Release v0.7.0: Authentication, WebSocket real-time, frontend fixes

Backend:
- Add CORS support for dashboard (localhost:3000)
- Hybrid auth on all API routes (session OR bearer)
- Secure cookies auto-configured based on TLS
- Fix prefixdctl operators create column name

Frontend:
- Fix API response unwrapping (mitigations/events wrappers)
- Fix Stats/HealthResponse/PopInfo types to match backend
- Fix SWR cache invalidation keys in WebSocket hook
- Fix status filter query param (comma-separated)

Docs:
- Update CHANGELOG with v0.7.0 release notes
- Update ROADMAP with v0.7 section

Author: lance0

CHANGELOG.md

@@ -5,7 +5,7 @@ All notable changes to prefixd will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.7.0] - 2026-01-18
 
 ### Added
 
@@ -46,6 +46,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Security**
   - Request body size limit (1MB) via tower-http
   - Fix SQL injection in `list_mitigations` queries (now uses parameterized queries)
+  - Hybrid auth on all API routes (session OR bearer token)
+  - Secure cookies configurable based on TLS presence
+
+- **CORS Support**
+  - CORS headers for dashboard cross-origin requests
+  - Credentials support for session cookies
 
 - **Reliability**
   - GoBGP gRPC timeout handling (10s connect, 30s request)
@@ -85,6 +91,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **Frontend API Integration**
+  - Fix API response unwrapping (mitigations/events return `{items, count}` wrapper)
+  - Fix Stats type to match backend (`total_active` instead of `active_mitigations`)
+  - Fix HealthResponse type to match backend (structured `bgp_sessions`, `gobgp` object)
+  - Fix PopInfo type (`{pop, active_mitigations}` objects instead of strings)
+  - Fix SWR cache invalidation keys in WebSocket hook
+  - Fix status filter query param (comma-separated instead of repeated)
+
 - **Startup validation** - `auth.mode=bearer` without token now fails fast at startup (was returning 500 on every request)
 
 - IPv6 prefix validation uses proper `IpAddr` parsing (was using contains(':') heuristic)

ROADMAP.md

@@ -156,6 +156,35 @@
   - [x] Config page (system status, BGP, quotas, safelist viewer)
   - [x] Loading/error states throughout
 
+## v0.7 - Authentication & Real-Time Dashboard (Done)
+
+**Goal:** Session-based auth for dashboard, WebSocket real-time updates, production-ready frontend.
+
+### Authentication (Done)
+- [x] Operators table with argon2 password hashing
+- [x] PostgreSQL session store via tower-sessions
+- [x] Login/logout/me endpoints
+- [x] Hybrid auth model (session for browser, bearer for CLI)
+- [x] `prefixdctl operators create` command
+- [x] Secure cookies configurable (auto-detect TLS)
+- [x] CORS support for dashboard
+
+### WebSocket Real-Time (Done)
+- [x] WebSocket endpoint `/v1/ws/feed`
+- [x] Message types: MitigationCreated/Updated/Expired/Withdrawn, EventIngested, ResyncRequired
+- [x] Broadcast channel in handlers and reconciliation loop
+- [x] Lag detection with ResyncRequired
+
+### Frontend Auth & Real-Time (Done)
+- [x] Login page with form validation
+- [x] `useAuth` hook with AuthProvider
+- [x] `useWebSocket` hook with reconnection
+- [x] `RequireAuth` protected route wrapper
+- [x] ConnectionStatus indicator
+- [x] UserMenu with logout
+- [x] SWR cache invalidation on WS messages
+- [x] Fix API response type mismatches
+
 ## v1.1 - Integration Tests & Bug Fixes
 
 **Goal:** Comprehensive integration test coverage and critical bug fixes.

docker-compose.yml

@@ -26,7 +26,7 @@ services:
     ports:
       - "3000:3000"
     environment:
-      - NEXT_PUBLIC_PREFIXD_API=http://prefixd:8080
+      - NEXT_PUBLIC_PREFIXD_API=http://localhost:8080
       - NEXT_PUBLIC_PREFIXD_TOKEN=${PREFIXD_API_TOKEN:-}
     depends_on:
       - prefixd

frontend/app/page.tsx

@@ -27,16 +27,16 @@ export default function OverviewPage() {
           <BgpSessionStatus />
 
           <div className="grid grid-cols-2 lg:grid-cols-4 gap-3">
-            <StatCard title="Active Mitigations" value={stats?.active_mitigations ?? activeMitigations.length} />
+            <StatCard title="Active Mitigations" value={stats?.total_active ?? activeMitigations.length} />
             <StatCard title="Police Actions" value={policeActions.length} accent="primary" />
             <StatCard title="Discard Actions" value={discardActions.length} accent="destructive" />
-            <StatCard title="Events (24h)" value={stats?.events_24h ?? 0} />
+            <StatCard title="Total Events" value={stats?.total_events ?? 0} />
           </div>
 
           <div className="grid grid-cols-1 lg:grid-cols-3 gap-3">
             <QuotaGauge
               title="Global Quota"
-              current={stats?.active_mitigations ?? 0}
+              current={stats?.total_active ?? 0}
               max={500}
               secondary={{
                 title: "Total Events",

frontend/hooks/use-websocket.ts

@@ -100,17 +100,19 @@ export function useWebSocket(options: UseWebSocketOptions = {}) {
           }
 
