feat: management UI + backend status endpoints

[roziscoding]

Summary

Adds a management UI for jack plus the backend endpoints it consumes.

Backend (feat(backend))

• New status module exposing:
  • GET /overview — peers, servers, and download counts (downloads enriched with computed progress)
  • GET /downloads — full download list, enriched
  • GET /ping — cheap key-guarded probe so the UI's BFF can verify the key and that the management API is up
• Wires the downloads repository into the management app.

UI (feat(ui))

• New apps/ui — a Nuxt 4 client-rendered management UI that proxies the management API through a server-side BFF (never exposing the key to the browser), supporting both inject-key and cookie-key modes.
• mise run ui task to run the dev server.
• Enables Vue linting at the repo root and ignores Nuxt build artifacts.

Test plan

• bun test apps/backend/src/__tests__/management-status.test.ts

Greptile Summary

This PR adds a Nuxt 4 management UI (apps/ui) with a server-side BFF that proxies jack's management API, plus the backend endpoints (GET /overview, GET /downloads, GET /ping) and import lifecycle tracking the UI depends on. A new ImportWatcher periodically reconciles import_queued downloads against each *arr server's history to flip rows to the new imported terminal state.

• Backend: New status module with overview/downloads endpoints, renames markCompleted → markImportQueued and adds markImported, adds ImportWatcher with a clean start/stop lifecycle, and adds rollback-aware ConnectorInitializationError handling to addServerConnector/addPeerConnector for interactive adds from the UI.
• UI BFF: Nuxt 4 client-rendered SPA whose server routes inject the management key (inject mode) or seal it in an HttpOnly/SameSite=Strict session cookie (cookie mode), so the key never reaches the browser. Download pages include an auto-refresh ticker with pause/resume controls.
• Migration: Schema migration 0005 removes the completed status, adds imported, and maps existing completed rows to imported for backwards compatibility.

Confidence Score: 5/5

Safe to merge; the BFF security model is correctly implemented and all identified concerns are minor migration semantics and a doc comment inaccuracy.

The BFF proxy, session sealing, CSRF guard, and key resolution logic are all correctly implemented. The rollback-aware connector init is a clean addition. The only substantive finding is the migration mapping completed → imported rather than import_queued — this affects only edge-case rows from processes that crashed mid-transfer on old versions, and the practical impact is minimal since most deployments will have no rows stuck in the old completed state.

apps/backend/drizzle/0005_young_sabretooth.sql — the status mapping for completed rows is worth confirming before deploying to instances with existing data.

Important Files Changed

Filename	Overview
apps/backend/drizzle/0005_young_sabretooth.sql	Adds imported status and removes completed; migration maps completed → imported but semantically completed was a pre-handoff intermediate state, so import_queued may be more accurate for edge-case rows.
apps/backend/src/modules/downloads/import-watcher.ts	New ImportWatcher polls *arr for import history and flips import_queued → imported; correctly uses unref() so it doesn't keep the process alive, and has clean start/stop lifecycle hooked into SIGINT/SIGTERM.
apps/backend/src/lib/servers/index.ts	Adds rollback-aware rethrowInitError option to addServerConnector/addPeerConnector; snapshot-and-restore pattern correctly covers serverMap, destinationIds, and sourceIds.
apps/backend/src/modules/config/config.service.ts	Adds transactional rollback for interactive add/update operations: persists config changes, attempts connector init, and rolls back both the file and in-memory state if init fails.
apps/ui/server/utils/management.ts	BFF utilities: session management, key resolution (env vs cookie mode), upstream URL construction, CSRF same-origin check, and upstream probe — all correctly implemented with defense-in-depth.
apps/ui/server/api/management/[...path].ts	BFF reverse proxy: correctly resolves key, enforces same-origin on mutations, mirrors upstream status and response body, and never exposes the management key to the browser.
apps/ui/nuxt.config.ts	Nuxt 4 config with correct SSR-off, BFF runtime config, and JACK_ env prefix setup; comment describing envPrefix as a "swap" is slightly misleading (it adds a secondary prefix, not replaces NUXT_).
apps/backend/src/modules/status/status.controller.ts	New controller exposing overview and download-list endpoints; enriches downloads with computed progress; handles optional repository correctly with ?.list() ?? [].

