,
admin: { username: v.ADMIN_USERNAME, password: v.ADMIN_PASSWORD },
database: compact<DashboardConfig['database']>({
name: v.DATABASE_NAME,
url: v.DATABASE_URL,
tlsCaFile: v.DATABASE_TLS_CA_FILE,
nodes: v.MONGO_NODES,
port: v.MONGO_PORT,
username: v.MONGO_ADMIN_USERNAME,
password: v.MONGO_ADMIN_PASSWORD,
replicaSet: v.MONGO_REPLICA_SET_NAME
}),
session: compact<DashboardConfig['session']>({
jwtSecret: v.DASHBOARD_JWT_SECRET,
refreshTokenTtlSeconds: v.DASHBOARD_REFRESH_TOKEN_TTL,
cookieSecure: v.DASHBOARD_COOKIE_SECURE
}),
http: compact<DashboardConfig['http']>({
trustProxy: v.DASHBOARD_TRUST_PROXY,
basePath: v.DASHBOARD_BASE_PATH
}),
lists: { totalMaxRangeMs: v.DASHBOARD_LIST_TOTAL_MAX_RANGE },
analytics: { cacheTtlSeconds: v.DASHBOARD_ANALYTICS_CACHE_TTL }
}
};
}

38
openvidu-dashboard/dashboard-ce/backend/src/di/tokens.ts Normal file
View File

@ -0,0 +1,38 @@
/** Service identifiers of the dashboard container; PRO rebinds them in `DashboardOptions.configure`. */
export const TOKENS = {
Config: Symbol.for('openvidu-dashboard.Config'),
Logger: Symbol.for('openvidu-dashboard.Logger'),
MongoClient: Symbol.for('openvidu-dashboard.MongoClient'),
Database: Symbol.for('openvidu-dashboard.Database'),
Shutdown: Symbol.for('openvidu-dashboard.Shutdown'),
/** `() => Date`, replaced in tests. */
Clock: Symbol.for('openvidu-dashboard.Clock'),
RouteRegistry: Symbol.for('openvidu-dashboard.RouteRegistry'),
/** `FeatureKey[]` reported by info; empty on CE. */
Features: Symbol.for('openvidu-dashboard.Features'),
/** `() => InfoLicense | undefined` reported by info; nothing on CE. */
LicenseInfo: Symbol.for('openvidu-dashboard.LicenseInfo'),
InfoService: Symbol.for('openvidu-dashboard.InfoService'),
SessionRepository: Symbol.for('openvidu-dashboard.SessionRepository'),
AuthService: Symbol.for('openvidu-dashboard.AuthService'),
RoomsService: Symbol.for('openvidu-dashboard.RoomsService'),
ParticipantsService: Symbol.for('openvidu-dashboard.ParticipantsService'),
EgressService: Symbol.for('openvidu-dashboard.EgressService'),
IngressService: Symbol.for('openvidu-dashboard.IngressService'),
AnalyticsService: Symbol.for('openvidu-dashboard.AnalyticsService'),
OverviewService: Symbol.for('openvidu-dashboard.OverviewService'),
StatusService: Symbol.for('openvidu-dashboard.StatusService'),
/** The freshness windows of the writer's batch interval, for the stale flags of rooms and participants. */
WriterFreshness: Symbol.for('openvidu-dashboard.WriterFreshness'),
/** `boolean`: the overview adds the server nodes; false on CE. */
OverviewExtension: Symbol.for('openvidu-dashboard.OverviewExtension'),
/** `AnalyticsCatalogue`: the metrics and dimensions the analytics endpoints compute; PRO adds its own. */
AnalyticsCatalogue: Symbol.for('openvidu-dashboard.AnalyticsCatalogue'),
/** Allows the PRO metrics, dimensions and scopes of the enabled features. */
AnalyticsFeatureGate: Symbol.for('openvidu-dashboard.AnalyticsFeatureGate'),
StatsModeReader: Symbol.for('openvidu-dashboard.StatsModeReader'),
/** Bound by the signing-key startup hook. */
SigningKey: Symbol.for('openvidu-dashboard.SigningKey'),
/** Bound by the base-path startup hook. */
BasePath: Symbol.for('openvidu-dashboard.BasePath')
} as const;

65
openvidu-dashboard/dashboard-ce/backend/src/egress/egress-mappers.ts Normal file
View File

@ -0,0 +1,65 @@
import type {
EgressDocument,
EgressListItem,
EgressOutputKind,
EgressOutputsSummary
} from '@openvidu-dashboard/typings';
import { iso } from '../api/mapping.js';
import { compact } from '../util/compact.js';
/** Fields of an egress document the list item needs; locations, URLs and messages are read only as flags. */
export const EGRESS_LIST_PROJECTION = {
roomSid: 1,
roomName: 1,
type: 1,
sourceType: 1,
status: 1,
closedBy: 1,
startedAt: 1,
endedAt: 1,
durationMs: 1,
error: 1,
errorCode: 1,
'outputs.kind': 1,
'outputs.error': 1
} as const;
type ListFields = Pick<
EgressDocument,
| '_id'
| 'roomSid'
| 'roomName'
| 'type'
| 'sourceType'
| 'status'
| 'closedBy'
| 'startedAt'
| 'endedAt'
| 'durationMs'
| 'error'
| 'errorCode'
> & { outputs: Pick<EgressDocument['outputs'][number], 'kind' | 'error'>[] };
/** Distinct output kinds in order of first appearance and the number of outputs. */
export function outputsSummary(outputs: readonly { kind: EgressOutputKind }[]): EgressOutputsSummary {
return { kinds: [...new Set(outputs.map((output) => output.kind))], count: outputs.length };
}
export function toEgressListItem(doc: ListFields): EgressListItem {
return compact<EgressListItem>({
egressId: doc._id,
roomSid: doc.roomSid,
roomName: doc.roomName,
type: doc.type,
sourceType: doc.sourceType,
status: doc.status,
closedBy: doc.closedBy,
startedAt: iso(doc.startedAt),
endedAt: iso(doc.endedAt),
durationMs: doc.durationMs,
outputs: outputsSummary(doc.outputs),
hasError: doc.error !== undefined || doc.outputs.some((output) => output.error !== undefined),
errorCode: doc.errorCode
});
}

69
openvidu-dashboard/dashboard-ce/backend/src/egress/egress-query.ts Normal file
View File

@ -0,0 +1,69 @@
import type { Document } from 'mongodb';
import { EgressSort } from '@openvidu-dashboard/typings';
import { prefixRegex } from '../api/search.js';
import { EGRESS_ID, type EgressesListParams } from './egress-schemas.js';
/** Index of a plan; `startedAt_id` and `roomNameLower_startedAt` are read with a sort on `{ startedAt, _id }`. */
export type EgressesIndex = 'startedAt_id' | 'status_startedAt' | 'roomSid_startedAt' | 'roomNameLower_startedAt';
export type EgressesListPlan =
| { kind: 'id'; filter: Document }
| {
kind: 'page';
/** Scope and residual filters, without the range or the keyset condition. */
filter: Document;
hint: EgressesIndex;
}
| {
kind: 'ranked';
filter: Document;
hint: EgressesIndex;
rank: (asOf: Date) => Document;
};
type RankedEgressSort = Exclude<EgressSort, 'startedAt'>;
/** Rank of each ranked sort key at `asOf`: an egress in flight ends, and lasts until, `asOf`. */
const EGRESS_RANKS: Readonly<Record<RankedEgressSort, (asOf: Date) => Document>> = {
endedAt: (asOf) => ({ $ifNull: ['$endedAt', asOf] }),
duration: (asOf) => ({ $ifNull: ['$durationMs', { $subtract: [asOf, '$startedAt'] }] })
};
/** Residual filters that never pick the index: `type`, and `status` when another field drives the plan. */
function residual(params: EgressesListParams, withStatus: boolean): Document {
return {
...(withStatus && params.status !== 'all' ? { status: { $in: params.status } } : {}),
...(params.type === undefined || params.type.length === 0 ? {} : { type: { $in: params.type } })
};
}
/**
* Plan of an egresses list request after the filter-to-index table of the design: an egress id is a point lookup; a
* room drives `{ roomSid, startedAt }` (a room name prefix residual); a room name prefix drives `{ roomNameLower,
* startedAt }`; a status set drives `{ status, startedAt }` (an `$in` explode merged in `startedAt` order); otherwise
* `{ startedAt, _id }`. The range is always on `startedAt`; a ranked sort key scans it whole and ranks in memory.
*/
export function egressesListPlan(params: EgressesListParams): EgressesListPlan {
if (params.q !== undefined && EGRESS_ID.test(params.q)) {
return { kind: 'id', filter: { _id: params.q } };
}
const prefix = params.q === undefined ? {} : { roomNameLower: prefixRegex(params.q) };
let scope: { filter: Document; hint: EgressesIndex };
if (params.room !== undefined) {
scope = { filter: { roomSid: params.room, ...prefix, ...residual(params, true) }, hint: 'roomSid_startedAt' };
} else if (params.q !== undefined) {
scope = { filter: { ...prefix, ...residual(params, true) }, hint: 'roomNameLower_startedAt' };
} else if (params.status !== 'all') {
scope = { filter: residual(params, true), hint: 'status_startedAt' };
} else {
scope = { filter: residual(params, false), hint: 'startedAt_id' };
}
return params.sort === EgressSort.STARTED_AT
? { kind: 'page', ...scope }
: { kind: 'ranked', ...scope, rank: EGRESS_RANKS[params.sort] };
}

128
openvidu-dashboard/dashboard-ce/backend/src/egress/egress-repository.ts Normal file
View File

@ -0,0 +1,128 @@
import type { Db, Document, Filter, Sort } from 'mongodb';
import {
Collection,
EGRESS_IN_FLIGHT_STATUSES,
type EgressDocument,
type EgressStatus,
type EgressType,
type HourlyRollupDocument
} from '@openvidu-dashboard/typings';
import { EGRESS_LIST_PROJECTION } from './egress-mappers.js';
export type EgressListDocument = Pick<
EgressDocument,
| '_id'
| 'roomSid'
| 'roomName'
| 'type'
| 'sourceType'
| 'status'
| 'closedBy'
| 'startedAt'
| 'endedAt'
| 'durationMs'
| 'error'
| 'errorCode'
| 'outputs'
>;
export interface EgressRangeFigures {
startedInRange: number;
byType: Partial<Record<EgressType, number>>;
byEndStatus: Partial<Record<EgressStatus, number>>;
totalDurationMs: number;
}
const TERMINAL: readonly EgressStatus[] = ['complete', 'failed', 'aborted', 'limit_reached'];
/** Egress reads: the list on the index of its plan and the summary. */
export class EgressRepository {
constructor(private readonly db: Db) {}
get egresses() {
return this.db.collection<EgressDocument>(Collection.EGRESSES);
}
find(filter: Document, sort: Sort, limit: number, hint?: string): Promise<EgressListDocument[]> {
return this.egresses
.find(filter as Filter<EgressDocument>, {
projection: EGRESS_LIST_PROJECTION,
...(hint === undefined ? {} : { hint })
})
.sort(sort)
.limit(limit)
.toArray();
}
count(filter: Document, hint: string): Promise<number> {
return this.egresses.countDocuments(filter, { hint });
}
countInFlight(): Promise<number> {
return this.egresses.countDocuments({ status: { $in: [...EGRESS_IN_FLIGHT_STATUSES] } });
}
/** Figures of the egresses started in `[from, to)`, grouped on `{ startedAt, _id }`. */
async rangeFigures(from: Date, to: Date): Promise<EgressRangeFigures> {
const [row] = await this.egresses
.aggregate<{
startedInRange: { n: number }[];
byType: { _id: EgressType; n: number }[];
byEndStatus: { _id: EgressStatus; n: number }[];
duration: { ms: number }[];
}>(
[
{ $match: { startedAt: { $gte: from, $lt: to } } },
{ $project: { _id: 0, type: 1, status: 1, durationMs: 1 } },
{
$facet: {
startedInRange: [{ $count: 'n' }],
byType: [{ $group: { _id: '$type', n: { $sum: 1 } } }],
byEndStatus: [
{ $match: { status: { $in: [...TERMINAL] } } },
{ $group: { _id: '$status', n: { $sum: 1 } } }
],
duration: [
{ $match: { status: { $in: [...TERMINAL] } } },
{ $group: { _id: null, ms: { $sum: { $ifNull: ['$durationMs', 0] } } } }
]
}
}
],
{ hint: 'startedAt_id' }
)
.toArray();
return {
startedInRange: row?.startedInRange[0]?.n ?? 0,
byType: Object.fromEntries((row?.byType ?? []).map((entry) => [entry._id, entry.n])),
byEndStatus: Object.fromEntries((row?.byEndStatus ?? []).map((entry) => [entry._id, entry.n])),
totalDurationMs: row?.duration[0]?.ms ?? 0
};
}
/** Sums of the egress counters of the global hourly rollups whose `_id` lies in `[first, last]`. */
async rollupFigures(first: string, last: string): Promise<EgressRangeFigures> {
const docs = await this.db
.collection<HourlyRollupDocument>(Collection.ANALYTICS_HOURLY)
.find({ _id: { $gte: first, $lte: last } }, { projection: { egress: 1 } })
.toArray();
const figures: EgressRangeFigures = { startedInRange: 0, byType: {}, byEndStatus: {}, totalDurationMs: 0 };
const add = <K extends string>(target: Partial<Record<K, number>>, counts: Partial<Record<K, number>> = {}) => {
for (const [key, value] of Object.entries(counts) as [K, number | undefined][]) {
target[key] = (target[key] ?? 0) + (value ?? 0);
}
};
for (const doc of docs) {
figures.startedInRange += doc.egress?.started ?? 0;
figures.totalDurationMs += doc.egress?.durationMs ?? 0;
add(figures.byType, doc.egress?.byType);
add(figures.byEndStatus, doc.egress?.endedByStatus);
}
return figures;
}
}

