Feat/s3 file browser v1

.env.example

@@ -11,6 +11,19 @@ STACKABLE_COCKPIT_OIDC_DISCOVERY_URL=https://your-idp.example.com/realms/your-re
 STACKABLE_COCKPIT_OIDC_CLIENT_ID=stackable-cockpit
 STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=your-client-secret
 
+# Storage encryption key (64 hex characters) used to encrypt sensitive data in storage.
+STORAGE_ENCRYPTION_KEY=F000000000000000000000000000000000000000000000000000000000000000
+# STACKABLE_COCKPIT_STORAGE_TLS_CA_CERT=/path/to/ca.pem  # CA certificate for S3 connections with TLS verification; replaces the system trust store
+
+# PostgreSQL database (required)
+DATABASE_HOST=localhost
+DATABASE_PORT=5432
+DATABASE_NAME=cockpit
+DATABASE_USER=cockpit
+DATABASE_PASSWORD=change-me
+# DATABASE_TLS_MODE=verify-full  # verify-full, require or disable (default: verify-full in production, disable otherwise)
+# DATABASE_TLS_CA_CERT=/path/to/ca.pem  # CA certificate for verify-full
+
 # OIDC claim used as the Trino user for impersonation (default: preferred_username)
 # STACKABLE_COCKPIT_TRINO_USER_CLAIM=preferred_username
 
@@ -30,14 +43,39 @@ STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=your-client-secret
 # the specified Trino endpoint is used automatically. By default the logged-in
 # user is forwarded to Trino as X-Trino-User (impersonation via the OIDC username).
 # STACKABLE_COCKPIT_TRINO_URL=https://trino.example.com:8443
+# STACKABLE_COCKPIT_TRINO_PUBLIC_URL=https://trino.example.com  # Browser-facing Trino URL for "View in Trino" links (default: the Trino URL used for queries)
 # STACKABLE_COCKPIT_TRINO_AUTH_TYPE=basic       # "none" (default) or "basic"
 # STACKABLE_COCKPIT_TRINO_AUTH_USERNAME=service-account
 # STACKABLE_COCKPIT_TRINO_AUTH_PASSWORD=secret
 # STACKABLE_COCKPIT_TRINO_USER_IMPERSONATION=false  # Disable impersonation: run all queries as the auth user (requires basic auth). Default: true
 # STACKABLE_COCKPIT_TRINO_TLS_INSECURE=false    # Set to "true" to skip TLS certificate verification
 # STACKABLE_COCKPIT_TRINO_TLS_CA_CERT=/path/to/ca.pem  # Custom CA certificate file
+# STACKABLE_COCKPIT_QUERY_TTL=1800  # Seconds before completed, unaccessed tab queries are evicted (default: 1800)
 