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Browser
    participant NuxtBFF as Nuxt BFF (server/)
    participant Session as Cookie/Env Key
    participant MgmtAPI as jack Management API

    Browser->>NuxtBFF: GET /api/ping
    NuxtBFF->>Session: resolveKey()
    Session-->>NuxtBFF: "{ key, mode }"
    NuxtBFF->>MgmtAPI: GET /ping (X-Management-Key: key)
    MgmtAPI-->>NuxtBFF: 200 / 401 / connection error
    NuxtBFF-->>Browser: "{ status: ok|needs-key|disabled|error, mode }"

    Browser->>NuxtBFF: "POST /api/login { key }"
    NuxtBFF->>NuxtBFF: assertSameOrigin()
    NuxtBFF->>MgmtAPI: GET /ping (X-Management-Key: key)
    MgmtAPI-->>NuxtBFF: 200
    NuxtBFF->>Session: "session.update({ key })"
    NuxtBFF-->>Browser: "{ status: ok }"

    Browser->>NuxtBFF: GET /api/management/overview
    NuxtBFF->>Session: resolveKey()
    Session-->>NuxtBFF: "{ key }"
    NuxtBFF->>MgmtAPI: GET /overview (X-Management-Key: key)
    MgmtAPI-->>NuxtBFF: "{ peers, servers, downloads }"
    NuxtBFF-->>Browser: mirrors status + body (key never sent to browser)

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Browser
    participant NuxtBFF as Nuxt BFF (server/)
    participant Session as Cookie/Env Key
    participant MgmtAPI as jack Management API

    Browser->>NuxtBFF: GET /api/ping
    NuxtBFF->>Session: resolveKey()
    Session-->>NuxtBFF: "{ key, mode }"
    NuxtBFF->>MgmtAPI: GET /ping (X-Management-Key: key)
    MgmtAPI-->>NuxtBFF: 200 / 401 / connection error
    NuxtBFF-->>Browser: "{ status: ok|needs-key|disabled|error, mode }"

    Browser->>NuxtBFF: "POST /api/login { key }"
    NuxtBFF->>NuxtBFF: assertSameOrigin()
    NuxtBFF->>MgmtAPI: GET /ping (X-Management-Key: key)
    MgmtAPI-->>NuxtBFF: 200
    NuxtBFF->>Session: "session.update({ key })"
    NuxtBFF-->>Browser: "{ status: ok }"

    Browser->>NuxtBFF: GET /api/management/overview
    NuxtBFF->>Session: resolveKey()
    Session-->>NuxtBFF: "{ key }"
    NuxtBFF->>MgmtAPI: GET /overview (X-Management-Key: key)
    MgmtAPI-->>NuxtBFF: "{ peers, servers, downloads }"
    NuxtBFF-->>Browser: mirrors status + body (key never sent to browser)

Loading

_{Reviews (6): Last reviewed commit: "perf(downloads): query import_queued row..." | Re-trigger Greptile}

[github-actions]

🐳 Docker images published

This PR has been built and pushed to GHCR:

ghcr.io/roziscoding/jack:pr-26        # backend
ghcr.io/roziscoding/jack-ui:pr-26     # management UI

Pull them locally:

docker pull ghcr.io/roziscoding/jack:pr-26
docker pull ghcr.io/roziscoding/jack-ui:pr-26

Run the backend standalone:

docker run --rm ghcr.io/roziscoding/jack:pr-26

The UI needs the backend + a management key, so run the two together with examples/docker-compose.yml, overriding the image tags to pr-26.

Last built from commit 9cd218d. Heads up: these images are automatically deleted when the PR is closed.