44
openvidu-dashboard/dashboard-ce/backend/src/egress/egress-responses.ts Normal file
View File

@ -0,0 +1,44 @@
import * as z from 'zod';
import { ClosedBy, EgressOutputKind, EgressSourceType, EgressStatus, EgressType } from '@openvidu-dashboard/typings';
import { isoDate, listResponse } from '../api/responses.js';
import { enumValues } from '../util/enum-values.js';
const count = z.number().int();
const outputKind = z.enum(enumValues(EgressOutputKind));
const status = z.enum(enumValues(EgressStatus));
const type = z.enum(enumValues(EgressType));
/** Fields of an egress list item, which the PRO egress detail extends. */
export const egressListFields = {
egressId: z.string(),
roomSid: z.string().optional(),
roomName: z.string().optional(),
type,
sourceType: z.enum(enumValues(EgressSourceType)),
status,
closedBy: z.enum(enumValues(ClosedBy)).optional(),
startedAt: isoDate,
endedAt: isoDate.optional(),
durationMs: count.optional(),
hasError: z.boolean(),
errorCode: count.optional()
};
export const egressListItem = z
.object({ ...egressListFields, outputs: z.object({ kinds: z.array(outputKind), count }) })
.meta({ id: 'EgressListItem' });
export const egressesListResponse = listResponse(egressListItem, 'EgressList');
export const egressSummary = z
.object({
active: count,
startedInRange: count,
byType: z.partialRecord(type, count),
byEndStatus: z.partialRecord(status, count),
totalDurationMs: z.number(),
approximate: z.boolean()
})
.meta({ id: 'EgressSummary' });

42
openvidu-dashboard/dashboard-ce/backend/src/egress/egress-routes.ts Normal file
View File

@ -0,0 +1,42 @@
import { FeatureKey } from '@openvidu-dashboard/typings';
import type { RouteRegistry } from '../api/route-registry.js';
import { egressesListResponse, egressSummary } from './egress-responses.js';
import { egressesListQuery, egressesSummaryQuery } from './egress-schemas.js';
import type { EgressService } from './egress-service.js';
const TAGS = ['Egress'];
/**
* Egress routes: the list and the summary, and the locks of the `egress-detail` routes (the detail and its events).
* `now` is read per request.
*/
export function registerEgressRoutes(registry: RouteRegistry, egress: () => EgressService, now: () => Date): void {
registry.register({
method: 'get',
path: '/egresses',
edition: 'ce',
summary: 'Egresses started in a range',
tags: TAGS,
security: 'bearer',
request: { query: egressesListQuery(now) },
responses: { 200: { description: 'One page of egresses', schema: egressesListResponse } },
handler: ({ query }) => egress().list(query)
});
// Registered before /egresses/{id} so the literal segment wins.
registry.register({
method: 'get',
path: '/egresses/summary',
edition: 'ce',
summary: 'Egress counts of a range',
tags: TAGS,
security: 'bearer',
request: { query: egressesSummaryQuery(now) },
responses: { 200: { description: 'Figures above the egress table', schema: egressSummary } },
handler: ({ query }) => egress().summary(query)
});
for (const path of ['', '/events']) {
registry.lock({ method: 'get', path: `/egresses/{id}${path}`, feature: FeatureKey.EGRESS_DETAIL });
}
}

68
openvidu-dashboard/dashboard-ce/backend/src/egress/egress-schemas.ts Normal file
View File

@ -0,0 +1,68 @@
import * as z from 'zod';
import { EgressSort, EgressStatus, EgressType, ENTITY_ID_PATTERNS } from '@openvidu-dashboard/typings';
import { csvParam, limitParam, orderParam, qParam, rangedQuery } from '../api/query.js';
import { ROOM_SID } from '../rooms/rooms-schemas.js';
import { enumValues } from '../util/enum-values.js';
export const EGRESS_ID = ENTITY_ID_PATTERNS.egress;
const STATUSES = enumValues(EgressStatus);
const cursorParam = z.string().min(1).optional();
/** Room name prefix of two characters or more; an egress id is accepted whatever its length. */
const egressSearch = qParam.refine((value) => value === undefined || EGRESS_ID.test(value) || value.length >= 2, {
error: 'must have at least two characters'
});
/** `all`, or a comma-separated subset of the egress statuses. */
const statusParam = z
.string()
.transform((value, context): 'all' | EgressStatus[] => {
if (value.trim() === 'all') {
return 'all';
}
const items = value
.split(',')
.map((item) => item.trim())
.filter((item) => item !== '');
if (
items.length === 0 ||
!items.every((item): item is EgressStatus => STATUSES.includes(item as EgressStatus))
) {
context.addIssue({
code: 'custom',
message: `must be all or a comma-separated list of ${STATUSES.join(', ')}`
});
return z.NEVER;
}
return [...new Set(items)];
})
.default('all')
.meta({ description: '`all` or a comma-separated subset of the egress statuses' });
export function egressesListQuery(now: () => Date) {
return rangedQuery(now, {
status: statusParam,
type: csvParam(enumValues(EgressType)).optional(),
room: z.string().regex(ROOM_SID, { error: 'must be a room SID (RM_…)' }).optional(),
q: egressSearch,
sort: z
.enum(enumValues(EgressSort), { error: 'must be startedAt, endedAt or duration' })
.default(EgressSort.STARTED_AT),
order: orderParam.default('desc'),
cursor: cursorParam,
limit: limitParam
});
}
export type EgressesListParams = z.output<ReturnType<typeof egressesListQuery>>;
export function egressesSummaryQuery(now: () => Date) {
return rangedQuery(now, {});
}

157
openvidu-dashboard/dashboard-ce/backend/src/egress/egress-service.ts Normal file
View File

@ -0,0 +1,157 @@
import type { Db } from 'mongodb';
import type { EgressDocument, EgressListItem, EgressSummary, ListResponse } from '@openvidu-dashboard/typings';
import { buildPage, type CursorPayload, cursorOrThrow, pageQuery } from '../api/cursor.js';
import { indexOrderedPage } from '../api/keyset.js';
import { assertRankedRange, rankedPage } from '../api/ranked.js';
import { EGRESS_LIST_PROJECTION, toEgressListItem } from './egress-mappers.js';
import { egressesListPlan } from './egress-query.js';
import { EgressRepository } from './egress-repository.js';
import type { EgressesListParams } from './egress-schemas.js';
export interface EgressServiceOptions {
/** Longest range, in milliseconds, whose list `total` and summary figures are exact (`DASHBOARD_LIST_TOTAL_MAX_RANGE`). */
totalMaxRangeMs: number;
now: () => Date;
}
const STARTED_AT = 'startedAt';
const HOUR_MS = 3_600_000;
/** `_id` of the global hourly rollup of `bucket`: RFC 3339 UTC without fractional seconds. */
function globalHourlyId(bucket: number): string {
return `global:${new Date(bucket).toISOString().replace('.000Z', 'Z')}`;
}
/** Egresses list and summary. */
export class EgressService {
private readonly repository: EgressRepository;
constructor(
db: Db,
private readonly options: EgressServiceOptions
) {
this.repository = new EgressRepository(db);
}
private exactRange(from: Date, to: Date): boolean {
return to.getTime() - from.getTime() <= this.options.totalMaxRangeMs;
}
async list(params: EgressesListParams): Promise<ListResponse<EgressListItem>> {
const plan = egressesListPlan(params);
if (plan.kind === 'id') {
const docs = await this.repository.find(plan.filter, { _id: 1 }, 1);
return { items: docs.map(toEgressListItem), nextCursor: null, prevCursor: null, total: docs.length };
}
const cursor = cursorOrThrow(params.cursor, params.sort, params.order);
const { filter, hint } = plan;
const countFilter = { ...filter, startedAt: { $gte: params.from, $lt: params.to } };
const total = this.exactRange(params.from, params.to) ? this.repository.count(countFilter, hint) : undefined;
if (plan.kind === 'ranked') {
assertRankedRange(params, this.options.totalMaxRangeMs, params.sort);
const [ranked, counted] = await Promise.all([
rankedPage<EgressDocument>(this.repository.egresses, {
match: countFilter,
rank: plan.rank,
projection: EGRESS_LIST_PROJECTION,
hint,
sort: params.sort,
order: params.order,
cursor,
limit: params.limit,
now: this.options.now()
}),
total
]);
return {
...ranked,
items: ranked.items.map(toEgressListItem),
...(counted === undefined ? {} : { total: counted })
};
}
const [page, counted] = await Promise.all([
hint === 'startedAt_id' || hint === 'roomNameLower_startedAt'
? this.sortedPage(filter, hint, params, cursor)
: this.indexOrdered(filter, hint, params, cursor),
total
]);
return {
...page,
items: page.items.map(toEgressListItem),
...(counted === undefined ? {} : { total: counted })
};
}
/** A page sorted on `{ startedAt, _id }`: in index order on `startedAt_id`, in memory over a room name prefix. */
private async sortedPage(
filter: Record<string, unknown>,
hint: string,
params: EgressesListParams,
cursor?: CursorPayload
) {
const query = pageQuery(STARTED_AT, params.order, cursor, { from: params.from, to: params.to });
const fetched = await this.repository.find({ ...filter, ...query.filter }, query.sort, params.limit + 1, hint);
return buildPage(
fetched,
params.limit,
query,
cursor !== undefined,
(doc) => ({ value: doc.startedAt, id: doc._id }),
{
sort: STARTED_AT,
order: params.order
}
);
}
/** A page on an index that orders by `startedAt` but not by `_id`; ties are read with a point query. */
private indexOrdered(
filter: Record<string, unknown>,
hint: string,
params: EgressesListParams,
cursor?: CursorPayload
) {
return indexOrderedPage<EgressDocument>({
collection: this.repository.egresses,
filter,
field: STARTED_AT,
order: params.order,
cursor,
limit: params.limit,
range: { from: params.from, to: params.to },
hint,
projection: EGRESS_LIST_PROJECTION
});
}
async summary(range: { from: Date; to: Date }): Promise<EgressSummary> {
const exact = this.exactRange(range.from, range.to);
const [active, figures] = await Promise.all([
this.repository.countInFlight(),
exact ? this.repository.rangeFigures(range.from, range.to) : this.rollupFigures(range.from, range.to)
]);
return { active, ...figures, approximate: !exact };
}
/** Egress figures of the hourly buckets that start inside `[from, to)`. */
private rollupFigures(from: Date, to: Date) {
const first = Math.ceil(from.getTime() / HOUR_MS) * HOUR_MS;
const last = Math.ceil(to.getTime() / HOUR_MS) * HOUR_MS - HOUR_MS;
return last < first
? Promise.resolve({ startedInRange: 0, byType: {}, byEndStatus: {}, totalDurationMs: 0 })
: this.repository.rollupFigures(globalHourlyId(first), globalHourlyId(last));
}
}

21
openvidu-dashboard/dashboard-ce/backend/src/http/api-error.ts Normal file
View File

@ -0,0 +1,21 @@
import { ERROR_STATUS, type ErrorCode, type ValidationIssue } from '@openvidu-dashboard/typings';
/** An error answered with the API error envelope; handlers throw it and the error middleware sends it. */
export class ApiError extends Error {
constructor(
readonly code: ErrorCode,
message: string,
readonly details?: Record<string, unknown>
) {
super(message);
this.name = 'ApiError';
}
get status(): number {
return ERROR_STATUS[this.code];
}
static validation(issues: ValidationIssue[]): ApiError {
return new ApiError('VALIDATION_ERROR', 'Invalid request', { issues });
}
}

57
openvidu-dashboard/dashboard-ce/backend/src/http/app.ts Normal file
View File

@ -0,0 +1,57 @@
import { join } from 'node:path';
import cookieParser from 'cookie-parser';
import express, { type Express, type Router } from 'express';
import type { TrustProxy } from '../config/variables.js';
import type { Logger } from '../logging/logger.js';
import { apiNotFound, errorHandler } from './errors.js';
import { requestContext } from './request-context.js';
export interface HttpAppOptions {
logger: Logger;
/** Directory of the built SPA (`index.html` and its assets). */
appRoot: string;
trustProxy: TrustProxy;
/** Routes mounted under `/api/v1`. */
apiRouter: Router;
/** Development-only documentation, mounted under `/api/v1` when present. */
docsRouter?: Router;
}
export const JSON_BODY_LIMIT = '1mb';
/** Express application of the dashboard: API under `/api`, the SPA for every other GET and HEAD. */
export function createHttpApp(options: HttpAppOptions): Express {
const app = express();
app.disable('x-powered-by');
app.set('trust proxy', options.trustProxy);
app.get('/api/healthcheck', (_req, res) => {
res.json({ status: 'ok' });
});
app.use('/api', requestContext(options.logger), express.json({ limit: JSON_BODY_LIMIT }), cookieParser());
app.use('/api/v1', options.apiRouter);
if (options.docsRouter) {
app.use('/api/v1', options.docsRouter);
}
app.use('/api', apiNotFound);
app.use(express.static(options.appRoot, { index: false, fallthrough: true }));
const indexFile = join(options.appRoot, 'index.html');
app.get('/{*splat}', (_req, res, next) => {
res.sendFile(indexFile, (error) => {
if (error) {
next(error);
}
});
});
app.use(errorHandler(options.logger));
return app;
}

31
openvidu-dashboard/dashboard-ce/backend/src/http/base-path.ts Normal file
View File

@ -0,0 +1,31 @@
import { readFileSync } from 'node:fs';
import { join } from 'node:path';
const BASE_HREF = /<base\s+href=["']([^"']+)["']/i;
export interface BasePathResolution {
basePath: string;
source: 'variable' | 'index.html' | 'default';
}
/**
* Public base path of the dashboard (the browser-visible prefix, `/dashboard/` behind the deployment proxy):
* `DASHBOARD_BASE_PATH`, else the `<base href>` of the built SPA, else `/`.
*/
export function resolveBasePath(configured: string | undefined, appRoot: string): BasePathResolution {
if (configured !== undefined) {
return { basePath: configured, source: 'variable' };
}
try {
const href = BASE_HREF.exec(readFileSync(join(appRoot, 'index.html'), 'utf8'))?.[1];
if (href?.startsWith('/')) {
return { basePath: href.endsWith('/') ? href : `${href}/`, source: 'index.html' };
}
} catch {
// No built SPA: the default applies.
}
return { basePath: '/', source: 'default' };
}