 # Feature flags
 # STACKABLE_COCKPIT_COMPLETION_ENABLED=false    # Disable SQL editor code completion (default: true)
 # STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true  # Enable S3/HDFS file browser (default: false)
+# PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS=true  # File browser: continue where you left off — restore open tabs from the last session (default: false)
+# PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=true  # Load CSV and Parquet preview rows lazily while scrolling; any other value than "true" disables it (default: true)
+# PUBLIC_STACKABLE_COCKPIT_STORAGE_CUT_COPY_ENABLED=true  # Enables cut/copy and dragging in the storage browser; client-only, the server work is gated by paste/move (default: false)
+# PUBLIC_STACKABLE_COCKPIT_STORAGE_PASTE_ENABLED=true  # Enables paste in the storage browser; the transfer API accepts copies only with this, and moves with this or MOVE_ENABLED (default: false)
+# PUBLIC_STACKABLE_COCKPIT_STORAGE_RENAME_ENABLED=true  # Enables rename in the storage browser; also enforced by the transfer API (default: false)
+# PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED=true  # Enables drag-and-drop move in the storage browser (dragging also needs CUT_COPY_ENABLED); the transfer API accepts moves with this or PASTE_ENABLED (default: false)
+
+# Storage browser limits and settings
+# STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144  # Max bytes fetched for text, TSV and JSON previews; editable files are fetched completely (default: 262144)
+# STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880  # Max bytes fetched for image previews (default: 5242880)
+# STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400  # Max bytes fetched for PDF previews (default: 26214400)
+# STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250  # Max rows in tabular file previews (default: 250)
+# STACKABLE_COCKPIT_FILE_PREVIEW_COLUMNS=50  # Max columns in tabular file previews (default: 50)
+# STACKABLE_COCKPIT_ARCHIVE_PREVIEW_MAX_MB=100  # Max size in megabytes of an archive opened for preview, checked against its compressed size, the total size of the listed entries and the size of an extracted entry (default: 100)
+# STACKABLE_COCKPIT_ARCHIVE_CACHE_MAX_MB=512  # Max total size of archives cached in /tmp for previews, in megabytes; raised to at least twice ARCHIVE_PREVIEW_MAX_MB (default: 512)
+# STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset  # Comma-separated list of compression types to disallow from parquet data preview (default: "gzip-no_offset")
+# BODY_SIZE_LIMIT=6M  # adapter-node request body limit; must be at least MAX_EDITABLE_FILE_SIZE (default: 6M in the container image, 512K otherwise)
+# PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=1048576  # Max file size (in bytes) of editable text files in the storage browser; BODY_SIZE_LIMIT must be at least this large (default: 5 MiB)
+# PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100  # Comma-separated page size options for paginated list views (default: 25,50,100)
+# PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25  # Page size selected when no user preference is stored; must be one of PAGE_SIZES (default: first page size)
+# PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15  # Number of recently visited storage locations kept in local storage (default: 15)
 # PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3  # Maximum number of concurrent file uploads (default: 3)
+# STACKABLE_COCKPIT_STORAGE_TRANSFER_CONCURRENCY=8  # Objects copied at once within one copy, move or rename request (default: 8)
+# STACKABLE_COCKPIT_DOWNLOAD_HISTORY_RETENTION_DAYS=30  # Days a user's download history is kept; an integer from 1 to 3650, any other value stops startup (default: 30)

.env.test

@@ -11,10 +11,23 @@ STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
 STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
 STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
 STACKABLE_COCKPIT_FILE_PREVIEW_COLUMNS=50
-PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
+STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset
+PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
 PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
+PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_CUT_COPY_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_PASTE_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_RENAME_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED=true
+# One object at a time, so the cancel E2E test can stop a move mid-way.
+STACKABLE_COCKPIT_STORAGE_TRANSFER_CONCURRENCY=1
 GARAGE_ADMIN_URL=http://localhost:30902
 GARAGE_ADMIN_TOKEN=stackable-cockpit-e2e-admin-token
+BETTER_AUTH_URL=http://localhost:4173
+BETTER_AUTH_SECRET=stackable-cockpit-e2e-better-auth-secret
+DATABASE_PASSWORD=e2e-build-placeholder-password
+STORAGE_ENCRYPTION_KEY=a781775ee543107bfa97191691bb23c982dd9d9550542df27194ebc09d617dfd
+PREVIEW_PORT=4173

.github/workflows/pr_checks.yaml

@@ -59,7 +59,7 @@ jobs:
         run: python -m pip install pre-commit
 
       - name: Run pre-commit
-        run: pre-commit run --all-files --show-diff-on-failure --color=always
+        run: pre-commit run --all-files --hook-stage manual --show-diff-on-failure --color=always
 
   unit-tests:
     name: Unit Tests
@@ -96,10 +96,9 @@ jobs:
         with:
           file-coverage-mode: changes
 
-  e2e-with-garage:
-    name: E2E Tests with Garage S3
+  e2e-tests:
+    name: E2E Tests with Garage S3 and PostgreSQL
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -118,35 +117,13 @@ jobs:
       - name: Install Playwright browsers
         run: npx playwright install --with-deps chromium firefox
 
