From c0e8faa30783ae154dc5b23079255ed87905388d Mon Sep 17 00:00:00 2001
From: Polliog <polliogiuseppe@live.it>
Date: Sat, 20 Jun 2026 21:34:03 +0200
Subject: [PATCH 01/10] gitignore frontend bug-hunt reports

---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index 10eb9c2e..f0408e28 100644
--- a/.gitignore
+++ b/.gitignore
@@ -56,3 +56,5 @@ claude.md
 /test-vector/
 /.env.prod
 /docs/superpowers/
+/FRONTEND-BUGS.md
+/BUGS.md

From 9fb2a9a1ce34009fa5e1dfab0f65eedb1938031f Mon Sep 17 00:00:00 2001
From: Polliog <polliogiuseppe@live.it>
Date: Sat, 20 Jun 2026 21:34:03 +0200
Subject: [PATCH 02/10] fix frontend api/store error handling, races and leaks

---
 packages/frontend/src/lib/api/admin.ts        | 10 +++---
 packages/frontend/src/lib/api/auth.ts         | 36 ++++++++++++++-----
 packages/frontend/src/lib/api/exceptions.ts   | 32 ++++++++---------
 packages/frontend/src/lib/stores/auth.ts      | 33 ++++++++++++++---
 .../src/lib/stores/custom-dashboards.ts       | 15 ++++++++
 .../frontend/src/lib/stores/monitoring.ts     |  9 +++++
 .../src/lib/stores/notification-channels.ts   |  5 +--
 packages/frontend/src/lib/utils/siem.ts       |  4 +--
 8 files changed, 105 insertions(+), 39 deletions(-)

diff --git a/packages/frontend/src/lib/api/admin.ts b/packages/frontend/src/lib/api/admin.ts
index b341681a..75880776 100644
--- a/packages/frontend/src/lib/api/admin.ts
+++ b/packages/frontend/src/lib/api/admin.ts
@@ -439,7 +439,7 @@ class AdminAPI {
         }
 
         if (!response.ok) {
-            const error = await response.json();
+            const error = await response.json().catch(() => ({}));
             throw new Error(error.message || 'API request failed');
         }
 
@@ -594,7 +594,7 @@ class AdminAPI {
         });
 
         if (!response.ok) {
-            const error = await response.json();
+            const error = await response.json().catch(() => ({}));
             throw new Error(error.error || 'Failed to update user role');
         }
 
@@ -691,7 +691,7 @@ class AdminAPI {
         });
 
         if (!response.ok) {
-            const error = await response.json();
+            const error = await response.json().catch(() => ({}));
             throw new Error(error.error || 'Failed to update retention policy');
         }
 
@@ -720,7 +720,7 @@ class AdminAPI {
         });
 
         if (!response.ok) {
-            const error = await response.json();
+            const error = await response.json().catch(() => ({}));
             throw new Error(error.error || 'Failed to update entitlements');
         }
 
@@ -795,7 +795,7 @@ class AdminAPI {
         });
 
         if (!response.ok) {
-            const error = await response.json();
+            const error = await response.json().catch(() => ({}));
             throw new Error(error.error || 'Failed to update settings');
         }
 
diff --git a/packages/frontend/src/lib/api/auth.ts b/packages/frontend/src/lib/api/auth.ts
index bdb075fa..3a016b41 100644
--- a/packages/frontend/src/lib/api/auth.ts
+++ b/packages/frontend/src/lib/api/auth.ts
@@ -63,7 +63,9 @@ export class AuthAPI {
     });
 
     if (!response.ok) {
-      const error: ErrorResponse = await response.json();
+      const error: ErrorResponse = await response
+        .json()
+        .catch(() => ({ error: response.statusText }));
       throw new Error(error.error || 'Registration failed');
     }
 
@@ -80,7 +82,9 @@ export class AuthAPI {
     });
 
     if (!response.ok) {
-      const error: ErrorResponse = await response.json();
+      const error: ErrorResponse = await response
+        .json()
+        .catch(() => ({ error: response.statusText }));
       throw new Error(error.error || 'Login failed');
     }
 
@@ -98,7 +102,9 @@ export class AuthAPI {
     });
 
     if (!response.ok) {
-      const error: ErrorResponse = await response.json();
+      const error: ErrorResponse = await response
+        .json()
+        .catch(() => ({ error: response.statusText }));
       throw new Error(error.error || 'Logout failed');
     }
   }
@@ -114,7 +120,9 @@ export class AuthAPI {
     });
 
     if (!response.ok) {
-      const error: ErrorResponse = await response.json();
+      const error: ErrorResponse = await response
+        .json()
+        .catch(() => ({ error: response.statusText }));
       throw new Error(error.error || 'Failed to get user info');
     }
 
@@ -145,7 +153,9 @@ export class AuthAPI {
     const response = await fetch(`${getApiBaseUrl()}/auth/providers`);
 
     if (!response.ok) {
-      const error: ErrorResponse = await response.json();
+      const error: ErrorResponse = await response
+        .json()
+        .catch(() => ({ error: response.statusText }));
       throw new Error(error.error || 'Failed to get auth providers');
     }
 
@@ -166,7 +176,9 @@ export class AuthAPI {
     );
 
     if (!response.ok) {
-      const error: ErrorResponse = await response.json();
+      const error: ErrorResponse = await response
+        .json()
+        .catch(() => ({ error: response.statusText }));
       throw new Error(error.error || 'Failed to get authorization URL');
     }
 
@@ -187,7 +199,9 @@ export class AuthAPI {
     });
 
     if (!response.ok) {
-      const error: ErrorResponse = await response.json();
+      const error: ErrorResponse = await response
+        .json()
+        .catch(() => ({ error: response.statusText }));
       throw new Error(error.error || 'Login failed');
     }
 
@@ -202,7 +216,9 @@ export class AuthAPI {
     });
 
     if (!response.ok) {
-      const error: ErrorResponse = await response.json();
+      const error: ErrorResponse = await response
+        .json()
+        .catch(() => ({ error: response.statusText }));
       throw new Error(error.error || 'Failed to get identities');
     }
 
@@ -218,7 +234,9 @@ export class AuthAPI {
     });
 
     if (!response.ok) {
-      const error: ErrorResponse = await response.json();
+      const error: ErrorResponse = await response
+        .json()
+        .catch(() => ({ error: response.statusText }));
       throw new Error(error.error || 'Failed to unlink identity');
     }
   }
diff --git a/packages/frontend/src/lib/api/exceptions.ts b/packages/frontend/src/lib/api/exceptions.ts
index 9f605d15..b1065380 100644
--- a/packages/frontend/src/lib/api/exceptions.ts
+++ b/packages/frontend/src/lib/api/exceptions.ts
@@ -50,8 +50,8 @@ export async function getExceptionByLogId(
   }
 
   if (!response.ok) {
-    const error = await response.json();
-    throw new Error(error.error || 'Failed to get exception');
+    const error = await response.json().catch(() => ({}));
+    throw new Error(error.error || `Failed to get exception (HTTP ${response.status})`);
   }
 
   return response.json();
@@ -75,8 +75,8 @@ export async function getExceptionById(
   }
 
   if (!response.ok) {
-    const error = await response.json();
-    throw new Error(error.error || 'Failed to get exception');
+    const error = await response.json().catch(() => ({}));
+    throw new Error(error.error || `Failed to get exception (HTTP ${response.status})`);
   }
 
   return response.json();
@@ -116,8 +116,8 @@ export async function getErrorGroups(
   });
 
   if (!response.ok) {
-    const error = await response.json();
-    throw new Error(error.error || 'Failed to get error groups');
+    const error = await response.json().catch(() => ({}));
+    throw new Error(error.error || `Failed to get error groups (HTTP ${response.status})`);
   }
 
   return response.json();
@@ -147,8 +147,8 @@ export async function getTopErrorGroups(params: {
   });
 
   if (!response.ok) {
-    const error = await response.json();
-    throw new Error(error.error || 'Failed to get top error groups');
+    const error = await response.json().catch(() => ({}));
+    throw new Error(error.error || `Failed to get top error groups (HTTP ${response.status})`);
   }
 
   return response.json();
@@ -172,8 +172,8 @@ export async function getErrorGroupById(
   }
 
   if (!response.ok) {
-    const error = await response.json();
-    throw new Error(error.error || 'Failed to get error group');
+    const error = await response.json().catch(() => ({}));
+    throw new Error(error.error || `Failed to get error group (HTTP ${response.status})`);
   }
 
   return response.json();
@@ -196,8 +196,8 @@ export async function updateErrorGroupStatus(
   });
 
   if (!response.ok) {
-    const error = await response.json();
-    throw new Error(error.error || 'Failed to update error group status');
+    const error = await response.json().catch(() => ({}));
+    throw new Error(error.error || `Failed to update error group status (HTTP ${response.status})`);
   }
 
   return response.json();
@@ -231,8 +231,8 @@ export async function getErrorGroupTrend(params: {
   );
 
   if (!response.ok) {
-    const error = await response.json();
-    throw new Error(error.error || 'Failed to get error group trend');
+    const error = await response.json().catch(() => ({}));
+    throw new Error(error.error || `Failed to get error group trend (HTTP ${response.status})`);
   }
 
   return response.json();
@@ -266,8 +266,8 @@ export async function getErrorGroupLogs(params: {
   );
 
   if (!response.ok) {
-    const error = await response.json();
-    throw new Error(error.error || 'Failed to get error group logs');
+    const error = await response.json().catch(() => ({}));
+    throw new Error(error.error || `Failed to get error group logs (HTTP ${response.status})`);
   }
 
   return response.json();
diff --git a/packages/frontend/src/lib/stores/auth.ts b/packages/frontend/src/lib/stores/auth.ts
index 88fa168c..e4772aef 100644
--- a/packages/frontend/src/lib/stores/auth.ts
+++ b/packages/frontend/src/lib/stores/auth.ts
@@ -19,17 +19,40 @@ export interface AuthState {
 
 const STORAGE_KEY = 'logtide_auth';
 
+function isValidStoredAuth(data: unknown): data is { user: User; token: string } {
+  if (typeof data !== 'object' || data === null) {
+    return false;
+  }
+  const candidate = data as { user?: unknown; token?: unknown };
+  if (typeof candidate.token !== 'string') {
+    return false;
+  }
+  const user = candidate.user;
+  if (typeof user !== 'object' || user === null) {
+    return false;
+  }
+  const u = user as { id?: unknown; email?: unknown; name?: unknown };
+  return (
+    typeof u.id === 'string' &&
+    typeof u.email === 'string' &&
+    typeof u.name === 'string'
+  );
+}
+
 function loadInitialState(): AuthState {
   if (browser) {
     try {
       const stored = localStorage.getItem(STORAGE_KEY);
       if (stored) {
         const data = JSON.parse(stored);
-        return {
-          user: data.user,
-          token: data.token,
-          loading: false,
-        };
+        if (isValidStoredAuth(data)) {
+          return {
+            user: data.user,
+            token: data.token,
+            loading: false,
+          };
+        }
+        localStorage.removeItem(STORAGE_KEY);
       }
     } catch (e) {
       console.error('Failed to load auth state:', e);
diff --git a/packages/frontend/src/lib/stores/custom-dashboards.ts b/packages/frontend/src/lib/stores/custom-dashboards.ts
index 1c0ee28d..1d8cf0c6 100644
--- a/packages/frontend/src/lib/stores/custom-dashboards.ts
+++ b/packages/frontend/src/lib/stores/custom-dashboards.ts
@@ -64,6 +64,10 @@ const initialState: DashboardStoreState = {
 function createDashboardStore() {
   const { subscribe, set, update } = writable<DashboardStoreState>(initialState);
 
+  // Monotonic guard so a stale in-flight fetch cannot write into a
+  // dashboard that has since been switched away from.
+  let panelFetchSeq = 0;
+
   function getState(): DashboardStoreState {
     return get({ subscribe });
   }
@@ -175,6 +179,9 @@ function createDashboardStore() {
       const dashboard = state.activeDashboard;
       if (!dashboard || dashboard.panels.length === 0) return;
 
+      const fetchSeq = ++panelFetchSeq;
+      const fetchedDashboardId = dashboard.id;
+
       // Mark all panels as loading
       update((s) => {
         const next: Record<string, PanelDataEntry> = { ...s.panelData };
@@ -196,6 +203,11 @@ function createDashboardStore() {
         );
         const now = Date.now();
         update((s) => {
+          // Ignore the response if a newer fetch started or the active
+          // dashboard changed while this request was in flight.
+          if (fetchSeq !== panelFetchSeq || s.activeDashboard?.id !== fetchedDashboardId) {
+            return s;
+          }
           const next: Record<string, PanelDataEntry> = { ...s.panelData };
           for (const [panelId, entry] of Object.entries(result.panels)) {
             next[panelId] = {
@@ -210,6 +222,9 @@ function createDashboardStore() {
       } catch (e) {
         const message = e instanceof Error ? e.message : 'Failed to load panel data';
         update((s) => {
+          if (fetchSeq !== panelFetchSeq || s.activeDashboard?.id !== fetchedDashboardId) {
+            return s;
+          }
           const next: Record<string, PanelDataEntry> = { ...s.panelData };
           for (const p of dashboard.panels) {
             next[p.id] = {
diff --git a/packages/frontend/src/lib/stores/monitoring.ts b/packages/frontend/src/lib/stores/monitoring.ts
index e1f4f6ff..7da77195 100644
--- a/packages/frontend/src/lib/stores/monitoring.ts
+++ b/packages/frontend/src/lib/stores/monitoring.ts
@@ -39,15 +39,21 @@ const initialState: MonitoringState = {
 function createMonitoringStore() {
   const { subscribe, set, update } = writable<MonitoringState>(initialState);
 
+  let loadSeq = 0;
+  let detailSeq = 0;
+
   return {
     subscribe,
 
     async load(organizationId: string, projectId?: string): Promise<void> {
+      const seq = ++loadSeq;
       update((s) => ({ ...s, loading: true, error: null }));
       try {
         const { monitors } = await listMonitors(organizationId, projectId);
+        if (seq !== loadSeq) return;
         update((s) => ({ ...s, monitors, loading: false }));
       } catch (err) {
+        if (seq !== loadSeq) return;
         update((s) => ({
           ...s,
           loading: false,
@@ -57,6 +63,7 @@ function createMonitoringStore() {
     },
 
     async loadDetail(id: string, organizationId: string): Promise<void> {
+      const seq = ++detailSeq;
       update((s) => ({ ...s, detailLoading: true, detailError: null }));
       try {
         const [monitorRes, resultsRes, uptimeRes] = await Promise.all([
@@ -64,6 +71,7 @@ function createMonitoringStore() {
           getMonitorResults(id, organizationId, 100),
           getMonitorUptime(id, organizationId, 90),
         ]);
+        if (seq !== detailSeq) return;
         update((s) => ({
           ...s,
           selectedMonitor: monitorRes.monitor,
@@ -72,6 +80,7 @@ function createMonitoringStore() {
           detailLoading: false,
         }));
       } catch (err) {
+        if (seq !== detailSeq) return;
         update((s) => ({
           ...s,
           detailLoading: false,
diff --git a/packages/frontend/src/lib/stores/notification-channels.ts b/packages/frontend/src/lib/stores/notification-channels.ts
index 80c2837c..2cd91cca 100644
--- a/packages/frontend/src/lib/stores/notification-channels.ts
+++ b/packages/frontend/src/lib/stores/notification-channels.ts
@@ -109,9 +109,10 @@ function createNotificationChannelsStore() {
 
       try {
         const defaults = await notificationChannelsAPI.getDefaults(organizationId);
-        update((s) => ({ ...s, defaults, defaultsLoading: false }));
+        update((s) => ({ ...s, defaults, defaultsLoading: false, error: null }));
       } catch (error) {
-        update((s) => ({ ...s, defaultsLoading: false }));
+        const errorMessage = error instanceof Error ? error.message : 'Failed to load defaults';
+        update((s) => ({ ...s, defaultsLoading: false, error: errorMessage }));
       }
     },
 
diff --git a/packages/frontend/src/lib/utils/siem.ts b/packages/frontend/src/lib/utils/siem.ts
index 0ffd8f95..f6a2127f 100644
--- a/packages/frontend/src/lib/utils/siem.ts
+++ b/packages/frontend/src/lib/utils/siem.ts
@@ -15,7 +15,7 @@ export function getStatusLabel(status: string): string {
 
 export function formatDate(dateStr: string): string {
   const date = new Date(dateStr);
-  return date.toLocaleDateString(undefined, {
+  return date.toLocaleDateString('en-US', {
     year: 'numeric',
     month: 'long',
     day: 'numeric',
@@ -26,7 +26,7 @@ export function formatDate(dateStr: string): string {
 
 export function formatShortDate(dateStr: string): string {
   const date = new Date(dateStr);
-  return date.toLocaleDateString(undefined, {
+  return date.toLocaleDateString('en-US', {
     month: 'short',
     day: 'numeric',
     hour: '2-digit',

