* feat(admin): add a Billing tab for subscriptions and sales
The admin can now follow subscriptions and sales without opening Stripe:
- Summary tiles: active subscriptions (monthly/annual), MRR with annual
plans counted as 1/12, sales and revenue for 7d/30d/90d/12m/all time,
all-time sales, subscriptions cancelling at period end, and refunds
and disputes.
- A stacked chart of sales per day, week or month by plan family.
- A by-plan table: active grants, period and all-time sales and revenue.
- A paginated list of grants with plan, Stripe status, active/expired/
revoked and user filters, linked to the admin user, repository or
conference.
- One row of webhook health: pending, failed, oldest pending event, last
error and unreviewed payment reversals.
A sale is one checkout or subscription, so a paper pack's three grants
count once. Revenue is each sale's Stripe list price, resolved once per
price and cached in memory. Currencies are never added together. Without
Stripe the page shows counts and marks revenue as unavailable.
GET /api/admin/billing/summary and /grants sit behind the admin check.
Grants get a { purchasedAt, _id } index for the list.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: preserve payment history in admin billing totals
* fix: scope billing history and preserve original sale prices
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(ui): browse and check every file in the anonymize preview
The "What reviewers will see" window now redacts the README GitHub actually
shows and lets authors open any file of the commit.
- README: resolved from the file list like GitHub (.github/, root, docs/,
any case, Markdown first) and only that path is tested against the
"Leave files unredacted" rules. Before the list loads, only root names are
assumed, so leaving docs/ unredacted no longer unredacts the root README.
The file bar shows the README's real name.
- New GET /api/repo/:owner/:repo/file?commit=&path= (same access checks as
/tree): raw text, no-store, path traversal rejected, 1 MB cap
(file_too_big, 413), binary files reported as { binary: true }.
/tree also lists binary files (binaryFiles) for the preview's tree.
- Tree rows open files (keyboard accessible, explorer active rail). Text is
redacted through /api/anonymize-preview by the same batcher as the README;
files left unredacted are sent without terms and tagged "Left unredacted"
(opens the dialog). Markdown renders like the README, code is highlighted
with Prism, images/PDF/binary/too-large files get a short note. Loading
and error (Retry) states reuse rp-state.
- File and folder names are redacted through /api/anonymize-preview.
- Caption counts the open file; "<name> left unredacted" when preserved.
- Phones: the Files button opens the tree as a sheet.
- dev-mock: a jsmith/robust-repair source with tree, file and
anonymize-preview endpoints and fixtures carrying the mock's terms.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(ui): reuse the explorer in the anonymize preview
Share the explorer file renderer and tree with the author preview. Apply
preserved-file rules on the server and keep the reviewer rendering and
redaction slots consistent across both views.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ui): keep the reviewer page unchanged by the preview reuse
The preview reuses tree.js and the shared file viewer; its differences now
apply only inside the anonymize preview.
- The narrow-pane rule that hid the file meta and Symbols applied to the
reviewer page too (visible with a widened sidebar); it is scoped to
.reviewer-preview. The token capture moves from body to the page that
holds the preview.
- tree.js: aria-expanded/aria-current and tree-only scrolling apply only
when the tree is embedded (selectedPath set); the reviewer page keeps
scrollIntoView and its original markup.
- file-viewer: the extra menu-closing click listener, the #L hash writes and
the Ctrl+F/G and Alt+Z shortcuts are limited to the preview (shortcuts
only while its code has focus), so the form keeps the browser's Find.
- Preview: the tree's file list is cached between renders, name batches are
chunked under the JSON body limit, /api/anonymize-preview accepts up to
3 MB so files up to the 1 MB preview limit can be redacted, and on phones
the caption's "<name> left unredacted" opens the dialog (the header tag
squeezed the path out).
- dev-mock: long and nested names for the tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ui): restore the redaction number on the right and level the slots
The redesign centered the term number in every redaction slot; it sits on
the right edge again, in code, Markdown, the tree and the breadcrumb. Tree,
breadcrumb and paragraph slots also sat about 2px below the text; they now
center on the line's letters.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: address preview navigation and path review findings
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The UI was uneven: the home page looked finished, but app pages used three
different display typefaces, the anonymize flow changed frame between steps,
and the dashboard, explorer and admin screens each had their own controls,
status colours and edge-case handling.
Make every screen follow one system: shared page header, grid, buttons,
filters and status colours; a repository picker and step trail on anonymize;
a "What reviewers will see" preview of the actual reviewer page; consistent
file headers and viewers for every file type; truthful admin charts and
tables. Fold the accumulated override blocks back into style.css (22%
smaller, no visual change).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The mask from /api/options is stored once loaded; code markers and
rendered Markdown are refreshed when it arrives instead of keeping the
XXXX default.
- Mermaid sources are left untouched so diagrams still parse.
- Fenced code blocks are marked from a Prism complete hook, after Prism
has rewritten their HTML.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Overview: error-volume bars render (the fills were inline spans), the
cumulative users chart is scaled to its range and labels it, latencies
over a second read in seconds, and charts and daily numbers use the
accent instead of four unrelated colours.
