fix: resolve 9 UI and backend bugs

[sarg3nt]

Summary

• Sortable.js not loaded: Added global SortableJS script to base.templ so sidebar edit mode can reorder nav items
• Excessive debug logging: Removed ~15 INFO-level log lines with emoji prefixes from auth/session middleware that fired on every request
• Logs/Services 500 error: Fixed GetEnabledLogSourcesByServerID to gracefully return empty list for non-HAProxy servers instead of 500
• Traffic 'g is undefined': Added null guards for SVG group variable in traffic-visualization.js
• Root URL blank page: Added missing haproxy case to integrationPathFromName in dashboard handlers
• Backend lockup on quick refresh: Changed ValidateSessionToken from exclusive Lock to RLock for reads, async goroutine for session_last_activity updates
• OS Updates CDN noise: Cleaned up per-request logging in assets middleware
• Disabled entities errors: Added null checks for DOM elements and moved Disabled Entities button from main settings to HAProxy settings page

Test plan

• Verify sidebar nav reordering works (click edit icon in nav bar)
• Confirm no excessive logging in server console on page loads
• Test Logs and Services plugins on servers without HAProxy configured
• Load Traffic plugin page and verify no JS errors
• Navigate to root URL (/) and verify redirect to first enabled plugin
• Rapidly refresh pages and confirm no backend lockup
• Check Disabled Entities button appears on HAProxy Boxes settings page
• Verify Disabled Entities page works without JS errors

Closes #10

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR addresses 9 distinct UI and backend bugs that were causing issues ranging from JavaScript errors to backend lockups. The fixes include improvements to session validation performance, error handling for servers without HAProxy configuration, null safety guards in JavaScript, and UI navigation fixes.

Changes:

• Fixed session validation performance bottleneck by using read locks and async updates for session activity tracking
• Added null guards to prevent JavaScript errors in traffic visualization and disabled entities pages
• Improved error handling for log sources API to gracefully handle servers without HAProxy
• Added missing navigation case for HAProxy plugin and loaded Sortable.js globally
• Cleaned up excessive debug logging that was cluttering server console output

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
gearbox/static/js/traffic/traffic-visualization.js	Added null guards for SVG group variable to prevent "g is undefined" errors
gearbox/internal/plugins/dashboard/handlers.go	Added missing "haproxy" case to fix blank page on root URL navigation
gearbox/internal/framework/templates/pages/user_pages.templ	Removed Disabled Entities button from main settings page
gearbox/internal/framework/templates/pages/haproxy_settings.templ	Moved Disabled Entities button to HAProxy settings page
gearbox/internal/framework/templates/pages/disabled_entities.templ	Added null checks for DOM elements to prevent JS errors when no entities exist
gearbox/internal/framework/templates/layouts/base.templ	Added global Sortable.js script for sidebar nav reordering
gearbox/internal/framework/middleware/assets.go	Removed excessive per-request logging with emoji prefixes
gearbox/internal/framework/database/users.go	Changed session validation to use RLock and async updates to prevent backend lockup
gearbox/internal/framework/database/log_sources.go	Changed error handling to return empty list instead of 500 error for non-HAProxy servers
gearbox/internal/framework/auth/auth.go	Removed excessive INFO-level debug logging from authentication flow

Comments suppressed due to low confidence (1)

gearbox/internal/framework/database/log_sources.go:57

• The comment on line 52 mentions "Use LEFT JOIN so servers without HAProxy entries return empty results", but the query on line 57 uses a regular INNER JOIN. An INNER JOIN will return no rows when there's no matching haproxy_servers entry, but it won't cause the query to fail - it will simply return zero rows. The comment is misleading as written.

Either change the JOIN to LEFT JOIN to match the comment, or update the comment to accurately describe the INNER JOIN behavior (which is that it returns no rows for servers without HAProxy configuration).

	// Use LEFT JOIN so servers without HAProxy entries return empty results instead of errors.
	// The haproxy_servers table may not have an entry for every server.
	query := `
		SELECT ls.id, ls.haproxy_server_id, ls.log_name, ls.display_name
		FROM log_source_settings ls
		JOIN haproxy_servers hs ON ls.haproxy_server_id = hs.id

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 3 comments.

[Copilot]

The comment states "Use LEFT JOIN so servers without HAProxy entries return empty results" but the query actually uses an INNER JOIN (line 57). An INNER JOIN will only return rows where both tables have matching records, so servers without HAProxy entries won't return any results - which achieves the goal. However, the comment should be corrected to match the actual query type being used, or the query should be changed to LEFT JOIN if that was the original intent. Since the goal is to return empty results for servers without HAProxy, the INNER JOIN is functionally correct, but the comment is misleading.

