feat(diagnostics): the admin log console

Admin → Diagnostics reads the server's stored log: one list, newest first,
where a line opens in place to its full record (time, source and logger,
account, request and job ids, version, message, attributes, stack). A
request or job id narrows the list to that request or job with every other
filter off, shown as a removable chip. Filters: level group, source,
account, event, period and a free-text search; all of them live in the URL
(`l*` keys, which setPage clears like the Plex and Channels keys), so a
filtered view is a link and Back restores it. "Live" re-reads the newest
page every few seconds while the tab is visible; paging into older rows
turns it off. Copy puts the loaded lines on the clipboard as JSON lines.

The facet counts now honour every filter but their own, as the feed's do:
a request pivot narrows them, and a picked level does not zero its
siblings. A value in use stays offered even when the counts drop it.

"Saját napló" and the console draw a line with one shared component,
`LogLine`, whose phone layout gives the message its own full-width line
(sharing the code's line left it a few characters). The level groups
moved to lib/log.ts for both.

The console's own reads are logged at DEBUG on success, like the
healthcheck: at INFO its live tail filled the log with itself.

backend/app/logs.py

@@ -638,9 +638,11 @@ def current_source() -> str:
 _REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9._-]{8,64}$")
 
 # Paths whose success is logged at DEBUG rather than INFO: the container healthcheck runs every 15s
-# (5.7k lines/day saying nothing) and hashed static assets are served by the hundred per page load.
-# A FAILURE on either still logs at WARNING/ERROR — this lowers the floor, it does not hide.
-_QUIET_PREFIXES = ("/healthz", "/assets/", "/static/")
+# (5.7k lines/day saying nothing), hashed static assets are served by the hundred per page load, and
+# the admin log console reads the stored log — its live tail every few seconds, so at INFO the log
+# would fill with the console watching itself. A FAILURE on any of them still logs at WARNING/ERROR
+# — this lowers the floor, it does not hide.
+_QUIET_PREFIXES = ("/healthz", "/assets/", "/static/", "/api/admin/logs")
 
 # Not `siftlode.logs`: this is the replacement for uvicorn's ACCESS log, and `siftlode.http` is
 # what an operator pins a level on when they want request lines and nothing else. The module it

backend/app/routes/admin_logs.py

@@ -18,6 +18,7 @@ commits, so a slower batch can land below an id the tail already passed — and
 import base64
 import binascii
 import json
+from dataclasses import dataclass
 from datetime import datetime, timezone
 from typing import Literal
 
@@ -91,8 +92,62 @@ def _accounts(db: Session, user_ids: set[int]) -> dict[str, str]:
     return {str(uid): email for uid, email in rows}
 
