feat(node): full dashboard auth and API parity

crates/taskito-node/src/convert/mod.rs

@@ -4,6 +4,7 @@
 mod job;
 mod lock;
 mod log;
+mod ops;
 mod outcome;
 mod periodic;
 mod stats;
@@ -14,6 +15,9 @@ mod workflow;
 pub use job::{build_new_job, job_to_js, JsJob, JsTaskInvocation};
 pub use lock::{lock_info_to_js, JsLockInfo};
 pub use log::{log_to_js, JsTaskLog};
+pub use ops::{
+    circuit_breaker_to_js, replay_to_js, JsCircuitBreaker, JsDagEdge, JsJobDag, JsReplayEntry,
+};
 pub use outcome::{outcome_to_js, JsOutcome};
 pub use periodic::{periodic_to_js, JsPeriodicTask};
 pub use stats::{

crates/taskito-node/src/convert/ops.rs

@@ -0,0 +1,75 @@
+//! JS shapes for operational inspection: circuit breakers, replay history,
+//! and the job dependency DAG.
+
+use napi_derive::napi;
+use taskito_core::storage::models::{CircuitBreakerRow, ReplayHistoryRow};
+
+use super::JsJob;
+
+/// A task's circuit-breaker state (the dashboard-facing subset).
+#[napi(object)]
+pub struct JsCircuitBreaker {
+    pub task_name: String,
+    /// `closed`, `open`, or `half_open`.
+    pub state: String,
+    pub failure_count: i32,
+    pub last_failure_at: Option<i64>,
+    pub opened_at: Option<i64>,
+    pub threshold: i32,
+    pub window_ms: i64,
+    pub cooldown_ms: i64,
+}
+
+pub fn circuit_breaker_to_js(row: CircuitBreakerRow) -> JsCircuitBreaker {
+    let state = match row.state {
+        1 => "open",
+        2 => "half_open",
+        _ => "closed",
+    };
+    JsCircuitBreaker {
+        task_name: row.task_name,
+        state: state.to_string(),
+        failure_count: row.failure_count,
+        last_failure_at: row.last_failure_at,
+        opened_at: row.opened_at,
+        threshold: row.threshold,
+        window_ms: row.window_ms,
+        cooldown_ms: row.cooldown_ms,
+    }
+}
+
+/// One replay of a job (result blobs are omitted; ids + errors suffice).
+#[napi(object)]
+pub struct JsReplayEntry {
+    pub id: String,
+    pub original_job_id: String,
+    pub replay_job_id: String,
+    pub replayed_at: i64,
+    pub original_error: Option<String>,
+    pub replay_error: Option<String>,
+}
+
+pub fn replay_to_js(row: ReplayHistoryRow) -> JsReplayEntry {
+    JsReplayEntry {
+        id: row.id,
+        original_job_id: row.original_job_id,
+        replay_job_id: row.replay_job_id,
+        replayed_at: row.replayed_at,
+        original_error: row.original_error,
+        replay_error: row.replay_error,
+    }
+}
+
+/// A `dependency -> dependent` edge in a job DAG.
+#[napi(object)]
+pub struct JsDagEdge {
+    pub from: String,
+    pub to: String,
+}
+
+/// The dependency DAG reachable from one job.
+#[napi(object)]
+pub struct JsJobDag {
+    pub nodes: Vec<JsJob>,
+    pub edges: Vec<JsDagEdge>,
+}

crates/taskito-node/src/queue/admin.rs

@@ -6,11 +6,12 @@ use std::collections::HashMap;
 
 use napi::bindgen_prelude::{spawn_blocking, Result};
 use napi_derive::napi;
+use taskito_core::job::{now_millis, NewJob};
 use taskito_core::Storage;
 
 use super::JsQueue;
 use crate::convert::{dead_job_to_js, JsDeadJob};
-use crate::error::{join_to_napi_err, non_negative, to_napi_err};
+use crate::error::{invalid_arg, join_to_napi_err, non_negative, to_napi_err};
 
 const DEFAULT_LIMIT: i64 = 50;
 
