Dataflow

.dockerignore

@@ -8,6 +8,7 @@
 !cli/
 !ee/
 !ee-stub/
+!dataflow/
 
 # Exclude test/dev artifacts within allowed directories
 **/node_modules

.gitignore

@@ -59,4 +59,17 @@ tools/docs-agent/.venv
 tools/docs-agent/runs/
 tools/
 .playwright-mcp
-dev_docs/
+dev_docs/
+dataflow/.next
+dataflow/build/
+*.env.local
+docs/superpowers/
+dataflow/docs/superpowers/
+
+# DataFlow derived files
+dataflow/public/monaco-editor/
+
+dataflow/.env
+
+.agents/
+.worktrees/

CLAUDE.md

@@ -1,6 +1,6 @@
 # WhoDB Development Guide
 
-WhoDB is a database management tool with a Go backend (`/core`) and React frontend (`/frontend`).
+WhoDB is a database management tool with a Go backend (`/core`) and two React frontends: the original management UI (`/frontend`) and the DataFlow analysis platform (`/dataflow`).
 
 ## Non-Negotiable Rules
 
@@ -28,11 +28,17 @@ core/                   # CE backend (Go)
   graph/schema.graphqls # GraphQL schema
   graph/*.resolvers.go  # GraphQL resolvers
 
-frontend/               # React/TypeScript
+frontend/               # Original management UI (React/TypeScript)
   src/index.tsx        # Entry point
   src/store/           # Redux Toolkit state
   src/generated/       # GraphQL codegen output (@graphql alias)
 
+dataflow/               # DataFlow analysis platform (React 19/TypeScript/Vite)
+  src/main.tsx         # Entry point
+  src/stores/          # Zustand state (auth, connection, tab, analysis)
+  src/generated/       # GraphQL codegen output (@/* alias)
+  src/components/      # layout, database views, analysis dashboard, editor, ui
+
 dev/                    # Docker compose, test scripts, sample data
 docs/                   # Integration plan and analysis
 ```
@@ -67,14 +73,26 @@ bash dev/run-backend-tests.sh all           # Unit + integration
 - `env` package is for pure env var declarations only (no `log` import). Functions that parse env vars and need `log` for error reporting go in `envconfig`
 - Delete build binaries after testing (`go build` artifacts)
 
-## When Working on Frontend (TypeScript)
+## When Working on Frontend — Original UI (`/frontend`)
 
 - Use PNPM, not NPM. Use pnpx, not npx
 - Define GraphQL operations in `.graphql` files, then run `pnpm run generate`
 - Import generated hooks from `@graphql` alias - never use inline `gql` strings
 - CE features in `frontend/src/`
+- State management: Redux Toolkit (`frontend/src/store/`)
 - **Keyboard shortcuts** are centralized in `frontend/src/utils/shortcuts.ts`. Never hardcode shortcut keys inline — use `SHORTCUTS.*` for definitions, `matchesShortcut()` for event handling, and `SHORTCUTS.*.displayKeys` for UI display. Platform-variant shortcuts (nav numbers) use `resolveShortcut()`
 
+## When Working on Frontend — DataFlow (`/dataflow`)
+
+- Use PNPM, not NPM. Use pnpx, not npx
+- Vite SPA with React 19, TypeScript, Tailwind CSS 4
+- State management: Zustand (`dataflow/src/stores/`)
+- Path alias: `@/*` maps to `src/` (configured in `vite.config.ts` and `tsconfig.json`)
+- Styling: `cn()` utility (clsx + tailwind-merge), CSS variables in `src/globals.css`
+- GraphQL codegen: define operations in `.graphql` files, run `pnpm run generate`
+- Key libraries: Monaco Editor, ECharts, react-grid-layout, xlsx
+- See `dataflow/CLAUDE.md` for full architecture details
+
 ## When Updating Dependencies
 
 Use `core/go.mod` as the reference point for dependency versions.
@@ -85,7 +103,8 @@ See `.claude/docs/commands.md` for full reference.
 
