Add Phase 5 Svelte dashboard on Cloudflare Pages (#4)

* Add Phase 5 Svelte dashboard on Cloudflare Pages

SvelteKit 5 app in dashboard/ with SSR load functions that forward the
Cf-Access-Jwt-Assertion header server-side so the token never reaches
browser JS. uPlot sparklines on the overview cards, full trend charts
on the drill-in page with metric selector and branch input.

Cloudflare Pages build settings: root=dashboard, output=.svelte-kit/cloudflare.
Configure WORKER_URL env var in Pages dashboard before deploying.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix dashboard API redirect handling and scope wrangler config

- api.ts: add redirect:'manual' to all Worker fetch calls so that
  Cloudflare Access login redirects (302) surface as HTTP errors
  instead of silently returning HTML that breaks JSON.parse
- Add dashboard/wrangler.toml so the adapter-cloudflare dev server
  stops walking up to the root wrangler.jsonc (which was injecting
  the Worker's WORKER_URL env var into the dashboard process)
- Update .gitignore to cover .dev.vars; update .env.example to
  document both Vite (.env) and wrangler (.dev.vars) dev patterns

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Add local dev bypass for Cloudflare Access + Service Token plan

Worker:
- src/types.ts: add optional DEV_BYPASS_SECRET to Bindings
- src/middleware/access.ts: if DEV_BYPASS_SECRET is set and the request
  carries a matching X-Dev-Bypass header, skip JWT verification; the
  guard is dead code in production where the env var is never set
- .dev.vars.example: document DEV_BYPASS_SECRET with a warning

Dashboard:
- api.ts: add optional extraHeaders param to fetchProjects/fetchTrend
- +page.server.ts (both routes): read DEV_BYPASS_SECRET from env and
  pass X-Dev-Bypass when set; no-op in production
- .env.example: document both WORKER_URL and DEV_BYPASS_SECRET

Docs:
- docs/plans/service-auth-token.md: future refactor to replace bypass +
  JWT forwarding with Cloudflare Access Service Tokens

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Add local D1 seed script and mark Phase 5 as implemented

- test/seed-local.sql: inserts a test owner, project, and 15+4 metric
  data points for local development against wrangler d1 --local
- package.json: add db:seed:local script (npx wrangler d1 execute)
- docs/PROGRESS.md: update Phase 5 from "Not started" to "Implemented –
  pending Pages deployment", listing what's done vs. still outstanding

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Add dashboard CI deploy workflow via Cloudflare Pages Direct Upload

- .github/workflows/deploy-dashboard.yml: builds and deploys the
  dashboard on push to main (production) and on PRs (preview branch),
  path-filtered to dashboard/** so unrelated changes don't trigger it
- dashboard/package.json: add wrangler ^4.104.0 as devDependency so
  the workflow resolves it from node_modules after npm ci

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Document dashboard deployment in INSTALLATION.md (step 14)

Covers: Pages project creation, WORKER_URL secret, GitHub Actions
secrets, Access application, and the "run from dashboard/ dir" note
to avoid the wrangler pages_build_output_dir warning.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix INSTALLATION.md: wrangler pages warning is unavoidable, not a cd issue

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Convert dashboard/wrangler.toml to wrangler.jsonc, unignore it

The root .gitignore blanket-ignores wrangler.jsonc to protect the
Worker's secrets. Add !dashboard/wrangler.jsonc to allow the Pages
config to be committed. This suppresses the spurious "missing
pages_build_output_dir" warning on wrangler pages commands (wrangler
finds the .jsonc before walking up to the root wrangler.jsonc).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Remove stale wrangler pages warning note from INSTALLATION.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Add nodejs_compat flag to dashboard Pages config

SvelteKit uses node:async_hooks internally; without nodejs_compat the
Pages worker throws at runtime.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix deploy: remove wrangler from dashboard deps, install v4 in CI

@sveltejs/adapter-cloudflare@4.x declares a peer dep on wrangler@^3;
having wrangler@^4 in devDependencies caused an ERESOLVE conflict on
npm ci. Remove it from package.json and install wrangler@^4 globally
as a dedicated CI step before the deploy, keeping peer deps clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: tbjers

.dev.vars.example

@@ -17,3 +17,8 @@ GITHUB_WEBHOOK_SECRET=
 CF_ACCESS_AUD=
 # Your Cloudflare Access team domain, e.g. myteam.cloudflareaccess.com
 CF_ACCESS_TEAM_DOMAIN=
+
+# Local dev only — lets the dashboard bypass Access JWT verification when running locally.
+# Set the same random string in dashboard/.dev.vars (or dashboard/.env).
+# NEVER add this to wrangler.jsonc vars or set it as a wrangler secret.
+DEV_BYPASS_SECRET=

.github/workflows/deploy-dashboard.yml

@@ -0,0 +1,54 @@
+name: Deploy dashboard
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'dashboard/**'
+      - '.github/workflows/deploy-dashboard.yml'
+  pull_request:
+    paths:
+      - 'dashboard/**'
+      - '.github/workflows/deploy-dashboard.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: ${{ github.ref == 'refs/heads/main' && 'production' || 'preview' }}
+      url: ${{ steps.deploy.outputs.deployment-url }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: dashboard/package-lock.json
+
+      - name: Install dependencies
+        working-directory: dashboard
+        run: npm ci
+
+      - name: Install wrangler
+        run: npm install -g wrangler@^4
+
+      - name: Build
+        working-directory: dashboard
+        run: npm run build
+
+      - name: Deploy to Cloudflare Pages
+        id: deploy
+        working-directory: dashboard
+        run: |
+          OUTPUT=$(wrangler pages deploy \
+            ${{ github.ref != 'refs/heads/main' && format('--branch {0}', github.head_ref || github.ref_name) || '' }})
+          echo "$OUTPUT"
+          URL=$(echo "$OUTPUT" | grep -oP 'https://[^\s]+\.pages\.dev[^\s]*' | tail -1)
+          echo "deployment-url=${URL}" >> "$GITHUB_OUTPUT"
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

.gitignore

@@ -4,5 +4,6 @@ node_modules/
 .*.vars
 !.*.vars.example
 wrangler.jsonc
+!dashboard/wrangler.jsonc
 *.local
 *.pem

dashboard/.env.example

@@ -0,0 +1,14 @@
+# For local development with `npm run dev` (Vite):
+# Copy to .env
+#
+# For local development with `wrangler pages dev` (simulates Cloudflare runtime):
+# Copy to .dev.vars
+
+# URL of your deployed Worker (no trailing slash)
+WORKER_URL=https://coverage-tracker.yourdomain.com
+
+# Local dev only — must match DEV_BYPASS_SECRET in the Worker's .dev.vars.
+# With this set, the dashboard passes X-Dev-Bypass to the local Worker so it
+# skips Cloudflare Access JWT verification during local development.
+# NEVER set this in production (Cloudflare Pages environment variables).
+DEV_BYPASS_SECRET=

dashboard/.gitignore

@@ -0,0 +1,7 @@
+node_modules/
+.svelte-kit/
+build/
+.env
+.env.*
+!.env.example
+.dev.vars