Suggested change

	// Use LEFT JOIN so servers without HAProxy entries return empty results instead of errors.
	// Use a JOIN so only servers with HAProxy entries return log sources; others return empty results.

[Copilot]

The sessionActivityTimes map is never cleaned up and will grow unbounded over time as users log in. Even if a user logs out or their account is deleted, their entry remains in this map indefinitely. This is a memory leak that will accumulate entries for every unique user ID that ever authenticates. Consider adding a cleanup mechanism, such as: removing entries when users log out (in ClearUserSessionToken), periodically pruning entries older than sessionActivityDebounce, or using a size-limited cache structure like an LRU cache.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

gearbox/internal/framework/database/log_sources.go:60

• The comment claims to use LEFT JOIN but the query uses INNER JOIN. This means servers without HAProxy entries will still return empty results (which is correct behavior), but not for the reason stated in the comment. Either update the comment to reflect the actual JOIN type, or change the JOIN to LEFT JOIN if that was the intended behavior. With INNER JOIN, the query will return no results when there's no matching haproxy_servers entry, which achieves the goal but the comment is misleading.

	// Use LEFT JOIN so servers without HAProxy entries return empty results instead of errors.
	// The haproxy_servers table may not have an entry for every server.
	query := `
		SELECT ls.id, ls.haproxy_server_id, ls.log_name, ls.display_name
		FROM log_source_settings ls
		JOIN haproxy_servers hs ON ls.haproxy_server_id = hs.id
		WHERE hs.server_id = ?
		ORDER BY ls.display_name ASC
	`

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

gearbox/internal/framework/templates/layouts/base.templ:556

• The drag handle elements are rendered and shown/hidden in edit mode (lines 498, 514), but the SortableJS configuration at line 547-556 doesn't include a handle option. This means the entire navigation item is draggable, making the visual drag handle indicators misleading - users might think they need to grab the handle, but they can actually drag from anywhere on the item.

Either add handle: '.nav-drag-handle' to the Sortable configuration to make the handles functional, or remove the visual handle indicators entirely if the design intent is to make the entire item draggable.

				sidebarSortable = window.Sortable.create(navList, {
					animation: 200,
					draggable: '.nav-item-draggable',
					ghostClass: 'sortable-ghost',
					chosenClass: 'sortable-chosen',
					dragClass: 'sortable-drag',
					onEnd: function(evt) {
						console.log('Item moved from index', evt.oldIndex, 'to', evt.newIndex);
					}
				});

[Copilot]

The sessionActivityTimes map grows indefinitely and is never cleaned up. Each user ID that ever logs in will have an entry in this map that persists for the lifetime of the application. Over time, this will cause a memory leak, especially in systems with many users or where user IDs change frequently.

Consider implementing periodic cleanup to remove entries that haven't been accessed in a long time (e.g., entries older than sessionActivityDebounce * 2), or remove entries when users log out via ClearUserSessionToken.

[Copilot]

The comment on line 52 states "Use LEFT JOIN so servers without HAProxy entries return empty results" but the actual SQL query on line 57 uses an INNER JOIN. An INNER JOIN will only return rows where both tables have matching records, which means servers without HAProxy entries will indeed return empty results, but not for the reason stated. If the goal is to gracefully handle servers without HAProxy configuration, the comment should either:

1. Be updated to match the implementation: "Use INNER JOIN which naturally returns empty results for servers without HAProxy entries", OR
2. The query should be changed to use LEFT JOIN if there's a need to return additional information about servers without HAProxy configuration.

The current implementation appears correct for the stated goal (returning empty results), but the comment is misleading.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

gearbox/internal/framework/database/users.go:1294

• When a session is cleared (on logout or password change), the corresponding entry in sessionActivityTimes map should also be removed to prevent the map from growing unbounded. Add cleanup logic to remove the map entry for this userID.

// ClearUserSessionToken invalidates a user's session token.
// Called on logout or password change to force re-authentication.
func (d *DB) ClearUserSessionToken(userID string) error {
	d.mu.Lock()
	defer d.mu.Unlock()

	_, err := d.db.Exec(`
		UPDATE users 
		SET session_token = NULL,
		    session_created_at = NULL,
		    session_last_activity = NULL,
		    session_ip = NULL,
		    session_user_agent = NULL
		WHERE id = ?`, userID)
	
	return err
}