From a2c6d092a4c52c722bc7867e3f1111cc769b8e3b Mon Sep 17 00:00:00 2001
From: Polliog <polliogiuseppe@live.it>
Date: Sat, 20 Jun 2026 21:34:03 +0200
Subject: [PATCH 03/10] fix frontend component bugs from bug hunt

---
 .../src/lib/components/AppLayout.svelte       | 12 ++++--
 .../lib/components/CreateApiKeyDialog.svelte  |  5 ++-
 .../src/lib/components/SigmaSyncDialog.svelte |  7 ++--
 .../lib/components/alerts/AlertPreview.svelte |  9 ++++-
 .../DashboardContainer.svelte                 | 16 +++++---
 .../exceptions/ExceptionDetailsDialog.svelte  | 11 +++++-
 .../notification-channels/ChannelsList.svelte | 17 ++-------
 .../CreateChannelDialog.svelte                | 37 +++++++++++++++----
 .../siem/dashboard/MitreHeatmap.svelte        | 29 +++++++++------
 .../siem/dashboard/SeverityPieChart.svelte    |  6 ++-
 .../lib/components/ui/sonner/sonner.svelte    |  4 +-
 11 files changed, 100 insertions(+), 53 deletions(-)

diff --git a/packages/frontend/src/lib/components/AppLayout.svelte b/packages/frontend/src/lib/components/AppLayout.svelte
index 5ce5e5af..8fbf43b0 100644
--- a/packages/frontend/src/lib/components/AppLayout.svelte
+++ b/packages/frontend/src/lib/components/AppLayout.svelte
@@ -296,15 +296,21 @@
     shortcutsStore.install();
 
     // First-time hint toast
+    let hintTimer: ReturnType<typeof setTimeout> | null = null;
     if (!shortcutsStore.hasShownHint()) {
       const mod = getPlatform().modSymbol;
-      setTimeout(() => {
+      // Mark as shown immediately so a fast unmount before the toast fires
+      // does not cause the hint to reappear on the next mount.
+      shortcutsStore.markHintShown();
+      hintTimer = setTimeout(() => {
         toastStore.info(`Pro tip: Press ${mod}+K to open command palette, or ? for shortcuts`, 8000);
-        shortcutsStore.markHintShown();
       }, 3000);
     }
 
-    return () => shortcutsStore.uninstall();
+    return () => {
+      if (hintTimer) clearTimeout(hintTimer);
+      shortcutsStore.uninstall();
+    };
   });
 </script>
 
diff --git a/packages/frontend/src/lib/components/CreateApiKeyDialog.svelte b/packages/frontend/src/lib/components/CreateApiKeyDialog.svelte
index 0fec9e51..d4874a41 100644
--- a/packages/frontend/src/lib/components/CreateApiKeyDialog.svelte
+++ b/packages/frontend/src/lib/components/CreateApiKeyDialog.svelte
@@ -37,8 +37,9 @@
 
   let dsn = $derived.by(() => {
     if (!generatedApiKey) return '';
-    const host = apiUrlValue.replace('https://', '').replace('http://', '');
-    return `https://${generatedApiKey}@${host}`;
+    const scheme = apiUrlValue.startsWith('http://') ? 'http' : 'https';
+    const host = apiUrlValue.replace(/^https?:\/\//, '');
+    return `${scheme}://${generatedApiKey}@${host}`;
   });
 
   function parseOrigins(raw: string): string[] | null {
diff --git a/packages/frontend/src/lib/components/SigmaSyncDialog.svelte b/packages/frontend/src/lib/components/SigmaSyncDialog.svelte
index aeb5f8a6..0d4041b6 100644
--- a/packages/frontend/src/lib/components/SigmaSyncDialog.svelte
+++ b/packages/frontend/src/lib/components/SigmaSyncDialog.svelte
@@ -188,10 +188,9 @@
                             </h3>
                             <p class="text-sm text-muted-foreground">
                                 Commit: <span class="font-mono text-xs"
-                                    >{syncResult.commitHash.substring(
-                                        0,
-                                        7,
-                                    )}</span
+                                    >{syncResult.commitHash
+                                        ? syncResult.commitHash.substring(0, 7)
+                                        : "-"}</span
                                 >
                             </p>
                         </div>
diff --git a/packages/frontend/src/lib/components/alerts/AlertPreview.svelte b/packages/frontend/src/lib/components/alerts/AlertPreview.svelte
index cca52a64..14d11e90 100644
--- a/packages/frontend/src/lib/components/alerts/AlertPreview.svelte
+++ b/packages/frontend/src/lib/components/alerts/AlertPreview.svelte
@@ -56,7 +56,10 @@
 
 	const timeRangeOptions: PreviewRange[] = ["1d", "7d", "14d", "30d"];
 
+	let loadSeq = 0;
+
 	async function loadPreview() {
+		const requestId = ++loadSeq;
 		loading = true;
 		error = null;
 
@@ -71,12 +74,16 @@
 				previewRange: timeRange,
 			});
 
+			if (requestId !== loadSeq) return;
 			data = response.preview;
 		} catch (e) {
+			if (requestId !== loadSeq) return;
 			error = e instanceof Error ? e.message : "Failed to load preview";
 			toastStore.error(error);
 		} finally {
-			loading = false;
+			if (requestId === loadSeq) {
+				loading = false;
+			}
 		}
 	}
 
diff --git a/packages/frontend/src/lib/components/custom-dashboards/DashboardContainer.svelte b/packages/frontend/src/lib/components/custom-dashboards/DashboardContainer.svelte
index cff4022a..3bf56a59 100644
--- a/packages/frontend/src/lib/components/custom-dashboards/DashboardContainer.svelte
+++ b/packages/frontend/src/lib/components/custom-dashboards/DashboardContainer.svelte
@@ -131,11 +131,17 @@
     const colW = colWidthPx();
     const rowStride = ROW_HEIGHT_PX + ROW_GAP_PX;
 
-    // Convert pixel delta into "stored" 12-col units regardless of viewport.
-    // This way resizing on a tablet (6 visible cols) still updates the
-    // logical width in the canonical 12-col reference space.
-    const visibleDeltaCols = Math.round(dx / (colW + COL_GAP_PX));
-    const storedDeltaCols = Math.round((visibleDeltaCols / effectiveCols) * 12);
+    // Width resize only makes sense on the canonical 12-col desktop grid.
+    // Below 12 effective columns the visible->stored conversion snaps the
+    // logical width by whole rows (a single visible column maps to 12/effectiveCols
+    // stored units), which makes resizing erratic and unusable on tablet/mobile.
+    // In those breakpoints we keep the stored width unchanged and allow only
+    // height resizing.
+    let storedDeltaCols = 0;
+    if (effectiveCols >= 12) {
+      const visibleDeltaCols = Math.round(dx / (colW + COL_GAP_PX));
+      storedDeltaCols = visibleDeltaCols;
+    }
     const deltaRows = Math.round(dy / rowStride);
 
     const newW = Math.min(12, Math.max(resizeState.minW, resizeState.startW + storedDeltaCols));
diff --git a/packages/frontend/src/lib/components/exceptions/ExceptionDetailsDialog.svelte b/packages/frontend/src/lib/components/exceptions/ExceptionDetailsDialog.svelte
index e14ba261..db519286 100644
--- a/packages/frontend/src/lib/components/exceptions/ExceptionDetailsDialog.svelte
+++ b/packages/frontend/src/lib/components/exceptions/ExceptionDetailsDialog.svelte
@@ -93,8 +93,15 @@
 
 	function viewErrorGroup() {
 		if (exception) {
-			// Navigate to error group page
-			goto(`/dashboard/errors?fingerprint=${exception.exception.fingerprint}&organizationId=${organizationId}`);
+			// Navigate to the error groups list filtered to this exception.
+			// The list page reads the `search` param (ILIKE on exception type/message);
+			// it does not read a `fingerprint` param, so use the exception type as the
+			// search term to land on the matching group.
+			const params = new URLSearchParams({
+				organizationId,
+				search: exception.exception.exceptionType,
+			});
+			goto(`/dashboard/errors?${params.toString()}`);
 			onClose();
 		}
 	}
diff --git a/packages/frontend/src/lib/components/notification-channels/ChannelsList.svelte b/packages/frontend/src/lib/components/notification-channels/ChannelsList.svelte
index b0533fff..88614f12 100644
--- a/packages/frontend/src/lib/components/notification-channels/ChannelsList.svelte
+++ b/packages/frontend/src/lib/components/notification-channels/ChannelsList.svelte
@@ -42,18 +42,9 @@
 	import TestTube from '@lucide/svelte/icons/test-tube';
 	import Bell from '@lucide/svelte/icons/bell';
 
-	let channels = $state<NotificationChannel[]>([]);
-	let loading = $state(false);
-
-	let currentOrg = $state<{ id: string } | null>(null);
-	organizationStore.subscribe((state) => {
-		currentOrg = state.currentOrganization;
-	});
-
-	notificationChannelsStore.subscribe((state) => {
-		channels = state.channels;
-		loading = state.loading;
-	});
+	let currentOrg = $derived($organizationStore.currentOrganization);
+	let channels = $derived($notificationChannelsStore.channels);
+	let loading = $derived($notificationChannelsStore.loading);
 
 	// Load channels when org changes
 	$effect(() => {
@@ -119,7 +110,7 @@
 	}
 
 	function formatDate(dateStr: string): string {
-		return new Date(dateStr).toLocaleDateString();
+		return new Date(dateStr).toLocaleDateString('en-US');
 	}
 
 	function getConfigSummary(channel: NotificationChannel): string {
diff --git a/packages/frontend/src/lib/components/notification-channels/CreateChannelDialog.svelte b/packages/frontend/src/lib/components/notification-channels/CreateChannelDialog.svelte
index fe862a9f..701dc07d 100644
--- a/packages/frontend/src/lib/components/notification-channels/CreateChannelDialog.svelte
+++ b/packages/frontend/src/lib/components/notification-channels/CreateChannelDialog.svelte
@@ -59,6 +59,10 @@
 	let webhookAuthToken = $state('');
 	let webhookAuthUser = $state('');
 	let webhookAuthPass = $state('');
+	// Whether the channel being edited already has a stored secret. Secrets are
+	// never sent back to the client, so on edit we keep the secret fields empty
+	// and only submit a new value when the user types one.
+	let hasStoredAuthSecret = $state(false);
 
 	const isEditing = $derived(!!channel);
 
@@ -74,6 +78,7 @@
 		webhookAuthToken = '';
 		webhookAuthUser = '';
 		webhookAuthPass = '';
+		hasStoredAuthSecret = false;
 		testResult = null;
 	}
 
@@ -90,15 +95,21 @@
 			webhookUrl = config.url;
 			webhookMethod = config.method === 'PUT' ? 'PUT' : 'POST';
 			webhookHeaders = config.headers ? JSON.stringify(config.headers, null, 2) : '';
+			// Never re-hydrate stored secrets into the DOM. Track that a secret
+			// exists so we can show a placeholder, and leave the secret fields
+			// empty; a blank value on submit means "keep the existing secret".
 			if (config.auth?.type === 'bearer') {
 				webhookAuthType = 'bearer';
-				webhookAuthToken = config.auth.token;
+				webhookAuthToken = '';
+				hasStoredAuthSecret = true;
 			} else if (config.auth?.type === 'basic') {
 				webhookAuthType = 'basic';
 				webhookAuthUser = config.auth.username;
-				webhookAuthPass = config.auth.password;
+				webhookAuthPass = '';
+				hasStoredAuthSecret = true;
 			} else {
 				webhookAuthType = 'none';
+				hasStoredAuthSecret = false;
 			}
 		}
 	}
@@ -132,14 +143,24 @@
 				}
 			}
 
-			if (webhookAuthType === 'bearer' && webhookAuthToken) {
-				config.auth = { type: 'bearer', token: webhookAuthToken };
+			if (webhookAuthType === 'bearer') {
+				// Only send a token when the user typed a new one. On edit, a
+				// blank field means "keep the existing secret" (the stored secret
+				// is never sent to the client), so we omit auth and let the
+				// backend preserve it.
+				if (webhookAuthToken) {
+					config.auth = { type: 'bearer', token: webhookAuthToken };
+				}
 			} else if (webhookAuthType === 'basic' && webhookAuthUser) {
-				config.auth = {
+				const basicAuth: { type: 'basic'; username: string; password?: string } = {
 					type: 'basic',
 					username: webhookAuthUser,
-					password: webhookAuthPass,
 				};
+				// Same rule for the password: only send a new one when typed.
+				if (webhookAuthPass) {
+					basicAuth.password = webhookAuthPass;
+				}
+				config.auth = basicAuth;
 			}
 
 			return config;
@@ -412,7 +433,7 @@
 							<Input
 								id="webhook-token"
 								type="password"
-								placeholder="Enter token"
+								placeholder={hasStoredAuthSecret ? 'Leave blank to keep current token' : 'Enter token'}
 								bind:value={webhookAuthToken}
 								disabled={submitting}
 							/>
@@ -436,7 +457,7 @@
 								<Input
 									id="webhook-pass"
 									type="password"
-									placeholder="Password"
+									placeholder={hasStoredAuthSecret ? 'Leave blank to keep current password' : 'Password'}
 									bind:value={webhookAuthPass}
 									disabled={submitting}
 								/>
diff --git a/packages/frontend/src/lib/components/siem/dashboard/MitreHeatmap.svelte b/packages/frontend/src/lib/components/siem/dashboard/MitreHeatmap.svelte
index 7ea2a848..e5f6ce3a 100644
--- a/packages/frontend/src/lib/components/siem/dashboard/MitreHeatmap.svelte
+++ b/packages/frontend/src/lib/components/siem/dashboard/MitreHeatmap.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { onMount } from 'svelte';
 	import * as echarts from 'echarts';
 	import { Card, CardContent, CardHeader, CardTitle } from '$lib/components/ui/card';
 	import type { MitreHeatmapCell } from '$lib/api/siem';
@@ -64,8 +63,12 @@
 		return technique;
 	}
 
-	onMount(() => {
-		if (!chartContainer) return;
+	// Initialize the chart once the container element is available. The container
+	// is always rendered (the empty state is an overlay), so this runs even when
+	// data arrives after mount.
+	$effect(() => {
+		if (!chartContainer || chart) return;
+
 		chart = echarts.init(chartContainer);
 		updateChart();
 
@@ -83,6 +86,7 @@
 			resizeObserver.disconnect();
 			unsubscribe();
 			chart?.dispose();
+			chart = null;
 		};
 	});
 
@@ -228,13 +232,16 @@
 		</CardTitle>
 	</CardHeader>
 	<CardContent>
-		{#if !cells || cells.length === 0}
-			<div class="text-center py-8 text-muted-foreground">
-				<Grid3x3 class="w-8 h-8 mx-auto mb-2 opacity-50" />
-				<p class="text-sm">No MITRE data available</p>
-			</div>
-		{:else}
-			<div bind:this={chartContainer} class="h-[280px] w-full"></div>
-		{/if}
+		<div class="relative h-[280px] w-full">
+			<div bind:this={chartContainer} class="h-full w-full"></div>
+			{#if !cells || cells.length === 0}
+				<div
+					class="absolute inset-0 flex flex-col items-center justify-center text-center text-muted-foreground"
+				>
+					<Grid3x3 class="w-8 h-8 mx-auto mb-2 opacity-50" />
+					<p class="text-sm">No MITRE data available</p>
+				</div>
+			{/if}
+		</div>
 	</CardContent>
 </Card>
diff --git a/packages/frontend/src/lib/components/siem/dashboard/SeverityPieChart.svelte b/packages/frontend/src/lib/components/siem/dashboard/SeverityPieChart.svelte
index d372da62..fe929b8e 100644
--- a/packages/frontend/src/lib/components/siem/dashboard/SeverityPieChart.svelte
+++ b/packages/frontend/src/lib/components/siem/dashboard/SeverityPieChart.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { onMount } from 'svelte';
 	import * as echarts from 'echarts';
 	import { Card, CardContent, CardHeader, CardTitle } from '$lib/components/ui/card';
 	import type { SeverityDistribution, Severity } from '$lib/api/siem';
@@ -103,7 +102,9 @@
 		};
 	}
 
-	onMount(() => {
+	$effect(() => {
+		if (!chartContainer) return;
+
 		chart = echarts.init(chartContainer);
 		chart.setOption(getChartOption());
 
@@ -121,6 +122,7 @@
 			resizeObserver.disconnect();
 			unsubscribe();
 			chart?.dispose();
+			chart = null;
 		};
 	});
 
diff --git a/packages/frontend/src/lib/components/ui/sonner/sonner.svelte b/packages/frontend/src/lib/components/ui/sonner/sonner.svelte
index 0631191c..910be7d0 100644
--- a/packages/frontend/src/lib/components/ui/sonner/sonner.svelte
+++ b/packages/frontend/src/lib/components/ui/sonner/sonner.svelte
@@ -1,12 +1,12 @@
 <script lang="ts">
 	import { Toaster as Sonner, type ToasterProps as SonnerProps } from "svelte-sonner";
-	import { mode } from "mode-watcher";
+	import { themeStore } from "$lib/stores/theme";
 
 	let { ...restProps }: SonnerProps = $props();
 </script>
 
 <Sonner
-	theme={mode.current}
+	theme={$themeStore}
 	class="toaster group"
 	toastOptions={{
 		classes: {