@@ -69,6 +70,48 @@ impl JsQueue {
         .map_err(join_to_napi_err)?
     }
 
+    /// Re-enqueue a copy of an existing job and record it in the replay
+    /// history. Returns the new job id.
+    #[napi]
+    pub async fn replay_job(&self, job_id: String) -> Result<String> {
+        let storage = self.storage.clone();
+        spawn_blocking(move || {
+            let original = storage
+                .get_job(&job_id)
+                .map_err(to_napi_err)?
+                .ok_or_else(|| invalid_arg(format!("Job not found: {job_id}")))?;
+            let new_job = NewJob {
+                queue: original.queue.clone(),
+                task_name: original.task_name.clone(),
+                payload: original.payload.clone(),
+                priority: original.priority,
+                scheduled_at: now_millis(),
+                max_retries: original.max_retries,
+                timeout_ms: original.timeout_ms,
+                unique_key: None,
+                metadata: Some(format!("{{\"replayed_from\":\"{job_id}\"}}")),
+                notes: original.notes.clone(),
+                depends_on: Vec::new(),
+                expires_at: None,
+                result_ttl_ms: original.result_ttl_ms,
+                namespace: original.namespace.clone(),
+            };
+            let job = storage.enqueue(new_job).map_err(to_napi_err)?;
+            // Best-effort audit row — a history write must not fail the replay.
+            let _ = storage.record_replay(
+                &job_id,
+                &job.id,
+                original.result.as_deref(),
+                None,
+                original.error.as_deref(),
+                None,
+            );
+            Ok(job.id)
+        })
+        .await
+        .map_err(join_to_napi_err)?
+    }
+
     /// Re-enqueue a dead-letter entry. Returns the new job id.
     #[napi]
     pub fn retry_dead(&self, dead_id: String) -> Result<String> {

crates/taskito-node/src/queue/inspect.rs

@@ -2,7 +2,7 @@
 //! storage, so each is async and offloads the blocking I/O to the blocking
 //! pool instead of stalling the JS event loop for the DB round-trip.
 
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 
 use napi::bindgen_prelude::{spawn_blocking, Result};
 use napi_derive::napi;
@@ -11,8 +11,9 @@ use taskito_core::Storage;
 use super::JsQueue;
 use crate::config::JobFilter;
 use crate::convert::{
-    job_error_to_js, job_to_js, metric_to_js, stats_to_js, status_code, worker_to_js, JsJob,
-    JsJobError, JsMetric, JsStats, JsWorkerRow,
+    circuit_breaker_to_js, job_error_to_js, job_to_js, log_to_js, metric_to_js, replay_to_js,
+    stats_to_js, status_code, worker_to_js, JsCircuitBreaker, JsDagEdge, JsJob, JsJobDag,
+    JsJobError, JsMetric, JsReplayEntry, JsStats, JsTaskLog, JsWorkerRow,
 };
 use crate::error::{invalid_arg, join_to_napi_err, non_negative, to_napi_err};
 
@@ -115,6 +116,98 @@ impl JsQueue {
         .map_err(join_to_napi_err)?
     }
 
+    /// Task logs across jobs, filtered by task/level, newest first.
+    /// `since_ms` is a Unix-ms lower bound on `logged_at`.
+    #[napi]
+    pub async fn query_task_logs(
+        &self,
+        task_name: Option<String>,
+        level: Option<String>,
+        since_ms: i64,
+        limit: i64,
+    ) -> Result<Vec<JsTaskLog>> {
+        non_negative(limit, "limit")?;
+        let storage = self.storage.clone();
+        spawn_blocking(move || {
+            let rows = storage
+                .query_task_logs(task_name.as_deref(), level.as_deref(), since_ms, limit)
+                .map_err(to_napi_err)?;
+            Ok(rows.into_iter().map(log_to_js).collect())
+        })
+        .await
+        .map_err(join_to_napi_err)?
+    }
+
+    /// Circuit-breaker state for every task that has one.
+    #[napi]
+    pub async fn list_circuit_breakers(&self) -> Result<Vec<JsCircuitBreaker>> {
+        let storage = self.storage.clone();
+        spawn_blocking(move || {
+            let rows = storage.list_circuit_breakers().map_err(to_napi_err)?;
+            Ok(rows.into_iter().map(circuit_breaker_to_js).collect())
+        })
+        .await
+        .map_err(join_to_napi_err)?
+    }
+
+    /// Replays recorded for a job, newest first.
+    #[napi]
+    pub async fn get_replay_history(&self, job_id: String) -> Result<Vec<JsReplayEntry>> {
+        let storage = self.storage.clone();
+        spawn_blocking(move || {
+            let rows = storage.get_replay_history(&job_id).map_err(to_napi_err)?;
+            Ok(rows.into_iter().map(replay_to_js).collect())
+        })
+        .await
+        .map_err(join_to_napi_err)?
+    }
+
+    /// The dependency DAG reachable from `job_id`: full job rows as nodes
+    /// plus `dependency -> dependent` edges, walked in both directions.
+    #[napi]
+    pub async fn job_dag(&self, job_id: String) -> Result<JsJobDag> {
+        let storage = self.storage.clone();
+        spawn_blocking(move || {
+            let mut visited: HashSet<String> = HashSet::new();
+            // Both endpoints of an edge report it (dependencies from one
+            // side, dependents from the other) — dedupe by (from, to).
+            let mut seen_edges: HashSet<(String, String)> = HashSet::new();
+            let mut nodes = Vec::new();
+            let mut edges = Vec::new();
+            let mut pending = vec![job_id];
+            while let Some(current) = pending.pop() {
+                if !visited.insert(current.clone()) {
+                    continue;
+                }
+                let Some(job) = storage.get_job(&current).map_err(to_napi_err)? else {
+                    continue;
+                };
+                nodes.push(job_to_js(job));
+                for dep_id in storage.get_dependencies(&current).map_err(to_napi_err)? {
+                    if seen_edges.insert((dep_id.clone(), current.clone())) {
+                        edges.push(JsDagEdge {
+                            from: dep_id.clone(),
+                            to: current.clone(),
+                        });
+                    }
+                    pending.push(dep_id);
+                }
+                for dep_id in storage.get_dependents(&current).map_err(to_napi_err)? {
+                    if seen_edges.insert((current.clone(), dep_id.clone())) {
+                        edges.push(JsDagEdge {
+                            from: current.clone(),
+                            to: dep_id.clone(),
+                        });
+                    }
+                    pending.push(dep_id);
+                }
+            }
+            Ok(JsJobDag { nodes, edges })
+        })
+        .await
+        .map_err(join_to_napi_err)?
+    }
+
     /// List registered workers (heartbeat + identity).
     #[napi]
     pub async fn list_workers(&self) -> Result<Vec<JsWorkerRow>> {