15
openvidu-dashboard/dashboard-ce/backend/src/http/conditional.ts Normal file
View File

@ -0,0 +1,15 @@
/**
* Weak comparison of an `If-None-Match` header with the current validator (RFC 9110, 13.1.2). Express's `req.fresh`
* is not used: fetch and XMLHttpRequest add `Cache-Control: no-cache` to every request carrying `If-None-Match`, and
* `req.fresh` then always reports the representation as stale.
*/
export function ifNoneMatchMatches(header: string | undefined, etag: string): boolean {
if (header === undefined) {
return false;
}
const opaque = (tag: string) => tag.trim().replace(/^W\//, '');
const current = opaque(etag);
return header.split(',').some((tag) => tag.trim() === '*' || opaque(tag) === current);
}

65
openvidu-dashboard/dashboard-ce/backend/src/http/errors.ts Normal file
View File

@ -0,0 +1,65 @@
import type { ErrorRequestHandler, RequestHandler } from 'express';
import { errors as joseErrors } from 'jose';
import { ZodError } from 'zod';
import type { ApiError as ApiErrorBody, ErrorCode } from '@openvidu-dashboard/typings';
import type { Logger } from '../logging/logger.js';
import { ApiError } from './api-error.js';
import { zodIssues } from '../api/validation.js';
export function errorBody(code: ErrorCode, message: string, details?: Record<string, unknown>): ApiErrorBody {
return { error: details === undefined ? { code, message } : { code, message, details } };
}
/** JSON 404 for `/api` paths no route answered, so the SPA fallback never serves them. */
export const apiNotFound: RequestHandler = (req, res) => {
res.status(404).json(errorBody('NOT_FOUND', `No API route for ${req.method} ${req.path}`));
};
interface BodyParserError {
type: string;
}
function isBodyParserError(error: unknown): error is BodyParserError {
return typeof error === 'object' && error !== null && typeof (error as { type?: unknown }).type === 'string';
}
/** Maps every error to the envelope: API errors as thrown, validation 400, token 401, body 400, anything else 500. */
export function errorHandler(logger: Logger): ErrorRequestHandler {
return (error: unknown, req, res, next) => {
if (res.headersSent) {
next(error);
return;
}
const log = (req as { log?: Logger }).log ?? logger;
let apiError: ApiError;
if (error instanceof ApiError) {
apiError = error;
} else if (error instanceof ZodError) {
apiError = ApiError.validation(zodIssues(error.issues));
} else if (error instanceof joseErrors.JOSEError) {
apiError = new ApiError('UNAUTHORIZED', 'Invalid access token', {
reason: error instanceof joseErrors.JWTExpired ? 'expired' : 'invalid'
});
} else if (isBodyParserError(error) && error.type === 'entity.too.large') {
apiError = new ApiError('VALIDATION_ERROR', 'The JSON body is larger than 1 MB');
} else if (isBodyParserError(error) && error.type.startsWith('entity.')) {
apiError = new ApiError('VALIDATION_ERROR', 'The body is not valid JSON');
} else {
log.error(`Unhandled error serving ${req.method} ${req.originalUrl}`, error);
res.status(500).json(errorBody('INTERNAL_ERROR', 'Internal server error'));
return;
}
if (apiError.code === 'UNAUTHORIZED') {
res.setHeader('WWW-Authenticate', 'Bearer');
}
res.status(apiError.status).json(errorBody(apiError.code, apiError.message, apiError.details));
};
}

32
openvidu-dashboard/dashboard-ce/backend/src/http/request-context.ts Normal file
View File

@ -0,0 +1,32 @@
import { randomUUID } from 'node:crypto';
import type { RequestHandler } from 'express';
import type { Logger } from '../logging/logger.js';
const REQUEST_ID = /^[A-Za-z0-9._-]{1,128}$/;
declare global {
// Express merges these into every request.
// eslint-disable-next-line @typescript-eslint/no-namespace
namespace Express {
interface Request {
/** `X-Request-Id` of the request, propagated from the proxy or generated. */
id: string;
/** Logger whose lines carry the request id. */
log: Logger;
}
}
}
/** Sets the request id (incoming header when well formed, else a UUID), its response header and a child logger. */
export function requestContext(logger: Logger): RequestHandler {
return (req, res, next) => {
const incoming = req.get('X-Request-Id');
req.id = incoming !== undefined && REQUEST_ID.test(incoming) ? incoming : randomUUID();
req.log = logger.child({ requestId: req.id });
res.setHeader('X-Request-Id', req.id);
next();
};
}

80
openvidu-dashboard/dashboard-ce/backend/src/index.ts Normal file
View File

@ -0,0 +1,80 @@
export { TOKENS } from './di/tokens.js';
export { type DashboardConfig, variableErrors } from './config/variables.js';
export type { Logger } from './logging/logger.js';
export { Shutdown, type Exit } from './lifecycle/shutdown.js';
export { runHealthcheck } from './lifecycle/healthcheck.js';
export {
type DashboardOptions,
ExitCode,
type RunningDashboard,
startDashboard,
type StartupContext,
type StartupHook
} from './lifecycle/startup.js';
export { openApiDocument } from './api/openapi.js';
export {
type AuthContext,
type HttpMethod,
type RouteDefinition,
type RouteInput,
type RouteLock,
RouteRegistry,
type RouteResponse,
type RouteSecurity
} from './api/route-registry.js';
export {
type AnalyticsCatalogue,
CE_ANALYTICS_CATALOGUE,
type DimensionDefinition,
type MetricDefinition,
ratio as ratioMetric,
sum as sumMetric
} from './analytics/analytics-catalogue.js';
export { AnalyticsFeatureGate } from './analytics/analytics-gate.js';
export { AnalyticsService } from './analytics/analytics-service.js';
export { EgressService } from './egress/egress-service.js';
export { ApiError } from './http/api-error.js';
export { InfoService } from './info/info-service.js';
export type { ParticipantGroup, RoomGroup } from './overview/overview-repository.js';
export { overviewResponse } from './overview/overview-responses.js';
export { overviewRoute } from './overview/overview-routes.js';
export { type OverviewExtension, type OverviewInputs, OverviewService } from './overview/overview-service.js';
export { IngressService } from './ingress/ingress-service.js';
export { ParticipantsService } from './participants/participants-service.js';
export { RoomsService } from './rooms/rooms-service.js';
export { StatsModeReader } from './stats/stats-mode.js';
// Generic pieces the PRO routes, queries and responses are built on.
export {
buildPage,
type CursorPayload,
cursorOrThrow,
decodeCursor,
encodeCursor,
pageQuery,
type PageQuery,
type SortValue
} from './api/cursor.js';
export { compareIds, compareValues, indexOrderedPage, type Page } from './api/keyset.js';
export { iso } from './api/mapping.js';
export { csvParam, limitParam, optionalRangeQuery, orderParam, qParam, rangedQuery, tzParam } from './api/query.js';
export { ROLLUP_INDEX } from './analytics/analytics-repository.js';
export { isoDate, listResponse, staleField } from './api/responses.js';
export { prefixRegex } from './api/search.js';
export { bucketStart, bucketStarts, MAX_BUCKETS } from './api/time-series.js';
export { ifNoneMatchMatches } from './http/conditional.js';
export { readRetentionMs, readStatsRetentionMs } from './schema/retention.js';
export { markStale, nodeAlive, type StaleContext, staleFlag, WriterFreshness } from './status/freshness.js';
export { compact, type Loose } from './util/compact.js';
export { enumValues } from './util/enum-values.js';
// CE resource pieces the PRO details extend.
export { EGRESS_LIST_PROJECTION, toEgressListItem } from './egress/egress-mappers.js';
export { egressesListResponse, egressListFields } from './egress/egress-responses.js';
export { toIngressListItem } from './ingress/ingress-mappers.js';
export { ingressListFields } from './ingress/ingress-responses.js';
export { toParticipantListItem } from './participants/participants-mappers.js';
export { PARTICIPANT_LIST_PROJECTION } from './participants/participants-query.js';
export { participantClientSummary, participantListFields } from './participants/participants-responses.js';
export { toRoomListItem } from './rooms/rooms-mappers.js';
export { roomListFields } from './rooms/rooms-responses.js';

85
openvidu-dashboard/dashboard-ce/backend/src/info/info-routes.ts Normal file
View File

@ -0,0 +1,85 @@
import * as z from 'zod';
import { FeatureKey, MigrationState, WriterSchemaStatus } from '@openvidu-dashboard/typings';
import type { RouteRegistry } from '../api/route-registry.js';
import type { InfoService } from './info-service.js';
const versions = z.object({ dashboard: z.string(), server: z.string().optional() });
/** Schema status, migration and retention: shared by `/info` and the overview health facts. */
export const healthFactsShape = {
schema: z.object({
dashboard: z.number().int(),
writer: z.number().int().optional(),
status: z.enum(WriterSchemaStatus)
}),
migration: z.object({
state: z.enum([...Object.values(MigrationState), 'none']),
progress: z
.object({
processed: z.number(),
total: z.number(),
startedAt: z.iso.datetime().optional(),
finishedAt: z.iso.datetime().optional()
})
.optional(),
error: z.string().optional()
}),
retention: z
.object({
eventsMs: z.number(),
statsMs: z.number(),
tracksMs: z.number(),
entitiesMs: z.number(),
rollups5MinMs: z.number(),
rollupsHourlyMs: z.number(),
rollupsDailyMs: z.number().nullable()
})
.optional()
};
const infoResponse = z
.object({
edition: z.enum(['ce', 'pro']),
versions,
...healthFactsShape,
database: z.object({ version: z.string(), timeseriesSupported: z.boolean() }),
storage: z.record(
z.string(),
z.object({
documents: z.number(),
storageBytes: z.number(),
indexBytes: z.number(),
oldest: z.iso.datetime().optional()
})
),
features: z.array(z.enum(FeatureKey)),
limits: z.object({
rankedSortMaxRangeMs: z.number().int().meta({ description: 'Rooms, egresses and ingresses' }),
participantRankedSortMaxRangeMs: z
.number()
.int()
.meta({ description: 'Participants and agents without a room filter' })
}),
license: z.object({ validUntil: z.iso.date().optional(), maskedKey: z.string() }).optional(),
openapiDocsEnabled: z.boolean()
})
.meta({
id: 'InfoResponse',
description: 'Full document with a bearer token; edition and version only without one'
});
/** `GET /info`: public subset without `Authorization`, full document with a valid bearer token. */
export function registerInfoRoute(registry: RouteRegistry, info: () => InfoService): void {
registry.register({
method: 'get',
path: '/info',
edition: 'ce',
summary: 'Edition, versions, writer schema, migration, retention, storage and features',
tags: ['info'],
security: 'optional-bearer',
responses: { 200: { description: 'Info document', schema: infoResponse } },
handler: ({ req }) => (req.auth === undefined ? info().publicInfo() : info().fullInfo())
});
}

200
openvidu-dashboard/dashboard-ce/backend/src/info/info-service.ts Normal file
View File