From 77bfa9b81d64bb0a8fda2282a679e999e91d4670 Mon Sep 17 00:00:00 2001
From: Polliog <polliogiuseppe@live.it>
Date: Sat, 20 Jun 2026 21:34:04 +0200
Subject: [PATCH 04/10] fix frontend route bugs from bug hunt

---
 .../src/routes/auth/callback/+page.svelte     |  7 +++
 .../routes/dashboard/admin/+layout@.svelte    | 52 ++++++++++++++++++-
 .../admin/organizations/[id]/+page.svelte     | 38 +++++++++++++-
 .../admin/system-health/+page.svelte          |  7 ++-
 .../routes/dashboard/admin/usage/+page.svelte | 46 +++++++++++++---
 .../dashboard/admin/users/[id]/+page.svelte   | 36 ++++++++++++-
 .../src/routes/dashboard/alerts/+page.svelte  | 51 +++++++++++++-----
 .../src/routes/dashboard/errors/+page.svelte  | 36 +++++++++++--
 .../routes/dashboard/errors/[id]/+page.svelte | 15 +++---
 .../src/routes/dashboard/metrics/+page.svelte |  5 +-
 .../routes/dashboard/monitoring/+page.svelte  | 45 ++++++++++++----
 .../dashboard/monitoring/[id]/+page.svelte    | 26 +++++++++-
 .../projects/[id]/settings/+page.svelte       |  6 +--
 .../src/routes/dashboard/search/+page.svelte  | 45 ++++++++++++++--
 .../dashboard/security/incidents/+page.svelte | 36 ++++++++++---
 .../dashboard/settings/audit-log/+page.svelte |  2 +-
 .../dashboard/settings/general/+page.svelte   |  1 +
 .../dashboard/settings/members/+page.svelte   |  2 +-
 .../settings/pii-masking/+page.svelte         | 12 +++++
 .../src/routes/dashboard/traces/+page.svelte  | 39 ++++++++++----
 .../routes/dashboard/traces/[id]/+page.svelte | 22 +++++---
 .../frontend/src/routes/login/+page.svelte    | 11 +++-
 .../[orgSlug]/[projectSlug]/+page.svelte      | 38 +++++++++-----
 23 files changed, 483 insertions(+), 95 deletions(-)

diff --git a/packages/frontend/src/routes/auth/callback/+page.svelte b/packages/frontend/src/routes/auth/callback/+page.svelte
index 0e4d33ad..e2a4cefd 100644
--- a/packages/frontend/src/routes/auth/callback/+page.svelte
+++ b/packages/frontend/src/routes/auth/callback/+page.svelte
@@ -24,6 +24,13 @@
       const expires = page.url.searchParams.get('expires');
       const isNewUser = page.url.searchParams.get('new_user') === 'true';
 
+      // Scrub the token (and other sensitive params) from the URL/history
+      // immediately so it never leaks into browser history, the referrer, or
+      // any pageview logging that captures window.location.href.
+      if (typeof history !== 'undefined') {
+        history.replaceState(null, '', '/auth/callback');
+      }
+
       if (!token) {
         error = 'No authentication token received. Please try logging in again.';
         loading = false;
diff --git a/packages/frontend/src/routes/dashboard/admin/+layout@.svelte b/packages/frontend/src/routes/dashboard/admin/+layout@.svelte
index 81559af8..eba8c83d 100644
--- a/packages/frontend/src/routes/dashboard/admin/+layout@.svelte
+++ b/packages/frontend/src/routes/dashboard/admin/+layout@.svelte
@@ -15,9 +15,57 @@
     import { cn } from "$lib/utils";
     import Footer from "$lib/components/Footer.svelte";
     import type { Snippet } from "svelte";
+    import { authStore } from "$lib/stores/auth";
+    import { UsersAPI } from "$lib/api/users";
+    import { goto } from "$app/navigation";
+    import { browser } from "$app/environment";
+    import { untrack } from "svelte";
+    import { get } from "svelte/store";
 
     let { children }: { children: Snippet } = $props();
 
+    // Centralized admin guard for the whole /dashboard/admin section.
+    // This layout resets the layout chain (the trailing "@"), so it does not
+    // inherit the dashboard auth guard; enforce authentication + is_admin here
+    // so individual admin pages cannot accidentally omit the check.
+    let adminResolved = $state(false);
+
+    const usersAPI = new UsersAPI(() => get(authStore).token);
+
+    $effect(() => {
+        if (!browser) return;
+
+        if (!$authStore.token) {
+            untrack(() => goto("/login"));
+            return;
+        }
+
+        if (!$authStore.user) return;
+
+        if ($authStore.user.is_admin === undefined) {
+            untrack(() => {
+                usersAPI
+                    .getCurrentUser()
+                    .then(({ user }) => {
+                        const currentUser = get(authStore).user;
+                        if (currentUser) {
+                            authStore.updateUser({ ...currentUser, ...user });
+                        }
+                        if (user.is_admin) {
+                            adminResolved = true;
+                        } else {
+                            goto("/dashboard");
+                        }
+                    })
+                    .catch(() => goto("/dashboard"));
+            });
+        } else if ($authStore.user.is_admin === false) {
+            untrack(() => goto("/dashboard"));
+        } else {
+            adminResolved = true;
+        }
+    });
+
     const navigation = [
         {
             name: "Dashboard",
@@ -215,7 +263,9 @@
         </header>
 
         <main class="flex-1">
-            {@render children()}
+            {#if adminResolved}
+                {@render children()}
+            {/if}
         </main>
         <Footer />
     </div>
diff --git a/packages/frontend/src/routes/dashboard/admin/organizations/[id]/+page.svelte b/packages/frontend/src/routes/dashboard/admin/organizations/[id]/+page.svelte
index 7b8d3104..2a68e3bc 100644
--- a/packages/frontend/src/routes/dashboard/admin/organizations/[id]/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/admin/organizations/[id]/+page.svelte
@@ -1,7 +1,11 @@
 <script lang="ts">
-    import { onMount } from "svelte";
+    import { onMount, untrack } from "svelte";
     import { page } from "$app/state";
     import { adminAPI, type OrganizationDetails, type EntitlementMap, type EntitlementUpdate } from "$lib/api/admin";
+    import { authStore } from "$lib/stores/auth";
+    import { browser } from "$app/environment";
+    import { UsersAPI } from "$lib/api/users";
+    import { get } from "svelte/store";
     import { Switch } from "$lib/components/ui/switch";
     import { Button, buttonVariants } from "$lib/components/ui/button";
     import { Badge } from "$lib/components/ui/badge";
@@ -46,6 +50,7 @@
     import { goto } from "$app/navigation";
 
     const orgId = $derived(page.params.id);
+    const usersAPI = new UsersAPI(() => get(authStore).token);
     let org: OrganizationDetails | null = $state(null);
     let loading = $state(true);
     let error = $state("");
@@ -65,6 +70,8 @@
     let limitInputs = $state<Record<string, string>>({});
 
     async function loadEntitlements() {
+        if ($authStore.user?.is_admin !== true) return;
+
         entitlementsLoading = true;
         entitlementsError = "";
         try {
@@ -139,6 +146,8 @@
     }
 
     async function loadOrganization() {
+        if ($authStore.user?.is_admin !== true) return;
+
         loading = true;
         error = "";
         try {
@@ -197,9 +206,34 @@
         return new Date(dateString).toLocaleString();
     }
 
-    onMount(() => {
+    function loadAll() {
         loadOrganization();
         loadEntitlements();
+    }
+
+    $effect(() => {
+        if (browser && $authStore.user) {
+            if ($authStore.user.is_admin === undefined) {
+                untrack(() => {
+                    usersAPI
+                        .getCurrentUser()
+                        .then(({ user }) => {
+                            const currentUser = get(authStore).user;
+                            if (currentUser) {
+                                authStore.updateUser({ ...currentUser, ...user });
+                                if (user.is_admin) loadAll();
+                            }
+                        })
+                        .catch(() => goto("/dashboard"));
+                });
+            } else if ($authStore.user.is_admin === false) {
+                untrack(() => goto("/dashboard"));
+            }
+        }
+    });
+
+    onMount(() => {
+        if ($authStore.user?.is_admin) loadAll();
     });
 </script>
 
diff --git a/packages/frontend/src/routes/dashboard/admin/system-health/+page.svelte b/packages/frontend/src/routes/dashboard/admin/system-health/+page.svelte
index da584c06..6c4a9d0b 100644
--- a/packages/frontend/src/routes/dashboard/admin/system-health/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/admin/system-health/+page.svelte
@@ -122,8 +122,11 @@
     function formatBytes(bytes: number) {
         if (!bytes) return "0 B";
         const k = 1024;
-        const sizes = ["B", "KB", "MB", "GB", "TB"];
-        const i = Math.floor(Math.log(bytes) / Math.log(k));
+        const sizes = ["B", "KB", "MB", "GB", "TB", "PB", "EB"];
+        const i = Math.min(
+            Math.floor(Math.log(bytes) / Math.log(k)),
+            sizes.length - 1,
+        );
         return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + " " + sizes[i];
     }
 
diff --git a/packages/frontend/src/routes/dashboard/admin/usage/+page.svelte b/packages/frontend/src/routes/dashboard/admin/usage/+page.svelte
index 4e872dbd..cf0525a5 100644
--- a/packages/frontend/src/routes/dashboard/admin/usage/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/admin/usage/+page.svelte
@@ -1,5 +1,10 @@
 <script lang="ts">
-    import { onMount } from 'svelte';
+    import { onMount, untrack } from 'svelte';
+    import { get } from 'svelte/store';
+    import { browser } from '$app/environment';
+    import { goto } from '$app/navigation';
+    import { authStore } from '$lib/stores/auth';
+    import { UsersAPI } from '$lib/api/users';
     import { adminAPI, type OrganizationBasic } from '$lib/api/admin';
     import { getUsage, getUsageBreakdown, getStorageUsage, type UsageRecord, type UsageBreakdown, type StorageUsageResponse } from '$lib/api/usage';
     import {
@@ -48,7 +53,36 @@
     let breakdown = $state<UsageBreakdown | null>(null);
     let storage = $state<StorageUsageResponse | null>(null);
 
-    onMount(async () => {
+    const usersAPI = new UsersAPI(() => get(authStore).token);
+
+    onMount(() => {
+        if ($authStore.user?.is_admin) loadOrgs();
+    });
+
+    $effect(() => {
+        if (browser && $authStore.user) {
+            if ($authStore.user.is_admin === undefined) {
+                untrack(() => {
+                    usersAPI
+                        .getCurrentUser()
+                        .then(({ user }) => {
+                            const currentUser = get(authStore).user;
+                            if (currentUser) {
+                                authStore.updateUser({ ...currentUser, ...user });
+                                if (user.is_admin) loadOrgs();
+                            }
+                        })
+                        .catch(() => goto('/dashboard'));
+                });
+            } else if ($authStore.user.is_admin === false) {
+                untrack(() => goto('/dashboard'));
+            }
+        }
+    });
+
+    async function loadOrgs() {
+        if ($authStore.user?.is_admin !== true) return;
+
         orgsLoading = true;
         orgsError = '';
         try {
@@ -62,7 +96,7 @@
         } finally {
             orgsLoading = false;
         }
-    });
+    }
 
     $effect(() => {
         if (selectedOrgId) {
@@ -129,12 +163,12 @@
     function formatCount(n: number): string {
         if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(1)}M`;
         if (n >= 1_000) return `${(n / 1_000).toFixed(1)}k`;
-        return n.toLocaleString();
+        return n.toLocaleString('en-US');
     }
 
     function formatDate(iso: string): string {
         if (!iso) return '';
-        return new Date(iso).toLocaleDateString(undefined, { month: 'short', day: 'numeric', year: 'numeric' });
+        return new Date(iso).toLocaleDateString('en-US', { month: 'short', day: 'numeric', year: 'numeric' });
     }
 
     function formatTypeQty(type: string, qty: number): string {
@@ -263,7 +297,7 @@
                     {#if loading}
                         <Spinner size="sm" />
                     {:else}
-                        <div class="text-2xl font-bold">{storage ? formatBytes(storage.current) : '—'}</div>
+                        <div class="text-2xl font-bold">{storage ? formatBytes(storage.current) : '-'}</div>
                         <p class="text-xs text-muted-foreground mt-1">
                             Logical bytes within retention · daily snapshot
                         </p>
diff --git a/packages/frontend/src/routes/dashboard/admin/users/[id]/+page.svelte b/packages/frontend/src/routes/dashboard/admin/users/[id]/+page.svelte
index 426b0bda..c5a51e2e 100644
--- a/packages/frontend/src/routes/dashboard/admin/users/[id]/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/admin/users/[id]/+page.svelte
@@ -1,7 +1,11 @@
 <script lang="ts">
-    import { onMount } from "svelte";
+    import { onMount, untrack } from "svelte";
     import { page } from "$app/state";
+    import { goto } from "$app/navigation";
+    import { browser } from "$app/environment";
+    import { get } from "svelte/store";
     import { adminAPI, type UserDetails } from "$lib/api/admin";
+    import { UsersAPI } from "$lib/api/users";
     import { toastStore } from "$lib/stores/toast";
     import { Button, buttonVariants } from "$lib/components/ui/button";
     import { Badge } from "$lib/components/ui/badge";
@@ -59,7 +63,35 @@
     // Check if current user is looking at their own profile
     const isOwnProfile = $derived($authStore.user?.id === userId);
 
+    const usersAPI = new UsersAPI(() => get(authStore).token);
+
+    $effect(() => {
+        if (browser && $authStore.user) {
+            if ($authStore.user.is_admin === undefined) {
+                untrack(() => {
+                    usersAPI
+                        .getCurrentUser()
+                        .then(({ user: current }) => {
+                            const currentUser = get(authStore).user;
+                            if (currentUser) {
+                                authStore.updateUser({
+                                    ...currentUser,
+                                    ...current,
+                                });
+                                if (current.is_admin) loadUser();
+                            }
+                        })
+                        .catch(() => goto("/dashboard"));
+                });
+            } else if ($authStore.user.is_admin === false) {
+                untrack(() => goto("/dashboard"));
+            }
+        }
+    });
+
     async function loadUser() {
+        if ($authStore.user?.is_admin !== true) return;
+
         loading = true;
         error = "";
         try {
@@ -166,7 +198,7 @@
     }
 
     onMount(() => {
-        loadUser();
+        if ($authStore.user?.is_admin) loadUser();
     });
 </script>
 
diff --git a/packages/frontend/src/routes/dashboard/alerts/+page.svelte b/packages/frontend/src/routes/dashboard/alerts/+page.svelte
index 1102ed6b..eaa3caae 100644
--- a/packages/frontend/src/routes/dashboard/alerts/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/alerts/+page.svelte
@@ -198,15 +198,6 @@
 		}
 	}
 
-	function handleDeleteKeydown(event: KeyboardEvent) {
-		if (event.key === "Enter" && showDeleteDialog && alertToDelete) {
-			event.preventDefault();
-			deleteAlert(alertToDelete);
-			showDeleteDialog = false;
-			alertToDelete = null;
-		}
-	}
-
 	async function deleteAlert(alertId: string) {
 		if (!$currentOrganization) return;
 
@@ -305,6 +296,40 @@
 		}
 	}
 
+	function buildSearchUrl(history: AlertHistory): string {
+		const params = new URLSearchParams();
+		if (history.projectId) {
+			params.set("project", history.projectId);
+		}
+		params.set(
+			"from",
+			new Date(
+				new Date(history.triggeredAt).getTime() - history.timeWindow * 60000,
+			).toISOString(),
+		);
+		params.set("to", new Date(history.triggeredAt).toISOString());
+		if (history.service) {
+			params.set("service", history.service);
+		}
+		if (history.level?.length) {
+			params.set("level", history.level.join(","));
+		}
+		return `/dashboard/search?${params.toString()}`;
+	}
+
+	function formatUtcTimestamp(value: string | Date): string {
+		const formatted = new Date(value).toLocaleString("en-US", {
+			timeZone: "UTC",
+			year: "numeric",
+			month: "2-digit",
+			day: "2-digit",
+			hour: "2-digit",
+			minute: "2-digit",
+			hour12: false,
+		});
+		return `${formatted} UTC`;
+	}
+
 	function getLevelColor(level: string): string {
 		switch (level) {
 			case "debug":
@@ -557,7 +582,7 @@
 											</div>
 											{#if history.projectId}
 												<a
-													href="/dashboard/search?project={history.projectId}&from={new Date(new Date(history.triggeredAt).getTime() - history.timeWindow * 60000).toISOString()}&to={new Date(history.triggeredAt).toISOString()}{history.service ? `&service=${history.service}` : ''}{history.level?.length ? `&level=${history.level.join(',')}` : ''}"
+													href={buildSearchUrl(history)}
 													class="text-sm text-primary hover:underline flex items-center gap-1"
 												>
 													<span>View Logs</span>
@@ -622,7 +647,7 @@
 