-      - name: Start Garage S3 and initialize bucket
-        run: |
-          # GitHub Actions services now support entrypoint + command, but we still
-          # start Garage manually here because service containers are created before
-          # actions/checkout runs. The upstream Garage image contains only the
-          # /garage binary (no /bin/sh), so the service cannot wait for the checked-
-          # out e2e/garage.toml to appear before it starts.
-          docker run -d --name garage \
-            -p 3900:3900 \
-            -p 3902:3902 \
-            -e GARAGE_CONFIG_FILE=/workspace/dev/garage/garage.toml \
-            -v "$PWD:/workspace" \
-            --entrypoint /garage \
-            oci.stackable.tech/stackable/dxflrs/garage:v2.3.0 \
-            server --single-node
-
-          # Wait for the S3 API to become available
-          for _ in $(seq 1 30); do
-            if curl -s http://localhost:3900 >/dev/null 2>&1; then
-              break
-            fi
-            sleep 1
-          done
-
-          S3_SECRET_ACCESS_KEY="e2e-test-secret-key-for-ci" \
-            GARAGE_ADMIN_TOKEN='stackable-cockpit-e2e-admin-token' \
-            S3_ENDPOINT='http://localhost:3900' \
-            S3_CONFIG_PATH="$PWD/s3-config.json" \
-            ./e2e/init-garage-s3.sh
-
-      - name: Run E2E tests with Garage
-        run: npm run test:e2e:garage
+      - name: Run E2E tests with Garage and PostgreSQL
+        run: npm run test:e2e
+
+      - name: Upload Playwright traces
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-traces
+          path: e2e/test-results/
+          retention-days: 7

.gitignore

@@ -10,6 +10,7 @@ src/lib/editor/generated/
 .wrangler
 .svelte-kit
 /build
+/reports/
 
 # OS
 .DS_Store
@@ -32,6 +33,7 @@ dist/
 # Claude Code - ignore local/personal files, commit shared config
 .claude/settings.local.json
 .claude/CLAUDE.local.md
+.claude/worktrees/
 
 # Vitest coverage reports
 coverage/
@@ -40,6 +42,7 @@ coverage/*
 # Playwright
 e2e/test-results
 e2e/.auth
+.playwright/
 # Paraglide
 src/lib/paraglide
 project.inlang/cache/

.nvmrc

@@ -0,0 +1 @@
+24.21.0

.pre-commit-config.yaml

@@ -53,27 +53,45 @@ repos:
 
   - repo: local
     hooks:
+      # ── Fix variant (runs locally on commit — auto-fixes where possible) ──
+      - id: npm-lint-fix
+        name: npm lint with --fix (prettier + eslint)
+        language: system
+        entry: npm run lint:fix
+        stages: [pre-commit, pre-merge-commit]
+        pass_filenames: false
+        files: \.(svelte|ts|js|css|html|json|md)$
+
+      # ── Check-only variant (runs in CI — no auto-fix) ──
       - id: npm-lint
-        name: npm lint (prettier + eslint)
+        name: npm lint check only (prettier + eslint)
         language: system
         entry: npm run lint
-        stages: [pre-commit, pre-merge-commit]
+        stages: [manual]
         pass_filenames: false
         files: \.(svelte|ts|js|css|html|json|md)$
 
+      # ── Shared hooks (same behaviour locally and in CI) ──
       - id: npm-check
         name: npm check (svelte-check)
         language: system
         entry: npm run check
-        stages: [pre-commit, pre-merge-commit]
+        stages: [pre-commit, pre-merge-commit, manual]
         pass_filenames: false
         files: \.(svelte|ts|js)$
 
+      - id: npm-arch-test
+        name: npm arch test (fitness functions)
+        language: system
+        entry: npm run test:arch
+        stages: [pre-commit, pre-merge-commit, manual]
+        pass_filenames: false
+
       - id: helm-lint
         name: helm lint
         language: system
         entry: helm lint deploy/helm/cockpit
-        stages: [pre-commit, pre-merge-commit]
+        stages: [pre-commit, pre-merge-commit, manual]
         pass_filenames: false
         files: ^deploy/helm/
 
@@ -85,7 +103,9 @@ repos:
           helm template test deploy/helm/cockpit
           --set auth.oidc.discoveryUrl=https://stub
           --set auth.oidc.clientId=stub
-          --set auth.oidc.clientSecret.secretKeyRef.name=stub > /dev/null'
-        stages: [pre-commit, pre-merge-commit]
+          --set auth.oidc.clientSecret.secretKeyRef.name=stub
+          --set database.host=stub
+          --set database.password.secretKeyRef.name=stub > /dev/null'
+        stages: [pre-commit, pre-merge-commit, manual]
         pass_filenames: false
         files: ^deploy/helm/