@ -0,0 +1,200 @@
import type { Db, Document } from 'mongodb';
import {
Collection,
DEFAULT_RETENTION_MS,
type Edition,
type FeatureKey,
type InfoLicense,
type InfoLimits,
type InfoMigration,
type InfoPublicResponse,
type InfoResponse,
type InfoRetention,
type InfoStorageEntry,
type SchemaMetaCapabilities,
type SchemaMetaConfig,
type SchemaMetaMigration,
type SchemaMetaRetention,
type SchemaMetaSchema
} from '@openvidu-dashboard/typings';
import { schemaStatus } from '../schema/schema-status.js';
import type { StatsModeReader } from '../stats/stats-mode.js';
export const STORAGE_CACHE_MS = 60_000;
/** Field whose earliest value dates a collection, when an index starts with it. */
const OLDEST_FIELDS = ['ts', 'bucket', 'createdAt'] as const;
type SchemaMetaDocument =
SchemaMetaSchema | SchemaMetaMigration | SchemaMetaRetention | SchemaMetaCapabilities | SchemaMetaConfig;
/** Schema status, migration and retention, as `GET /info` and the overview report them. */
export type HealthFacts = Pick<InfoResponse, 'schema' | 'migration' | 'retention'>;
export interface InfoServiceOptions {
edition: Edition;
version: string;
features: () => FeatureKey[];
limits: InfoLimits;
/** The license of a PRO deployment. */
license?: () => InfoLicense | undefined;
openapiDocsEnabled: boolean;
/** Refreshed with the `config` document of every full read. */
statsMode?: StatsModeReader;
now?: () => number;
}
/** The info document: public subset before login, every fact after it; `schema_meta` is read on every call. */
export class InfoService {
private storage: { at: number; value: Record<string, InfoStorageEntry> } | undefined;
private readonly now: () => number;
constructor(
private readonly db: Db,
private readonly options: InfoServiceOptions
) {
this.now = options.now ?? Date.now;
}
publicInfo(): InfoPublicResponse {
return { edition: this.options.edition, versions: { dashboard: this.options.version } };
}
async fullInfo(): Promise<InfoResponse> {
const byId = await this.schemaMeta();
const schema = byId.get('schema') as SchemaMetaSchema | undefined;
const capabilities = byId.get('capabilities') as SchemaMetaCapabilities | undefined;
const build = await this.db.command({ buildInfo: 1 });
const license = this.options.license?.();
return {
edition: this.options.edition,
versions: {
dashboard: this.options.version,
...(schema?.writerVersion === undefined ? {} : { server: schema.writerVersion })
},
...healthFacts(byId),
database: { version: String(build.version), timeseriesSupported: capabilities?.timeseries ?? false },
storage: await this.storageInfo(),
features: this.options.features(),
limits: this.options.limits,
...(license === undefined ? {} : { license }),
openapiDocsEnabled: this.options.openapiDocsEnabled
};
}
/** Schema status, migration and retention from one read of `schema_meta`. */
async health(): Promise<HealthFacts> {
return healthFacts(await this.schemaMeta());
}
private async schemaMeta(): Promise<ReadonlyMap<string, unknown>> {
const meta = await this.db.collection<SchemaMetaDocument>(Collection.SCHEMA_META).find({}).toArray();
const byId = new Map(meta.map((document) => [document._id, document]));
this.options.statsMode?.remember(byId.get('config') as SchemaMetaConfig | undefined);
return byId;
}
private async storageInfo(): Promise<Record<string, InfoStorageEntry>> {
if (this.storage !== undefined && this.now() - this.storage.at < STORAGE_CACHE_MS) {
return this.storage.value;
}
const existing = new Set(
(await this.db.listCollections({}, { nameOnly: true }).toArray()).map((collection) => collection.name)
);
const value: Record<string, InfoStorageEntry> = {};
for (const name of Object.values(Collection)) {
if (existing.has(name)) {
value[name] = await this.collectionStorage(name);
}
}
this.storage = { at: this.now(), value };
return value;
}
private async collectionStorage(name: string): Promise<InfoStorageEntry> {
const collection = this.db.collection(name);
const [stats] = await collection
.aggregate<{ storageStats?: Document }>([{ $collStats: { storageStats: {} } }])
.toArray();
const storageStats = stats?.storageStats ?? {};
const count =
typeof storageStats.count === 'number' ? storageStats.count : await collection.estimatedDocumentCount();
const entry: InfoStorageEntry = {
documents: count,
storageBytes: Number(storageStats.storageSize ?? 0),
indexBytes: Number(storageStats.totalIndexSize ?? 0)
};
const indexes = (await collection.listIndexes().toArray()) as { key: Document }[];
const field = OLDEST_FIELDS.find((candidate) =>
indexes.some((index) => Object.keys(index.key)[0] === candidate)
);
if (field !== undefined) {
const [oldest] = await collection
.find({ [field]: { $type: 'date' } }, { projection: { [field]: 1 } })
.sort({ [field]: 1 })
.limit(1)
.toArray();
const value: unknown = oldest?.[field];
if (value instanceof Date) {
entry.oldest = value.toISOString();
}
}
return entry;
}
}
function healthFacts(byId: ReadonlyMap<string, unknown>): HealthFacts {
const schema = byId.get('schema') as SchemaMetaSchema | undefined;
const retention = byId.get('retention') as SchemaMetaRetention | undefined;
return {
schema: schemaStatus(typeof schema?.version === 'number' ? schema.version : undefined),
migration: migrationInfo(byId.get('migration') as SchemaMetaMigration | undefined),
...(retention === undefined ? {} : { retention: retentionInfo(retention) })
};
}
function migrationInfo(migration: SchemaMetaMigration | undefined): InfoMigration {
if (migration === undefined) {
return { state: 'none' };
}
return {
state: migration.state,
progress: {
processed: migration.processed,
total: migration.total,
...(migration.startedAt === undefined ? {} : { startedAt: migration.startedAt.toISOString() }),
...(migration.finishedAt === undefined ? {} : { finishedAt: migration.finishedAt.toISOString() })
},
...(migration.error === undefined ? {} : { error: migration.error })
};
}
function retentionInfo(retention: SchemaMetaRetention): InfoRetention {
// Absent from documents written before the 5-minute rollups had their own retention.
const recorded: unknown = retention.rollups5MinMs;
const rollups5MinMs = typeof recorded === 'number' ? recorded : (DEFAULT_RETENTION_MS.rollups5Min ?? 0);
return {
eventsMs: retention.eventsMs,
statsMs: retention.statsMs,
tracksMs: retention.tracksMs,
entitiesMs: retention.entitiesMs,
rollups5MinMs,
rollupsHourlyMs: retention.rollupsHourlyMs,
rollupsDailyMs: retention.rollupsDailyMs
};
}

58
openvidu-dashboard/dashboard-ce/backend/src/ingress/ingress-mappers.ts Normal file
View File

@ -0,0 +1,58 @@
import type { IngressDocument, IngressListItem } from '@openvidu-dashboard/typings';
import { iso } from '../api/mapping.js';
import { compact } from '../util/compact.js';
/** Fields of an ingress document the list item needs; `lastError` is read only as a flag. */
export const INGRESS_LIST_PROJECTION = {
name: 1,
inputType: 1,
roomName: 1,
participantIdentity: 1,
status: 1,
enabled: 1,
reusable: 1,
createdAt: 1,
deletedAt: 1,
sessions: 1,
totalDurationMs: 1,
lastSessionAt: 1,
lastError: 1
} as const;
type ListFields = Pick<
IngressDocument,
| '_id'
| 'name'
| 'inputType'
| 'roomName'
| 'participantIdentity'
| 'status'
| 'enabled'
| 'reusable'
| 'createdAt'
| 'deletedAt'
| 'sessions'
| 'totalDurationMs'
| 'lastSessionAt'
| 'lastError'
>;
export function toIngressListItem(doc: ListFields): IngressListItem {
return compact<IngressListItem>({
ingressId: doc._id,
name: doc.name,
inputType: doc.inputType,
roomName: doc.roomName,
participantIdentity: doc.participantIdentity,
status: doc.status,
enabled: doc.enabled,
reusable: doc.reusable,
createdAt: iso(doc.createdAt),
deletedAt: iso(doc.deletedAt),
sessions: doc.sessions,
totalDurationMs: doc.totalDurationMs,
lastSessionAt: iso(doc.lastSessionAt),
hasError: doc.lastError !== undefined
});
}

70
openvidu-dashboard/dashboard-ce/backend/src/ingress/ingress-query.ts Normal file
View File

@ -0,0 +1,70 @@
import type { Document } from 'mongodb';
import { type IngressSort, IngressStatus } from '@openvidu-dashboard/typings';
import { prefixRegex } from '../api/search.js';
import { INGRESS_ID, type IngressesListParams } from './ingress-schemas.js';
export type IngressesListPlan =
| { kind: 'id'; filter: Document }
| {
kind: 'ranked';
/** Activity range, scope and residual filters. */
match: Document;
rank: (asOf: Date) => Document | string;
};
/** Rank of each sort key at `asOf`: a publishing ingress adds its running session to its total. */
const INGRESS_RANKS: Readonly<Record<IngressSort, (asOf: Date) => Document | string>> = {
createdAt: () => '$createdAt',
totalDuration: (asOf) => ({
$add: [
{ $ifNull: ['$totalDurationMs', 0] },
{
$cond: [
{ $eq: ['$status', IngressStatus.PUBLISHING] },
{ $subtract: [asOf, { $ifNull: ['$lastSessionAt', asOf] }] },
0
]
}
]
}),
sessions: () => ({ $ifNull: ['$sessions', 0] }),
lastSession: () => ({ $ifNull: ['$lastSessionAt', new Date(0)] })
};
/**
* The ingresses active in `[from, to)`: created in it (`createdAt_id`), with a session started in it
* (`lastSessionAt_id`), or publishing now and created before `to` (`status_createdAt`).
*/
export function activityRange(from: Date, to: Date): Document {
return {
$or: [
{ createdAt: { $gte: from, $lt: to } },
{ lastSessionAt: { $gte: from, $lt: to } },
{ status: IngressStatus.PUBLISHING, createdAt: { $lt: to } }
]
};
}
/**
* Plan of an ingresses list request: an ingress id is a point lookup; otherwise the activity range with the status,
* input type and name prefix filters, ranked in memory by the sort key (the union of three index-backed branches has
* no single index order).
*/
export function ingressesListPlan(params: IngressesListParams): IngressesListPlan {
if (params.q !== undefined && INGRESS_ID.test(params.q)) {
return { kind: 'id', filter: { _id: params.q } };
}
return {
kind: 'ranked',
match: {
...activityRange(params.from, params.to),
...(params.q === undefined ? {} : { nameLower: prefixRegex(params.q) }),
...(params.status === 'all' ? {} : { status: params.status }),
...(params.inputType === undefined ? {} : { inputType: params.inputType })
},
rank: INGRESS_RANKS[params.sort]
};
}

90
openvidu-dashboard/dashboard-ce/backend/src/ingress/ingress-repository.ts Normal file
View File

@ -0,0 +1,90 @@
import type { Db, Document, Filter, Sort } from 'mongodb';
import {
Collection,
type HourlyRollupDocument,
type IngressDocument,
type IngressInputType,
IngressStatus
} from '@openvidu-dashboard/typings';
import { INGRESS_LIST_PROJECTION } from './ingress-mappers.js';
import { activityRange } from './ingress-query.js';
export type IngressListDocument = Pick<
IngressDocument,
| '_id'
| 'name'
| 'inputType'
| 'roomName'
| 'participantIdentity'
| 'status'
| 'enabled'
| 'reusable'
| 'createdAt'
| 'deletedAt'
| 'sessions'
| 'totalDurationMs'
| 'lastSessionAt'
| 'lastError'
>;
/** Ingress reads: definitions on the index of the list plan and the summary. */
export class IngressRepository {
constructor(private readonly db: Db) {}
get ingresses() {
return this.db.collection<IngressDocument>(Collection.INGRESSES);
}
find(filter: Document, sort: Sort, limit: number, hint?: string): Promise<IngressListDocument[]> {
return this.ingresses
.find(filter as Filter<IngressDocument>, {
projection: INGRESS_LIST_PROJECTION,
...(hint === undefined ? {} : { hint })
})
.sort(sort)
.limit(limit)
.toArray();
}
count(filter: Document, hint?: string): Promise<number> {
return this.ingresses.countDocuments(filter, hint === undefined ? {} : { hint });
}
countPublishing(): Promise<number> {
return this.ingresses.countDocuments({ status: IngressStatus.PUBLISHING });
}
/** Ingresses created in `[from, to)` by input type, on `{ createdAt, _id }`. */
/** The ingresses of the activity range of `[from, to)` per input type, as the list selects them. */
async activeByInputType(from: Date, to: Date): Promise<Partial<Record<IngressInputType, number>>> {
const groups = await this.ingresses
.aggregate<{ _id: IngressInputType; n: number }>([
{ $match: activityRange(from, to) },
{ $group: { _id: '$inputType', n: { $sum: 1 } } }
])
.toArray();
return Object.fromEntries(groups.map((group) => [group._id, group.n]));
}
/** Sums of the ingress counters of the global hourly rollups whose `_id` lies in `[first, last]`. */
async rollupSessions(first: string, last: string): Promise<{ sessions: number; durationMs: number }> {
const [sums] = await this.db
.collection<HourlyRollupDocument>(Collection.ANALYTICS_HOURLY)
.aggregate<{ sessions: number; durationMs: number }>([
{ $match: { _id: { $gte: first, $lte: last } } },
{
$group: {
_id: null,
sessions: { $sum: '$ingress.sessionsStarted' },
durationMs: { $sum: '$ingress.durationMs' }
}
}
])
.toArray();
return { sessions: sums?.sessions ?? 0, durationMs: sums?.durationMs ?? 0 };
}
}

42
openvidu-dashboard/dashboard-ce/backend/src/ingress/ingress-responses.ts Normal file
View File

@ -0,0 +1,42 @@
import * as z from 'zod';
import { IngressInputType, IngressStatus } from '@openvidu-dashboard/typings';
import { isoDate, listResponse } from '../api/responses.js';
import { enumValues } from '../util/enum-values.js';
const count = z.number().int();
const inputType = z.enum(enumValues(IngressInputType));
/** Fields of an ingress list item, which the PRO ingress detail extends. */
export const ingressListFields = {
ingressId: z.string(),
name: z.string().optional(),
inputType,
roomName: z.string(),
participantIdentity: z.string(),
status: z.enum(enumValues(IngressStatus)),
enabled: z.boolean(),
reusable: z.boolean(),
createdAt: isoDate,
deletedAt: isoDate.optional(),
sessions: count,
totalDurationMs: z.number(),
lastSessionAt: isoDate.optional(),
hasError: z.boolean()
};
export const ingressListItem = z.object(ingressListFields).meta({ id: 'IngressListItem' });
export const ingressesListResponse = listResponse(ingressListItem, 'IngressList');
export const ingressSummary = z
.object({
publishingNow: count,
ingressesInRange: count,
byInputType: z.record(inputType, count),
sessionsInRange: count,
totalDurationMs: z.number(),
approximate: z.boolean()
})
.meta({ id: 'IngressSummary' });

42
openvidu-dashboard/dashboard-ce/backend/src/ingress/ingress-routes.ts Normal file
View File

@ -0,0 +1,42 @@
import { FeatureKey } from '@openvidu-dashboard/typings';
import type { RouteRegistry } from '../api/route-registry.js';
import { ingressesListResponse, ingressSummary } from './ingress-responses.js';
import { ingressesListQuery, ingressesSummaryQuery } from './ingress-schemas.js';
import type { IngressService } from './ingress-service.js';
const TAGS = ['Ingress'];
/**
* Ingress routes: the list and the summary, and the locks of the `ingress-detail` routes (the detail, its sessions and
* its events). `now` is read per request.
*/
export function registerIngressRoutes(registry: RouteRegistry, ingress: () => IngressService, now: () => Date): void {
registry.register({
method: 'get',
path: '/ingresses',
edition: 'ce',
summary: 'Ingresses created in a range',
tags: TAGS,
security: 'bearer',
request: { query: ingressesListQuery(now) },
responses: { 200: { description: 'One page of ingresses', schema: ingressesListResponse } },
handler: ({ query }) => ingress().list(query)
});
// Registered before /ingresses/{id} so the literal segment wins.
registry.register({
method: 'get',
path: '/ingresses/summary',
edition: 'ce',
summary: 'Ingress counts of a range',
tags: TAGS,
security: 'bearer',
request: { query: ingressesSummaryQuery(now) },
responses: { 200: { description: 'Figures above the ingress table', schema: ingressSummary } },
handler: ({ query }) => ingress().summary(query)
});
for (const path of ['', '/sessions', '/events']) {
registry.lock({ method: 'get', path: `/ingresses/{id}${path}`, feature: FeatureKey.INGRESS_DETAIL });
}
}

