Phase 2 (Milestone 2): Dashboards

[kosminus]

Summary

Milestone 2 of Phase 2 — composes the M1 saved queries/charts into workspace-shared dashboards: a draggable tile grid with per-tile refresh and dashboard-level filters that flow into every tile's SQL.

Stacked on #13 (M1). This PR's base is feat/phase2-durable-artifacts, so the diff shows only the M2 changes. Merge #13 first (or retarget to main after it merges).

Backend

• Models Dashboard + DashboardTile — the first workspace-scoped artifact (workspace_id, not connection-scoped); migration 006.
• dashboard_service: _assert_access (workspace scope + role, mirrors connection_service), CRUD, tile CRUD, bulk update_layout, and run_tile. Tiles run through saved_query_service.run_saved_query, so they authorize via the saved query's connection and reuse the M1 result cache.
• Filters reuse the saved-query param system: dashboard filter values are passed as supplied params; render_sql only consumes the {{name}}s a tile's SQL references and ignores the rest — no per-tile wiring.
• _finalize refreshes server-side onupdate timestamps after UPDATEs to avoid a lazy-load (MissingGreenlet) during async response serialization.
• Endpoints under /dashboards (workspace-scoped via get_org_context, like teams.py); registered in router.py.

Frontend (react-grid-layout)

• Dashboards list + detail page (draggable/resizable grid), tile cards rendering a chart (reusing ChartView) or table with a cached/fresh badge and optional auto-refresh, a filters bar, add-tile and dashboard-form modals.
• Extracted a shared ParamInputs component (used by both the M1 saved-query run drawer and the dashboard filters bar); routes + nav item.

Notable decisions

• Dashboards are workspace-scoped (compose tiles across connections); saved queries/charts remain connection-scoped.
• Filters chosen to reuse the param system rather than a separate mechanism — minimal surface, and tile authorization + caching come for free.
• Tile = saved query (data) + optional chart (viz; null = table). Deleting a saved query cascades to its tiles.

Verification

• Backend: full pytest 155 passed (9 new: _assert_access scope/role rules + filter passthrough); ruff clean.
• Live (Docker + real Postgres): migration 005→006 ran on startup; created a dashboard with a {{min_stage}} filter, added a chart tile + a table tile, ran both (filter value changes the row count → confirms filters reach the SQL), confirmed M1 cache reuse on re-run, and verified drag/resize layout persistence across reload. All update paths (dashboard/tile/layout) return 200 after the _finalize fix.
• Frontend: ESLint clean; tsc -b && vite build succeeds (react-grid-layout compiles with React 19).

Notes

• Frontend container needs npm install (or image rebuild) to pick up react-grid-layout — same anonymous-node_modules-volume caveat as recharts in M1.
• AuthZ (viewer-denied writes, cross-workspace 404, private hiding) is covered by unit tests since DISABLE_AUTH=true makes the local container act as admin.

🤖 Generated with Claude Code