 ```bash
 # Backend: cd core && go run .
-# Frontend: cd frontend && pnpm start
+# Frontend (Original UI): cd frontend && pnpm start
+# Frontend (DataFlow): cd dataflow && pnpm dev
 ```
 
 ## Development Principles

Makefile

@@ -1,6 +1,7 @@
 SERVICE_NAME = whodb
 DOCKER_USERNAME ?=
 IMAGE_TAG ?= latest
+WHODB_AES_KEY ?=
 IMG ?= $(DOCKER_USERNAME)/$(SERVICE_NAME):$(IMAGE_TAG)
 
 .PHONY: all
@@ -35,3 +36,11 @@ docker-push: ## Push docker image.
 .PHONY: docker-build-push
 docker-build-push: ## Build and push docker image.
 	docker buildx build -f core/Dockerfile --platform linux/amd64 -t $(IMG) --push .
+
+.PHONY: docker-build-dataflow
+docker-build-dataflow: ## Build docker image with DataFlow frontend.
+	docker buildx build -f core/Dockerfile.dataflow --platform linux/amd64 --build-arg WHODB_AES_KEY=$(WHODB_AES_KEY) -t $(IMG) .
+
+.PHONY: docker-build-push-dataflow
+docker-build-push-dataflow: ## Build and push docker image with DataFlow frontend.
+	docker buildx build -f core/Dockerfile.dataflow --platform linux/amd64 --build-arg WHODB_AES_KEY=$(WHODB_AES_KEY) -t $(IMG) --push .

core/Dockerfile.dataflow

@@ -0,0 +1,82 @@
+# Copyright 2025 Clidey, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM node:25.6.0-alpine3.23 AS build-stage
+RUN npm i -g pnpm@10.29.3
+WORKDIR /app
+COPY ./dataflow/package.json ./dataflow/pnpm-lock.yaml ./
+RUN pnpm install
+COPY ./dataflow/ ./
+
+ARG VERSION=dev
+ENV VITE_APP_VERSION=${VERSION}
+ARG WHODB_AES_KEY
+RUN if [ -n "$WHODB_AES_KEY" ]; then echo "VITE_WHODB_AES_KEY=$WHODB_AES_KEY" >> .env; fi && \
+    pnpm run build
+ARG TARGETARCH
+ARG PLATFORM=docker
+
+FROM golang:1.26-alpine3.23 AS backend-stage
+RUN apk add --no-cache \
+	gcc \
+	musl-dev \
+	git \
+	ca-certificates \
+	curl
+WORKDIR /app
+
+# Copy core module files
+COPY ./core/go.mod ./core/go.sum ./
+RUN go mod download
+COPY ./core/ ./
+
+
+COPY --from=build-stage /app/build/ ./build/
+
+# Build backend with version and environment
+ARG VERSION
+ARG TARGETARCH
+ARG PLATFORM
+RUN CGO_CFLAGS="-Os -ffunction-sections -fdata-sections -fno-asynchronous-unwind-tables -fno-unwind-tables -flto -fvisibility=hidden" \
+	CGO_LDFLAGS="-Wl,--gc-sections -Wl,--as-needed -flto" \
+	CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} go build -tags prod -trimpath \
+	-ldflags="-s -w -X github.com/clidey/whodb/core/src/env.ApplicationVersion=${VERSION} -X github.com/clidey/whodb/core/src/env.ApplicationEnvironment=${PLATFORM}-${TARGETARCH}" \
+	-o /core
+
+# Pre-download BAML native library for the target architecture (musl for Alpine)
+# Extract BAML version from go.mod to stay in sync
+ARG TARGETARCH
+RUN BAML_VERSION=$(grep 'github.com/boundaryml/baml ' go.mod | awk '{print $2}' | sed 's/^v//') && \
+    if [ "$TARGETARCH" = "amd64" ]; then \
+        BAML_ARCH="x86_64"; \
+    elif [ "$TARGETARCH" = "arm64" ]; then \
+        BAML_ARCH="aarch64"; \
+    else \
+        echo "Unsupported architecture: $TARGETARCH" && exit 1; \
+    fi && \
+    mkdir -p /baml-lib && \
+    curl -L -o /baml-lib/libbaml_cffi.so \
+        https://github.com/boundaryml/baml/releases/download/${BAML_VERSION}/libbaml_cffi-${BAML_ARCH}-unknown-linux-musl.so && \
+    echo "Downloaded BAML musl library for ${BAML_ARCH}"
+
+FROM alpine:3.23
+RUN apk add --no-cache ca-certificates libgcc
+WORKDIR /app
+COPY --from=backend-stage /core /core
+# Copy BAML musl library and set path via env var
+# (BAML Go client's isMusl() is not implemented, so we must use BAML_LIBRARY_PATH)
+COPY --from=backend-stage /baml-lib/libbaml_cffi.so /usr/local/lib/libbaml_cffi.so
+ENV BAML_LIBRARY_PATH=/usr/local/lib/libbaml_cffi.so
+
+CMD ["/core"]

core/graph/dashboard_graphql_test.go

@@ -0,0 +1,144 @@
+package graph
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/99designs/gqlgen/graphql/handler"
+	"github.com/clidey/whodb/core/src/auth"
+	"github.com/clidey/whodb/core/src/dashboard"
+	"github.com/clidey/whodb/core/src/engine"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+)
+
+func TestGetDashboardsReturnsScopedDashboards(t *testing.T) {
+	service := newDashboardServiceForGraphTest(t)
