jordibrouwer/nextdash v1.4.4.1

on GitHub

Widgets

• new — a custom widget can be tried before it is saved. The tile is the only place a custom widget's answer was ever visible, and all it can say about a path that matched nothing is —; four of them look identical whether the address is wrong, the key is wrong, or the JSON simply nests one level deeper than the boxes say. Config → Widgets → Settings now carries a Try it block under the figures: Ask now makes the request the panel describes — the address as typed, GET or POST, the credential it would name once saved — and shows the document that came back, indented and in the service's own key order, beside the figures the tile would draw from it. The facts of the request sit above both: method, host, status, how long it took, how much arrived, and whether a sign-in went with it, which is the difference between the key is wrong and no key was sent. A service that explains a 401 or a 404 in its body is shown that body, which the tile reads and throws away. POST /api/widgets/custom/test, widgets_custom.go, dashboard-config.js.
• new — Keep watching repeats the request while you look at it. Every 5, 10, 30 or 60 seconds, with the figures that moved on the last beat marked for a moment — for a queue draining or a service coming back up. Chained rather than an interval, so a slow service is asked again after it answers instead of accumulating a queue of requests behind it; nothing is asked while the tab is in the background, exactly as the tile asks nothing there; and it stops itself after five minutes, saying so rather than going quiet. One panel at a time. Every beat is a request to a machine that never agreed to be polled, which is also why the interval is a list starting at five seconds rather than a number box.
• new — GET or POST is a setting again. The server has accepted both since the widget shipped and the manual said so; the panel offered neither, so the only way to give a widget POST was to edit bookmarks-N.json by hand. It is a dropdown beside the address now. Nothing is sent with either method — POST is for the services that answer a statistics endpoint on that method and no other, not so a tile can change something.
• note — the test route takes a config rather than a widget id. The tile's own route deliberately does not: the address is stored, so it cannot be talked into fetching something by asking. This one is behind the write token, and whoever holds that can store the same config on a widget and press refresh at it — so it reaches nothing that was not already reachable, and saves saving a widget that is still being written. The same sanitiser, the same address checks, the same outbound client, and no cache is written: a draft that was never saved must not become what the tile draws.
• new — a stored key can be looked at, from the panel that stored it. A key typed into a custom widget goes to the credential file and never comes back: the panel is drawn from the shape around it, and the box over a saved one says Set — type to replace. That rule keeps the secret out of bookmarks-N.json, out of every export and out of the browser, and it is right about all of those — but it is also why an Authorization header missing its Bearer prefix is invisible, since the service answers 401 exactly as it would to a wrong key. There is an eye beside the box now. GET /api/health/credentials/reveal is the one route that hands a secret back, and it is narrow on purpose: only widget: ids, so a shared sign-in stays write-only and the store cannot be walked; one named field per request; behind the write token, like PUT and DELETE; and every reveal logged by id and field, never by value. An unknown id and a shared id give the same 404, so probing the route reveals nothing about which sign-ins exist.
• fix — a preset fills in the scheme its API key needs. Choosing Speedtest Tracker gave an address, three paths, a header name and a tile that answered 401: an Authorization value takes a scheme in front of the token, the box asks for "API key", so the token goes in bare and nothing on screen distinguishes that from a wrong key. The presets carry the scheme now and seed the box with it, shown rather than masked — it is not the secret, it is the half that was missing. Per preset, not a constant: Paperless takes Token , Proxmox takes PVEAPIToken=. Saving a box holding only the scheme is refused, since that would file the word "Bearer" as the key and send a header that looks filled in and authenticates as nothing.
• new — a Speed format, in the units a line is sold in. data.download is bytes per second, so a gigabit connection read 124.703 MB beside the word down — the same measurement as the 1 Gbps on the contract, expressed so differently the two cannot be compared at a glance. The new format reads bits and steps in thousands: 1.046 Gbps, scaling on its own so a slower line reads 94.000 Mbps rather than 0.094 Gbps. Three decimals, because a connection is compared against itself and one decimal rounds this week's 1.046 and last week's 1.038 to the same figure. The Speedtest Tracker preset points at download_bits and uses it.