feat(#17): project-scoped pages and dashboard event access

[jpricardo]

Closes #17.

/dashboard and /keys read the current project from a ?projectId query param that nothing ever set — the gap noted at the end of #33 — so both were stuck on their empty state. They now take it from the session via getCurrentProjectID(), and so does the key-create action: a key can no longer be minted for whatever project a stale tab named in a hidden form field. The rest of the issue (the X-User-Login client, per-method project ids, the 'default' hardcode, /settings as a redirect) had already landed with #32/#33.

That left /events, which the issue scoped out. It read through the SDK, whose key belongs to one fixed project, so it showed that project's events to every dashboard user regardless of the switcher — and wrote new ones into it. Closing that meant giving the dashboard a way in that isn't an API key:

• logger — RPCServer.GetLog, one entry by id within a project. models.GetLog was already project-scoped; nothing exposed it over RPC.
• broker — internal, membership-checked /projects/{id}/logs routes: list, submit, get one, delete one. The project comes from the path and never from the body, and an id belonging to another project is a 404, not someone else's event. Pagination parsing is now shared with the public GET /logs.
• frontend — getLogs / getLog / createLog / deleteLog on the API client, decoding responses with the SDK's own LogwolfEventSchema so pages keep receiving LogwolfEventData and no component changed. lib/logwolf.ts stays for what it actually is: the dashboard's own error tracking.

Also fixes /keys crashing on a project with no keys yet. ListAPIKeysByProject returns a nil slice, which reaches the browser as "data": null, and the page iterated it — invisible until the loader started actually fetching. getKeys now falls back to [], as getMembers already did.

Docs updated across CLAUDE.md and the broker, logger and frontend overviews. The frontend route table's /events/create is corrected to /events/new, which is what routes.ts registers.

Verification

go build, go vet and go test (broker + toolbox) pass; frontend typecheck, lint (0 errors) and build pass.

Not verified against the real stack — that needs Docker plus a GitHub OAuth login. The cross-project isolation assertions that would prove it end to end belong to #19.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
logwolf-docs	Ready	Preview	Aug 22, 2026 2:26am