 										<div class="flex items-center gap-1.5 text-sm text-muted-foreground">
 											<Clock class="w-4 h-4" />
-											<span>{new Date(history.triggeredAt).toISOString().slice(0, 16).replace("T", " ")}</span>
+											<span>{formatUtcTimestamp(history.triggeredAt)}</span>
 										</div>
 
 										{#if history.error}
@@ -740,7 +765,7 @@
 
 										<div class="flex items-center gap-1.5 text-sm text-muted-foreground">
 											<Clock class="w-4 h-4" />
-											<span>{new Date(detection.time).toISOString().slice(0, 16).replace("T", " ")}</span>
+											<span>{formatUtcTimestamp(detection.time)}</span>
 										</div>
 									</div>
 								</CardContent>
@@ -776,7 +801,7 @@
 
 
 	<AlertDialog bind:open={showDeleteDialog}>
-		<AlertDialogContent onkeydown={handleDeleteKeydown}>
+		<AlertDialogContent>
 			<AlertDialogHeader>
 				<AlertDialogTitle>Delete Alert Rule</AlertDialogTitle>
 				<AlertDialogDescription>
diff --git a/packages/frontend/src/routes/dashboard/errors/+page.svelte b/packages/frontend/src/routes/dashboard/errors/+page.svelte
index 8598a4c5..663b5b51 100644
--- a/packages/frontend/src/routes/dashboard/errors/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/errors/+page.svelte
@@ -50,6 +50,7 @@
 	let error = $state('');
 	let lastLoadedOrg = $state<string | null>(null);
 	let refreshing = $state(false);
+	let loadSeq = 0;
 
 	// Filters
 	let statusFilter = $state<ErrorGroupStatus | ''>('');
@@ -72,16 +73,23 @@
 		const statusParam = params.get('status');
 		const languageParam = params.get('language');
 		const searchParam = params.get('search');
+		const pageParam = params.get('page');
 
 		if (statusParam && ['open', 'resolved', 'ignored'].includes(statusParam)) {
 			statusFilter = statusParam as ErrorGroupStatus;
 		}
-		if (languageParam && ['nodejs', 'python', 'java', 'go', 'php', 'unknown'].includes(languageParam)) {
+		if (languageParam && ['nodejs', 'python', 'java', 'go', 'php', 'kotlin', 'csharp', 'rust', 'ruby', 'unknown'].includes(languageParam)) {
 			languageFilter = languageParam as ExceptionLanguage;
 		}
 		if (searchParam) {
 			searchQuery = searchParam;
 		}
+		if (pageParam) {
+			const parsedPage = Number.parseInt(pageParam, 10);
+			if (Number.isFinite(parsedPage) && parsedPage >= 1) {
+				currentPage = parsedPage;
+			}
+		}
 	});
 
 	// Load when org changes
@@ -89,6 +97,9 @@
 		if (!$currentOrganization) return;
 		if ($currentOrganization.id === lastLoadedOrg) return;
 
+		// Reset to the first page when switching organizations so the offset
+		// query stays within the new org's result range
+		currentPage = 1;
 		loadErrorGroups();
 		lastLoadedOrg = $currentOrganization.id;
 	});
@@ -96,6 +107,7 @@
 	async function loadErrorGroups() {
 		if (!$currentOrganization) return;
 
+		const seq = ++loadSeq;
 		loading = true;
 		error = '';
 
@@ -109,14 +121,26 @@
 				offset: (currentPage - 1) * pageSize,
 			});
 
+			// Ignore stale responses if a newer load has started
+			if (seq !== loadSeq) return;
+
 			groups = response.groups;
 			total = response.total;
+
+			// Clamp the current page if it now exceeds the available pages
+			const pages = Math.max(1, Math.ceil(total / pageSize));
+			if (currentPage > pages) {
+				currentPage = pages;
+			}
 		} catch (e) {
+			if (seq !== loadSeq) return;
 			error = e instanceof Error ? e.message : 'Failed to load error groups';
 			toastStore.error(error);
 		} finally {
-			loading = false;
-			hasLoadedOnce = true;
+			if (seq === loadSeq) {
+				loading = false;
+				hasLoadedOnce = true;
+			}
 		}
 	}
 
@@ -161,6 +185,7 @@
 		if (statusFilter) params.set('status', statusFilter);
 		if (languageFilter) params.set('language', languageFilter);
 		if (searchQuery) params.set('search', searchQuery);
+		if (currentPage > 1) params.set('page', String(currentPage));
 
 		const newUrl = params.toString() ? `?${params}` : '/dashboard/errors';
 		goto(newUrl, { replaceState: true, noScroll: true });
@@ -169,6 +194,7 @@
 	function goToPage(page: number) {
 		if (page >= 1 && page <= totalPages && page !== currentPage) {
 			currentPage = page;
+			updateUrl();
 			loadErrorGroups();
 		}
 	}
@@ -193,6 +219,10 @@
 		{ value: 'java', label: 'Java' },
 		{ value: 'go', label: 'Go' },
 		{ value: 'php', label: 'PHP' },
+		{ value: 'kotlin', label: 'Kotlin' },
+		{ value: 'csharp', label: 'C#' },
+		{ value: 'rust', label: 'Rust' },
+		{ value: 'ruby', label: 'Ruby' },
 		{ value: 'unknown', label: 'Unknown' },
 	];
 </script>
diff --git a/packages/frontend/src/routes/dashboard/errors/[id]/+page.svelte b/packages/frontend/src/routes/dashboard/errors/[id]/+page.svelte
index 374bd34b..b58f3251 100644
--- a/packages/frontend/src/routes/dashboard/errors/[id]/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/errors/[id]/+page.svelte
@@ -107,10 +107,6 @@
 
 			const [trendData, logsData, apiKeysData] = await Promise.all(promises);
 
-			console.log('--- Debug Error Group Logs ---');
-			console.log('logsData.logs[0]', logsData.logs[0]);
-			console.log('apiKeysData', apiKeysData);
-
 			trend = trendData.trend;
 			logs = logsData.logs;
 			logsTotal = logsData.total;
@@ -139,7 +135,7 @@
 		if (!apiKeyId) return null;
 
 		const key = apiKeys.find((k) => k.id === apiKeyId);
-		return key ? key.name : apiKeyId.slice(0, 8);
+		return key ? key.name : 'Unknown key';
 	}
 
 	async function loadMoreLogs() {
@@ -203,14 +199,15 @@
 	function formatTimeAgo(dateStr: string | Date): string {
 		const date = typeof dateStr === 'string' ? new Date(dateStr) : dateStr;
 		const now = new Date();
-		const diffMs = now.getTime() - date.getTime();
+		const diffMs = Math.max(now.getTime() - date.getTime(), 0);
 		const diffMins = Math.floor(diffMs / 60000);
 		const diffHours = Math.floor(diffMs / 3600000);
 		const diffDays = Math.floor(diffMs / 86400000);
 
-		if (diffMins < 60) return `${diffMins} minutes ago`;
-		if (diffHours < 24) return `${diffHours} hours ago`;
-		return `${diffDays} days ago`;
+		if (diffMins < 1) return 'just now';
+		if (diffMins < 60) return `${diffMins} minute${diffMins === 1 ? '' : 's'} ago`;
+		if (diffHours < 24) return `${diffHours} hour${diffHours === 1 ? '' : 's'} ago`;
+		return `${diffDays} day${diffDays === 1 ? '' : 's'} ago`;
 	}
 
 	// Status options
diff --git a/packages/frontend/src/routes/dashboard/metrics/+page.svelte b/packages/frontend/src/routes/dashboard/metrics/+page.svelte
index a2aca91f..96327c12 100644
--- a/packages/frontend/src/routes/dashboard/metrics/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/metrics/+page.svelte
@@ -347,6 +347,9 @@
 
   function handleMetricSelect(metricName: string) {
     metricsStore.selectMetric(metricName);
+    // Reset local label filter selectors to match the cleared store state
+    selectedLabelKey = null;
+    selectedLabelValue = null;
     if (!selectedProject) return;
 
     const { from, to } = getTimeRange();
@@ -564,7 +567,7 @@
 
   function formatBucketLabel(bucket: string): string {
     const d = new Date(bucket);
-    return d.toLocaleTimeString(undefined, {
+    return d.toLocaleTimeString("en-US", {
       hour: "2-digit",
       minute: "2-digit",
       hour12: false,
diff --git a/packages/frontend/src/routes/dashboard/monitoring/+page.svelte b/packages/frontend/src/routes/dashboard/monitoring/+page.svelte
index b29afc84..25c849dd 100644
--- a/packages/frontend/src/routes/dashboard/monitoring/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/monitoring/+page.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-  import { onMount } from 'svelte';
+  import { onMount, untrack } from 'svelte';
   import { goto } from '$app/navigation';
   import { currentOrganization } from '$lib/stores/organization';
   import { monitoringStore, monitors, monitorsLoading, monitorsError } from '$lib/stores/monitoring';
@@ -71,15 +71,22 @@
   let availableServices = $state<string[]>([]);
   let serviceSearchOpen = $state(false);
 
+  $effect(() => {
+    const orgId = org?.id;
+    if (!orgId) return;
+    projectsAPI.getProjects(orgId).then((res) => {
+      projects = res.projects;
+      if (!untrack(() => projectId) && res.projects.length > 0) {
+        projectId = res.projects[0].id;
+      }
+    }).catch((err) => {
+      toastStore.error(err instanceof Error ? err.message : 'Failed to load projects');
+    });
+  });
+
   $effect(() => {
     if (org) {
       monitoringStore.load(org.id, projectId);
-      projectsAPI.getProjects(org.id).then((res) => {
-        projects = res.projects;
-        if (!projectId && res.projects.length > 0) {
-          projectId = res.projects[0].id;
-        }
-      }).catch(() => {});
       if (projectId) {
         loadIncidents();
         loadMaintenances();
@@ -135,7 +142,27 @@
 
   let formError = $state<string | null>(null);
 
+  const defaultGracePeriod = $derived(
+    Number.isFinite(formInterval) ? String(Math.round(formInterval * 1.5)) : ''
+  );
+
   function validateForm(): string | null {
+    if (!Number.isFinite(formInterval) || formInterval < 30 || formInterval > 86400) {
+      return 'Check interval must be between 30 and 86400 seconds';
+    }
+    if (formType !== 'heartbeat' && formType !== 'log_heartbeat') {
+      if (!Number.isFinite(formTimeout) || formTimeout < 1 || formTimeout > 60) {
+        return 'Timeout must be between 1 and 60 seconds';
+      }
+    }
+    if (!Number.isFinite(formThreshold) || formThreshold < 1 || formThreshold > 20) {
+      return 'Failure threshold must be between 1 and 20';
+    }
+    if (formType === 'log_heartbeat' && formGracePeriod != null) {
+      if (!Number.isFinite(formGracePeriod) || formGracePeriod < 60 || formGracePeriod > 86400) {
+        return 'Silence threshold must be between 60 and 86400 seconds';
+      }
+    }
     if (formType === 'log_heartbeat') {
       if (!formTarget || !formTarget.trim()) {
         return 'Service name is required for log-based monitors';
@@ -819,10 +846,10 @@
                   bind:value={formGracePeriod}
                   min="60"
                   max="86400"
-                  placeholder={String(Math.round(formInterval * 1.5))}
+                  placeholder={defaultGracePeriod}
                   class="w-full rounded-md border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-primary"
                 />
-                <p class="mt-1 text-xs text-muted-foreground">Mark as down after this many seconds without logs. Default: {Math.round(formInterval * 1.5)}s (interval × 1.5)</p>
+                <p class="mt-1 text-xs text-muted-foreground">Mark as down after this many seconds without logs. Default: {defaultGracePeriod}s (interval × 1.5)</p>
               </div>
             {/if}
 
diff --git a/packages/frontend/src/routes/dashboard/monitoring/[id]/+page.svelte b/packages/frontend/src/routes/dashboard/monitoring/[id]/+page.svelte
index eb3eadc9..96d26018 100644
--- a/packages/frontend/src/routes/dashboard/monitoring/[id]/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/monitoring/[id]/+page.svelte
@@ -32,9 +32,31 @@
   const loading = $derived($monitorDetailLoading);
   const error = $derived($monitorDetailError);
 
+  // File-local request-sequence guard: each load captures a sequence value and
+  // the monitor id it was started for. When the user navigates quickly between
+  // monitors the in-flight Promise.all from the previous monitor can resolve
+  // after the new one started; bailing out here keeps a stale response from
+  // being treated as the current monitor's data.
+  let loadSeq = 0;
+
+  function loadDetail(id: string, organizationId: string) {
+    const seq = ++loadSeq;
+    monitoringStore.loadDetail(id, organizationId).then(() => {
+      if (seq !== loadSeq || page.params.id !== id) {
+        // A newer load has started; re-load the monitor that is now current so
+        // the rendered store state always matches the URL.
+        const current = $currentOrganization;
+        const currentId = page.params.id;
+        if (current && currentId && currentId !== id) {
+          loadDetail(currentId, current.id);
+        }
+      }
+    });
+  }
+
   $effect(() => {
     if (org && monitorId) {
-      monitoringStore.loadDetail(monitorId, org.id);
+      loadDetail(monitorId, org.id);
     }
     return () => monitoringStore.clearDetail();
   });
@@ -89,7 +111,7 @@
 
   function refresh() {
     if (org && monitorId) {
-      monitoringStore.loadDetail(monitorId, org.id);
+      loadDetail(monitorId, org.id);
     }
   }
 
diff --git a/packages/frontend/src/routes/dashboard/projects/[id]/settings/+page.svelte b/packages/frontend/src/routes/dashboard/projects/[id]/settings/+page.svelte
index 030c6d9e..65650590 100644
--- a/packages/frontend/src/routes/dashboard/projects/[id]/settings/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/projects/[id]/settings/+page.svelte
@@ -171,7 +171,7 @@
 
 	function formatDate(date: string | null): string {
 		if (!date) return 'Never';
-		return new Date(date).toLocaleString();
+		return new Date(date).toLocaleString('en-US');
 	}
 
 	const hasChanges = $derived(
@@ -263,12 +263,12 @@
 
 				<div class="space-y-2">
 					<Label>Created</Label>
-					<Input value={new Date(project.createdAt).toLocaleString()} readonly />
+					<Input value={new Date(project.createdAt).toLocaleString('en-US')} readonly />
 				</div>
 
 				<div class="space-y-2">
 					<Label>Last Updated</Label>
-					<Input value={new Date(project.updatedAt).toLocaleString()} readonly />
+					<Input value={new Date(project.updatedAt).toLocaleString('en-US')} readonly />
 				</div>
 			</CardContent>
 		</Card>
diff --git a/packages/frontend/src/routes/dashboard/search/+page.svelte b/packages/frontend/src/routes/dashboard/search/+page.svelte
index 5a77d663..8adc8418 100644
--- a/packages/frontend/src/routes/dashboard/search/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/search/+page.svelte
@@ -101,9 +101,23 @@
 
   // Custom metadata columns (persisted per project in localStorage)
   let customColumns = $state<string[]>([]);
+  // Cache stores per projectId so that any selectedProjects mutation does not
+  // recreate the store (and re-read localStorage) on every dependency change.
+  const columnStoreCache = new Map<
+    string,
+    ReturnType<typeof createColumnConfigStore>
+  >();
+  function getColumnStore(projectId: string) {
+    let store = columnStoreCache.get(projectId);
+    if (!store) {
+      store = createColumnConfigStore(projectId);
+      columnStoreCache.set(projectId, store);
+    }
+    return store;
+  }
   let columnStore = $derived(
     selectedProjects.length > 0
-      ? createColumnConfigStore(selectedProjects[0])
+      ? getColumnStore(selectedProjects[0])
       : null
   );
   $effect(() => {
@@ -457,6 +471,10 @@
   // Pagination state
   let currentPage = $state(1);
 
+  // Monotonic request counter so a slower earlier loadLogs() cannot overwrite
+  // the results of a newer one when several calls are in flight at once.
+  let loadLogsRequestId = 0;
+
   async function loadLogs() {
     if (selectedProjects.length === 0) {
       logs = [];
@@ -465,6 +483,7 @@
       return;
     }
 
+    const requestId = ++loadLogsRequestId;
     isLoading = true;
 
     try {
@@ -508,17 +527,23 @@
         metadataFilters: validMetadataFilters.length > 0 ? validMetadataFilters : undefined,
       });
 
+      // A newer load started while this one was in flight; drop the stale result.
+      if (requestId !== loadLogsRequestId) return;
+
       logs = response.logs;
       totalLogs = response.total;
       hasMoreLogs = response.hasMore ?? (response.logs.length >= pageSize);
     } catch (e) {
+      if (requestId !== loadLogsRequestId) return;
       console.error("Failed to load logs:", e);
       toastStore.error("Failed to load logs. Please try again.");
       logs = [];
       hasMoreLogs = false;
     } finally {
-      isLoading = false;
-      hasLoadedOnce = true;
+      if (requestId === loadLogsRequestId) {
+        isLoading = false;
+        hasLoadedOnce = true;
+      }
     }
   }
 