sdks/node/src/cli/commands/dashboard.ts

@@ -4,20 +4,34 @@ import { serveDashboard } from "../../dashboard";
 import { connect, type GlobalOptions } from "../connect";
 import { positiveIntFlag } from "../parse";
 
+interface DashboardFlags {
+  port?: string;
+  host?: string;
+  token?: string;
+  insecureCookies?: boolean;
+}
+
 export function registerDashboard(program: Command): void {
   program
     .command("dashboard")
     .description("Serve the web dashboard")
     .option("-p, --port <n>", "port to listen on", "8787")
     .option("--host <host>", "host to bind", "127.0.0.1")
-    .action(async (options: { port?: string; host?: string }, command: Command) => {
+    .option("--token <token>", "legacy shared-token gate (disables the login flow)")
+    .option("--insecure-cookies", "drop the Secure cookie attribute for plain-HTTP dev")
+    .action(async (options: DashboardFlags, command: Command) => {
       const queue = connect(command.optsWithGlobals() as GlobalOptions);
       const host = options.host ?? "127.0.0.1";
       const port = positiveIntFlag(options.port, "port") ?? 8787;
       if (port > 65535) {
         throw new Error(`--port must be <= 65535, got ${port}`);
       }
-      const server = serveDashboard(queue, { port, host });
+      const server = serveDashboard(queue, {
+        port,
+        host,
+        auth: options.token ? { token: options.token } : undefined,
+        secureCookies: options.insecureCookies ? false : undefined,
+      });
       // Confirm the bind succeeded before reporting success (e.g. port in use).
       await Promise.race([
         once(server, "listening"),

sdks/node/src/contrib/express.ts

@@ -20,6 +20,10 @@ export type TaskitoRouterOptions = RestOptions;
 export interface TaskitoDashboardOptions {
   /** Path to the built SPA assets (defaults to the package's bundled `static/dashboard`). */
   staticDir?: string;
+  /** Legacy shared-token gate. When set, the session-auth login flow is disabled. */
+  auth?: { token: string };
+  /** Mark session cookies `Secure` (default true). Disable only for plain-HTTP dev. */
+  secureCookies?: boolean;
 }
 
 /**
@@ -70,7 +74,10 @@ export function taskitoDashboard(
   queue: Queue,
   options: TaskitoDashboardOptions = {},
 ): RequestHandler {
-  const handler = createDashboardHandler(queue, options.staticDir ?? defaultStaticDir());
+  const handler = createDashboardHandler(queue, options.staticDir ?? defaultStaticDir(), {
+    auth: options.auth,
+    secureCookies: options.secureCookies,
+  });
   return (req, res) => {
     handler(req, res);
   };

sdks/node/src/contrib/fastify.ts

@@ -22,6 +22,10 @@ export interface TaskitoDashboardPluginOptions {
   queue: Queue;
   /** Path to the built SPA assets (defaults to the package's bundled `static/dashboard`). */
   staticDir?: string;
+  /** Legacy shared-token gate. When set, the session-auth login flow is disabled. */
+  auth?: { token: string };
+  /** Mark session cookies `Secure` (default true). Disable only for plain-HTTP dev. */
+  secureCookies?: boolean;
 }
 
 /**
@@ -66,7 +70,10 @@ export const taskitoDashboardPlugin: FastifyPluginAsync<TaskitoDashboardPluginOp
   fastify,
   options,
 ) => {
-  const handler = createDashboardHandler(options.queue, options.staticDir ?? defaultStaticDir());
+  const handler = createDashboardHandler(options.queue, options.staticDir ?? defaultStaticDir(), {
+    auth: options.auth,
+    secureCookies: options.secureCookies,
+  });
   const prefix = fastify.prefix;
 
   // Leave the request body stream intact so the dashboard handler can read POST bodies.