.prettierignore

@@ -13,6 +13,8 @@ build/
 .output/
 e2e/test-results/
 e2e/.auth/
+.playwright/
+reports/
 src/lib/paraglide/
 project.inlang/
 
@@ -33,3 +35,7 @@ coverage/
 # Helm templates
 deploy/helm/
 dev/garage/
+dev/postgresql/
+
+# Claude Code worktrees (full repo copies)
+.claude/worktrees/

AGENTS.md

@@ -188,10 +188,10 @@ The application uses **Paraglide-JS v2** for type-safe, compiler-based internati
 
 ### Node.js Version
 
-The required Node.js version is pinned in `.node-version`. Use `nvm` to install and activate it before running any `npm` commands — `npm` will hard-fail with engine errors otherwise (`.npmrc` sets `engine-strict=true`).
+The required Node.js version is pinned in `.node-version` for CI and `.nvmrc` for NVM. Keep both files synchronised. Use `nvm` to install and activate it before running any `npm` commands — `npm` will hard-fail with engine errors otherwise (`.npmrc` sets `engine-strict=true`).
 
 ```bash
-nvm install   # installs the version from .node-version
+nvm install   # installs the version from .nvmrc
 nvm use       # activates it in the current shell
 ```
 
@@ -224,6 +224,36 @@ pre-commit run --all-files   # Run all checks: lint (prettier + eslint), type ch
                              # markdownlint, yamllint, shellcheck, actionlint, hadolint, helm lint
 ```
 
+### Architecture Fitness Functions
+
+```bash
+npm run test:arch            # Run all architecture fitness function tests (~5 s)
+npm run test:arch:report     # Same, plus generate HTML dependency/metrics reports in /reports/
+```
+
+Architecture tests live in `src/architecture-tests/*.spec.ts` and use [ArchUnitTS](https://github.com/LukasNiessen/ArchUnitTS) together with plain Node.js `fs` checks. They run in CI and must remain **green at all times**.
+
+**Run `npm run test:arch` whenever you:**
+
+- Add a new file to `src/lib/server/` (verify it doesn't break client-boundary rules)
+- Add a new Svelte component (PascalCase naming and UI-pattern checks)
+- Add or remove message keys in `messages/en.json` (both locale files must stay in sync)
+- Refactor the Trino sub-layer (circular-dependency rules)
+
+**What the fitness functions enforce:**
+
+| Category                 | What is checked                                                                                               |
+| ------------------------ | ------------------------------------------------------------------------------------------------------------- |
+| Server / Client Boundary | `src/lib/client`, `stores`, `storage`, `editor`, `types` must not import `src/lib/server/**`                  |
+| No Circular Dependencies | `src/lib/**` (excluding Trino) and `src/routes/**` must be cycle-free                                         |
+| Naming Conventions       | Stores → `*.svelte.ts`; lib components → PascalCase `.svelte`; server files → no `.svelte.ts` extension       |
+| Code Size Limits         | `.ts` files < 2 400 LOC; `.svelte` files < 1 100 LOC; test files < 1 000 LOC                                  |
+| UI Pattern Enforcement   | No native date inputs; `<img>` must have `alt`; no clickable `<div>` or `<span>` (with documented exceptions) |
+| i18n Compliance          | `messages/en.json` and `messages/de.json` must have the same keys; no static `aria-label="English text"`      |
+
+**Extending the fitness functions:**
+When you add a new architectural rule (e.g., a new layer, a new naming convention), add a new `.spec.ts` file in `src/architecture-tests/` following the existing patterns. Use archunit for TypeScript dependency/cycle rules and plain Node.js `fs` for content checks on Svelte files.
+
 ### E2E Testing
 
 ```bash
@@ -261,7 +291,7 @@ test('example test', async ({ page }) => {
 
 ### Authentication
 
-Tests use a saved session from `e2e/.auth/user.json`. If tests fail with auth errors, run the auth setup to re-authenticate via OIDC.
+Import `test` and `expect` from `e2e/support/fixtures.ts`, not `@playwright/test`. Its worker-scoped fixture logs each worker in via the mock OIDC server as its own user, so parallel workers never share server-side state. Opt out with `test.use({ storageState: { cookies: [], origins: [] } })`.
 
 ## Important Notes