@@ -705,6 +730,18 @@
             if (sessionId) {
               newLogs = newLogs.filter((log) => log.sessionId === sessionId);
             }
+            // The WS only carries a single level/hostname filter (startLiveTail
+            // sends one only when exactly one is selected). When the user picked
+            // multiple, filter the incoming logs client-side so live tail never
+            // shows levels/hosts that were filtered out.
+            if (selectedLevels.length > 1) {
+              newLogs = newLogs.filter((log) => selectedLevels.includes(log.level));
+            }
+            if (selectedHostnames.length > 1) {
+              newLogs = newLogs.filter((log) =>
+                selectedHostnames.includes(log.metadata?.hostname),
+              );
+            }
 
             if (newLogs.length > 0) {
               const shift = newLogs.length;
@@ -1591,7 +1628,7 @@
           <div class="flex items-center justify-between">
             <CardTitle>
               {#if effectiveTotalLogs > 0}
-                {effectiveTotalLogs.toLocaleString()}
+                {effectiveTotalLogs.toLocaleString("en-US")}
                 {effectiveTotalLogs === 1 ? "log" : "logs"}
                 {#if liveTail}
                   <span class="text-sm font-normal text-muted-foreground"
diff --git a/packages/frontend/src/routes/dashboard/security/incidents/+page.svelte b/packages/frontend/src/routes/dashboard/security/incidents/+page.svelte
index 7f3a8912..ddb70868 100644
--- a/packages/frontend/src/routes/dashboard/security/incidents/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/security/incidents/+page.svelte
@@ -23,6 +23,9 @@
 	// Cleanup SSE connection on component destroy
 	onDestroy(() => {
 		siemStore.stopRealtimeUpdates();
+		if (filterDebounceTimer) {
+			clearTimeout(filterDebounceTimer);
+		}
 	});
 
 	// State
@@ -35,6 +38,11 @@
 	let maxWidthClass = $state("max-w-7xl");
 	let containerPadding = $state("px-6 py-8");
 
+	// Guard against stale responses from concurrent loads
+	let loadSeq = 0;
+	// Debounce timer for text filter inputs
+	let filterDebounceTimer: ReturnType<typeof setTimeout> | null = null;
+
 	$effect(() => {
 		const unsubscribe = layoutStore.maxWidthClass.subscribe((value) => {
 			maxWidthClass = value;
@@ -89,6 +97,7 @@
 	async function loadIncidents() {
 		if (!$currentOrganization) return;
 
+		const seq = ++loadSeq;
 		loading = true;
 		error = '';
 
@@ -103,16 +112,22 @@
 				offset: (currentPage - 1) * pageSize,
 			});
 
+			// Ignore responses from superseded loads
+			if (seq !== loadSeq) return;
+
 			incidents = response.incidents;
 			totalIncidents = response.total;
 			hasMore = (currentPage - 1) * pageSize + response.incidents.length < response.total;
 			lastLoadedOrg = $currentOrganization.id;
 		} catch (e) {
+			if (seq !== loadSeq) return;
 			error = e instanceof Error ? e.message : 'Failed to load incidents';
 			toastStore.error(error);
 		} finally {
-			loading = false;
-			hasLoadedOnce = true;
+			if (seq === loadSeq) {
+				loading = false;
+				hasLoadedOnce = true;
+			}
 		}
 	}
 
@@ -137,18 +152,27 @@
 		loadIncidents();
 	}
 
+	function debounceFilterReload() {
+		if (filterDebounceTimer) {
+			clearTimeout(filterDebounceTimer);
+		}
+		filterDebounceTimer = setTimeout(() => {
+			filterDebounceTimer = null;
+			updateUrl();
+			loadIncidents();
+		}, 300);
+	}
+
 	function handleServiceChange(service: string) {
 		serviceFilter = service;
 		currentPage = 1;
-		updateUrl();
-		loadIncidents();
+		debounceFilterReload();
 	}
 
 	function handleTechniqueChange(technique: string) {
 		techniqueFilter = technique;
 		currentPage = 1;
-		updateUrl();
-		loadIncidents();
+		debounceFilterReload();
 	}
 
 	function handleResetFilters() {
diff --git a/packages/frontend/src/routes/dashboard/settings/audit-log/+page.svelte b/packages/frontend/src/routes/dashboard/settings/audit-log/+page.svelte
index 9909f00d..78c4a799 100644
--- a/packages/frontend/src/routes/dashboard/settings/audit-log/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/settings/audit-log/+page.svelte
@@ -492,7 +492,7 @@
 													>
 												{/if}
 											{:else}
-												<span class="text-muted-foreground/50">\u2014</span>
+												<span class="text-muted-foreground/50">{'\u2014'}</span>
 											{/if}
 										</TableCell>
 										<TableCell class="font-mono text-xs text-muted-foreground">
diff --git a/packages/frontend/src/routes/dashboard/settings/general/+page.svelte b/packages/frontend/src/routes/dashboard/settings/general/+page.svelte
index 40949a13..4347edeb 100644
--- a/packages/frontend/src/routes/dashboard/settings/general/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/settings/general/+page.svelte
@@ -258,6 +258,7 @@
                 <AlertDialogCancel>Cancel</AlertDialogCancel>
                 <AlertDialogAction
                   onclick={deleteOrganization}
+                  disabled={deleting}
                   class="bg-destructive hover:bg-destructive/90"
                 >
                   {deleting ? 'Deleting...' : 'Delete Organization'}
diff --git a/packages/frontend/src/routes/dashboard/settings/members/+page.svelte b/packages/frontend/src/routes/dashboard/settings/members/+page.svelte
index 0620a10a..e9e8691d 100644
--- a/packages/frontend/src/routes/dashboard/settings/members/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/settings/members/+page.svelte
@@ -240,7 +240,7 @@
     if (days === 0) return 'Today';
     if (days === 1) return 'Yesterday';
     if (days < 7) return `${days} days ago`;
-    return d.toLocaleDateString();
+    return d.toLocaleDateString('en-US');
   }
 
   function formatExpiresIn(date: Date | string): string {
diff --git a/packages/frontend/src/routes/dashboard/settings/pii-masking/+page.svelte b/packages/frontend/src/routes/dashboard/settings/pii-masking/+page.svelte
index ba94b17d..e46109a8 100644
--- a/packages/frontend/src/routes/dashboard/settings/pii-masking/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/settings/pii-masking/+page.svelte
@@ -182,6 +182,18 @@
           return;
         }
 
+        if (formPatternType === 'custom' && !formRegexPattern.trim()) {
+          toastStore.error('Please provide a regex pattern for a custom rule');
+          saving = false;
+          return;
+        }
+
+        if (formPatternType === 'field_name' && fieldNames.length === 0) {
+          toastStore.error('Please provide at least one field name');
+          saving = false;
+          return;
+        }
+
         await piiMaskingAPI.createRule({
           name: formName,
           displayName: formDisplayName,
diff --git a/packages/frontend/src/routes/dashboard/traces/+page.svelte b/packages/frontend/src/routes/dashboard/traces/+page.svelte
index 5d1ba06d..e493f232 100644
--- a/packages/frontend/src/routes/dashboard/traces/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/traces/+page.svelte
@@ -199,6 +199,11 @@
 
   let lastLoadedOrg = $state<string | null>(null);
 
+  // Request-sequence guard: each loadTraces() captures the current value and
+  // bails out after its await if a newer load has started in the meantime,
+  // so a slow earlier response cannot overwrite fresher results.
+  let loadTracesSeq = 0;
+
   onMount(() => {
     shortcutsStore.setScope('traces');
     shortcutsStore.register([
@@ -340,6 +345,7 @@
     }
 
     isLoading = true;
+    const seq = ++loadTracesSeq;
 
     try {
       const timeRange = getTimeRange();
@@ -359,27 +365,37 @@
         offset: offset,
       });
 
+      // A newer load started while this request was in flight: discard the
+      // stale response so it cannot overwrite fresher results.
+      if (seq !== loadTracesSeq) return;
+
       traces = response.traces;
       totalTraces = response.total;
 
       // Stats are auxiliary: a stats failure must not discard the loaded traces,
       // so fetch them in their own try/catch rather than the outer one.
       try {
-        stats = await tracesAPI.getStats(
+        const loadedStats = await tracesAPI.getStats(
           selectedProject,
           timeRange.from.toISOString(),
           timeRange.to.toISOString()
         );
+        if (seq === loadTracesSeq) {
+          stats = loadedStats;
+        }
       } catch (e) {
         console.error("Failed to load trace stats:", e);
       }
     } catch (e) {
+      if (seq !== loadTracesSeq) return;
       console.error("Failed to load traces:", e);
       toastStore.error('Failed to load traces');
       traces = [];
     } finally {
-      isLoading = false;
-      hasLoadedOnce = true;
+      if (seq === loadTracesSeq) {
+        isLoading = false;
+        hasLoadedOnce = true;
+      }
     }
   }
 
@@ -520,7 +536,10 @@
     const canvas = document.querySelector(
       ".service-map canvas",
     ) as HTMLCanvasElement | null;
-    if (!canvas) return;
+    if (!canvas) {
+      toastStore.error('Unable to export the service map image');
+      return;
+    }
     const link = document.createElement("a");
     link.download = `service-map-${selectedProject}-${Date.now()}.png`;
     link.href = canvas.toDataURL("image/png");
@@ -784,7 +803,7 @@
             <GitBranch class="w-5 h-5 text-muted-foreground" />
             <div>
               <p class="text-sm text-muted-foreground">Total Traces</p>
-              <p class="text-2xl font-bold">{stats.total_traces.toLocaleString()}</p>
+              <p class="text-2xl font-bold">{stats.total_traces.toLocaleString('en-US')}</p>
             </div>
           </div>
         </CardContent>
@@ -795,7 +814,7 @@
             <Layers class="w-5 h-5 text-muted-foreground" />
             <div>
               <p class="text-sm text-muted-foreground">Total Spans</p>
-              <p class="text-2xl font-bold">{stats.total_spans.toLocaleString()}</p>
+              <p class="text-2xl font-bold">{stats.total_spans.toLocaleString('en-US')}</p>
             </div>
           </div>
         </CardContent>
@@ -1188,7 +1207,7 @@
         <div class="flex items-center justify-between">
           <CardTitle>
             {#if totalTraces > 0}
-              {totalTraces.toLocaleString()}
+              {totalTraces.toLocaleString('en-US')}
               {totalTraces === 1 ? "trace" : "traces"}
             {:else}
               No traces
@@ -1339,10 +1358,10 @@
           {#if traces.length > 0}
             <div class="flex items-center justify-between mt-6 px-2">
               <div class="text-sm text-muted-foreground">
-                Showing {((currentPage - 1) * pageSize + 1).toLocaleString()} to {Math.min(
+                Showing {((currentPage - 1) * pageSize + 1).toLocaleString('en-US')} to {Math.min(
                   currentPage * pageSize,
                   totalTraces,
-                ).toLocaleString()} of {totalTraces.toLocaleString()} traces
+                ).toLocaleString('en-US')} of {totalTraces.toLocaleString('en-US')} traces
               </div>
               <div class="flex items-center gap-2">
                 <Button
@@ -1582,7 +1601,7 @@
                 <div class="p-3 rounded-lg bg-muted/50">
                   <p class="text-xs text-muted-foreground">Total Calls</p>
                   <p class="text-lg font-bold">
-                    {selectedNode.totalCalls.toLocaleString()}
+                    {selectedNode.totalCalls.toLocaleString('en-US')}
                   </p>
                 </div>
               </div>
diff --git a/packages/frontend/src/routes/dashboard/traces/[id]/+page.svelte b/packages/frontend/src/routes/dashboard/traces/[id]/+page.svelte
index 13ddb8da..401a936a 100644
--- a/packages/frontend/src/routes/dashboard/traces/[id]/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/traces/[id]/+page.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-  import { onMount } from "svelte";
   import { page } from "$app/state";
   import { goto } from "$app/navigation";
   import { tracesAPI, type TraceRecord, type SpanRecord } from "$lib/api/traces";
@@ -60,32 +59,41 @@
   let traceEndTime = $derived(trace ? new Date(trace.end_time).getTime() : 0);
   let traceDuration = $derived(traceEndTime - traceStartTime);
 
-  onMount(async () => {
+  let loadSequence = 0;
+
+  $effect(() => {
     if (!projectId) {
       goto("/dashboard/traces");
       return;
     }
 
-    await loadTraceData();
+    loadTraceData(traceId, projectId);
   });
 
-  async function loadTraceData() {
+  async function loadTraceData(currentTraceId: string, currentProjectId: string) {
+    const sequence = ++loadSequence;
     isLoading = true;
     try {
       const [traceData, spansData] = await Promise.all([
-        tracesAPI.getTrace(traceId, projectId),
-        tracesAPI.getTraceSpans(traceId, projectId),
+        tracesAPI.getTrace(currentTraceId, currentProjectId),
+        tracesAPI.getTraceSpans(currentTraceId, currentProjectId),
       ]);
 
+      if (sequence !== loadSequence) return;
+
       trace = traceData;
       spans = spansData;
       spanTree = buildSpanTree(spansData);
 
       expandedSpans = new Set(spansData.map(s => s.span_id));
+      selectedSpan = null;
     } catch (e) {
+      if (sequence !== loadSequence) return;
       console.error("Failed to load trace:", e);
     } finally {
-      isLoading = false;
+      if (sequence === loadSequence) {
+        isLoading = false;
+      }
     }
   }
 
diff --git a/packages/frontend/src/routes/login/+page.svelte b/packages/frontend/src/routes/login/+page.svelte
index cdf550ac..8541dbb2 100644
--- a/packages/frontend/src/routes/login/+page.svelte
+++ b/packages/frontend/src/routes/login/+page.svelte
@@ -20,7 +20,16 @@
 
   // Get redirect URL and error from query params
   let redirectUrl = $derived(page.url.searchParams.get('redirect'));
-  let urlError = $derived(page.url.searchParams.get('error'));
+  // Sanitize the reflected error param to limit content-spoofing on this trusted
+  // page: strip control characters and cap the length while preserving the short
+  // provider error descriptions the backend legitimately forwards here.
+  function sanitizeErrorParam(value: string | null): string {
+    if (!value) return '';
+    // eslint-disable-next-line no-control-regex
+    const cleaned = value.replace(/[\x00-\x1f\x7f]/g, ' ').replace(/\s+/g, ' ').trim();
+    return cleaned.length > 200 ? `${cleaned.slice(0, 200)}...` : cleaned;
+  }
+  let urlError = $derived(sanitizeErrorParam(page.url.searchParams.get('error')));
 
   // Login mode: 'select' (provider selection), 'local' (email/password), 'ldap' (LDAP form)
   type LoginMode = 'select' | 'local' | 'ldap';
diff --git a/packages/frontend/src/routes/status/[orgSlug]/[projectSlug]/+page.svelte b/packages/frontend/src/routes/status/[orgSlug]/[projectSlug]/+page.svelte
index 4fa5879e..61988915 100644
--- a/packages/frontend/src/routes/status/[orgSlug]/[projectSlug]/+page.svelte
+++ b/packages/frontend/src/routes/status/[orgSlug]/[projectSlug]/+page.svelte
@@ -173,6 +173,15 @@
     return { bg: 'bg-red-500/10 border-red-500/20', text: 'text-red-700 dark:text-red-400', dot: 'bg-red-500 shadow-red-500/50', label: 'Major system outage' };
   }
 
+  const WINDOW_BARS = 45;
+
+  function oldestBarLabel(history: UptimeBar[]): string {
+    const visible = history.slice(-WINDOW_BARS);
+    if (visible.length >= WINDOW_BARS) return `${WINDOW_BARS}d ago`;
+    if (visible.length === 0) return 'No data';
+    return new Date(visible[0].bucket).toLocaleDateString('en-US');
+  }
+
   function getMonitorTypeLabel(type: string): string {
     if (type === 'http') return 'HTTP';
     if (type === 'tcp') return 'TCP';
@@ -273,7 +282,7 @@
               <p class="text-xs text-muted-foreground mt-0.5">{m.description}</p>
             {/if}
             <p class="text-xs text-muted-foreground mt-1">
-              {new Date(m.scheduledStart).toLocaleString()} - {new Date(m.scheduledEnd).toLocaleString()}
+              {new Date(m.scheduledStart).toLocaleString('en-US')} - {new Date(m.scheduledEnd).toLocaleString('en-US')}
             </p>
           </div>
         {/each}
@@ -287,7 +296,7 @@
               <p class="text-xs text-muted-foreground mt-0.5">{m.description}</p>
             {/if}
             <p class="text-xs text-muted-foreground mt-1">
-              {new Date(m.scheduledStart).toLocaleString()} - {new Date(m.scheduledEnd).toLocaleString()}
+              {new Date(m.scheduledStart).toLocaleString('en-US')} - {new Date(m.scheduledEnd).toLocaleString('en-US')}
             </p>
           </div>
         {/each}
@@ -309,7 +318,7 @@
                   <div>
                     <div class="flex items-center gap-1.5">
                       <span class="text-xs font-medium uppercase text-muted-foreground">{update.status}</span>
-                      <span class="text-xs text-muted-foreground">{new Date(update.createdAt).toLocaleString()}</span>
+                      <span class="text-xs text-muted-foreground">{new Date(update.createdAt).toLocaleString('en-US')}</span>
                     </div>
                     <p class="text-xs">{update.message}</p>
                   </div>
@@ -336,19 +345,19 @@
           </div>
 