- Labels, table headers and state chips drop the mono caps; queue stat
values drop the serif.
- Error rows keep their content aligned; row metadata wraps instead of
truncating every item; "1 term" is singular.
- Errors filter uses the shared segmented control; breadcrumbs include
Admin; user detail spaces its status and actions, uses the accent for
Generate and says when no access token is stored.
- The jobs table scrolls inside its card on phones.
- Mock server: admin fixtures for every admin endpoint (ADMIN=1).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The range picker drew a border around every segment inside the group's
border, and Drain used a filled pill that made the most destructive
action the loudest. Segments are now borderless inside one outline with
a tinted selection, all header controls share one height, and Drain and
Clear all use a red outline. Queue labels drop the mono caps. ADMIN=1
signs the mock server in as an administrator.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- Explorer: redacted terms are highlighted in Markdown and code, the
sidebar shows when the link expires, "Download repository" is the one
primary action, and signed-out reviewers get a header without Sign in
or the source-code link.
- Status: a ready anonymization leads with a copyable share link; the
support links sit flat inside their section.
- One primary colour (accent) for actions and progress; mono is kept for
IDs, hashes and paths; settings are plain sections instead of cards.
- Font sizes snap to one scale (10-40px); rem values keep following the
reader's browser font size.
- Ko-fi button uses a dark surface in dark mode instead of a white pill.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The mock now serves a small file tree, README and source file for
anonymous_github-C72C plus a missing-repo error, so explorer pages can
be reviewed without the live site. Stats history grows unevenly so the
landing sparklines show realistic bars.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
"Report an issue" in the navbar read like a way to report an anonymized
repository, and it opened a blank GitHub issue instead of the template
that asks reporters to confirm the issue is about the service. The user
menu offered "Default settings" and "Logout" with no hint of what lives
behind them, and the Claim page was unreachable from any menu.
The settings page never loaded quotas (the bars stayed in their striped
loading state), mixed serif checkbox labels with sans forms, used
Bootstrap alert colours, and described options in jargon ("Proxy mode",
"Github page", "Line of code").
- Navbar: "Report a bug" links to the issue template with a tooltip that
names the service; the user menu shows who is signed in and lists
Settings, Claim an anonymization, Report a bug, Source code, Sign out,
each with a one-line hint. Icon links get aria-labels.
- Settings: quotas load through a shared quotaService (also used by the
dashboard); sections match the side navigation, which now follows
scrolling via a small paperScrollspy directive; copy explains each
option; account card with Sign out; delete moved into a danger zone;
Save shows Saving/Saved and the error alert uses the paper palette.
- Conferences list and detail: sort and status buttons show their state,
hidden statuses appear as chips with a count line, Remove is a button
behind a divider, dates spell the month, expiry column matches the
dashboard, detail page gets an Edit button and plan/cost meta.
- New conference: validation errors only appear after a field is touched
or the form submitted; pricing copy matches how price is computed.
- Status page: progress label no longer overlaps the details below it;
"Report a bug" points at the template and says whom it is for.
- Claim: single rule, constrained width, explains when to use it.
- Anonymize: shorter placeholder, consistent Auto-update label.
- Mock server gains the endpoints these pages need and an ANON mode.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The dashboard showed the anonymize date under "Expired", a dash in the
Expires column for 54 of 60 rows, raw status codes such as
branch_not_found, and a chip reading "REMOVED" that actually meant
"removed items are hidden". Muted text sat at 3.5:1 contrast, keyboard
focus was invisible, numbers were left-aligned, and a legacy record
without an identifier rendered as an empty link to /pr/undefined/.
This rewrites the dashboard template and controller and tightens the
theme tokens:
- Status sub-line is labelled ("anonymized on Sep 6, 2026"); Expires
shows Never, the date, or "Expired on <date>".
- Conference folded into the name cell as a tag; Views right-aligned;
every column header is a keyboard-sortable button with aria-sort.
- Sort/Status buttons show their state; chips read "Hiding Removed";
result count and Clear filters; empty state with a way out.
- Status filter covers Ready, In progress, Error, Expired, Removed.
Stuck downloads say so; codes map to sentences; statuses to labels.
- Lists load in parallel and merge once behind a skeleton; broken
records are flagged instead of linking nowhere.
- Actions menu: View, View page, Edit, Force update, divider, Remove,
all as buttons rather than href="#" anchors.
- Theme: warm dark canvas, muted text >= 4.5:1 in both modes, semantic
status tokens, 11/13/14/16px type scale, mono only for identifiers,
6px/10px/pill radii, :focus-visible ring, quota bars in ink until a
limit is near, unlimited shown as such.
- Mobile: no 9px text, filter row wraps in two lines, meta on one line.
Adds scripts/dev-mock.js to serve the dashboard with fixture data and
test/dashboard-ui.test.js covering the filters, template invariants and
token contrast.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
