2 Commits

Include renames

Author	SHA1	Message	Date
2GT-RichandClaude Opus 5	7b994ad935	feat(sites): one install, many networks (v0.24.0-beta) ... Closes #130. Multi-site, not multi-tenancy: a site is a named collection of devices whose clients, events, topology and dashboards are viewed separately. Sites separate what you see, not who you are — the admin/manage/read-only roles are unchanged and every user sees every site. Per-site permissions would have multiplied the work for a need nobody stated. Two measurements decided the design. Every device-derived table hangs off devices(id) — 25 of 50 tables, 35 foreign keys — so a single site_id column on devices scopes clients, events, topology, backups and the rest transitively. No other table needed one. The frontend has 162 useQuery call sites across 57 files. Threading a site through each would be a large change that leaves a permanent trap: every future query another chance to forget. The site is injected in the existing axios interceptor instead, beside the auth token, so a new query is scoped by default. Only 23 collection routes needed filtering; the 131 per-device routes are already scoped by their device. Existing installs are untouched. Migration creates one "Default Site", adopts every device into it, and a single-site install never meets the concept. An absent X-Site-Id header means unscoped, so existing API tokens and scripts behave exactly as before. Polling stays fleet-wide. Sites are a view over data already gathered, not a change to how it is gathered — a device does not stop being monitored because you are looking elsewhere. Rogue-AP detection scopes the scans but keeps the "these are ours" BSSID set fleet-wide, or your own AP in another site reads as an evil twin. Bulk actions do obey the selector: an operation that silently spanned two customers is the blast radius the wave guards exist to contain. Four rounds of defects came out of testing the UI rather than the API, and the first is the one worth recording. Switching sites called queryClient.clear(), which empties the cache and reviews as correct. It isn't: clear() destroys each query but a *mounted* observer keeps its own reference and last result, so every rendered page went on showing the previous site's data. The QueryClient is now keyed on the site, which remounts the tree against an empty cache. Three tests pin the old behaviour down so the shortcut cannot return. The others: an unscoped fallback path behind the Connected Clients chart; Config Health, TX retries and the activity feed reading fleet-wide; and site_id added to the device list query but none of the other four that build a device payload, so the Site field could not read its own value and appeared to reject every change while the writes were landing. That last one is now structural — DEVICE_BASE_COLUMNS is shared by all five, with a test that fails when a device payload is hand-rolled, and which found two further instances while being written. Frontend tests were never run by CI despite vitest being configured and six suites existing; they now run in both the workflow and ci-preflight. Verified against a live four-device fleet: the migration left every figure identical, an empty site returns zero from every read endpoint, moving a device carries its history with it, and deleting a site with devices is refused. Minor bump rather than patch: sites change the shape of the product rather than adding to it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-07 12:02:00 -07:00
2GT-RichandClaude Opus 5	e10f7ba568	docs: split reference material into docs/, keeping the README a shop window (v0.23.4-beta) ... Documentation only — no functional change. The README was carrying two jobs for two different readers. Its Reference section was the single largest block at 154 lines, and nobody deciding whether to try the project reads an InfluxDB environment variable table — while the people who need it were scrolling past the pitch to reach it. Split along that seam: anything you would read before installing stays in the README, anything you would read after installing moves to docs/. README.md 430 lines sell, prove, install, feature overview docs/change-guard.md 193 safety system, settings, guard states docs/architecture.md 116 data stores, polling model, module layout docs/capsman.md 84 role model, radio matching, current limits docs/alerting.md 81 rules, channels, webhooks, maintenance windows docs/api.md 77 scoped tokens, preflight, scripting docs/configuration.md 76 environment, secrets, rotation, TLS docs/sso-oidc.md 71 identity provider setup and behaviour docs/README.md 20 index In-repo rather than a documentation site, deliberately. A change to Change Guard's semantics can edit its documentation in the same commit as the code — which, given how often that behaviour has been refined recently, is the property that actually matters. A static site generator can point at docs/ later without moving a file. The Change Guard pitch stays on the front page: the problem framing, the verified recovery timeline and the quoted prediction warning are what make someone care, and a reference page is the wrong home for them. Three sections are new rather than relocated, written because the split exposed the gaps: - architecture.md did not exist. It now records why there are three data stores, the polling cadences, and which modules are pure functions over a snapshot and why. - Scoped API tokens shipped without usage documentation. api.md shows preflighting a change from a script and reading the guard block afterwards. - change-guard.md records why ip-on-bridge-port is informational rather than critical on RouterOS 7 — reasoning that previously existed only in a commit message. Every internal anchor and cross-file link verified to resolve, including anchors into other documents. No content dropped, checked by keyword comparison against the previous single file. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-21 12:26:18 -07:00