Channels: HTTP proxy with observability for Lightning (#4419)

* Add Channels data layer: schemas, context, and migration

* Add channel proxy plug with endpoint routing

* Add channel proxy load testing and telemetry

* Add Channels handler and observability pipeline

* Add Channels source and sink authentication

* Add Channels CRUD

* Fix unique_constraint errors on channel name not showing up

* Refactor ChannelProxyPlug headers and add request tracing

* Add Channel LiveView UI: proxy URLs, icons, and polish

* Add channel request search and logs page

* Add channel logs infrastructure: tab bar, config, and History integration

* Rename Weir dependency to Philter (now published on Hex)

* Add Channels feature to CHANGELOG

* Refactor channel proxy to use Philter's extra_headers/strip_headers

Replace manual conn.req_headers mutation (Headers module) with Philter's
purpose-built API. This fixes a security issue where source authentication
headers (x-api-key for API auth, authorization for Basic auth) leaked
through to the upstream sink.

- Delete inner Headers module that mutated conn.req_headers
- Add build_extra_headers/2 for proxy headers (x-forwarded-*, x-request-id, sink auth)
- Add build_strip_headers/1 to remove source auth headers before forwarding
- Add source_auth_types to SinkRequest struct, populated from channel config
- Bump Philter to 0.2.0 for extra_headers/strip_headers support
- Add 5 new tests: host rewrite regression, source auth stripping, passthrough

* Update philter to 0.2.1

* Remove orphaned Headers test file

The Headers module was extracted into Philter during the refactor,
but this test file was left behind referencing the deleted module.

---------

Co-authored-by: Midigo Frank <39288959+midigofrank@users.noreply.github.com>
Co-authored-by: Frank Midigo <midigofrank@gmail.com>

Author: stuartc

.circleci/config.yml

@@ -171,23 +171,24 @@ jobs:
       - run:
           name: "Check code formatting"
           command: |
-            sudo -u lightning mix format --check-formatted || touch /tmp/lint_failed
+            sudo -u lightning mix format --check-formatted || echo "format" >> /tmp/lint_failed
       - run:
           name: "Check code style with Credo"
           when: always
           command: |
-            sudo -u lightning mix credo --strict --all || touch /tmp/lint_failed
+            sudo -u lightning mix credo --strict --all || echo "credo" >> /tmp/lint_failed
       - run:
           name: "Check for security vulnerabilities"
           when: always
           command: |
-            sudo -u lightning mix sobelow --threshold medium || touch /tmp/lint_failed
+            sudo -u lightning mix sobelow --threshold medium || echo "sobelow" >> /tmp/lint_failed
       - run:
           name: "Verify all checks passed"
           when: always
           command: |
             if [ -f /tmp/lint_failed ]; then
-              echo "One or more lint checks failed"
+              echo "The following checks failed:"
+              cat /tmp/lint_failed
               exit 1
             fi
 

CHANGELOG.md

@@ -17,6 +17,10 @@ and this project adheres to
 
 ### Added
 
+- Channels: a high-performance reverse proxy for forwarding authenticated
+  requests between systems with full observability. Includes source/sink
+  authentication, request/response logging, and a searchable history UI.
+  [#4322](https://github.com/OpenFn/lightning/issues/4322)
 - Now saving "final output state" for runs, not just steps. (Important for
   workflows with multiple leaf nodes.)
   [#4485](https://github.com/OpenFn/lightning/issues/4485)

assets/js/hooks/index.ts

@@ -760,15 +760,33 @@ export const Copy = {
       }
 
       if (text) {
-        const element = this.el;
-        navigator.clipboard
-          .writeText(text)
-          .then(() => {
+        if (navigator.clipboard?.writeText) {
+          navigator.clipboard
+            .writeText(text)
+            .then(() => {
+              this.showCopiedTooltip();
+            })
+            .catch(err => {
+              console.error('Failed to copy text: ', err);
+            });
+        } else {
+          // Fallback for insecure contexts (HTTP over non-localhost)
+          const textarea = document.createElement('textarea');
+          textarea.value = text;
+          textarea.style.position = 'fixed';
+          textarea.style.opacity = '0';
+          document.body.appendChild(textarea);
+          textarea.select();
+
+          try {
+            document.execCommand('copy');
             this.showCopiedTooltip();
-          })
-          .catch(err => {
+          } catch (err) {
             console.error('Failed to copy text: ', err);
-          });
+          } finally {
+            document.body.removeChild(textarea);
+          }
+        }
       }
     });
   },
@@ -1014,6 +1032,7 @@ export const LocalTimeConverter = {
       const textElement = this.el.querySelector('.datetime-text');
       if (textElement && displayTime) {
         textElement.textContent = displayTime;
+        textElement.className = 'datetime-text';
       }
     } catch (err) {
       console.error('Failed to convert timestamp to display time:', err);

assets/tailwind.config.ts

@@ -125,5 +125,41 @@ export default {
         { values }
       );
     }),
+    // Embeds Lucide icons (https://lucide.dev) into your app.css bundle
+    // Only a subset of icons are vendored. Add more SVGs to vendor/lucide/optimized/
+    //
+    plugin(function ({ matchComponents, theme }) {
+      let iconsDir = path.join(
+        __dirname,
+        './vendor/lucide/optimized/24/outline'
+      );
+      let values: Record<string, { name: string; fullPath: string }> = {};
+      fs.readdirSync(iconsDir).forEach(file => {
+        let name = path.basename(file, '.svg');
+        values[name] = { name, fullPath: path.join(iconsDir, file) };
+      });
+      matchComponents(
+        {
+          lucide: ({ name, fullPath }) => {
+            let content = fs
+              .readFileSync(fullPath)
+              .toString()
+              .replace(/\r?\n|\r/g, '');
+            return {
+              [`--lucide-${name}`]: `url('data:image/svg+xml;utf8,${content}')`,
+              '-webkit-mask': `var(--lucide-${name})`,
+              mask: `var(--lucide-${name})`,
+              'mask-repeat': 'no-repeat',
+              'background-color': 'currentColor',
+              'vertical-align': 'middle',
+              display: 'inline-block',
+              width: theme('spacing.6'),
+              height: theme('spacing.6'),
+            };
+          },
+        },
+        { values }
+      );
+    }),
   ],
 } satisfies Config;

assets/vendor/lucide/LICENSE

@@ -0,0 +1,17 @@
+ISC License
+
+Copyright (c) for portions of Lucide are held by Cole Bemis 2013-2022 as part
+of Feather (MIT). All other copyright (c) for Lucide are held by Lucide
+Contributors 2022.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.