41
openvidu-dashboard/dashboard-ce/backend/src/ingress/ingress-schemas.ts Normal file
View File

@ -0,0 +1,41 @@
import * as z from 'zod';
import { ENTITY_ID_PATTERNS, IngressInputType, IngressSort, IngressStatus } from '@openvidu-dashboard/typings';
import { limitParam, orderParam, qParam, rangedQuery } from '../api/query.js';
import { enumValues } from '../util/enum-values.js';
export const INGRESS_ID = ENTITY_ID_PATTERNS.ingress;
const cursorParam = z.string().min(1).optional();
/** Name prefix of two characters or more; an ingress id is accepted whatever its length. */
const ingressSearch = qParam.refine((value) => value === undefined || INGRESS_ID.test(value) || value.length >= 2, {
error: 'must have at least two characters'
});
export function ingressesListQuery(now: () => Date) {
return rangedQuery(now, {
status: z
.enum(['all', ...enumValues(IngressStatus)], {
error: `must be all or one of ${enumValues(IngressStatus).join(', ')}`
})
.default('all'),
inputType: z
.enum(enumValues(IngressInputType), { error: `must be one of ${enumValues(IngressInputType).join(', ')}` })
.optional(),
q: ingressSearch,
sort: z
.enum(enumValues(IngressSort), { error: 'must be createdAt, totalDuration, sessions or lastSession' })
.default(IngressSort.CREATED_AT),
order: orderParam.default('desc'),
cursor: cursorParam,
limit: limitParam
});
}
export type IngressesListParams = z.output<ReturnType<typeof ingressesListQuery>>;
export function ingressesSummaryQuery(now: () => Date) {
return rangedQuery(now, {});
}

101
openvidu-dashboard/dashboard-ce/backend/src/ingress/ingress-service.ts Normal file
View File

@ -0,0 +1,101 @@
import type { Db } from 'mongodb';
import {
type IngressDocument,
IngressInputType,
type IngressListItem,
IngressSort,
type IngressSummary,
type ListResponse
} from '@openvidu-dashboard/typings';
import { cursorOrThrow } from '../api/cursor.js';
import { assertRankedRange, rankedPage } from '../api/ranked.js';
import { INGRESS_LIST_PROJECTION, toIngressListItem } from './ingress-mappers.js';
import { ingressesListPlan } from './ingress-query.js';
import { IngressRepository } from './ingress-repository.js';
import type { IngressesListParams } from './ingress-schemas.js';
export interface IngressServiceOptions {
/** Longest range, in milliseconds, whose list `total` is exact (`DASHBOARD_LIST_TOTAL_MAX_RANGE`). */
totalMaxRangeMs: number;
now: () => Date;
}
const HOUR_MS = 3_600_000;
/** `_id` of the global hourly rollup of `bucket`: RFC 3339 UTC without fractional seconds. */
function globalHourlyId(bucket: number): string {
return `global:${new Date(bucket).toISOString().replace('.000Z', 'Z')}`;
}
/** Ingresses list and summary. */
export class IngressService {
private readonly repository: IngressRepository;
constructor(
db: Db,
private readonly options: IngressServiceOptions
) {
this.repository = new IngressRepository(db);
}
private exactRange(from: Date, to: Date): boolean {
return to.getTime() - from.getTime() <= this.options.totalMaxRangeMs;
}
async list(params: IngressesListParams): Promise<ListResponse<IngressListItem>> {
const plan = ingressesListPlan(params);
if (plan.kind === 'id') {
const docs = await this.repository.find(plan.filter, { _id: 1 }, 1);
return { items: docs.map(toIngressListItem), nextCursor: null, prevCursor: null, total: docs.length };
}
if (params.sort !== IngressSort.CREATED_AT) {
assertRankedRange(params, this.options.totalMaxRangeMs, params.sort);
}
const cursor = cursorOrThrow(params.cursor, params.sort, params.order);
const [page, total] = await Promise.all([
rankedPage<IngressDocument>(this.repository.ingresses, {
match: plan.match,
rank: plan.rank,
projection: INGRESS_LIST_PROJECTION,
sort: params.sort,
order: params.order,
cursor,
limit: params.limit,
now: this.options.now()
}),
this.exactRange(params.from, params.to) ? this.repository.count(plan.match) : undefined
]);
return { ...page, items: page.items.map(toIngressListItem), ...(total === undefined ? {} : { total }) };
}
async summary(range: { from: Date; to: Date }): Promise<IngressSummary> {
const first = Math.ceil(range.from.getTime() / HOUR_MS) * HOUR_MS;
const last = Math.ceil(range.to.getTime() / HOUR_MS) * HOUR_MS - HOUR_MS;
const [publishingNow, byInputType, sessions] = await Promise.all([
this.repository.countPublishing(),
this.repository.activeByInputType(range.from, range.to),
last < first
? Promise.resolve({ sessions: 0, durationMs: 0 })
: this.repository.rollupSessions(globalHourlyId(first), globalHourlyId(last))
]);
const counts = Object.fromEntries(
Object.values(IngressInputType).map((type) => [type, byInputType[type] ?? 0])
) as IngressSummary['byInputType'];
return {
publishingNow,
ingressesInRange: Object.values(counts).reduce((sum, n) => sum + n, 0),
byInputType: counts,
sessionsInRange: sessions.sessions,
totalDurationMs: sessions.durationMs,
approximate: range.from.getTime() % HOUR_MS !== 0 || range.to.getTime() % HOUR_MS !== 0
};
}
}

32
openvidu-dashboard/dashboard-ce/backend/src/lifecycle/healthcheck.ts Normal file
View File

@ -0,0 +1,32 @@
import { get } from 'node:http';
import { loadConfigFile } from '../config/config-file.js';
const TIMEOUT_MS = 4_000;
/**
* Container health check: 0 when `GET /api/healthcheck` on the local port answers 200, 1 otherwise. It uses
* `node:http` because `fetch` refuses the ports the Fetch standard blocks, 6000 among them.
*/
export function runHealthcheck(env: NodeJS.ProcessEnv): Promise<number> {
loadConfigFile(env);
const port = Number(env.SERVER_PORT ?? 5000);
if (!Number.isInteger(port) || port < 1 || port > 65_535) {
return Promise.resolve(1);
}
return new Promise((resolve) => {
const request = get({ host: '127.0.0.1', port, path: '/api/healthcheck', timeout: TIMEOUT_MS }, (response) => {
response.resume();
resolve(response.statusCode === 200 ? 0 : 1);
});
request.on('timeout', () => {
request.destroy();
});
request.on('error', () => {
resolve(1);
});
});
}

87
openvidu-dashboard/dashboard-ce/backend/src/lifecycle/shutdown.ts Normal file
View File

@ -0,0 +1,87 @@
import type { Server } from 'node:http';
import type { Logger } from '../logging/logger.js';
/** Time a shutdown may take before the process exits anyway, under the 10 s container stop timeout. */
export const SHUTDOWN_DEADLINE_MS = 5_000;
export type Exit = (code: number) => void;
/**
* The one shutdown sequence of the process, used by signals, startup failures and the exits of startup hooks:
* stop accepting connections, close idle ones, run the registered closers (timers, MongoDB client) and exit with
* the requested code. The first request wins; later ones are ignored.
*/
export class Shutdown {
private readonly closers: (() => Promise<void> | void)[] = [];
private server: Server | undefined;
private started = false;
constructor(
private readonly logger: Logger,
private readonly exit: Exit,
private readonly deadlineMs = SHUTDOWN_DEADLINE_MS
) {}
/** True once a shutdown has been requested; startup steps check it before going on. */
isRequested(): boolean {
return this.started;
}
attachServer(server: Server): void {
this.server = server;
}
/** Registers a resource to release, closed in reverse order of registration. */
onShutdown(closer: () => Promise<void> | void): void {
this.closers.push(closer);
}
async run(code: number, reason?: string): Promise<void> {
if (this.started) {
return;
}
this.started = true;
if (reason) {
this.logger.info(`Shutting down: ${reason}`);
}
const deadline = setTimeout(() => {
this.logger.warn(`Shutdown took longer than ${String(this.deadlineMs)} ms; exiting`);
this.exit(code);
}, this.deadlineMs);
deadline.unref();
try {
await this.closeServer();
for (const closer of [...this.closers].reverse()) {
try {
await closer();
} catch (error) {
this.logger.warn('Error while shutting down', error);
}
}
} finally {
clearTimeout(deadline);
this.exit(code);
}
}
private closeServer(): Promise<void> {
const server = this.server;
if (!server?.listening) {
return Promise.resolve();
}
return new Promise((resolve) => {
server.close(() => {
resolve();
});
server.closeIdleConnections();
});
}
}

484
openvidu-dashboard/dashboard-ce/backend/src/lifecycle/startup.ts Normal file
View File

