Fix dashboard module wiring and add frontend smoke/link checks

[shadow-ghost706]

Summary

Fix dashboard module wiring and add frontend smoke/link checks

What was solved

#863 — static/session.js references undefined KEY_NAME, KEY_SAVED_AT, safeGet, safeSet, safeRemove and memoryStorage

Fix static/session.js by defining the missing constants (KEY_NAME, KEY_SAVED_AT), storage helpers (safeGet/safeSet/safeRemove), and a Map-backed memoryStorage() fallback, exporting KEY_NAME for tests. Then update static/dashboard.js to import KEY_NAME/KEY_SAVED_AT from session.js instead of redeclaring them, establishing a single source of truth.

Addressed:

• Changed: static/session.js, static/session.js
• Define KEY_NAME and KEY_SAVED_AT constants in static/session.js and export KEY_NAME as static/tests/session.test.js expects
• Implement safeGet/safeSet/safeRemove helpers with try/catch around getItem/setItem/removeItem
• Implement a tiny Map-backed memoryStorage() fallback used when opts.session/opts.local is absent

#864 — static/session.js contains two competing API-key storage designs — pick one and delete the other

Remove the dead in-memory API-key storage (getStoredKey/storeKey/storedKey/storedKeyExpiresAt) from static/session.js so the module exports exactly one storage mechanism — the existing createSessionStore (sessionStorage by default, localStorage only with explicit "remember me" plus TTL). Update the README dashboard security section to state the storage policy (where, how long, how to clear), and align the no-key-leak.spec.js e2e test with that policy (nothing in localStorage without "remember me").

Addressed:

• Changed: e2e/tests/no-key-leak.spec.js
• static/session.js must export exactly one storage mechanism: keep createSessionStore and delete the unused module-level in-memory getStoredKey/storeKey implementation (and its storedKey/storedKeyExpiresAt state).
• Do not change createSessionStore's behaviour (sessionStorage default, localStorage only with remember-me, saved-at timestamp, expiry on read) — it is the chosen design and is used by dashboard.js.
• README dashboard security section must plainly describe where the key is stored, for how long, and how to clear it.

#865 — Orphaned dashboard modules: static/api.js, static/dom.js and static/dashboard-format.js are never served or imported

Adopt the orphaned static/api.js and static/dom.js modules by serving them from src/api/mod.rs (include_str! + routes), importing them from dashboard.js in place of the inline el()/setText helpers and inline fetch wrapper, and delete the unused static/dashboard-format.js shim. Add an asset test in tests/dashboard_asset_tests.rs enforcing that every static/*.js (excluding static/tests/) is served, so orphans can't accumulate again.

Addressed:

• Changed: README.md
• Serve static/api.js and static/dom.js via include_str! plus routes in src/api/mod.rs, matching the existing pattern used for other static modules
• Have static/dashboard.js import request/API helpers from api.js and $/el/show/clear/setError from dom.js, removing the inline duplicate helpers and inline fetch wrapper
• Delete static/dashboard-format.js (shim with no consumer)

#866 — Dashboard CI can't catch a page that fails to load — add a browser smoke test that doesn't depend on the Rust build

Add a Rust-independent dashboard browser smoke test plus a static module-graph link check so CI catches frontend breakage (missing exports, undefined identifiers) even when the Rust build is broken. The smoke test serves static/ with the gateway path layout, stubs /v1/* with fixtures, loads /dashboard in Chromium, fails on any pageerror/console.error, signs in with a fixture key, and asserts the payments table renders a row. A separate no-browser script parses import { … } from './x.js' across static/ and verifies names against each module's exports.

Addressed:

• Changed: .github/workflows/dashboard.yml, e2e/scripts/serve.mjs, e2e/tests/dashboard.spec.js, scripts/check-dashboard-a11y.mjs
• Add a fast CI job that does not install Rust or run cargo
• Serve static/ with the gateway path layout (/dashboard/app.js → static/dashboard.js) via a small Node static server, extending e2e/scripts/serve.mjs if suitable
• Stub /v1/* using e2e/fixtures/

Changes

• README.md (modify)
• e2e/tests/dashboard.spec.js (modify)
• static/session.js (modify)
• .github/workflows/dashboard.yml (modify)
• scripts/check-dashboard-a11y.mjs (modify)
• e2e/tests/no-key-leak.spec.js (modify)
• e2e/scripts/serve.mjs (modify)

Approach

1. static/session.js references undefined KEY_NAME, KEY_SAVED_AT, safeGet, safeSet, safeRemove and memoryStorage #863 — static/session.js references undefined KEY_NAME, KEY_SAVED_AT, safeGet, safeSet, safeRemove and memoryStorage (Changed: static/session.js, static/session.js)
2. static/session.js contains two competing API-key storage designs — pick one and delete the other #864 — static/session.js contains two competing API-key storage designs — pick one and delete the other (Changed: e2e/tests/no-key-leak.spec.js)
3. Orphaned dashboard modules: static/api.js, static/dom.js and static/dashboard-format.js are never served or imported #865 — Orphaned dashboard modules: static/api.js, static/dom.js and static/dashboard-format.js are never served or imported (Changed: README.md)
4. Dashboard CI can't catch a page that fails to load — add a browser smoke test that doesn't depend on the Rust build #866 — Dashboard CI can't catch a page that fails to load — add a browser smoke test that doesn't depend on the Rust build (Changed: .github/workflows/dashboard.yml, e2e/scripts/serve.mjs, e2e/tests/dashboard.spec.js, scripts/check-dashboard-a11y.mjs)

Issues

Closes #863
Closes #864
Closes #865
Closes #866

[drips-wave]

@shadow-ghost706 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits