feat(WP-0010): IHF Phase 9 — External API Surface and Consumer SDKs
Delivers the full Phase 9 external API layer:
- Versioned REST API (/api/v2/) with OpenAPI 3.1 spec; enum arrays for
widget_type, event_type, annotation category drawn live from registry tables
- OAuth 2.0 client credentials flow (/api/v2/token); hub:*:write scopes
gated on active HubCapabilityManifest FK
- API key management: SHA256-hashed tokens, key_prefix for display,
one-time reveal on creation, revocation support
- TypeScript and Python consumer SDKs generated from registry tables
(/api/v2/sdk/ihf-client.ts, /api/v2/sdk/ihf-client.py)
- Webhook delivery: HMAC-SHA256 signing, append-only webhook_deliveries,
fire-and-forget dispatch via forkIO, 3-retry logic
- Admin API dashboard with 24h stats (request count, error rate, last seen)
- Rate limiting (per-minute) and daily quota enforcement via api_request_log
- Schema migration: api_consumers, api_keys, webhook_subscriptions (CHECK
constraint on 6 framework lifecycle topics), webhook_deliveries
(append-only trigger), api_request_log
- ARCHITECTURE-LAYERS.md scorecard: 3.34 → 3.41 (approaching Strong)
- contracts/functional/interaction-reporting-v1.md extended with Phase 9
endpoint catalogue and 422 validation error format
GAAF: no bare TEXT discriminators; webhook event_type uses CHECK constraint
over 6 allowed framework lifecycle topic strings (not widget event types).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 19:52:20 +00:00
|
|
|
module Web.Controller.ApiDashboard where
|
|
|
|
|
|
|
|
|
|
import Web.Types
|
|
|
|
|
import Web.View.ApiDashboard.Show
|
|
|
|
|
import Generated.Types
|
|
|
|
|
import IHP.Prelude
|
|
|
|
|
import IHP.ControllerPrelude
|
2026-04-11 23:40:31 +00:00
|
|
|
import Web.Routes ()
|
feat(WP-0010): IHF Phase 9 — External API Surface and Consumer SDKs
Delivers the full Phase 9 external API layer:
- Versioned REST API (/api/v2/) with OpenAPI 3.1 spec; enum arrays for
widget_type, event_type, annotation category drawn live from registry tables
- OAuth 2.0 client credentials flow (/api/v2/token); hub:*:write scopes
gated on active HubCapabilityManifest FK
- API key management: SHA256-hashed tokens, key_prefix for display,
one-time reveal on creation, revocation support
- TypeScript and Python consumer SDKs generated from registry tables
(/api/v2/sdk/ihf-client.ts, /api/v2/sdk/ihf-client.py)
- Webhook delivery: HMAC-SHA256 signing, append-only webhook_deliveries,
fire-and-forget dispatch via forkIO, 3-retry logic
- Admin API dashboard with 24h stats (request count, error rate, last seen)
- Rate limiting (per-minute) and daily quota enforcement via api_request_log
- Schema migration: api_consumers, api_keys, webhook_subscriptions (CHECK
constraint on 6 framework lifecycle topics), webhook_deliveries
(append-only trigger), api_request_log
- ARCHITECTURE-LAYERS.md scorecard: 3.34 → 3.41 (approaching Strong)
- contracts/functional/interaction-reporting-v1.md extended with Phase 9
endpoint catalogue and 422 validation error format
GAAF: no bare TEXT discriminators; webhook event_type uses CHECK constraint
over 6 allowed framework lifecycle topic strings (not widget event types).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 19:52:20 +00:00
|
|
|
import Database.PostgreSQL.Simple (Only(..))
|
|
|
|
|
|
|
|
|
|
instance Controller ApiDashboardController where
|
|
|
|
|
beforeAction = ensureIsUser
|
|
|
|
|
|
|
|
|
|
action ShowApiDashboardAction = autoRefresh do
|
|
|
|
|
consumers <- query @ApiConsumer
|
|
|
|
|
|> orderByAsc #name
|
|
|
|
|
|> fetch
|
|
|
|
|
stats <- mapM fetchStats consumers
|
|
|
|
|
render ShowView { stats }
|
|
|
|
|
|
|
|
|
|
-- | Aggregate per-consumer stats from api_request_log (last 24 hours).
|
|
|
|
|
fetchStats :: (?modelContext :: ModelContext) => ApiConsumer -> IO ConsumerStats
|
|
|
|
|
fetchStats consumer = do
|
|
|
|
|
rows <- sqlQuery
|
|
|
|
|
"SELECT COUNT(*), \
|
|
|
|
|
\ COUNT(*) FILTER (WHERE status_code >= 400), \
|
|
|
|
|
\ MAX(requested_at) \
|
|
|
|
|
\FROM api_request_log \
|
|
|
|
|
\WHERE api_consumer_id = ? \
|
|
|
|
|
\ AND requested_at >= NOW() - INTERVAL '24 hours'"
|
|
|
|
|
(Only consumer.id)
|
|
|
|
|
case rows of
|
|
|
|
|
[(total, errs, lastTs)] ->
|
|
|
|
|
let errRate = if (total :: Int) == 0
|
|
|
|
|
then 0.0
|
|
|
|
|
else fromIntegral (errs :: Int) / fromIntegral total
|
|
|
|
|
in pure ConsumerStats
|
|
|
|
|
{ consumer
|
|
|
|
|
, requests24h = total
|
|
|
|
|
, errorRate = errRate
|
|
|
|
|
, lastSeen = lastTs
|
|
|
|
|
}
|
|
|
|
|
_ -> pure ConsumerStats
|
|
|
|
|
{ consumer
|
|
|
|
|
, requests24h = 0
|
|
|
|
|
, errorRate = 0.0
|
|
|
|
|
, lastSeen = Nothing
|
|
|
|
|
}
|