@ -0,0 +1,484 @@
import type { Server } from 'node:http';
import { Container } from 'inversify';
import { type Db, MongoClient } from 'mongodb';
import {
type Edition,
type FeatureKey,
type InfoLicense,
type InfoSchema,
WriterSchemaStatus
} from '@openvidu-dashboard/typings';
import { loadConfigFile } from '../config/config-file.js';
import { type DashboardConfig, parseConfig } from '../config/variables.js';
import { TOKENS } from '../di/tokens.js';
import { AnalyticsCache } from '../analytics/analytics-cache.js';
import { type AnalyticsCatalogue, CE_ANALYTICS_CATALOGUE } from '../analytics/analytics-catalogue.js';
import { AnalyticsFeatureGate } from '../analytics/analytics-gate.js';
import { registerAnalyticsRoutes } from '../analytics/analytics-routes.js';
import { AnalyticsService } from '../analytics/analytics-service.js';
import { docsRouter, openApiDocument } from '../api/openapi.js';
import { registerProbes } from '../api/probes.js';
import { rankedSortLimits } from '../api/ranked-limits.js';
import { RouteRegistry } from '../api/route-registry.js';
import { registerAuthRoutes } from '../auth/auth-routes.js';
import { AuthService } from '../auth/auth-service.js';
import { bearerAuthenticator } from '../auth/bearer.js';
import { SessionRepository } from '../auth/session-repository.js';
import { provisionSigningKey } from '../auth/signing-key.js';
import { registerEgressRoutes } from '../egress/egress-routes.js';
import { EgressService } from '../egress/egress-service.js';
import { createHttpApp } from '../http/app.js';
import { resolveBasePath } from '../http/base-path.js';
import { InfoService } from '../info/info-service.js';
import { registerIngressRoutes } from '../ingress/ingress-routes.js';
import { IngressService } from '../ingress/ingress-service.js';
import { registerInfoRoute } from '../info/info-routes.js';
import { createLogger, type Logger } from '../logging/logger.js';
import { mongoClientOptions, resolveMongoUrl } from '../mongo/mongo-client.js';
import { registerOverviewRoutes } from '../overview/overview-routes.js';
import { type OverviewExtension, OverviewService } from '../overview/overview-service.js';
import { registerParticipantsRoutes } from '../participants/participants-routes.js';
import { ParticipantsService } from '../participants/participants-service.js';
import { registerRoomsRoutes } from '../rooms/rooms-routes.js';
import { RoomsService } from '../rooms/rooms-service.js';
import { olderSchemaMessage, readSchemaStatus } from '../schema/schema-status.js';
import { StatsModeReader } from '../stats/stats-mode.js';
import { registerStatusRoutes } from '../status/status-routes.js';
import { WriterFreshness } from '../status/freshness.js';
import { StatusService } from '../status/status-service.js';
import { registerTracksRoutes } from '../tracks/tracks-routes.js';
import { type Exit, Shutdown } from './shutdown.js';
/** Process exit codes of the dashboard; an extending edition's startup hooks may exit with codes of their own. */
export const ExitCode = {
OK: 0,
FAILURE: 1,
SCHEMA_TOO_OLD: 3
} as const;
export interface StartupContext {
config: DashboardConfig;
logger: Logger;
client: MongoClient;
db: Db;
container: Container;
shutdown: Shutdown;
}
/** Runs after the schema gate and before listening; a rejection stops the dashboard with exit code 1. */
export type StartupHook = (context: StartupContext) => Promise<void>;
export interface DashboardOptions {
edition: Edition;
version: string;
/** Directory of the built SPA. */
appRoot: string;
env?: NodeJS.ProcessEnv;
startupHooks?: StartupHook[];
/** Overrides of the CE bindings, applied before the startup hooks. */
configure?: (container: Container) => void;
exit?: Exit;
/** Installs SIGTERM and SIGINT handlers (default true). */
handleSignals?: boolean;
}
export interface RunningDashboard {
server: Server;
container: Container;
shutdown: Shutdown;
}
/**
* Starts the dashboard: configuration, MongoDB ping, writer schema gate, startup hooks, listen. A failure at any
* step exits through the shutdown routine without listening; so does a signal received during startup.
*/
export async function startDashboard(options: DashboardOptions): Promise<RunningDashboard | undefined> {
const env = options.env ?? process.env;
const exit = options.exit ?? ((code: number) => process.exit(code));
let logger = createLogger();
const file = loadConfigFile(env);
if (file.kind === 'missing') {
logger.warn(`Configuration file ${file.path} (DASHBOARD_CONFIG_PATH) not found; using the environment only`);
} else if (file.kind === 'unreadable') {
logger.error(`Cannot read the configuration file ${file.path} (DASHBOARD_CONFIG_PATH): ${file.reason}`);
exit(ExitCode.FAILURE);
return undefined;
}
const parsed = parseConfig(env);
if (parsed.kind === 'mongo-disabled') {
logger.info('MongoDB is disabled. Stopping application.');
exit(ExitCode.OK);
return undefined;
}
for (const warning of parsed.warnings) {
logger.warn(warning);
}
if (parsed.kind === 'invalid') {
for (const error of parsed.errors) {
logger.error(`Invalid configuration: ${error}`);
}
exit(ExitCode.FAILURE);
return undefined;
}
const { config } = parsed;
logger = createLogger(config.logLevel);
const shutdown = new Shutdown(logger, exit);
if (options.handleSignals ?? true) {
for (const signal of ['SIGTERM', 'SIGINT'] as const) {
process.on(signal, () => {
void shutdown.run(ExitCode.OK, `${signal} received`);
});
}
}
const fail = async (message: string, code: number = ExitCode.FAILURE): Promise<undefined> => {
logger.error(message);
await shutdown.run(code);
return undefined;
};
const url = resolveMongoUrl(config.database);
if (url.kind === 'missing') {
for (const variable of url.variables) {
logger.error(`Environment variable "${variable}" is not defined`);
}
return fail('Define every MONGO_* variable or DATABASE_URL before running OpenVidu Dashboard');
}
let clientOptions;
try {
clientOptions = mongoClientOptions(config.database);
} catch (error) {
return fail(
`Cannot read the CA file ${config.database.tlsCaFile ?? ''} (DATABASE_TLS_CA_FILE): ${String(error)}`
);
}
const client = new MongoClient(url.url, clientOptions);
shutdown.onShutdown(() => client.close());
const db = client.db(config.database.name);
logger.info('Connecting to MongoDB');
try {
await client.connect();
await db.command({ ping: 1 });
} catch (error) {
if (shutdown.isRequested()) {
return undefined;
}
return fail(`Cannot connect to MongoDB: ${error instanceof Error ? error.message : String(error)}`);
}
if (shutdown.isRequested()) {
return undefined;
}
const schema = await readSchemaStatus(db);
if (schema.status === WriterSchemaStatus.OLDER && schema.writer !== undefined) {
return fail(olderSchemaMessage(schema.writer), ExitCode.SCHEMA_TOO_OLD);
}
logSchema(logger, schema);
const container = buildContainer(options, config, logger, client, db, shutdown);
try {
options.configure?.(container);
} catch (error) {
return fail(`Startup failed: ${error instanceof Error ? error.message : String(error)}`);
}
const unimplemented =
options.edition === 'pro' ? container.get<RouteRegistry>(TOKENS.RouteRegistry).unimplemented() : [];
if (unimplemented.length > 0) {
return fail(`Startup failed: PRO routes without a definition: ${unimplemented.join(', ')}`);
}
const context: StartupContext = { config, logger, client, db, container, shutdown };
for (const hook of [...ceStartupHooks(options), ...(options.startupHooks ?? [])]) {
try {
await hook(context);
} catch (error) {
return fail(`Startup failed: ${error instanceof Error ? error.message : String(error)}`);
}
if (shutdown.isRequested()) {
return undefined;
}
}
const registry = container.get<RouteRegistry>(TOKENS.RouteRegistry);
const app = createHttpApp({
logger,
appRoot: options.appRoot,
trustProxy: config.http.trustProxy,
apiRouter: registry.router(bearerAuthenticator(() => container.get<AuthService>(TOKENS.AuthService))),
...(docsEnabled(env) ? { docsRouter: docsRouter(() => openApiDocument(registry, options.version)) } : {})
});
return new Promise((resolve) => {
const server = app.listen(config.port, (error) => {
if (error) {
void fail(`Cannot listen on port ${String(config.port)}: ${error.message}`).then(resolve);
return;
}
shutdown.attachServer(server);
logger.info(
`OpenVidu Dashboard ${options.version} (${options.edition}) listening on port ${String(config.port)}`
);
resolve({ server, container, shutdown });
});
});
}
/** The OpenAPI document and its page are served outside production only. */
export function docsEnabled(env: NodeJS.ProcessEnv): boolean {
return env.NODE_ENV !== 'production';
}
/** CE startup hooks, run after the schema gate and before the edition's own hooks. */
function ceStartupHooks(options: DashboardOptions): StartupHook[] {
return [
({ config, container, logger }) => {
const resolution = resolveBasePath(config.http.basePath, options.appRoot);
if (resolution.source === 'default') {
logger.warn('No DASHBOARD_BASE_PATH and no built SPA with a <base href>: the public base path is /');
}
container.bind(TOKENS.BasePath).toConstantValue(resolution.basePath);
return Promise.resolve();
},
async ({ config, container, db }) => {
container.bind(TOKENS.SigningKey).toConstantValue(await provisionSigningKey(db, config.session.jwtSecret));
},
async ({ container }) => {
await container.get<SessionRepository>(TOKENS.SessionRepository).ensureIndexes();
}
];
}
function logSchema(logger: Logger, schema: InfoSchema): void {
if (schema.status === WriterSchemaStatus.NEWER) {
logger.warn(
`Analytics schema version ${String(schema.writer)} is newer than ${String(schema.dashboard)}, the latest ` +
'this dashboard knows; upgrade the dashboard to see every field'
);
} else if (schema.status === WriterSchemaStatus.UNINITIALIZED) {
logger.info('The OpenVidu server has not initialized the analytics database yet');
}
}
function buildContainer(
options: DashboardOptions,
config: DashboardConfig,
logger: Logger,
client: MongoClient,
db: Db,
shutdown: Shutdown
): Container {
const env = options.env ?? process.env;
const container = new Container();
container.bind(TOKENS.Config).toConstantValue(config);
container.bind(TOKENS.Logger).toConstantValue(logger);
container.bind(TOKENS.MongoClient).toConstantValue(client);
container.bind(TOKENS.Database).toConstantValue(db);
container.bind(TOKENS.Shutdown).toConstantValue(shutdown);
container.bind<() => Date>(TOKENS.Clock).toConstantValue(() => new Date());
container.bind<FeatureKey[]>(TOKENS.Features).toConstantValue([]);
container.bind<() => InfoLicense | undefined>(TOKENS.LicenseInfo).toConstantValue(() => undefined);
container.bind(TOKENS.RouteRegistry).toConstantValue(new RouteRegistry(options.edition));
container.bind<AnalyticsCatalogue>(TOKENS.AnalyticsCatalogue).toConstantValue(CE_ANALYTICS_CATALOGUE);
container
.bind(TOKENS.SessionRepository)
.toResolvedValue((database: Db) => new SessionRepository(database), [TOKENS.Database])
.inSingletonScope();
container
.bind(TOKENS.StatsModeReader)
.toResolvedValue(
(database: Db, clock: () => Date) => new StatsModeReader(database, clock),
[TOKENS.Database, TOKENS.Clock]
)
.inSingletonScope();
container
.bind(TOKENS.InfoService)
.toResolvedValue(
(database: Db, statsMode: StatsModeReader) =>
new InfoService(database, {
edition: options.edition,
version: options.version,
features: () => container.get<FeatureKey[]>(TOKENS.Features),
limits: rankedSortLimits(config.lists.totalMaxRangeMs),
license: () => container.get<() => InfoLicense | undefined>(TOKENS.LicenseInfo)(),
openapiDocsEnabled: docsEnabled(env),
statsMode
}),
[TOKENS.Database, TOKENS.StatsModeReader]
)
.inSingletonScope();
container
.bind(TOKENS.AuthService)
.toResolvedValue(
(key: Uint8Array, sessions: SessionRepository, clock: () => Date) =>
new AuthService({
username: config.admin.username,
password: config.admin.password,
edition: options.edition,
key,
refreshTokenTtlSeconds: config.session.refreshTokenTtlSeconds,
sessions,
logger,
now: clock
}),
[TOKENS.SigningKey, TOKENS.SessionRepository, TOKENS.Clock]
)
.inSingletonScope();
container
.bind(TOKENS.WriterFreshness)
.toResolvedValue(
(database: Db, clock: () => Date) => new WriterFreshness(database, clock),
[TOKENS.Database, TOKENS.Clock]
)
.inSingletonScope();
container
.bind(TOKENS.RoomsService)
.toResolvedValue(
(database: Db, clock: () => Date, freshness: WriterFreshness) =>
new RoomsService(database, {
totalMaxRangeMs: config.lists.totalMaxRangeMs,
freshness,
now: clock
}),
[TOKENS.Database, TOKENS.Clock, TOKENS.WriterFreshness]
)
.inSingletonScope();
container
.bind(TOKENS.ParticipantsService)
.toResolvedValue(
(database: Db, clock: () => Date, freshness: WriterFreshness) =>
new ParticipantsService(database, {
totalMaxRangeMs: config.lists.totalMaxRangeMs,
freshness,
now: clock
}),
[TOKENS.Database, TOKENS.Clock, TOKENS.WriterFreshness]
)
.inSingletonScope();
container
.bind(TOKENS.EgressService)
.toResolvedValue(
(database: Db, clock: () => Date) =>
new EgressService(database, { totalMaxRangeMs: config.lists.totalMaxRangeMs, now: clock }),
[TOKENS.Database, TOKENS.Clock]
)
.inSingletonScope();
container
.bind(TOKENS.IngressService)
.toResolvedValue(
(database: Db, clock: () => Date) =>
new IngressService(database, { totalMaxRangeMs: config.lists.totalMaxRangeMs, now: clock }),
[TOKENS.Database, TOKENS.Clock]
)
.inSingletonScope();
container
.bind(TOKENS.AnalyticsFeatureGate)
.toResolvedValue(() => new AnalyticsFeatureGate(() => container.get<FeatureKey[]>(TOKENS.Features)))
.inSingletonScope();
container
.bind(TOKENS.AnalyticsService)
.toResolvedValue(
(database: Db, clock: () => Date, gate: AnalyticsFeatureGate, catalogue: AnalyticsCatalogue) =>
new AnalyticsService(database, {
now: clock,
gate,
catalogue,
cache: new AnalyticsCache(config.analytics.cacheTtlSeconds * 1000, clock)
}),
[TOKENS.Database, TOKENS.Clock, TOKENS.AnalyticsFeatureGate, TOKENS.AnalyticsCatalogue]
)
.inSingletonScope();
container.bind<OverviewExtension>(TOKENS.OverviewExtension).toConstantValue(() => ({}));
container
.bind(TOKENS.OverviewService)
.toResolvedValue(
(database: Db, clock: () => Date, extension: OverviewExtension) =>
new OverviewService(database, { now: clock, extension }),
[TOKENS.Database, TOKENS.Clock, TOKENS.OverviewExtension]
)
.inSingletonScope();
container
.bind(TOKENS.StatusService)
.toResolvedValue(
(database: Db, clock: () => Date, info: InfoService) => new StatusService(database, { info, now: clock }),
[TOKENS.Database, TOKENS.Clock, TOKENS.InfoService]
)
.inSingletonScope();
logger.info(
config.analytics.cacheTtlSeconds > 0
? `Analytics cache: completed buckets kept for ${String(config.analytics.cacheTtlSeconds)} s`
: 'Analytics cache disabled (DASHBOARD_ANALYTICS_CACHE_TTL=0)'
);
const registry = container.get<RouteRegistry>(TOKENS.RouteRegistry);
const now = () => container.get<() => Date>(TOKENS.Clock)();
registerProbes(registry, options.version, db);
registerAuthRoutes(
registry,
() => container.get<AuthService>(TOKENS.AuthService),
() => ({
basePath: container.get<string>(TOKENS.BasePath),
ttlSeconds: config.session.refreshTokenTtlSeconds,
secure: config.session.cookieSecure
})
);
registerInfoRoute(registry, () => container.get<InfoService>(TOKENS.InfoService));
registerRoomsRoutes(registry, () => container.get<RoomsService>(TOKENS.RoomsService), now);
registerParticipantsRoutes(registry, () => container.get<ParticipantsService>(TOKENS.ParticipantsService), now);
registerTracksRoutes(registry);
registerEgressRoutes(registry, () => container.get<EgressService>(TOKENS.EgressService), now);
registerIngressRoutes(registry, () => container.get<IngressService>(TOKENS.IngressService), now);
registerAnalyticsRoutes(registry, () => container.get<AnalyticsService>(TOKENS.AnalyticsService), now);
registerOverviewRoutes(registry, () => container.get<OverviewService>(TOKENS.OverviewService));
registerStatusRoutes(registry, () => container.get<StatusService>(TOKENS.StatusService));
return container;
}

27
openvidu-dashboard/dashboard-ce/backend/src/logging/logger.ts Normal file
View File

@ -0,0 +1,27 @@
import { createLogger as createWinstonLogger, format, type Logger, transports } from 'winston';
import type { LogLevel } from '../config/variables.js';
export type { Logger };
/** Console logger: `<timestamp> <level>: <message>` followed by metadata as JSON and the stack of errors. */
export function createLogger(level: LogLevel = 'info'): Logger {
const formats = [
format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss.SSS' }),
format.splat(),
format.errors({ stack: true }),
format.printf((info) => {
const { level: name, message, timestamp, stack, ...meta } = info;
const metadata = Object.keys(meta).length > 0 ? ` ${JSON.stringify(meta)}` : '';
const trace = typeof stack === 'string' ? `\n${stack}` : '';
return `${String(timestamp)} ${name}: ${String(message)}${metadata}${trace}`;
})
];
if (process.stdout.isTTY) {
formats.unshift(format.colorize());
}
return createWinstonLogger({ level, format: format.combine(...formats), transports: [new transports.Console()] });
}

55
openvidu-dashboard/dashboard-ce/backend/src/mongo/mongo-client.ts Normal file
View File

@ -0,0 +1,55 @@
import { accessSync, constants } from 'node:fs';
import type { MongoClientOptions } from 'mongodb';
import type { DashboardConfig } from '../config/variables.js';
export type MongoUrlResult = { kind: 'url'; url: string } | { kind: 'missing'; variables: string[] };
const COMPOSITION_VARIABLES = [
['MONGO_NODES', 'nodes'],
['MONGO_PORT', 'port'],
['MONGO_ADMIN_USERNAME', 'username'],
['MONGO_ADMIN_PASSWORD', 'password'],
['MONGO_REPLICA_SET_NAME', 'replicaSet']
] as const;
/**
* `DATABASE_URL`, or the URL composed from the `MONGO_*` variables as OpenVidu 3.9 does: every node of
* `MONGO_NODES` gets `MONGO_PORT`, credentials are used as given, and reads prefer the primary.
*/
export function resolveMongoUrl(database: DashboardConfig['database']): MongoUrlResult {
if (database.url) {
return { kind: 'url', url: database.url };
}
const missing = COMPOSITION_VARIABLES.filter(([, key]) => !database[key]).map(([name]) => name);
if (missing.length > 0) {
return { kind: 'missing', variables: missing };
}
const { nodes = '', port = '', username = '', password = '', replicaSet = '' } = database;
const hosts = nodes
.split(',')
.map((node) => `${node.trim()}:${port}`)
.join(',');
return {
kind: 'url',
url: `mongodb://${username}:${password}@${hosts}/?replicaSet=${replicaSet}&readPreference=primaryPreferred`
};
}
/** Options of the client; a CA file switches TLS on and must be readable now, not at the first connection. */
export function mongoClientOptions(database: DashboardConfig['database']): MongoClientOptions {
const options: MongoClientOptions = { serverSelectionTimeoutMS: 10_000, appName: 'openvidu-dashboard' };
if (database.tlsCaFile) {
accessSync(database.tlsCaFile, constants.R_OK);
options.tls = true;
options.tlsCAFile = database.tlsCaFile;
}
return options;
}

137
openvidu-dashboard/dashboard-ce/backend/src/overview/overview-repository.ts Normal file
View File

@ -0,0 +1,137 @@
import type { Db, Document } from 'mongodb';
import {
Collection,
EGRESS_IN_FLIGHT_STATUSES,
IngressSessionStatus,
type NodeDocument,
ParticipantKind,
ParticipantStatus,
type RoomDocument,
RoomStatus
} from '@openvidu-dashboard/typings';
import type { Counters } from '../analytics/analytics-catalogue.js';
import { foldRows, totalCounters } from '../analytics/analytics-counters.js';
import { AnalyticsRepository } from '../analytics/analytics-repository.js';
import { RoomsRepository } from '../rooms/rooms-repository.js';
export const RECENT_ROOMS = 10;
export const TODAY_FIELDS = [
'rooms.created',
'participants.joined',
'participants.minutes',
'egress.started',
'ingress.sessionsStarted'
] as const;
/** Active rooms of a node. */
export interface RoomGroup {
_id: string | null;
rooms: number;
stale: number;
}
/** Active participants of one kind on a node. */
export interface ParticipantGroup {
_id: { nodeId: string | null; kind: ParticipantKind };
count: number;
publishers: number;
stale: number;
}
/** `1` when the document has stats older than `threshold`; documents without `lastStatsAt` never count. */
function staleCount(threshold: Date): Document {
return {
$sum: {
$cond: [{ $and: [{ $gt: ['$lastStatsAt', null] }, { $lt: ['$lastStatsAt', threshold] }] }, 1, 0]
}
};
}
export function activeRoomsPipeline(threshold: Date): Document[] {
return [
{ $match: { status: RoomStatus.ACTIVE } },
{ $group: { _id: '$nodeId', rooms: { $sum: 1 }, stale: staleCount(threshold) } }
];
}
/** Every kind in the filter, so both `{ status, kind }` and `{ kind, status, joinedAt, _id }` can serve it. */
export function activeParticipantsPipeline(threshold: Date): Document[] {
return [
{ $match: { kind: { $in: Object.values(ParticipantKind) }, status: ParticipantStatus.ACTIVE } },
{
$group: {
_id: { nodeId: '$nodeId', kind: '$kind' },
count: { $sum: 1 },
publishers: { $sum: { $cond: ['$isPublisher', 1, 0] } },
stale: staleCount(threshold)
}
}
];
}
export const IN_FLIGHT_EGRESS = { status: { $in: [...EGRESS_IN_FLIGHT_STATUSES] } };
export const PUBLISHING_INGRESS = { status: IngressSessionStatus.PUBLISHING };
/** The reads of the overview: active groups, in-flight counts, recent rooms, today's rollups and the nodes. */
export class OverviewRepository {
private readonly rooms: RoomsRepository;
private readonly rollups: AnalyticsRepository;
constructor(private readonly db: Db) {
this.rooms = new RoomsRepository(db);
this.rollups = new AnalyticsRepository(db);
}
/** The MongoDB server clock, so freshness never depends on the dashboard host clock. */
async now(fallback: Date): Promise<Date> {
const hello = await this.db.command({ hello: 1 });
return hello.localTime instanceof Date ? hello.localTime : fallback;
}
roomGroups(threshold: Date): Promise<RoomGroup[]> {
return this.db
.collection(Collection.ROOMS)
.aggregate<RoomGroup>(activeRoomsPipeline(threshold), { hint: 'status_createdAt_id' })
.toArray();
}
participantGroups(threshold: Date): Promise<ParticipantGroup[]> {
return this.db
.collection(Collection.PARTICIPANTS)
.aggregate<ParticipantGroup>(activeParticipantsPipeline(threshold))
.toArray();
}
inFlightEgresses(): Promise<number> {
return this.db.collection(Collection.EGRESSES).countDocuments(IN_FLIGHT_EGRESS);
}
publishingIngressSessions(): Promise<number> {
return this.db.collection(Collection.INGRESS_SESSIONS).countDocuments(PUBLISHING_INGRESS);
}
/** The newest rooms of any status, through the rooms list query. */
recentRooms(): Promise<RoomDocument[]> {
return this.rooms.list(
{ status: { $in: [RoomStatus.ACTIVE, RoomStatus.CLOSED] } },
{ createdAt: -1, _id: -1 },
RECENT_ROOMS
);
}
/** Sum of the global hourly rollups whose bucket starts in `[from, to]`. */
async today(from: Date, to: Date): Promise<Counters> {
const end = new Date(to.getTime() + 1);
return totalCounters(
await foldRows(this.rollups.rollups(Collection.ANALYTICS_HOURLY, 'global', from, end, TODAY_FIELDS), [from])
);
}
nodes(): Promise<NodeDocument[]> {
return this.db.collection<NodeDocument>(Collection.NODES).find({}).sort({ _id: 1 }).toArray();
}
}

60
openvidu-dashboard/dashboard-ce/backend/src/overview/overview-responses.ts Normal file
View File

@ -0,0 +1,60 @@
import * as z from 'zod';
import { ClosedBy, ParticipantKind, RoomStatus } from '@openvidu-dashboard/typings';
import { isoDate, staleField } from '../api/responses.js';
import { enumValues } from '../util/enum-values.js';
const count = z.number().int();
const live = z.object({
rooms: count,
participants: count.meta({ description: 'Active STANDARD sessions' }),
services: count.meta({ description: 'Active sessions of every kind but STANDARD' }),
participantsByKind: z.object(
Object.fromEntries(enumValues(ParticipantKind).map((kind) => [kind, count])) as Record<
ParticipantKind,
typeof count
>
),
publishers: count.meta({ description: 'Active STANDARD sessions that publish' }),
egresses: count,
ingressSessions: count,
stale: z.object({ rooms: count, participants: count, olderThanMs: count })
});
const today = z.object({
tz: z.string(),
since: isoDate,
rooms: count,
participantSessions: count,
participantMinutes: count,
egresses: count,
ingressSessions: count,
approximate: z.boolean()
});
const recentRoom = z.object({
sid: z.string(),
name: z.string(),
status: z.enum(enumValues(RoomStatus)),
createdAt: isoDate,
endedAt: isoDate.optional(),
durationMs: count.optional(),
closedBy: z.enum(enumValues(ClosedBy)).optional(),
participants: z.object({ active: count, sessions: count, unique: count }),
nodeId: z.string().optional(),
lastStatsAt: isoDate.optional(),
stale: staleField
});
const fields = {
generatedAt: isoDate,
live,
today,
recentRooms: z.array(recentRoom)
};
export const overviewResponse = z
.object(fields)
.meta({ id: 'OverviewResponse', description: 'Live counters, today and recent rooms' });

51
openvidu-dashboard/dashboard-ce/backend/src/overview/overview-routes.ts Normal file
View File

@ -0,0 +1,51 @@
import * as z from 'zod';
import type { RouteDefinition, RouteRegistry } from '../api/route-registry.js';
import { ifNoneMatchMatches } from '../http/conditional.js';
import { overviewResponse } from './overview-responses.js';
import { overviewQuery, type OverviewParams } from './overview-schemas.js';
import type { OverviewService } from './overview-service.js';
/** `GET /overview` documented with `schema`; the PRO edition replaces the CE route with the schema of its extension. */
export function overviewRoute(
overview: () => OverviewService,
schema: z.ZodType
): RouteDefinition<unknown, OverviewParams> {
return {
method: 'get',
path: '/overview',
edition: 'ce',
summary: 'Live counters, today and recent rooms',
tags: ['Overview'],
security: 'bearer',
request: { query: overviewQuery },
responses: {
200: {
description: 'The overview',
schema,
headers: z.object({
ETag: z.string().meta({ description: 'Weak validator of the body without generatedAt' })
})
},
304: { description: 'Unchanged since the `If-None-Match` validator' }
},
handler: async ({ query, req, res }) => {
const { body, etag } = await overview().overview(query.tz);
res.setHeader('ETag', etag);
res.setHeader('Cache-Control', 'private, no-cache');
if (ifNoneMatchMatches(req.get('If-None-Match'), etag)) {
res.status(304).end();
return undefined;
}
return body;
}
};
}
export function registerOverviewRoutes(registry: RouteRegistry, overview: () => OverviewService): void {
registry.register(overviewRoute(overview, overviewResponse));
}

7
openvidu-dashboard/dashboard-ce/backend/src/overview/overview-schemas.ts Normal file
View File

@ -0,0 +1,7 @@
import * as z from 'zod';
import { tzParam } from '../api/query.js';
export const overviewQuery = z.object({ tz: tzParam });
export type OverviewParams = z.output<typeof overviewQuery>;

170
openvidu-dashboard/dashboard-ce/backend/src/overview/overview-service.ts Normal file
View File

@ -0,0 +1,170 @@
import { createHash } from 'node:crypto';
import type { Db } from 'mongodb';
import {
freshnessWindows,
type NodeDocument,
type OverviewLive,
type OverviewRecentRoom,
type OverviewResponse,
type OverviewToday,
ParticipantKind,
type RoomDocument
} from '@openvidu-dashboard/typings';
import type { Counters } from '../analytics/analytics-catalogue.js';
import { iso } from '../api/mapping.js';
import { staleFlag, writerBatchInterval } from '../status/freshness.js';
import { compact } from '../util/compact.js';
import { OverviewRepository, type ParticipantGroup, type RoomGroup } from './overview-repository.js';
import { todayWindow } from './overview-window.js';
/** What an {@link OverviewExtension} folds: the node documents, the active groups and the database clock. */
export interface OverviewInputs {
nodes: readonly NodeDocument[];
roomGroups: readonly RoomGroup[];
participantGroups: readonly ParticipantGroup[];
now: Date;
}
/** Extra fields of the overview body, merged before its `ETag` is computed; the PRO edition adds the nodes. */
export type OverviewExtension = (inputs: OverviewInputs) => Readonly<Record<string, unknown>>;
export interface OverviewServiceOptions {
/** Dashboard clock, used only when MongoDB does not report its own. */
now: () => Date;
extension: OverviewExtension;
}
/** An overview body and its weak validator. */
export interface OverviewResult {
body: OverviewResponse;
etag: string;
}
export function foldLive(
roomGroups: readonly RoomGroup[],
participantGroups: readonly ParticipantGroup[],
egresses: number,
ingressSessions: number,
staleMs: number
): OverviewLive {
const byKind = Object.fromEntries(Object.values(ParticipantKind).map((kind) => [kind, 0])) as Record<
ParticipantKind,
number
>;
let participants = 0;
let services = 0;
let publishers = 0;
let staleParticipants = 0;
for (const group of participantGroups) {
// A kind newer than this dashboard counts as a service but has no entry of its own.
if (Object.hasOwn(byKind, group._id.kind)) {
byKind[group._id.kind] += group.count;
}
staleParticipants += group.stale;
if (group._id.kind === ParticipantKind.STANDARD) {
participants += group.count;
publishers += group.publishers;
} else {
services += group.count;
}
}
return {
rooms: roomGroups.reduce((sum, group) => sum + group.rooms, 0),
participants,
services,
participantsByKind: byKind,
publishers,
egresses,
ingressSessions,
stale: {
rooms: roomGroups.reduce((sum, group) => sum + group.stale, 0),
participants: staleParticipants,
olderThanMs: staleMs
}
};
}
export function toRecentRoom(doc: RoomDocument, staleMs: number, now: Date): OverviewRecentRoom {
return compact<OverviewRecentRoom>({
sid: doc._id,
name: doc.name,
status: doc.status,
createdAt: doc.createdAt.toISOString(),
endedAt: iso(doc.endedAt),
durationMs: doc.durationMs,
closedBy: doc.closedBy,
participants: {
active: doc.participants.active,
sessions: doc.participants.sessions,
unique: doc.participants.unique
},
nodeId: doc.nodeId,
lastStatsAt: iso(doc.lastStatsAt),
stale: staleFlag(doc.status, doc.lastStatsAt, staleMs, now)
});
}
function today(counters: Counters, tz: string, since: Date, approximate: boolean): OverviewToday {
const value = (path: string) => counters.get(path) ?? 0;
return {
tz,
since: since.toISOString(),
rooms: value('rooms.created'),
participantSessions: value('participants.joined'),
participantMinutes: Math.round(value('participants.minutes')),
egresses: value('egress.started'),
ingressSessions: value('ingress.sessionsStarted'),
approximate
};
}
/** `W/"<sha1>"` of the body without `generatedAt`: unchanged while nothing the page shows changes. */
export function overviewEtag(body: OverviewResponse): string {
const { generatedAt: _generatedAt, ...rest } = body;
return `W/"${createHash('sha1').update(JSON.stringify(rest)).digest('base64url')}"`;
}
/** The overview: live counters, today's rollups, recent rooms and the fields of the extension. */
export class OverviewService {
private readonly repository: OverviewRepository;
constructor(
db: Db,
private readonly options: OverviewServiceOptions
) {
this.repository = new OverviewRepository(db);
}
async overview(tz: string): Promise<OverviewResult> {
const [now, nodes] = await Promise.all([this.repository.now(this.options.now()), this.repository.nodes()]);
const { staleMs } = freshnessWindows(writerBatchInterval(nodes, now));
const threshold = new Date(now.getTime() - staleMs);
const window = todayWindow(now, tz);
const [roomGroups, participantGroups, egresses, ingressSessions, recent, counters] = await Promise.all([
this.repository.roomGroups(threshold),
this.repository.participantGroups(threshold),
this.repository.inFlightEgresses(),
this.repository.publishingIngressSessions(),
this.repository.recentRooms(),
this.repository.today(window.from, now)
]);
const body: OverviewResponse = {
generatedAt: now.toISOString(),
live: foldLive(roomGroups, participantGroups, egresses, ingressSessions, staleMs),
today: today(counters, tz, window.since, window.approximate),
recentRooms: recent.map((room) => toRecentRoom(room, staleMs, now)),
...this.options.extension({ nodes, roomGroups, participantGroups, now })
};
return { body, etag: overviewEtag(body) };
}
}