           <div class="flex items-center gap-[2px]">
-            {#each Array(Math.max(0, 45 - monitor.uptimeHistory.length)) as _}
-              <div class="bar-cell flex-1 min-w-[4px] sm:min-w-[6px] h-[22px] rounded-sm bg-muted">
-                <span class="bar-tooltip">No data</span>
+            {#each Array(Math.max(0, WINDOW_BARS - monitor.uptimeHistory.length)) as _}
+              <div class="bar-cell bar-empty flex-1 min-w-[4px] sm:min-w-[6px] h-[22px] rounded-sm">
+                <span class="bar-tooltip">No monitoring data</span>
               </div>
             {/each}
-            {#each monitor.uptimeHistory.slice(-45) as bucket}
+            {#each monitor.uptimeHistory.slice(-WINDOW_BARS) as bucket}
               <div class="bar-cell flex-1 min-w-[4px] sm:min-w-[6px] h-[22px] rounded-sm {barColor(bucket.uptimePct)} transition-colors hover:brightness-110">
-                <span class="bar-tooltip">{new Date(bucket.bucket).toLocaleDateString()}<br/>{pct(bucket.uptimePct).toFixed(1)}%</span>
+                <span class="bar-tooltip">{new Date(bucket.bucket).toLocaleDateString('en-US')}<br/>{pct(bucket.uptimePct).toFixed(1)}%</span>
               </div>
             {/each}
           </div>
           <div class="mt-1.5 flex justify-between text-[10px] text-muted-foreground">
-            <span>45d ago</span>
+            <span>{oldestBarLabel(monitor.uptimeHistory)}</span>
             <span>Now</span>
           </div>
         </div>
@@ -369,7 +378,7 @@
             <div class="rounded-lg border bg-card px-4 py-3">
               <div class="flex items-center justify-between mb-1">
                 <p class="text-sm font-medium">{incident.title}</p>
-                <span class="text-xs text-muted-foreground">{new Date(incident.resolvedAt ?? incident.createdAt).toLocaleDateString()}</span>
+                <span class="text-xs text-muted-foreground">{new Date(incident.resolvedAt ?? incident.createdAt).toLocaleDateString('en-US')}</span>
               </div>
               {#if incident.updates.length > 0}
                 <div class="space-y-1 border-l-2 border-muted pl-3 mt-2">
@@ -377,7 +386,7 @@
                     <div>
                       <div class="flex items-center gap-1.5">
                         <span class="text-xs font-medium uppercase text-muted-foreground">{update.status}</span>
-                        <span class="text-xs text-muted-foreground">{new Date(update.createdAt).toLocaleString()}</span>
+                        <span class="text-xs text-muted-foreground">{new Date(update.createdAt).toLocaleString('en-US')}</span>
                       </div>
                       <p class="text-xs text-muted-foreground">{update.message}</p>
                     </div>
@@ -391,7 +400,7 @@
     {/if}
 
     <div class="mt-8 text-center text-xs text-muted-foreground space-y-1.5">
-      <p>Last updated {new Date(data.lastUpdated).toLocaleString()}</p>
+      <p>Last updated {new Date(data.lastUpdated).toLocaleString('en-US')}</p>
       <p>
         Powered by
         <a href="https://logtide.dev" class="font-medium text-primary hover:underline underline-offset-2">LogTide</a>
@@ -406,6 +415,11 @@
     cursor: default;
   }
 
+  .bar-empty {
+    background-color: hsl(var(--muted) / 0.4);
+    border: 1px dashed hsl(var(--border));
+  }
+
   .bar-tooltip {
     display: none;
     position: absolute;

From f6a74b60aabd45139f710f821cfbb67d5f3cd2b7 Mon Sep 17 00:00:00 2001
From: Polliog <polliogiuseppe@live.it>
Date: Sat, 20 Jun 2026 21:47:24 +0200
Subject: [PATCH 05/10] add single-use stream tickets backend

---
 .../backend/migrations/049_stream_tickets.sql | 16 +++++
 packages/backend/src/database/types.ts        |  8 +++
 .../modules/streaming/stream-ticket-routes.ts | 45 ++++++++++++++
 .../streaming/stream-ticket-service.ts        | 62 +++++++++++++++++++
 packages/backend/src/server.ts                |  2 +
 5 files changed, 133 insertions(+)
 create mode 100644 packages/backend/migrations/049_stream_tickets.sql
 create mode 100644 packages/backend/src/modules/streaming/stream-ticket-routes.ts
 create mode 100644 packages/backend/src/modules/streaming/stream-ticket-service.ts

diff --git a/packages/backend/migrations/049_stream_tickets.sql b/packages/backend/migrations/049_stream_tickets.sql
new file mode 100644
index 00000000..ee1534f0
--- /dev/null
+++ b/packages/backend/migrations/049_stream_tickets.sql
@@ -0,0 +1,16 @@
+-- migrations/049_stream_tickets.sql
+-- Short-lived, single-use tickets for browser streaming endpoints (WebSocket
+-- live-tail and SSE). EventSource/WebSocket cannot send Authorization headers,
+-- so the browser used to put the long-lived session token in the URL query
+-- string, where reverse proxies and servers log it. Instead the client now
+-- mints a short-lived ticket via an authenticated request and passes the ticket
+-- in the stream URL; it is consumed (deleted) on first use.
+
+CREATE TABLE IF NOT EXISTS stream_tickets (
+  ticket TEXT PRIMARY KEY,
+  user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  expires_at TIMESTAMPTZ NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_stream_tickets_expires_at ON stream_tickets (expires_at);
diff --git a/packages/backend/src/database/types.ts b/packages/backend/src/database/types.ts
index b68939d2..f2725c6f 100644
--- a/packages/backend/src/database/types.ts
+++ b/packages/backend/src/database/types.ts
@@ -106,6 +106,13 @@ export interface SessionsTable {
   created_at: Generated<Timestamp>;
 }
 
+export interface StreamTicketsTable {
+  ticket: string;
+  user_id: string;
+  expires_at: Timestamp;
+  created_at: Generated<Timestamp>;
+}
+
 export interface OrganizationsTable {
   id: Generated<string>;
   name: string;
@@ -1116,6 +1123,7 @@ export interface Database {
   logs: LogsTable;
   users: UsersTable;
   sessions: SessionsTable;
+  stream_tickets: StreamTicketsTable;
   organizations: OrganizationsTable;
   organization_members: OrganizationMembersTable;
   organization_invitations: OrganizationInvitationsTable;
diff --git a/packages/backend/src/modules/streaming/stream-ticket-routes.ts b/packages/backend/src/modules/streaming/stream-ticket-routes.ts
new file mode 100644
index 00000000..0ca93c60
--- /dev/null
+++ b/packages/backend/src/modules/streaming/stream-ticket-routes.ts
@@ -0,0 +1,45 @@
+import type { FastifyPluginAsync } from 'fastify';
+import { settingsService } from '../settings/service.js';
+import { bootstrapService } from '../bootstrap/service.js';
+import { streamTicketService } from './stream-ticket-service.js';
+
+/**
+ * POST /api/v1/stream-tickets
+ *
+ * Mint a short-lived, single-use ticket for the authenticated user. The client
+ * passes the returned ticket (instead of the session token) in WebSocket/SSE
+ * stream URLs, so the long-lived session token never appears in a URL.
+ *
+ * Registered after the auth plugin, so the request is already authenticated via
+ * the normal Authorization: Bearer header.
+ */
+const streamTicketRoutes: FastifyPluginAsync = async (fastify) => {
+  fastify.post(
+    '/api/v1/stream-tickets',
+    {
+      config: { rateLimit: { max: 60, timeWindow: '1 minute' } },
+    },
+    async (request: any, reply) => {
+      let userId: string | undefined = request.user?.id;
+
+      // Auth-free mode: the auth plugin marks the request authenticated without
+      // attaching a user, so fall back to the configured default user.
+      if (!userId) {
+        const authMode = await settingsService.getAuthMode();
+        if (authMode === 'none') {
+          const defaultUser = await bootstrapService.getDefaultUser();
+          userId = defaultUser?.id;
+        }
+      }
+
+      if (!userId) {
+        return reply.code(401).send({ error: 'Unauthorized' });
+      }
+
+      const { ticket, expiresInSeconds } = await streamTicketService.createTicket(userId);
+      return reply.send({ ticket, expiresInSeconds });
+    }
+  );
+};
+
+export default streamTicketRoutes;
diff --git a/packages/backend/src/modules/streaming/stream-ticket-service.ts b/packages/backend/src/modules/streaming/stream-ticket-service.ts
new file mode 100644
index 00000000..1719d688
--- /dev/null
+++ b/packages/backend/src/modules/streaming/stream-ticket-service.ts
@@ -0,0 +1,62 @@
+import { randomBytes } from 'crypto';
+import { db } from '../../database/index.js';
+
+/**
+ * Short-lived, single-use tickets for browser streaming endpoints.
+ *
+ * Browser WebSocket and EventSource APIs cannot set request headers, so they
+ * cannot send the session token as `Authorization: Bearer`. Putting the
+ * long-lived session token in the URL query string leaks it into reverse-proxy
+ * and server access logs. Instead the client makes an authenticated request to
+ * mint a ticket and passes the ticket (not the session token) in the stream URL.
+ *
+ * Tickets are stored in the relational database (not Redis) so the mechanism
+ * works regardless of the configured queue backend (BullMQ or graphile-worker).
+ */
+
+// Tickets are meant to be redeemed immediately after minting; keep the window short.
+const TICKET_TTL_MS = 30_000;
+
+export const streamTicketService = {
+  /**
+   * Create a single-use ticket bound to the given user. Best-effort prunes
+   * expired tickets so the table stays small.
+   */
+  async createTicket(userId: string): Promise<{ ticket: string; expiresInSeconds: number }> {
+    const ticket = randomBytes(32).toString('hex');
+    const expiresAt = new Date(Date.now() + TICKET_TTL_MS);
+
+    await db
+      .insertInto('stream_tickets')
+      .values({ ticket, user_id: userId, expires_at: expiresAt })
+      .execute();
+
+    // Best-effort cleanup of expired tickets (ignore failures).
+    try {
+      await db.deleteFrom('stream_tickets').where('expires_at', '<', new Date()).execute();
+    } catch {
+      // non-fatal
+    }
+
+    return { ticket, expiresInSeconds: Math.floor(TICKET_TTL_MS / 1000) };
+  },
+
+  /**
+   * Atomically consume a ticket. Returns the bound userId if the ticket exists
+   * and has not expired, otherwise null. The ticket is deleted whether or not it
+   * was valid for that value, so it can never be redeemed twice.
+   */
+  async consumeTicket(ticket: string): Promise<string | null> {
+    if (!ticket) return null;
+
+    const row = await db
+      .deleteFrom('stream_tickets')
+      .where('ticket', '=', ticket)
+      .returning(['user_id', 'expires_at'])
+      .executeTakeFirst();
+
+    if (!row) return null;
+    if (new Date(row.expires_at) < new Date()) return null;
+    return row.user_id;
+  },
+};
diff --git a/packages/backend/src/server.ts b/packages/backend/src/server.ts
index 5edc324c..a20173fb 100644
--- a/packages/backend/src/server.ts
+++ b/packages/backend/src/server.ts
@@ -53,6 +53,7 @@ import internalLoggingPlugin from './plugins/internal-logging-plugin.js';
 import { initializeInternalLogging, shutdownInternalLogging } from './utils/internal-logger.js';
 import websocketPlugin from './plugins/websocket.js';
 import websocketRoutes from './modules/query/websocket.js';
+import streamTicketRoutes from './modules/streaming/stream-ticket-routes.js';
 import { enrichmentService } from './modules/siem/enrichment-service.js';
 import { validateStorageConfig } from './database/storage-config.js';
 import { shutdownReservoir } from './database/reservoir.js';
@@ -197,6 +198,7 @@ export async function build(opts = {}) {
 
   await fastify.register(authPlugin);
   await fastify.register(contextPlugin);
+  await fastify.register(streamTicketRoutes);
   await fastify.register(ingestionRoutes);
   await fastify.register(queryRoutes);
   await fastify.register(correlationRoutes, { prefix: '/api' });

From 1b2c8edd95ce9a7f6cc0cb58d150fbfbb4427d4f Mon Sep 17 00:00:00 2001
From: Polliog <polliogiuseppe@live.it>
Date: Sat, 20 Jun 2026 21:47:24 +0200
Subject: [PATCH 06/10] auth live streams via ticket instead of url token

---
 packages/backend/src/modules/auth/plugin.ts   | 28 +++++++++++
 .../backend/src/modules/query/websocket.ts    | 46 +++++++++++--------
 .../backend/src/modules/siem/sse-events.ts    | 26 +++++++++--
 3 files changed, 77 insertions(+), 23 deletions(-)

diff --git a/packages/backend/src/modules/auth/plugin.ts b/packages/backend/src/modules/auth/plugin.ts
index b498f43e..f4241af7 100644
--- a/packages/backend/src/modules/auth/plugin.ts
+++ b/packages/backend/src/modules/auth/plugin.ts
@@ -5,6 +5,7 @@ import { apiKeysService } from '../api-keys/service.js';
 import { usersService } from '../users/service.js';
 import { settingsService } from '../settings/service.js';
 import { bootstrapService } from '../bootstrap/service.js';
+import { streamTicketService } from '../streaming/stream-ticket-service.js';
 
 declare module 'fastify' {
   interface FastifyRequest {
@@ -94,6 +95,33 @@ const authPlugin: FastifyPluginAsync = async (fastify) => {
     const apiKey = request.headers['x-api-key'] as string;
     const authHeader = request.headers['authorization'] as string;
     const tokenParam = (request.query as any)?.token as string | undefined;
+    const ticketParam = (request.query as any)?.ticket as string | undefined;
+
+    // 0. Try a single-use stream ticket first (for WebSocket/SSE - the browser
+    // cannot send headers, and this avoids putting the session token in the URL).
+    if (ticketParam) {
+      const userId = await streamTicketService.consumeTicket(ticketParam);
+      if (!userId) {
+        reply.code(401).send({
+          error: 'Unauthorized',
+          message: 'Invalid or expired stream ticket',
+        });
+        return;
+      }
+
+      const user = await usersService.getUserById(userId);
+      if (!user) {
+        reply.code(401).send({
+          error: 'Unauthorized',
+          message: 'Invalid or expired stream ticket',
+        });
+        return;
+      }
+
+      request.authenticated = true;
+      (request as any).user = user;
+      return;
+    }
 
     // 1. Try token from query param first (for SSE - EventSource can't send headers)
     if (tokenParam) {
diff --git a/packages/backend/src/modules/query/websocket.ts b/packages/backend/src/modules/query/websocket.ts
index 4e3ba3d3..6bee987f 100644
--- a/packages/backend/src/modules/query/websocket.ts
+++ b/packages/backend/src/modules/query/websocket.ts
@@ -35,36 +35,44 @@ const websocketRoutes: FastifyPluginAsync = async (fastify) => {
       token?: string;
     };
 
-    // Verify authentication token
-    if (!token) {
-      socket.close(1008, 'Authentication token required');
-      return;
-    }
-
     if (!projectId) {
       socket.close(1008, 'ProjectId required');
       return;
     }
 
-    // Verify session token (reuse session validation logic) and that the
-    // authenticated user actually has access to the requested project. The REST
+    // The auth plugin runs onRequest for this upgrade and authenticates via the
+    // single-use stream ticket (?ticket=) or a legacy session token (?token=),
+    // attaching the user to the request. Prefer that. Fall back to validating a
+    // session token directly only if no user was attached. Either way, verify the
+    // authenticated user actually has access to the requested project: the REST
     // log/trace/metric routes all gate on verifyProjectAccess; without the same
     // check here, any authenticated user could live-tail any project's logs by
     // passing a foreign projectId (cross-tenant leak).
     try {
-      const session = await db
-        .selectFrom('sessions')
-        .innerJoin('users', 'users.id', 'sessions.user_id')
-        .select(['users.id as userId', 'sessions.expires_at'])
-        .where('sessions.token', '=', token)
-        .executeTakeFirst();
-
-      if (!session || new Date(session.expires_at) < new Date()) {
-        socket.close(1008, 'Invalid or expired authentication token');
-        return;
+      let userId: string | undefined = (req as any).user?.id;
+
+      if (!userId) {
+        if (!token) {
+          socket.close(1008, 'Authentication required');
+          return;
+        }
+
+        const session = await db
+          .selectFrom('sessions')
+          .innerJoin('users', 'users.id', 'sessions.user_id')
+          .select(['users.id as userId', 'sessions.expires_at'])
+          .where('sessions.token', '=', token)
+          .executeTakeFirst();
+
+        if (!session || new Date(session.expires_at) < new Date()) {
+          socket.close(1008, 'Invalid or expired authentication token');
+          return;
+        }
+
+        userId = session.userId;
       }
 
