Live updates and filtering on every list; stop broadcasting model events to everyone

[wmantly]

Only the Proxy List updated itself, and only via code hand-written in that one view. Two root causes, plus a security problem found on the way.

Why only one page ever updated

Only Host published events. Every model registers a ModelPs proxy, but only host.js exports it — the rest export the raw class, and the routes import those files directly. LocalGroup and Permission published nothing, so the Groups and Permissions pages were subscribed to events that were never sent.

ModelPs published the class name as the primary key. getIndex() read model[Model._key], and on a static call model is the class — which always has a built-in .name. So for any model keyed on 'name', the pk of every event was the literal string "LocalGroup". Creates appended a row matching nothing; updates would have duplicated the record. Host behaved only because its key is 'host' and Host.host is undefined.

Security: the bridge broadcast everything to everyone

app.io.emit('P2PSub', …) sent every model event, with its full record, to every authenticated socket. No per-model or per-row read check — a viewer scoped to one domain received live payloads for every other domain in the install.

utils/socket_pubsub.js now gates per socket, mirroring the REST read guards (Host → viewer on that domain, DnsProvider → admin, …), caching resolved rights briefly and busting them when a grant or group membership changes. Models without a gate are not broadcast at all, so a new model must opt in deliberately rather than start leaking the moment someone wraps it in ModelPs.

Clients could also inject topics: socket.on('P2PSub') republished anything a client emitted to every other client. No app code has ever called app.publish(), so this carried no legitimate traffic; events now flow server → client only. That also fixes a crash where a delete event's null body was tagged unconditionally.

Lists

Hosts, Permissions and Groups now use app.filter.live() from @simpleworkjs/frontend. The one changed row is patched rather than reloading the whole list, so scroll position, checkbox selection and open dropdowns survive another user's edit. Each list gains a search box and a count; hosts also gets a type facet, and its search now covers IP, port and DNS provider instead of hostname only.

Verification

216 unit tests pass, including 10 new ones for the read gate. Driven in a real browser:

• create / update / delete propagating live between two tabs with no refresh
• a live insert appearing only if it matches the active filter, and showing up when that filter is cleared
• a domain-scoped viewer receiving only model:Host:update:alpha.example.com while delta.test.local was withheld entirely — the admin tab received both

Note on the dependency

Stays at ^0.3.0, which 0.3.1 satisfies, so npm ci keeps working. Two framework fixes this UI wants (Bootstrap d-flex rows not hiding, and a stale filter count) are in @simpleworkjs/frontend@0.3.1, which is merged and tagged but not yet published to npm. Once it is, a routine npm install here picks it up with no code change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BxAmDhp1KABTwWUFca7sQR