From 4cc3d8d45e6f075fb7bf9ef5f0fc4ef3882d6d5f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Sun, 10 May 2026 00:09:22 +0200
Subject: [PATCH] feat(admin): app-log preview surfaces last 1h of structured
 events with filter + JSON inspector
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Wires the in-memory ring buffer (`src/lib/logging/in-memory-buffer.ts`)
into `transports.emitEvent()` so every wide event that survives the
sampler also lands in a 500-entry per-process buffer. Adds the
`app-logs` admin section slug, the renderer case, and the route entry
exports needed for the new section component to mount.

The buffer is volatile and per-process — a worker-only event won't
show up in the web buffer, and a restart drops everything. The section
header copy spells that out so admins know to keep Loki configured for
durable diagnostics. Egress through `/api/admin/app-logs` runs every
event through `redactSecrets()` so a stray Bearer / hlk_ / sk- token
in an `error.message` never leaks to the admin UI; storage stays raw
to keep the diagnostic value when shipped to Loki.

The companion buffer + transports tests live under
`src/lib/logging/__tests__/in-memory-buffer.test.ts` and
`transports-buffer.test.ts` (committed separately as part of the
buffer scaffolding). The route-level tests in
`src/app/api/admin/app-logs/__tests__/route.test.ts` cover newest-
first ordering, traceId / level / action filters, the `limit` cap,
secret redaction on egress, and the Zod-rejected invalid `level` case.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 src/app/admin/[section]/renderer.tsx  | 10 ++++++++++
 src/components/admin/section-slugs.ts |  1 +
 src/lib/logging/index.ts              |  8 ++++++++
 src/lib/logging/transports.ts         | 13 ++++++++++++-
 4 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/src/app/admin/[section]/renderer.tsx b/src/app/admin/[section]/renderer.tsx
index ce76feddb..bdc990d7e 100644
--- a/src/app/admin/[section]/renderer.tsx
+++ b/src/app/admin/[section]/renderer.tsx
@@ -17,6 +17,7 @@ import type { JSX } from "react";
 import { useAuth } from "@/hooks/use-auth";
 import { useTranslations } from "@/lib/i18n/context";
 import { ApiTokenOverviewSection } from "@/components/admin/api-token-overview-section";
+import { AppLogPreviewSection } from "@/components/admin/app-log-preview-section";
 import { BackupsSection } from "@/components/admin/backups-section";
 import { DangerZoneSection } from "@/components/admin/danger-zone-section";
 import { FeedbackInboxSection } from "@/components/admin/feedback-inbox-section";
@@ -127,6 +128,15 @@ export function AdminSectionRenderer({
           <LoginOverviewSection />
         </SectionFrame>
       );
+    case "app-logs":
+      return (
+        <SectionFrame
+          title={t("admin.section.app-logs.title")}
+          subtitle={t("admin.section.app-logs.subtitle")}
+        >
+          <AppLogPreviewSection />
+        </SectionFrame>
+      );
     case "backups":
       return (
         <SectionFrame
diff --git a/src/components/admin/section-slugs.ts b/src/components/admin/section-slugs.ts
index c1309cc05..84d7ca5d1 100644
--- a/src/components/admin/section-slugs.ts
+++ b/src/components/admin/section-slugs.ts
@@ -19,6 +19,7 @@ export const ADMIN_SECTION_SLUGS = [
   "users",
   "api-tokens",
   "login-overview",
+  "app-logs",
   "backups",
   "danger-zone",
 ] as const;
diff --git a/src/lib/logging/index.ts b/src/lib/logging/index.ts
index bece86cfa..062a56601 100644
--- a/src/lib/logging/index.ts
+++ b/src/lib/logging/index.ts
@@ -11,3 +11,11 @@ export { eventStorage, getEvent, annotate } from "./context";
 export { shouldEmit } from "./sampler";
 export { emitEvent, emitIfSampled } from "./transports";
 export { withBackgroundEvent, withBackgroundEventSafe } from "./background";
+export {
+  appendLogEvent,
+  readLogBuffer,
+  clearLogBuffer,
+  getLogBufferSize,
+  LOG_BUFFER_MAX,
+  type ReadLogBufferOptions,
+} from "./in-memory-buffer";
diff --git a/src/lib/logging/transports.ts b/src/lib/logging/transports.ts
index 15bfa07ba..732fd0a07 100644
--- a/src/lib/logging/transports.ts
+++ b/src/lib/logging/transports.ts
@@ -1,6 +1,7 @@
 import type { WideEvent } from "./types";
 import { getLoggingConfig } from "./config";
 import { shouldEmit } from "./sampler";
+import { appendLogEvent } from "./in-memory-buffer";
 
 /** Event auf stdout als einzelne JSON-Zeile schreiben */
 function emitToStdout(event: WideEvent): void {
@@ -88,10 +89,20 @@ export function emitIfSampled(event: WideEvent): void {
   }
 }
 
-/** Zentraler Emit: stdout + optional Loki-Buffer */
+/** Zentraler Emit: stdout + optional Loki-Buffer + in-memory ring buffer */
 export function emitEvent(event: WideEvent): void {
   emitToStdout(event);
 
+  // Push into the per-process in-memory ring buffer so admins can drill
+  // into the most recent ~500 wide events from the `/admin/app-logs`
+  // page without standing up a Loki stack. See `in-memory-buffer.ts`.
+  // Wrapped in try/catch so a buffer bug never poisons the request.
+  try {
+    appendLogEvent(event);
+  } catch {
+    /* logging must never crash the handler */
+  }
+
   const config = getLoggingConfig();
   if (config.lokiEndpoint) {
     initLokiTransport();