+	ctx := contextWithScope("primary")
+
+	dash, err := service.CreateDashboard(ctx, dashboard.CreateDashboardParams{
+		Name:        "Revenue",
+		RefreshRule: dashboard.RefreshRuleOnDemand,
+	})
+	if err != nil {
+		t.Fatalf("create dashboard: %v", err)
+	}
+	_, err = service.AddWidget(ctx, dash.ID, dashboard.WidgetInput{
+		Type:   dashboard.WidgetTypeChart,
+		Title:  "Monthly revenue",
+		Layout: `{"i":"widget-1","x":0,"y":0,"w":4,"h":6}`,
+	})
+	if err != nil {
+		t.Fatalf("add widget: %v", err)
+	}
+
+	body, _ := json.Marshal(map[string]any{
+		"query": `query { GetDashboards { ID Name Widgets { ID Type Layout } } }`,
+	})
+	recorder := executeDashboardGraphQL(t, service, ctx, body)
+
+	if recorder.Code != http.StatusOK || !strings.Contains(recorder.Body.String(), "Revenue") {
+		t.Fatalf("unexpected response: %d %s", recorder.Code, recorder.Body.String())
+	}
+}
+
+func TestAddWidgetRejectsCrossScopeMutation(t *testing.T) {
+	service := newDashboardServiceForGraphTest(t)
+	ownerCtx := contextWithScope("primary")
+	otherCtx := contextWithScope("secondary")
+
+	dash, err := service.CreateDashboard(ownerCtx, dashboard.CreateDashboardParams{
+		Name:        "Revenue",
+		RefreshRule: dashboard.RefreshRuleOnDemand,
+	})
+	if err != nil {
+		t.Fatalf("create dashboard: %v", err)
+	}
+
+	mutation := fmt.Sprintf(
+		`mutation { AddWidget(dashboardId:%q, input:{Type:"chart", Title:"Blocked", Layout:"{\"i\":\"widget-1\",\"x\":0,\"y\":0,\"w\":4,\"h\":6}"}) { ID } }`,
+		dash.ID,
+	)
+	body, _ := json.Marshal(map[string]any{"query": mutation})
+	recorder := executeDashboardGraphQL(t, service, otherCtx, body)
+
+	if recorder.Code != http.StatusOK || !strings.Contains(recorder.Body.String(), dashboard.ErrScopeMismatch.Error()) {
+		t.Fatalf("expected scope error, got %d %s", recorder.Code, recorder.Body.String())
+	}
+}
+
+func TestUpdateWidgetSnapshotAcceptsSnapshotPayload(t *testing.T) {
+	service := newDashboardServiceForGraphTest(t)
+	ctx := contextWithScope("primary")
+
+	dash, err := service.CreateDashboard(ctx, dashboard.CreateDashboardParams{
+		Name:        "Revenue",
+		RefreshRule: dashboard.RefreshRuleOnDemand,
+	})
+	if err != nil {
+		t.Fatalf("create dashboard: %v", err)
+	}
+	widget, err := service.AddWidget(ctx, dash.ID, dashboard.WidgetInput{
+		Type:   dashboard.WidgetTypeChart,
+		Title:  "Monthly revenue",
+		Layout: `{"i":"widget-1","x":0,"y":0,"w":4,"h":6}`,
+	})
+	if err != nil {
+		t.Fatalf("add widget: %v", err)
+	}
+
+	mutation := fmt.Sprintf(
+		`mutation { UpdateWidgetSnapshot(id:%q, snapshot:{Config:"{\"type\":\"bar\"}", Data:"{}", ExecutedAt:"2026-04-02T00:00:00Z"}) { Status } }`,
+		widget.ID,
+	)
+	body, _ := json.Marshal(map[string]any{"query": mutation})
+	recorder := executeDashboardGraphQL(t, service, ctx, body)
+
+	if recorder.Code != http.StatusOK || !strings.Contains(recorder.Body.String(), `"Status":true`) {
+		t.Fatalf("expected success, got %d %s", recorder.Code, recorder.Body.String())
+	}
+}
+
+func executeDashboardGraphQL(t *testing.T, service dashboard.ServiceAPI, ctx context.Context, body []byte) *httptest.ResponseRecorder {
+	t.Helper()
+
+	srv := handler.NewDefaultServer(NewExecutableSchema(Config{
+		Resolvers: &Resolver{DashboardService: service},
+	}))
+	req := httptest.NewRequest(http.MethodPost, "/api/query", bytes.NewBuffer(body))
+	req = req.WithContext(ctx)
+	req.Header.Set("Content-Type", "application/json")
+	recorder := httptest.NewRecorder()
+	srv.ServeHTTP(recorder, req)
+	return recorder
+}
+
+func newDashboardServiceForGraphTest(t *testing.T) *dashboard.Service {
+	t.Helper()
+
+	db, err := gorm.Open(sqlite.Open("file::memory:?cache=shared"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open sqlite db: %v", err)
+	}
+
+	service, err := dashboard.NewService(db)
+	if err != nil {
+		t.Fatalf("new service: %v", err)
+	}
+
+	return service
+}
+
+func contextWithScope(database string) context.Context {
+	return context.WithValue(context.Background(), auth.AuthKey_Credentials, &engine.Credentials{
+		Type:     "Postgres",
+		Hostname: "db.internal",
+		Database: database,
+	})
+}