Floogos Update — Week 18, April–May 2026 (Apr 27 – May 3)

Summary

Week 18 was focused on security, interactivity, and performance. Webhooks received a comprehensive security system including rate limiting, IP filtering, HMAC signature verification, and reusable security policies, along with a redesigned UI showing real-time statistics and logs. Dashboards became interactive with click actions and an action drawer. DataStore moved to server-side pagination for much better performance on large datasets. Dashboard KPIs were corrected to use real execution success rates.

New Features

Webhook Security Policies

A full security engine is now available for webhooks. Security policies are reusable configurations that can be assigned to one or more webhooks. Each policy supports:

• Rate limiting — Limit the number of requests per time window, either globally or per originating IP address.
• IP filtering — Allow or block specific IP addresses and CIDR ranges (e.g., 192.168.1.0/24).
• HMAC-SHA256 verification — Validate request authenticity using a shared secret key. The signature is compared using a timing-safe equality check to prevent timing attacks. The header name carrying the signature is configurable.
• HTTP method restriction — Accept only specific methods (GET, POST, PUT, etc.).
• Payload size limit — Reject requests whose body exceeds a configured size.
• Schedule restriction — Allow requests only on specific days of the week and within a time range, with timezone support.

All validation is performed in a chained sequence with no external dependencies. Rate limiting is maintained in memory with TTL-based expiry.

Policies are created and managed from the webhook panel. An auto-generated name is suggested based on the active configuration. A random 32-byte hex secret key can be generated with a single click for HMAC setup.

Webhook Logging

Every request reaching a webhook is now logged automatically. Each log entry records:

• Originating IP address
• HTTP method
• Response status (allowed / blocked / rate_limited / error)
• Request duration in milliseconds
• User-Agent string

The webhook list view now shows, for each webhook: calls in the last 24 hours, blocked requests in the last 24 hours, and the timestamp of the most recent call.

An expandable panel per webhook shows:

• 30-day KPI summary.
• Area chart of daily total and blocked requests over 30 days.
• Table of the last 8 requests with IP, status, duration, and block reason.

Dashboard Click Actions

Dashboard widgets now support configurable click actions. When a user clicks on a widget, it can:

• Open an external URL (in the same tab, a new tab, or a drawer).
• Open another Floogos dashboard embedded in a side drawer.
• Open a Floogos form in an embedded iframe within a drawer.
• Open a data preview drawer with DataStore content.

Table widgets additionally support row-level click actions, using a configurable rowIdField to pass the clicked row’s identifier to the target.

A new DashboardActionDrawer component handles all drawer-mode targets (embedded dashboards, iframe forms, data previews).

The Dashboard Builder’s left catalog panel is now collapsible, and the right configuration panel has a resizable splitter.

DataStore Server-Side Pagination

DataStore now performs pagination, filtering, and search on the server side. The API accepts limit, offset, search, and noTags parameters and returns a COUNT alongside the data. This eliminates the N+1 query pattern and makes DataStore usable with large datasets without loading all records into the browser.

The UI adds debounced search, a “no tags” filter toggle, and an export function that fetches all rows (bypassing the page size) for download.

Public Dashboard Feature Parity

Public dashboards (accessible via /public-dashboard/:token) now fully match the editor experience: shared data sources are loaded correctly, and the action drawer works identically to the authenticated view.

Improvements

Dashboard KPIs Use Real Success Rate

The dashboard KPI cards were updated to calculate the success rate from actual execution records rather than a hardcoded or estimated value. The tutorial was also updated to reflect the new indicators.

Security Badge Rendering Fix

Security badges in the webhook list were not rendering when the underlying value was MySQL’s TINYINT 0 (which JavaScript received as the number 0 rather than false). The rendering logic now correctly handles this case.

Webhook List Redesign

The webhook list was simplified with a cleaner layout:

• Webhook URLs and security information moved to a side drawer that opens on row click, reducing visual clutter in the main list.
• Security badges (Rate, IP, HMAC) are now shown inline in a compact column.
• A policy selector dropdown allows changing the assigned policy directly from the list.

Technical Notes

• The webhook security system is implemented in services/webhookSecurityService.js with no external runtime dependencies.
• Logging uses a new webhook_logs table (migration 031). The webhook list query uses a subquery to count calls_24h and blocked_24h without a separate request.
• Security policies use a new webhook_policies table (migration 032) with policy_id and secret_key columns added to the webhooks table.
• All security stats and CRUD for policies are exposed via routes/webhookStats.js: GET /:id/stats, GET /:id/logs, and full CRUD on /policies plus PUT /:id/policy.
• The HMAC comparison uses Node.js crypto.timingSafeEqual to prevent timing oracle attacks.