           // Invalidate relevant caches based on message type
+          // SWR keys match hook keys: "mitigations", "stats", "events"
           if (message.type === "MitigationCreated" || 
               message.type === "MitigationUpdated" ||
               message.type === "MitigationExpired" ||
               message.type === "MitigationWithdrawn") {
-            mutate("/v1/mitigations")
-            mutate("/v1/stats")
+            // Invalidate all mitigation-related keys (including those with params)
+            mutate((key) => typeof key === "string" && key.startsWith("mitigations") || Array.isArray(key) && key[0] === "mitigations")
+            mutate("stats")
           }
 
           if (message.type === "EventIngested") {
-            mutate("/v1/events")
-            mutate("/v1/stats")
+            mutate((key) => typeof key === "string" && key.startsWith("events") || Array.isArray(key) && key[0] === "events")
+            mutate("stats")
           }
         } catch (e) {
           console.error("Failed to parse WebSocket message:", e)

frontend/lib/api.ts

@@ -48,26 +48,35 @@ export interface Event {
 }
 
 export interface Stats {
+  total_active: number
   total_mitigations: number
-  active_mitigations: number
-  events_24h: number
   total_events: number
-  pops: string[]
+  pops: PopInfo[]
+}
+
+export interface PopInfo {
+  pop: string
+  active_mitigations: number
+  last_seen: string
 }
 
 export interface HealthResponse {
   status: string
-  version: string
-  pop: string
-  uptime_seconds: number
-  bgp_session_up: boolean
+  bgp_sessions: Record<string, string>
+  active_mitigations: number
+  database: string
+  gobgp: {
+    status: string
+    error?: string
+  }
 }
 
 export interface SafelistEntry {
   prefix: string
-  reason: string
+  reason: string | null
   added_by: string
   added_at: string
+  expires_at: string | null
 }
 
 async function fetchApi<T>(endpoint: string, options?: RequestInit): Promise<T> {
@@ -102,7 +111,10 @@ async function fetchApi<T>(endpoint: string, options?: RequestInit): Promise<T>
 }
 
 async function doFetch<T>(url: string, options: RequestInit): Promise<T> {
-  const res = await fetch(url, options)
+  const res = await fetch(url, {
+    ...options,
+    credentials: "include", // Send session cookies for hybrid auth
+  })
 
   if (!res.ok) {
     const error = await res.text()
@@ -128,16 +140,18 @@ export async function getMitigations(params?: {
   offset?: number
 }): Promise<Mitigation[]> {
   const searchParams = new URLSearchParams()
-  if (params?.status) {
-    params.status.forEach((s) => searchParams.append("status", s))
+  if (params?.status && params.status.length > 0) {
+    // Backend expects comma-separated status values
+    searchParams.set("status", params.status.join(","))
   }
   if (params?.customer_id) searchParams.set("customer_id", params.customer_id)
   if (params?.pop) searchParams.set("pop", params.pop)
   if (params?.limit) searchParams.set("limit", params.limit.toString())
   if (params?.offset) searchParams.set("offset", params.offset.toString())
 
   const query = searchParams.toString()
-  return fetchApi<Mitigation[]>(`/v1/mitigations${query ? `?${query}` : ""}`)
+  const response = await fetchApi<{ mitigations: Mitigation[]; count: number }>(`/v1/mitigations${query ? `?${query}` : ""}`)
+  return response.mitigations
 }
 
 export async function getMitigation(id: string): Promise<Mitigation> {
@@ -164,7 +178,8 @@ export async function getEvents(params?: {
   if (params?.offset) searchParams.set("offset", params.offset.toString())
 
   const query = searchParams.toString()
-  return fetchApi<Event[]>(`/v1/events${query ? `?${query}` : ""}`)
+  const response = await fetchApi<{ events: Event[]; count: number }>(`/v1/events${query ? `?${query}` : ""}`)
+  return response.events
 }
 
 export interface AuditEntry {
@@ -212,8 +227,8 @@ export async function removeSafelist(prefix: string): Promise<void> {
   })
 }
 
-export async function getPops(): Promise<string[]> {
-  return fetchApi<string[]>("/v1/pops")
+export async function getPops(): Promise<PopInfo[]> {
+  return fetchApi<PopInfo[]>("/v1/pops")
 }
 
 export async function reloadConfig(): Promise<void> {

src/api/routes.rs

@@ -1,11 +1,12 @@
 use axum::{
-    http::{header, HeaderValue},
+    http::{header, HeaderValue, Method},
     response::IntoResponse,
     routing::{any, get, post},
     Json, Router,
 };
 use axum_login::AuthManagerLayer;
 use std::sync::Arc;
+use tower_http::cors::CorsLayer;
 use tower_http::limit::RequestBodyLimitLayer;
 use tower_http::set_header::SetResponseHeaderLayer;
 use tower_sessions_sqlx_store::PostgresStore;
@@ -72,6 +73,14 @@ pub fn create_router(
         ))
         // Request body size limit (1MB)
         .layer(RequestBodyLimitLayer::new(1024 * 1024))
+        // CORS for dashboard
+        .layer(
+            CorsLayer::new()
+                .allow_origin("http://localhost:3000".parse::<HeaderValue>().unwrap())
+                .allow_methods([Method::GET, Method::POST, Method::DELETE, Method::OPTIONS])
+                .allow_headers([header::CONTENT_TYPE, header::AUTHORIZATION, header::COOKIE])
+                .allow_credentials(true),
+        )
 }
 
 async fn openapi_json() -> impl IntoResponse {

src/bin/prefixdctl.rs

@@ -606,7 +606,7 @@ async fn cmd_operators(cmd: OperatorCommands, format: OutputFormat) -> Result<()
                 r#"
                 INSERT INTO operators (username, password_hash, role)
                 VALUES ($1, $2, $3)
-                RETURNING id
+                RETURNING operator_id
                 "#
             )
             .bind(&username)