-      const hasAccess = await verifyProjectAccess(projectId, session.userId);
+      const hasAccess = await verifyProjectAccess(projectId, userId);
       if (!hasAccess) {
         socket.close(1008, 'Access denied for the requested project');
         return;
diff --git a/packages/backend/src/modules/siem/sse-events.ts b/packages/backend/src/modules/siem/sse-events.ts
index 0a4796ee..6ab6399d 100644
--- a/packages/backend/src/modules/siem/sse-events.ts
+++ b/packages/backend/src/modules/siem/sse-events.ts
@@ -6,6 +6,7 @@ import { UsersService } from '../users/service.js';
 import { db } from '../../database/index.js';
 import { settingsService } from '../settings/service.js';
 import { bootstrapService } from '../bootstrap/service.js';
+import { streamTicketService } from '../streaming/stream-ticket-service.js';
 
 const siemService = new SiemService(db);
 const organizationsService = new OrganizationsService();
@@ -43,11 +44,14 @@ export async function registerSiemSseRoutes(fastify: FastifyInstance) {
       schema: {
         querystring: {
           type: 'object',
-          required: ['organizationId', 'token'],
+          required: ['organizationId'],
           properties: {
             organizationId: { type: 'string', format: 'uuid' },
             projectId: { type: 'string', format: 'uuid' },
             incidentId: { type: 'string', format: 'uuid' },
+            // Either a single-use stream ticket (preferred) or a legacy session
+            // token must be provided; EventSource cannot send an auth header.
+            ticket: { type: 'string' },
             token: { type: 'string' },
           },
         },
@@ -59,7 +63,8 @@ export async function registerSiemSseRoutes(fastify: FastifyInstance) {
           organizationId: z.string().uuid(),
           projectId: z.string().uuid().optional(),
           incidentId: z.string().uuid().optional(),
-          token: z.string().min(1),
+          ticket: z.string().min(1).optional(),
+          token: z.string().min(1).optional(),
         });
 
         const query = schema.parse(request.query);
@@ -76,14 +81,27 @@ export async function registerSiemSseRoutes(fastify: FastifyInstance) {
               error: 'Auth-free mode enabled but default user not configured',
             });
           }
-        } else {
-          // Standard mode: validate session token
+        } else if (query.ticket) {
+          // Preferred: single-use stream ticket (keeps the session token out of the URL)
+          const userId = await streamTicketService.consumeTicket(query.ticket);
+          user = userId ? await usersService.getUserById(userId) : null;
+          if (!user) {
+            return reply.status(401).send({
+              error: 'Invalid or expired stream ticket',
+            });
+          }
+        } else if (query.token) {
+          // Legacy: validate session token from the query string
           user = await usersService.validateSession(query.token);
           if (!user) {
             return reply.status(401).send({
               error: 'Invalid or expired session token',
             });
           }
+        } else {
+          return reply.status(401).send({
+            error: 'A stream ticket or session token is required',
+          });
         }
 
         // Verify user is member of organization

From 5b40f8e31f94dc3dbe3966843e7d95e6104e7b39 Mon Sep 17 00:00:00 2001
From: Polliog <polliogiuseppe@live.it>
Date: Sat, 20 Jun 2026 21:47:24 +0200
Subject: [PATCH 07/10] test stream ticket auth chain

---
 .../modules/streaming/stream-tickets.test.ts  | 109 ++++++++++++++++++
 1 file changed, 109 insertions(+)
 create mode 100644 packages/backend/src/tests/modules/streaming/stream-tickets.test.ts

diff --git a/packages/backend/src/tests/modules/streaming/stream-tickets.test.ts b/packages/backend/src/tests/modules/streaming/stream-tickets.test.ts
new file mode 100644
index 00000000..4ca414d4
--- /dev/null
+++ b/packages/backend/src/tests/modules/streaming/stream-tickets.test.ts
@@ -0,0 +1,109 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import request from 'supertest';
+import type { FastifyInstance } from 'fastify';
+import { build } from '../../../server.js';
+import { db } from '../../../database/index.js';
+import { streamTicketService } from '../../../modules/streaming/stream-ticket-service.js';
+import { createTestContext } from '../../helpers/factories.js';
+import { createTestSession } from '../../helpers/auth.js';
+
+/**
+ * Stream tickets keep the long-lived session token out of WebSocket/SSE URLs.
+ * These cover the service (single-use, expiry) and the end-to-end auth chain:
+ * minting a ticket with a Bearer token, then redeeming it on a protected route
+ * via the ?ticket= query param handled by the auth plugin.
+ */
+describe('Stream tickets', () => {
+  let app: FastifyInstance;
+  let userId: string;
+  let projectId: string;
+  let sessionToken: string;
+
+  beforeEach(async () => {
+    const ctx = await createTestContext();
+    userId = ctx.user.id;
+    projectId = ctx.project.id;
+    const session = await createTestSession(userId);
+    sessionToken = session.token;
+
+    app = await build();
+    await app.ready();
+  });
+
+  describe('streamTicketService', () => {
+    it('mints a ticket that can be consumed exactly once', async () => {
+      const { ticket } = await streamTicketService.createTicket(userId);
+      expect(ticket).toMatch(/^[a-f0-9]{64}$/);
+
+      const first = await streamTicketService.consumeTicket(ticket);
+      expect(first).toBe(userId);
+
+      // Single use: the same ticket cannot be redeemed again.
+      const second = await streamTicketService.consumeTicket(ticket);
+      expect(second).toBeNull();
+    });
+
+    it('rejects an unknown ticket', async () => {
+      const result = await streamTicketService.consumeTicket('does-not-exist');
+      expect(result).toBeNull();
+    });
+
+    it('rejects an expired ticket', async () => {
+      const ticket = 'expired'.padEnd(64, '0');
+      await db
+        .insertInto('stream_tickets')
+        .values({ ticket, user_id: userId, expires_at: new Date(Date.now() - 1000) })
+        .execute();
+
+      const result = await streamTicketService.consumeTicket(ticket);
+      expect(result).toBeNull();
+    });
+  });
+
+  describe('POST /api/v1/stream-tickets', () => {
+    it('mints a ticket for an authenticated session', async () => {
+      const response = await request(app.server)
+        .post('/api/v1/stream-tickets')
+        .set('Authorization', `Bearer ${sessionToken}`)
+        .expect(200);
+
+      expect(response.body.ticket).toMatch(/^[a-f0-9]{64}$/);
+      expect(response.body.expiresInSeconds).toBeGreaterThan(0);
+
+      // The minted ticket resolves to the authenticated user.
+      const resolved = await streamTicketService.consumeTicket(response.body.ticket);
+      expect(resolved).toBe(userId);
+    });
+
+    it('rejects an unauthenticated request', async () => {
+      await request(app.server).post('/api/v1/stream-tickets').expect(401);
+    });
+  });
+
+  describe('ticket auth on protected routes', () => {
+    it('authenticates a request via ?ticket= and does not leak the session token', async () => {
+      const { ticket } = await streamTicketService.createTicket(userId);
+
+      // A protected route (logs query) accepts the ticket in place of credentials.
+      await request(app.server)
+        .get('/api/v1/logs')
+        .query({ projectId, ticket })
+        .expect(200);
+    });
+
+    it('rejects an invalid ticket on a protected route', async () => {
+      await request(app.server)
+        .get('/api/v1/logs')
+        .query({ projectId, ticket: 'invalid-ticket' })
+        .expect(401);
+    });
+
+    it('rejects reuse of a ticket on a protected route (single use)', async () => {
+      const { ticket } = await streamTicketService.createTicket(userId);
+
+      await request(app.server).get('/api/v1/logs').query({ projectId, ticket }).expect(200);
+      // The auth plugin consumed the ticket on the first request.
+      await request(app.server).get('/api/v1/logs').query({ projectId, ticket }).expect(401);
+    });
+  });
+});

From 6b28005a4450b162dfdb029c6ada12e2bdc89720 Mon Sep 17 00:00:00 2001
From: Polliog <polliogiuseppe@live.it>
Date: Sat, 20 Jun 2026 21:47:24 +0200
Subject: [PATCH 08/10] frontend live tail uses stream tickets not token in url

---
 packages/frontend/src/lib/api/logs.ts         | 11 ++++----
 .../frontend/src/lib/api/stream-tickets.ts    | 26 +++++++++++++++++++
 packages/frontend/src/lib/api/traces.ts       | 11 +++++---
 packages/frontend/src/lib/stores/siem.ts      | 16 ++++++++++--
 .../src/routes/dashboard/search/+page.svelte  | 14 ++++++++--
 .../src/routes/dashboard/traces/+page.svelte  | 14 ++++++++--
 6 files changed, 77 insertions(+), 15 deletions(-)
 create mode 100644 packages/frontend/src/lib/api/stream-tickets.ts

diff --git a/packages/frontend/src/lib/api/logs.ts b/packages/frontend/src/lib/api/logs.ts
index cc68d9cf..8faceb2a 100644
--- a/packages/frontend/src/lib/api/logs.ts
+++ b/packages/frontend/src/lib/api/logs.ts
@@ -1,5 +1,6 @@
 import { getApiBaseUrl, getApiUrl } from '$lib/config';
 import { getAuthToken } from '$lib/utils/auth';
+import { requestStreamTicket } from './stream-tickets';
 import type { LogLevel, MetadataFilterInput } from '@logtide/shared';
 
 interface LogEntry {
@@ -165,17 +166,17 @@ export class LogsAPI {
     return response.json();
   }
 
-  createLogsWebSocket(filters: { service?: string; level?: string; hostname?: string; projectId: string }): WebSocket {
+  async createLogsWebSocket(filters: { service?: string; level?: string; hostname?: string; projectId: string }): Promise<WebSocket> {
     const params = new URLSearchParams();
     params.append('projectId', filters.projectId);
     if (filters.service) params.append('service', filters.service);
     if (filters.level) params.append('level', filters.level);
     if (filters.hostname) params.append('hostname', filters.hostname);
 
-    const token = this.getToken();
-    if (token) {
-      params.append('token', token);
-    }
+    // Pass a short-lived single-use ticket instead of the session token so the
+    // long-lived token never appears in the WebSocket URL (and thus in proxy logs).
+    const ticket = await requestStreamTicket(this.getToken());
+    params.append('ticket', ticket);
 
     const wsProtocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
     // getApiUrl() may be empty (same-origin reverse proxy) or a relative path, in
diff --git a/packages/frontend/src/lib/api/stream-tickets.ts b/packages/frontend/src/lib/api/stream-tickets.ts
new file mode 100644
index 00000000..8e2392da
--- /dev/null
+++ b/packages/frontend/src/lib/api/stream-tickets.ts
@@ -0,0 +1,26 @@
+import { getApiBaseUrl } from '$lib/config';
+
+/**
+ * Mint a short-lived, single-use stream ticket for the current session.
+ *
+ * Browser WebSocket and EventSource APIs cannot set an Authorization header, so
+ * stream URLs historically carried the session token in the query string, where
+ * reverse proxies and servers log it. Instead, callers fetch a ticket via this
+ * authenticated request and pass the ticket (not the token) in the stream URL.
+ */
+export async function requestStreamTicket(token: string | null): Promise<string> {
+  const response = await fetch(`${getApiBaseUrl()}/stream-tickets`, {
+    method: 'POST',
+    headers: token ? { Authorization: `Bearer ${token}` } : {},
+  });
+
+  if (!response.ok) {
+    throw new Error(`Failed to obtain stream ticket: ${response.status}`);
+  }
+
+  const data = await response.json().catch(() => ({}));
+  if (!data.ticket) {
+    throw new Error('Stream ticket response did not include a ticket');
+  }
+  return data.ticket as string;
+}
diff --git a/packages/frontend/src/lib/api/traces.ts b/packages/frontend/src/lib/api/traces.ts
index b26be3a1..ae74dc2e 100644
--- a/packages/frontend/src/lib/api/traces.ts
+++ b/packages/frontend/src/lib/api/traces.ts
@@ -1,5 +1,6 @@
 import { getApiBaseUrl } from '$lib/config';
 import { getAuthToken } from '$lib/utils/auth';
+import { requestStreamTicket } from './stream-tickets';
 
 export interface TraceRecord {
   trace_id: string;
@@ -227,11 +228,11 @@ export class TracesAPI {
    * the traces query (projectId, service, error). Returns an EventSource the
    * caller is responsible for closing.
    */
-  createTracesEventSource(filters: {
+  async createTracesEventSource(filters: {
     projectId: string;
     service?: string | string[];
     error?: boolean;
-  }): EventSource {
+  }): Promise<EventSource> {
     const params = new URLSearchParams();
     params.append('projectId', filters.projectId);
     if (filters.service) {
@@ -239,8 +240,10 @@ export class TracesAPI {
       if (services.length > 0) params.append('service', services.join(','));
     }
     if (filters.error !== undefined) params.append('error', String(filters.error));
-    const token = this.getToken();
-    if (token) params.append('token', token);
+    // Use a short-lived single-use ticket instead of the session token so the
+    // token never appears in the SSE URL (and thus in proxy/server logs).
+    const ticket = await requestStreamTicket(this.getToken());
+    params.append('ticket', ticket);
     const url = `${getApiBaseUrl()}/traces/stream?${params.toString()}`;
     return new EventSource(url, { withCredentials: true });
   }
diff --git a/packages/frontend/src/lib/stores/siem.ts b/packages/frontend/src/lib/stores/siem.ts
index 08286d2f..cc446611 100644
--- a/packages/frontend/src/lib/stores/siem.ts
+++ b/packages/frontend/src/lib/stores/siem.ts
@@ -9,6 +9,7 @@ import {
 } from '$lib/api/siem';
 import { getApiUrl } from '$lib/config';
 import { getAuthToken } from '$lib/utils/auth';
+import { requestStreamTicket } from '$lib/api/stream-tickets';
 
 // ============================================================================
 // TYPES
@@ -187,7 +188,7 @@ function createSiemStore() {
 		// Real-time Methods (SSE)
 		// ========================================
 
-		startRealtimeUpdates(organizationId: string, incidentId?: string): void {
+		async startRealtimeUpdates(organizationId: string, incidentId?: string): Promise<void> {
 			const currentState = get({ subscribe });
 
 			// Close existing connection
@@ -203,8 +204,19 @@ function createSiemStore() {
 				params.append('incidentId', incidentId);
 			}
 
+			// Use a short-lived single-use ticket instead of the session token so the
+			// token never appears in the SSE URL (and thus in proxy/server logs).
+			let ticket: string;
+			try {
+				ticket = await requestStreamTicket(token);
+			} catch (error) {
+				console.error('Failed to obtain SIEM stream ticket:', error);
+				return;
+			}
+			params.append('ticket', ticket);
+
 			const eventSource = new EventSource(
-				`${getApiUrl()}/api/v1/siem/events?${params.toString()}&token=${token}`
+				`${getApiUrl()}/api/v1/siem/events?${params.toString()}`
 			);
 
 			eventSource.onmessage = (event) => {
diff --git a/packages/frontend/src/routes/dashboard/search/+page.svelte b/packages/frontend/src/routes/dashboard/search/+page.svelte
index 8adc8418..b43b795c 100644
--- a/packages/frontend/src/routes/dashboard/search/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/search/+page.svelte
@@ -694,12 +694,14 @@
   });
 
   let ws: WebSocket | null = null;
+  let liveTailSeq = 0;
 
-  function startLiveTail() {
+  async function startLiveTail() {
     if (selectedProjects.length !== 1) return; // Live tail only works with single project
 
+    const seq = ++liveTailSeq;
     try {
-      const socket = logsAPI.createLogsWebSocket({
+      const socket = await logsAPI.createLogsWebSocket({
         projectId: selectedProjects[0],
         service:
           selectedServices.length === 1 ? selectedServices[0] : undefined,
@@ -708,6 +710,13 @@
           selectedHostnames.length === 1 ? selectedHostnames[0] : undefined,
       });
 
+      // A newer start/stop happened while the ticket request was in flight: drop
+      // this now-stale socket instead of leaking it.
+      if (seq !== liveTailSeq) {
+        socket.close();
+        return;
+      }
+
       socket.onmessage = (event) => {
         try {
           const data = JSON.parse(event.data);
@@ -774,6 +783,7 @@
   }
 
   function stopLiveTail() {
+    liveTailSeq++;
     if (ws) {
       ws.close();
       ws = null;
diff --git a/packages/frontend/src/routes/dashboard/traces/+page.svelte b/packages/frontend/src/routes/dashboard/traces/+page.svelte
index e493f232..441cdc35 100644
--- a/packages/frontend/src/routes/dashboard/traces/+page.svelte
+++ b/packages/frontend/src/routes/dashboard/traces/+page.svelte
@@ -99,6 +99,7 @@
   let liveTailLimit = $state(100);
   let liveTailConnectionKey = $state<string | null>(null);
   let tracesEventSource: EventSource | null = null;
+  let liveTailSeq = 0;
 
   // Row expansion + keyboard nav
   let expandedTraceIds = $state<Set<string>>(new Set());
@@ -425,15 +426,23 @@
     liveTailConnectionKey = key;
   });
 