 
-@router.get("")
-def list_logs(
+@dataclass(frozen=True)
+class LogFilters:
+    """The console's filters, shared by the page and its facet counts."""
+
+    levels: list[str]
+    sources: list[str]
+    user: str | None
+    event: str | None
+    request_id: str | None
+    job_id: int | None
+    q: str | None
+    since: datetime | None
+    until: datetime | None
+
+    def conditions(self, skip: str | None = None) -> list:
+        """The WHERE conditions, ANDed by the caller. `skip` leaves one filter out: a facet counts
+        its own values under every OTHER filter, so picking a level does not zero the other
+        levels' counts (the way back), while a request pivot does narrow them (honest counts)."""
+        out = []
+        if self.levels and skip != "levels":
+            out.append(LogEvent.level.in_(self.levels))
+        if self.sources and skip != "sources":
+            out.append(LogEvent.source.in_(self.sources))
+        if self.user is not None and skip != "user":
+            out.append(
+                LogEvent.user_id.is_(None)
+                if self.user == NONE
+                else LogEvent.user_id == int(self.user)
+            )
+        if self.event is not None and skip != "event":
+            out.append(
+                LogEvent.event.is_(None) if self.event == NONE else LogEvent.event == self.event
+            )
+        if self.request_id is not None:
+            out.append(LogEvent.request_id == self.request_id)
+        if self.job_id is not None:
+            out.append(LogEvent.job_id == self.job_id)
+        if self.since is not None:
+            out.append(LogEvent.ts >= _utc(self.since))
+        if self.until is not None:
+            out.append(LogEvent.ts < _utc(self.until))
+        if self.q and self.q.strip():
+            like = f"%{like_escape(self.q.strip())}%"
+            out.append(
+                or_(
+                    LogEvent.msg.ilike(like),
+                    LogEvent.event.ilike(like),
+                    LogEvent.request_id.ilike(like),
+                    LogEvent.exc.ilike(like),
+                    cast(LogEvent.attrs, Text).ilike(like),
+                )
+            )
+        return out
+
+
+def log_filters(
     levels: list[Level] = Query(default=[]),
     sources: list[str] = Query(default=[], max_length=8),
     user: str | None = Query(default=None, pattern=r"^(none|[0-9]{1,10})$"),
@@ -104,6 +159,13 @@ def list_logs(
     q: str | None = Query(default=None, max_length=200),
     since: datetime | None = None,
     until: datetime | None = None,
+) -> LogFilters:
+    return LogFilters(list(levels), list(sources), user, event, request_id, job_id, q, since, until)
+
+
+@router.get("")
+def list_logs(
+    filters: LogFilters = Depends(log_filters),
     before: str | None = Query(default=None, max_length=200),
     limit: int = Query(default=100, ge=1, le=PAGE_MAX),
     _: User = Depends(admin_user),
@@ -111,36 +173,7 @@ def list_logs(
 ) -> dict:
     """One page of rows, newest first, matching every filter given (they AND together); `before`
     continues from a previous page's `next_cursor`."""
-    query = select(LogEvent)
-    if levels:
-        query = query.where(LogEvent.level.in_(levels))
-    if sources:
-        query = query.where(LogEvent.source.in_(sources))
-    if user is not None:
-        query = query.where(
-            LogEvent.user_id.is_(None) if user == NONE else LogEvent.user_id == int(user)
-        )
-    if event is not None:
-        query = query.where(LogEvent.event.is_(None) if event == NONE else LogEvent.event == event)
-    if request_id is not None:
-        query = query.where(LogEvent.request_id == request_id)
-    if job_id is not None:
-        query = query.where(LogEvent.job_id == job_id)
-    if since is not None:
-        query = query.where(LogEvent.ts >= _utc(since))
-    if until is not None:
-        query = query.where(LogEvent.ts < _utc(until))
-    if q and q.strip():
-        like = f"%{like_escape(q.strip())}%"
-        query = query.where(
-            or_(
-                LogEvent.msg.ilike(like),
-                LogEvent.event.ilike(like),
-                LogEvent.request_id.ilike(like),
-                LogEvent.exc.ilike(like),
-                cast(LogEvent.attrs, Text).ilike(like),
-            )
-        )
+    query = select(LogEvent).where(*filters.conditions())
     if before is not None:
         ts, row_id = _decode_cursor(before)
         # The `ts <=` conjunct is implied by the OR; it is there so the planner can bound the
@@ -169,18 +202,17 @@ def list_logs(
 
 @router.get("/facets")
 def log_facets(
-    since: datetime | None = None,
+    filters: LogFilters = Depends(log_filters),
     _: User = Depends(admin_user),
     db: Session = Depends(get_db),
 ) -> dict:
-    """What the filter chips offer, with counts: every level, source and account present in the
-    window, and its most frequent events. Over the window alone, not the other filters — a chip
-    row that shrank as you clicked would hide the way back."""
-    window = [LogEvent.ts >= _utc(since)] if since is not None else []
+    """What the filter chips offer, with counts: the levels, sources and accounts present, and the
+    most frequent events — each counted under every filter but its own (`LogFilters.conditions`).
+    `total` is the "all levels" count: every filter but the level one."""
 