20
openvidu-dashboard/dashboard-ce/backend/src/overview/overview-window.ts Normal file
View File

@ -0,0 +1,20 @@
import { bucketStart } from '../api/time-series.js';
const HOUR_MS = 3_600_000;
export interface TodayWindow {
/** Local midnight of the zone. */
since: Date;
/** Start of the hourly bucket containing `since`: the first rollup document summed. */
from: Date;
/** `since` is not on an hour boundary, so the first bucket also holds the end of the previous day. */
approximate: boolean;
}
/** "Today" in `tz` at `now`, aligned to the UTC hourly rollups. */
export function todayWindow(now: Date, tz: string): TodayWindow {
const since = bucketStart(now, '1d', tz);
const from = new Date(Math.floor(since.getTime() / HOUR_MS) * HOUR_MS);
return { since, from, approximate: from.getTime() !== since.getTime() };
}

55
openvidu-dashboard/dashboard-ce/backend/src/participants/participants-mappers.ts Normal file
View File

@ -0,0 +1,55 @@
import {
type ParticipantClientSummary,
type ParticipantDocument,
type ParticipantListItem,
TrackSource
} from '@openvidu-dashboard/typings';
import { iso } from '../api/mapping.js';
import { compact } from '../util/compact.js';
function clientSummary(doc: Pick<ParticipantDocument, 'client'>): ParticipantClientSummary | undefined {
const client = doc.client;
if (client === undefined) {
return undefined;
}
const summary = compact<ParticipantClientSummary>({
sdk: client.sdk,
version: client.version,
os: client.os,
osVersion: client.osVersion,
browser: client.browser,
browserVersion: client.browserVersion
});
return Object.keys(summary).length === 0 ? undefined : summary;
}
export function toParticipantListItem(doc: ParticipantDocument): ParticipantListItem {
return compact<ParticipantListItem>({
sid: doc._id,
identity: doc.identity,
name: doc.name,
kind: doc.kind,
status: doc.status,
roomSid: doc.roomSid,
roomName: doc.roomName,
joinedAt: iso(doc.joinedAt),
leftAt: iso(doc.leftAt),
durationMs: doc.durationMs,
connectionType: doc.connectionType,
nodeId: doc.nodeId,
isPublisher: doc.isPublisher,
publishedSources: publishedSources(doc),
client: clientSummary(doc)
});
}
/** Sources with at least one publication, in `TrackSource` order. */
function publishedSources(doc: Pick<ParticipantDocument, 'tracks'>): TrackSource[] {
const { bySource } = doc.tracks;
return Object.values(TrackSource).filter((source) => (bySource[source] ?? 0) > 0);
}

152
openvidu-dashboard/dashboard-ce/backend/src/participants/participants-query.ts Normal file
View File

@ -0,0 +1,152 @@
import type { Document, Sort } from 'mongodb';
import { ParticipantKind, ParticipantSort, ParticipantStatus } from '@openvidu-dashboard/typings';
import { type CursorPayload, pageQuery, type PageQuery } from '../api/cursor.js';
import { prefixRegex } from '../api/search.js';
import { PARTICIPANT_SID } from './participants-schemas.js';
/** Fields of a participant document the list item needs. */
export const PARTICIPANT_LIST_PROJECTION: Readonly<Document> = {
identity: 1,
name: 1,
kind: 1,
status: 1,
roomSid: 1,
roomName: 1,
joinedAt: 1,
leftAt: 1,
durationMs: 1,
connectionType: 1,
nodeId: 1,
isPublisher: 1,
lastStatsAt: 1,
'tracks.bySource': 1,
'client.sdk': 1,
'client.version': 1,
'client.os': 1,
'client.osVersion': 1,
'client.browser': 1,
'client.browserVersion': 1
};
const ALL_KINDS = Object.values(ParticipantKind);
const ALL_STATUSES = Object.values(ParticipantStatus);
export interface ParticipantsFilter {
q?: string | undefined;
kind?: readonly ParticipantKind[] | undefined;
status?: ParticipantStatus | undefined;
room?: string | undefined;
publisher?: true | undefined;
from: Date;
to: Date;
sort: ParticipantSort;
order: 'asc' | 'desc';
}
export type ParticipantsListPlan =
| { kind: 'sid'; filter: Document }
| {
kind: 'page';
filter: Document;
/** The list filter without the cursor condition, for `total`. */
countFilter: Document;
sort: Sort;
page: PageQuery;
/** Index of the kind and status branch: without it the planner may prefer `{ status, kind }` and sort in memory. */
hint?: string;
}
| {
kind: 'ranked';
/** The list filter over the join range, ranked in memory. */
match: Document;
countFilter: Document;
rank: (asOf: Date) => Document;
hint?: string;
};
type RankedParticipantSort = Exclude<ParticipantSort, 'joinedAt'>;
/** Rank of each ranked sort key at `asOf`: an open session leaves, and lasts until, `asOf`. */
const PARTICIPANT_RANKS: Readonly<Record<RankedParticipantSort, (asOf: Date) => Document>> = {
leftAt: (asOf) => ({ $ifNull: ['$leftAt', asOf] }),
duration: (asOf) => ({
$ifNull: ['$durationMs', { $subtract: [{ $ifNull: ['$leftAt', asOf] }, '$joinedAt'] }]
})
};
/**
* Filter, sort and keyset condition of a participants or agents list: a SID is a point lookup; an identity prefix
* drives `{ identityLower, joinedAt }` (or `{ roomSid, identityLower, joinedAt }` with a room); a room drives
* `{ roomSid, joinedAt, _id }`; kinds or a status drive `{ kind, status, joinedAt, _id }` with absent filters as `$in`
* over every value so the sorted branches merge; otherwise `{ joinedAt, _id }`. `publisher` is residual on each. The
* range is always on `joinedAt`; a ranked sort key scans it whole and ranks in memory.
*/
export function participantsListPlan(filter: ParticipantsFilter, cursor?: CursorPayload): ParticipantsListPlan {
if (filter.q !== undefined && PARTICIPANT_SID.test(filter.q)) {
return { kind: 'sid', filter: { _id: filter.q } };
}
const range = { from: filter.from, to: filter.to };
const bounds = pageQuery('joinedAt', filter.order, undefined, range).fieldFilter ?? {};
const kinds = filter.kind === undefined || filter.kind.length === 0 ? undefined : [...new Set(filter.kind)];
const publisher: Document = filter.publisher === true ? { isPublisher: true } : {};
const residual: Document = {
...(kinds === undefined ? {} : { kind: kinds.length === 1 ? kinds[0] : { $in: kinds } }),
...(filter.status === undefined ? {} : { status: filter.status }),
...publisher
};
const build = (joinedAt: Document): Document => {
if (filter.q !== undefined) {
return {
...(filter.room === undefined ? {} : { roomSid: filter.room }),
identityLower: prefixRegex(filter.q),
joinedAt,
...residual
};
}
if (filter.room !== undefined) {
return { roomSid: filter.room, joinedAt, ...residual };
}
if (kinds !== undefined || filter.status !== undefined) {
return {
kind: kinds === undefined ? { $in: ALL_KINDS } : kinds.length === 1 ? kinds[0] : { $in: kinds },
status: filter.status ?? { $in: ALL_STATUSES },
joinedAt,
...publisher
};
}
return { joinedAt, ...publisher };
};
const byKindAndStatus =
filter.q === undefined && filter.room === undefined && (kinds !== undefined || filter.status !== undefined);
const hint = byKindAndStatus ? { hint: 'kind_status_joinedAt_id' } : {};
if (filter.sort !== ParticipantSort.JOINED_AT) {
return {
kind: 'ranked',
match: build(bounds),
countFilter: build(bounds),
rank: PARTICIPANT_RANKS[filter.sort],
...hint
};
}
const page = pageQuery('joinedAt', filter.order, cursor, range);
return {
kind: 'page',
filter: { ...build(page.fieldFilter ?? {}), ...page.ties },
countFilter: build(bounds),
sort: page.sort,
page,
...hint
};
}

67
openvidu-dashboard/dashboard-ce/backend/src/participants/participants-responses.ts Normal file
View File

@ -0,0 +1,67 @@
import * as z from 'zod';
import { ClientSdk, ParticipantKind, ParticipantStatus, TrackSource } from '@openvidu-dashboard/typings';
import { isoDate, listResponse, staleField } from '../api/responses.js';
import { enumValues } from '../util/enum-values.js';
const count = z.number().int();
const connectionType = z.enum(['udp', 'tcp', 'turn']);
/** Client fields of a list item, which the PRO session detail extends. */
export const participantClientSummary = z.object({
sdk: z.enum(enumValues(ClientSdk)).optional(),
version: z.string().optional(),
os: z.string().optional(),
osVersion: z.string().optional(),
browser: z.string().optional(),
browserVersion: z.string().optional()
});
/** Fields of a participant list item, which the PRO session detail extends. */
export const participantListFields = {
sid: z.string(),
identity: z.string(),
name: z.string().optional(),
kind: z.enum(enumValues(ParticipantKind)),
status: z.enum(enumValues(ParticipantStatus)),
roomSid: z.string(),
roomName: z.string(),
joinedAt: isoDate,
leftAt: isoDate.optional(),
durationMs: count.optional(),
connectionType: connectionType.optional(),
nodeId: z.string().optional(),
isPublisher: z.boolean(),
publishedSources: z
.array(z.enum(enumValues(TrackSource)))
.meta({ description: 'Track sources with at least one publication' }),
stale: staleField
};
export const participantListItem = z
.object({ ...participantListFields, client: participantClientSummary.optional() })
.meta({ id: 'ParticipantListItem' });
export const participantsListResponse = listResponse(participantListItem, 'ParticipantsList');
const countByKind = z.object(
Object.fromEntries(enumValues(ParticipantKind).map((kind) => [kind, count])) as Record<
ParticipantKind,
typeof count
>
);
export const participantsSummary = z
.object({
active: z.object({
participants: count.meta({ description: 'Active STANDARD sessions' }),
services: count.meta({ description: 'Active sessions of every kind but STANDARD' }),
byKind: countByKind
}),
sessions: z.object({
participants: count.meta({ description: 'STANDARD sessions joined in the range' }),
byKind: countByKind
}),
approximate: z.boolean()
})
.meta({ id: 'ParticipantsSummary' });

56
openvidu-dashboard/dashboard-ce/backend/src/participants/participants-routes.ts Normal file
View File

@ -0,0 +1,56 @@
import { FeatureKey } from '@openvidu-dashboard/typings';
import type { RouteRegistry } from '../api/route-registry.js';
import { participantsListResponse, participantsSummary } from './participants-responses.js';
import { agentsListQuery, participantsListQuery, participantsSummaryQuery } from './participants-schemas.js';
import type { ParticipantsService } from './participants-service.js';
const TAGS = ['Participants'];
/**
* Participant routes: the search and agents lists and their summary, and the locks of the `participant-detail` routes
* (the detail and its sub-resources). `now` is read per request.
*/
export function registerParticipantsRoutes(
registry: RouteRegistry,
participants: () => ParticipantsService,
now: () => Date
): void {
registry.register({
method: 'get',
path: '/participants',
edition: 'ce',
summary: 'Search participant sessions',
tags: TAGS,
security: 'bearer',
request: { query: participantsListQuery(now) },
responses: { 200: { description: 'One page of participant sessions', schema: participantsListResponse } },
handler: ({ query }) => participants().list(query)
});
registry.register({
method: 'get',
path: '/participants/summary',
edition: 'ce',
summary: 'Participant and service counts of a range',
tags: TAGS,
security: 'bearer',
request: { query: participantsSummaryQuery(now) },
responses: { 200: { description: 'Counts above the participants table', schema: participantsSummary } },
handler: ({ query }) => participants().summary(query)
});
registry.register({
method: 'get',
path: '/agents',
edition: 'ce',
summary: 'List agent sessions',
tags: ['Agents'],
security: 'bearer',
request: { query: agentsListQuery(now) },
responses: { 200: { description: 'One page of agent sessions', schema: participantsListResponse } },
handler: ({ query }) => participants().agents(query)
});
for (const path of ['', '/sessions', '/tracks', '/subscriptions', '/events', '/series']) {
registry.lock({ method: 'get', path: `/participants/{sid}${path}`, feature: FeatureKey.PARTICIPANT_DETAIL });
}
}

Some files were not shown because too many files have changed in this diff Show More