-  function startLiveTail() {
+  async function startLiveTail() {
     if (!selectedProject) return;
+    const seq = ++liveTailSeq;
     try {
-      const es = tracesAPI.createTracesEventSource({
+      const es = await tracesAPI.createTracesEventSource({
         projectId: selectedProject,
         service: selectedServices.length > 0 ? selectedServices : undefined,
         error: statusFilter === 'errors' ? true : statusFilter === 'ok' ? false : undefined,
       });
 
+      // A newer start/stop happened while the ticket request was in flight: drop
+      // this now-stale stream instead of leaking it.
+      if (seq !== liveTailSeq) {
+        es.close();
+        return;
+      }
+
       es.onmessage = (event) => {
         try {
           const data = JSON.parse(event.data);
@@ -468,6 +477,7 @@
   }
 
   function stopLiveTail() {
+    liveTailSeq++;
     if (tracesEventSource) {
       tracesEventSource.close();
       tracesEventSource = null;

From a72068333010b8aac65ab4138485725a2fa16c32 Mon Sep 17 00:00:00 2001
From: Polliog <polliogiuseppe@live.it>
Date: Sat, 20 Jun 2026 22:23:36 +0200
Subject: [PATCH 09/10] add global 401 handler via fetch interceptor

---
 .../frontend/src/lib/api/fetch-interceptor.ts | 87 +++++++++++++++++++
 packages/frontend/src/routes/+layout.svelte   |  4 +
 2 files changed, 91 insertions(+)
 create mode 100644 packages/frontend/src/lib/api/fetch-interceptor.ts

diff --git a/packages/frontend/src/lib/api/fetch-interceptor.ts b/packages/frontend/src/lib/api/fetch-interceptor.ts
new file mode 100644
index 00000000..32dd038a
--- /dev/null
+++ b/packages/frontend/src/lib/api/fetch-interceptor.ts
@@ -0,0 +1,87 @@
+import { goto } from '$app/navigation';
+import { authStore } from '$lib/stores/auth';
+import { getAuthToken } from '$lib/utils/auth';
+
+/**
+ * Global 401 handler.
+ *
+ * The ~30 API client wrappers all call window.fetch directly and there is no
+ * shared HTTP client to hook into. Rather than route every client through a new
+ * wrapper, we install a single fetch interceptor once at app startup: when any
+ * authenticated API request comes back 401 (revoked or expired session), we
+ * clear the local auth state and bounce the user to the login page, preserving
+ * where they were so they land back there after signing in.
+ *
+ * Without this, a dead session was only detected on a full dashboard remount, so
+ * a user could keep clicking around a logged-out app getting silent failures.
+ */
+
+let installed = false;
+// Guards against a burst of concurrent 401s (e.g. several parallel requests)
+// all triggering a logout + navigation at once.
+let handling = false;
+
+function urlOf(input: RequestInfo | URL): string {
+  if (typeof input === 'string') return input;
+  if (input instanceof URL) return input.href;
+  if (input instanceof Request) return input.url;
+  return String(input);
+}
+
+function isApiRequest(url: string): boolean {
+  return url.includes('/api/v1/');
+}
+
+// Auth flows (login, register, OIDC, LDAP, admin auth) manage their own 401s and
+// must not be treated as an expired session.
+function isAuthEndpoint(url: string): boolean {
+  return url.includes('/auth/');
+}
+
+function handleUnauthorized(): void {
+  if (handling) return;
+  handling = true;
+
+  authStore.clearAuth();
+
+  const onLoginPage = window.location.pathname.startsWith('/login');
+  if (!onLoginPage) {
+    const current = window.location.pathname + window.location.search;
+    const target = `/login?redirect=${encodeURIComponent(current)}`;
+    // Prefer SvelteKit navigation; fall back to a hard redirect if it fails.
+    Promise.resolve(goto(target)).catch(() => {
+      window.location.href = target;
+    });
+  }
+
+  // Allow future handling once this logout cycle has settled.
+  window.setTimeout(() => {
+    handling = false;
+  }, 1000);
+}
+
+export function installAuthFetchInterceptor(): void {
+  if (installed || typeof window === 'undefined') return;
+  installed = true;
+
+  const originalFetch = window.fetch.bind(window);
+
+  window.fetch = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+    const response = await originalFetch(input, init);
+
+    try {
+      if (
+        response.status === 401 &&
+        getAuthToken() &&
+        isApiRequest(urlOf(input)) &&
+        !isAuthEndpoint(urlOf(input))
+      ) {
+        handleUnauthorized();
+      }
+    } catch {
+      // Never let interceptor logic break a fetch call.
+    }
+
+    return response;
+  };
+}
diff --git a/packages/frontend/src/routes/+layout.svelte b/packages/frontend/src/routes/+layout.svelte
index 56f000f6..4096e2f6 100644
--- a/packages/frontend/src/routes/+layout.svelte
+++ b/packages/frontend/src/routes/+layout.svelte
@@ -5,9 +5,13 @@
   import { afterNavigate } from "$app/navigation";
   import { hub } from "@logtide/core";
   import { createBoundaryHandler } from "@logtide/sveltekit";
+  import { installAuthFetchInterceptor } from "$lib/api/fetch-interceptor";
 
   const onerror = createBoundaryHandler('RootLayout');
 
+  // Install the global 401 handler once, before any API request fires.
+  installAuthFetchInterceptor();
+
   // Track client-side navigations as page views
   afterNavigate(({ to, type }) => {
     const client = hub.getClient();

From 6b5772b17804b1266d5069ba8e72d3f8e7501478 Mon Sep 17 00:00:00 2001
From: Polliog <polliogiuseppe@live.it>
Date: Sun, 21 Jun 2026 13:26:32 +0200
Subject: [PATCH 10/10] bump version to 1.0.2 and changelog

---
 CHANGELOG.md                                  | 26 +++++++++++++++++++
 README.md                                     |  6 ++---
 package.json                                  |  2 +-
 packages/backend/package.json                 |  2 +-
 packages/backend/src/utils/internal-logger.ts |  2 +-
 packages/frontend/package.json                |  2 +-
 packages/frontend/src/hooks.client.ts         |  2 +-
 packages/frontend/src/hooks.server.ts         |  2 +-
 .../frontend/src/lib/components/Footer.svelte |  2 +-
 packages/reservoir/package.json               |  2 +-
 packages/shared/package.json                  |  2 +-
 11 files changed, 38 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 85e05eba..5a17a7bc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,32 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+## [1.0.2] - 2026-06-22
+
+A frontend correctness and security release from a comprehensive multi-agent frontend bug hunt (UI, logic, reactivity, leaks and security), plus a hardening of how the browser authenticates the live-streaming endpoints. The headline item is single-use stream tickets: the session token no longer travels in WebSocket/SSE URLs (where reverse proxies log it). One additive database migration (`049_stream_tickets`); otherwise a drop-in upgrade.
+
+### Security
+- **Session token no longer placed in WebSocket/SSE URLs**: browser `WebSocket` and `EventSource` cannot send an `Authorization` header, so the log live-tail (`/api/v1/logs/ws`), the SIEM events stream (`/api/v1/siem/events`) and the trace live-tail (`/api/v1/traces/stream`) previously carried the long-lived session token in the URL query string, where it is logged by proxies and servers. The client now mints a short-lived, single-use **stream ticket** via an authenticated `POST /api/v1/stream-tickets` and passes that ticket instead. Tickets live in the relational database (not Redis, so the mechanism is portable across the BullMQ and graphile queue backends), expire in 30s and are consumed on first use. The legacy `?token=` path still works for backward compatibility
+- **Webhook channel secrets no longer rehydrated into the DOM**: editing a notification channel no longer pre-fills the bearer token / basic-auth password inputs with the stored secret; the fields stay empty with a "leave blank to keep current" hint and are only sent when the user types a new value
+- **OIDC callback strips the session token from the URL** after reading it, so it no longer lingers in browser history, the referrer or logs
+- **Admin pages enforce a client-side admin guard**: several admin views (user detail, usage, organization detail) loaded and could mutate data on mount without checking the admin role; they now redirect non-admins, and the admin section layout has a guard of its own
+- **Removed a debug `console.log`** that leaked log message content and api-key metadata to the browser console on the error-detail page
+
+### Added
+- **Global 401 handler**: a single fetch interceptor installed at app startup clears local auth state and redirects to the login page (preserving the current path so the user lands back there after signing in) on any authenticated `/api/v1` 401 that is not an auth endpoint. Previously a revoked or expired session was only detected on a full dashboard remount, so a logged-out user could keep clicking around getting silent failures
+- **`POST /api/v1/stream-tickets`** endpoint and `stream_tickets` table (migration 049) backing the stream-ticket auth described above
+
+### Fixed
+- **Stale-response races**: overlapping loads triggered by fast filter/pagination changes could let an older in-flight response overwrite fresher results. Added local request-sequence guards on the log search, traces list, error groups, SIEM incidents, monitor detail/list, custom-dashboard panels and alert-preview views
+- **API client error handling**: error-branch `response.json()` calls are guarded so a non-JSON error body (reverse-proxy 502/HTML, empty `204`) no longer throws a `SyntaxError` that masks the real HTTP failure (auth, admin and exceptions clients)
+- **Locale-stable formatting**: user-facing dates and numbers now use explicit `en-US` formatting across the status pages, members, project settings, traces, metrics, search and notification-channel views; alert-history timestamps no longer label UTC values as if they were local time
+- **Lifecycle and memory leaks**: component store subscriptions are auto-managed, a first-run shortcut-hint `setTimeout` is cleared on unmount, and chart instances are disposed, so navigating away no longer leaves timers, listeners or subscriptions behind
+- **Svelte 5 reactivity and assorted UI fixes**: the trace detail page reloads when navigating between traces; the api-key DSN preserves an `http://` scheme for non-TLS deployments; the "View Error Group" action navigates with a param the target page actually reads; SigmaSync no longer crashes when a commit hash is absent; the toaster follows the app theme; the delete-organization confirm is disabled while in flight; PII masking rules require a regex or field names; numeric monitor inputs guard against `NaN`; and the audit-log resource cell no longer renders a literal escape sequence
+- **ClickHouse**: materialized-view backfills now run once instead of on every startup
+
+### Notes
+- Left intentionally unchanged: storing the session token in `localStorage` (a disputed, low-severity finding). Moving it to an httpOnly cookie would trade XSS token-theft for CSRF surface and a full auth-model overhaul without a clear net win; the high-leverage XSS defenses (CSP, output sanitization, auditing the few `{@html}` sites) are tracked separately
+
 ## [1.0.1] - 2026-06-19
 
 A security and correctness release from a comprehensive, multi-engine bug audit of the 1.0 line. The headline items are two cross-tenant data-exposure fixes that were live in 1.0.0, alongside a broad sweep of detection, ingestion, storage, alerting and frontend correctness fixes. No database migrations; this is a drop-in upgrade. The storage-layer fixes were validated against real ClickHouse and MongoDB (and TimescaleDB), and CI now runs the MongoDB reservoir integration suite.
diff --git a/README.md b/README.md
index 5a229f74..8c8ae6cd 100644
--- a/README.md
+++ b/README.md
@@ -16,14 +16,14 @@
   <a href="https://codecov.io/gh/logtide-dev/logtide"><img src="https://codecov.io/gh/logtide-dev/logtide/branch/main/graph/badge.svg" alt="Coverage"></a>
   <a href="https://hub.docker.com/r/logtide/backend"><img src="https://img.shields.io/docker/v/logtide/backend?label=docker&logo=docker" alt="Docker"></a>
   <a href="https://artifacthub.io/packages/helm/logtide/logtide"><img src="https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/logtide" alt="Artifact Hub"></a>
-  <img src="https://img.shields.io/badge/version-1.0.1-blue.svg" alt="Version">
+  <img src="https://img.shields.io/badge/version-1.0.2-blue.svg" alt="Version">
   <img src="https://img.shields.io/badge/license-AGPLv3-blue.svg" alt="License">
   <img src="https://img.shields.io/badge/status-beta-success.svg" alt="Status">
 </div>
 
 <br />
 
-> **🌊 LogTide 1.0.1 (public beta):** unified **Logs, Traces & Metrics** with a built-in **SIEM**, multi-engine storage (TimescaleDB / ClickHouse / MongoDB), uptime monitoring, parsing pipelines, and custom dashboards.
+> **🌊 LogTide 1.0.2 (public beta):** unified **Logs, Traces & Metrics** with a built-in **SIEM**, multi-engine storage (TimescaleDB / ClickHouse / MongoDB), uptime monitoring, parsing pipelines, and custom dashboards.
 
 ---
 
@@ -124,7 +124,7 @@ We host it for you. Perfect for testing. [**Sign up at logtide.dev**](https://lo
 
 ---
 
-## ✨ Core Features (v1.0.1)
+## ✨ Core Features (v1.0.2)
 
 ### Monitoring, Pipelines & Dashboards
 * 🩺 **Uptime Monitoring & Status Pages:** HTTP/TCP/heartbeat monitors with configurable thresholds, auto-created SIEM incidents on failure, scheduled maintenances, and public Uptime-Kuma-style status pages per project.
diff --git a/package.json b/package.json
index e77fb4d9..00232a3a 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "logtide",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "private": true,
   "description": "LogTide - Self-hosted log management platform",
   "author": "LogTide Team",
diff --git a/packages/backend/package.json b/packages/backend/package.json
index 6b193d34..05198cc3 100644
--- a/packages/backend/package.json
+++ b/packages/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logtide/backend",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "private": true,
   "description": "LogTide Backend API",
   "type": "module",
diff --git a/packages/backend/src/utils/internal-logger.ts b/packages/backend/src/utils/internal-logger.ts
index 4572ddba..26c300f0 100644
--- a/packages/backend/src/utils/internal-logger.ts
+++ b/packages/backend/src/utils/internal-logger.ts
@@ -58,7 +58,7 @@ export async function initializeInternalLogging(): Promise<string | null> {
       dsn,
       service: process.env.SERVICE_NAME || 'logtide-backend',
       environment: process.env.NODE_ENV || 'development',
-      release: process.env.npm_package_version || '1.0.1',
+      release: process.env.npm_package_version || '1.0.2',
       batchSize: 5, // Smaller batch for internal logs to see them faster
       flushInterval: 5000,
       maxBufferSize: 1000,
diff --git a/packages/frontend/package.json b/packages/frontend/package.json
index 3b666d06..07c68938 100644
--- a/packages/frontend/package.json
+++ b/packages/frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logtide/frontend",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "private": true,
   "description": "LogTide Frontend Dashboard",
   "type": "module",
diff --git a/packages/frontend/src/hooks.client.ts b/packages/frontend/src/hooks.client.ts
index 44ce2978..f8f923d9 100644
--- a/packages/frontend/src/hooks.client.ts
+++ b/packages/frontend/src/hooks.client.ts
@@ -9,7 +9,7 @@ if (dsn) {
     dsn,
     service: 'logtide-frontend-client',
     environment: env.PUBLIC_NODE_ENV || 'production',
-    release: env.PUBLIC_APP_VERSION || '1.0.1',
+    release: env.PUBLIC_APP_VERSION || '1.0.2',
     debug: env.PUBLIC_NODE_ENV === 'development',
     browser: {
       // Core Web Vitals (LCP, INP, CLS, TTFB)
diff --git a/packages/frontend/src/hooks.server.ts b/packages/frontend/src/hooks.server.ts
index 2481d1dc..31b94ef5 100644
--- a/packages/frontend/src/hooks.server.ts
+++ b/packages/frontend/src/hooks.server.ts
@@ -82,7 +82,7 @@ export const handle = dsn
         dsn,
         service: 'logtide-frontend',
         environment: privateEnv?.NODE_ENV || 'production',
-        release: process.env.npm_package_version || '1.0.1',      }) as unknown as Handle,
+        release: process.env.npm_package_version || '1.0.2',      }) as unknown as Handle,
       requestLogHandle,
       configHandle
     )
diff --git a/packages/frontend/src/lib/components/Footer.svelte b/packages/frontend/src/lib/components/Footer.svelte
index 39ad4ff6..4ce73582 100644
--- a/packages/frontend/src/lib/components/Footer.svelte
+++ b/packages/frontend/src/lib/components/Footer.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
   import Github from "@lucide/svelte/icons/github";
 
-  const version = "Beta v1.0.1";
+  const version = "Beta v1.0.2";
   const currentYear = new Date().getFullYear();
   const githubUrl = "https://github.com/logtide-dev/logtide";
 </script>
diff --git a/packages/reservoir/package.json b/packages/reservoir/package.json
index 020f3cff..ac334236 100644
--- a/packages/reservoir/package.json
+++ b/packages/reservoir/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logtide/reservoir",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Pluggable storage abstraction for Logtide log management",
   "type": "module",
   "main": "./dist/index.js",
diff --git a/packages/shared/package.json b/packages/shared/package.json
index 8a8e9f8b..0c270b63 100644
--- a/packages/shared/package.json
+++ b/packages/shared/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logtide/shared",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "private": true,
   "description": "Shared types, schemas and utilities for LogTide",
   "type": "module",