-    def counts(col, cap: int | None = None) -> list[dict]:
+    def counts(col, skip: str, cap: int | None = None) -> list[dict]:
         n = func.count().label("n")
-        stmt = select(col, n).where(*window).group_by(col).order_by(n.desc(), col)
+        stmt = select(col, n).where(*filters.conditions(skip)).group_by(col).order_by(n.desc(), col)
         if cap is not None:
             stmt = stmt.limit(cap)
         return [
@@ -188,12 +220,13 @@ def log_facets(
             for value, count in db.execute(stmt).all()
         ]
 
-    users = counts(LogEvent.user_id)
+    users = counts(LogEvent.user_id, "user")
+    total = select(func.count()).select_from(LogEvent).where(*filters.conditions("levels"))
     return {
-        "levels": counts(LogEvent.level),
-        "sources": counts(LogEvent.source),
-        "events": counts(LogEvent.event, FACET_EVENTS_MAX),
+        "levels": counts(LogEvent.level, "levels"),
+        "sources": counts(LogEvent.source, "sources"),
+        "events": counts(LogEvent.event, "event", FACET_EVENTS_MAX),
         "users": [{**u, "value": str(u["value"])} for u in users],
         "accounts": _accounts(db, {u["value"] for u in users if u["value"] != NONE}),
-        "total": db.scalar(select(func.count()).select_from(LogEvent).where(*window)) or 0,
+        "total": db.scalar(total) or 0,
     }

backend/tests/test_admin_logs.py

@@ -152,3 +152,23 @@ def test_facets_count_the_window_and_name_the_rows_without_a_value(db, admin):
     ]
     assert body["users"] == [{"value": "1", "count": 2}, {"value": "none", "count": 1}]
     assert body["accounts"] == {"1": "admin@example.com"}
+
+
+def test_a_facet_counts_under_every_other_filter_but_not_its_own(db, admin):
+    _add(
+        db,
+        _row(request_id="req-aaaaaaaa"),
+        _row(request_id="req-aaaaaaaa", level="ERROR", sev=17, source="worker"),
+        _row(request_id="req-bbbbbbbb", level="ERROR", sev=17),
+        _row(request_id="req-bbbbbbbb"),
+    )
+
+    body = admin.get(
+        "/api/admin/logs/facets", params={"request_id": "req-aaaaaaaa", "levels": ["ERROR"]}
+    ).json()
+
+    # The pivot narrows every count; the picked level does not zero its sibling (the way back).
+    assert body["levels"] == [{"value": "ERROR", "count": 1}, {"value": "INFO", "count": 1}]
+    assert body["total"] == 2
+    # Every other facet counts under the level filter too.
+    assert body["sources"] == [{"value": "worker", "count": 1}]

backend/tests/test_logs.py

@@ -14,7 +14,7 @@ import logging
 from pathlib import Path
 
 import pytest
-from fastapi import FastAPI, Request
+from fastapi import FastAPI, HTTPException, Request
 from fastapi.testclient import TestClient
 
 from app import logs
@@ -213,6 +213,12 @@ def _client() -> TestClient:
     def _health():
         return {"ok": True}
 
+    @app.get("/api/admin/logs/facets")
+    def _log_console(fail: bool = False):
+        if fail:
+            raise HTTPException(status_code=400, detail={"code": "bad_cursor"})
+        return {"ok": True}
+
     @app.get("/boom")
     def _boom():
         raise RuntimeError("kaboom")
@@ -307,6 +313,16 @@ def test_the_healthcheck_is_logged_at_debug_so_it_cannot_drown_the_log(sink):
     assert len(sink.lines) == before
 
 
+def test_the_log_consoles_own_reads_are_debug_but_its_failures_are_not(sink):
+    http = logging.getLogger("siftlode.http")
+    http.setLevel(logs.TRACE)
+    client = _client()
+    client.get("/api/admin/logs/facets")
+    assert sink.objects()[-1]["level"] == "DEBUG"
+    client.get("/api/admin/logs/facets?fail=1")
+    assert sink.objects()[-1]["level"] == "WARNING"
+
+
 def test_a_failing_request_is_logged_by_status_and_an_unhandled_error_is_logged_at_all(sink):
     client = _client()
     client.get("/api/videos/missing/deeper")  # 404 from the router