Studio

fenec studio is the server's own admin page: its collections, their rows and their schema in a browser, the edits you make there, a query editor, the rows as they change and the server's own numbers. Start the server with --studio and open /_studio/, or try it on the Playground, where it runs over a database in your own tab.

Turn it on

Add --studio to fenec-server, open /_studio/ on the same address, and paste a token.

fenec-server --file data.fenec --http 127.0.0.1:8080 \
         --http-token "$TOKEN" --studio

open http://127.0.0.1:8080/_studio/

• Off by default. Without --studio, /_studio/ answers 404, as an unknown path does.
• No new authority. The page reads and writes with the token you paste, over the same HTTP surface every client uses.
• A tool for operators: keep it on a private network or behind your own sign-in (Security).

Connect

The server is the page's own address unless you name another, and the token is the one the server takes: its --http-token, or a JSON Web Token its policy holds to its rows. The top bar says who the server takes it for.

• Your token stays in the tab. It is kept in session storage and forgotten when the tab closes: never in local storage, a cookie or a URL.
• Who you are: the token's subject, role and tenant, the rules that apply to it, and how long until its exp. The line under the top bar shortens as the token's life runs out, and the page warns you five minutes before it does.

curl -H "Authorization: Bearer $ALICE" http://127.0.0.1:8080/_whoami
# {"node":"single","tenant":null,"read_only":false,"kind":"scoped","sub":"alice",
#  "tenants":null,"unbound":false,"append_only":[],
#  "rules":[{"collection":"orders","grants":["read","insert","update","delete"],
#            "fields":null,"read_fields":null,"rows":"owner = $jwt.sub"}]}

Collections and rows

The sidebar lists the collections the token can read, each with its rows and its fields' types and indexes. The grid shows a collection's rows, as many as it holds, read a page at a time as you scroll.

• Sort by id, or by a field an index orders: @sorted or @ttl.
• Filter with a where clause in FenecQL and its parameters, or a box under each column: abc, =v, >=v, a..b, null.
• Counts by value for each @hash field, over what the filter selects; pick one to filter by it.
• A row unfolded (Space): a json field as a tree, a vector as its dimension, its length and its first components.
• File size and what a compact would give back, where the token may read /_metrics.

Edit

Enter writes a cell, N opens a form for a new row, and Delete removes one after you confirm the statement it will send.

set orders {note: $1} where id = $2 require 1
insert orders {customer: $1, total: $2}
del orders where id = $1 require 1

• Every value is a parameter. A text shaped as FenecQL is stored as it reads.
• Every write is a /batch with an Idempotency-Key, so a retry cannot write it twice.
• A refusal says why: 403 names the field the policy refused, and 412 says the row changed — deleted, or no longer the token's — since it was read.

Query

The Query tab is an editor for FenecQL. It runs exactly what you type, with your token: it can do what the token may, and nothing more.

• Run with Ctrl+Enter or ⌘Enter; a selection runs alone.
• Parameters are a JSON list, bound to $1, $2…
• Several statements, separated by ;, run as one /batch: they land together or not at all. Give their parameters as a list each, [[1], ["a"]].
• The answer as rows or as JSON, with its status, its time, its Fenec-Seq for a write and its X-Request-Id.
• The plan of a get: the Plan tab asks the server for explain of the same text with the same parameters.
• A refusal shows the server's message and status, and for a batch which statement stopped it, which the editor selects.
• History and saved queries stay in this browser. The token is never kept there.

Schema

The Schema tab shows a collection as the statements that make it, and its fields. With the server's token you can add an index or a field, rename or drop a field, and drop the collection.

• Every change is shown before it runs: the exact statement, and what POST /_schema/plan says of the schema as it would be after it.
• A drop waits for its name. Dropping a field or a collection runs only once you type its name.
• A scoped token reads the schema of the collections it reads, and changes nothing.

create index on orders (total) @sorted
alter collection orders add field due timestamp @ttl(30d)
alter collection orders rename field note to memo
alter collection orders drop field memo
drop collection scratch

Live

The Live tab follows a collection's rows as they change: new and rewritten rows are marked as they arrive, deleted ones struck through before they go.

• A where clause picks the rows to follow.
• Pause holds the changes back and counts them; resume applies them in order.
• A scoped token sees its own rows: the server holds the stream to them, deletions included.

Admin

The Admin tab is shown to the server's own token. It reads the statements by shape, the server's counts and, on a router, its tenants.

• Statements: the slowest and the most run shapes, from /_stats/statements. Pick one to open it in the editor.
• Server: reads, writes, errors and their latency, the file and what a compact would give back, memory and compactions, from /_metrics, read again every 5 seconds.
• On a router: each tenant with its node, state and size on disk, from GET /_shard/tenants?bytes.

In your browser

The site's Playground is this studio — the same files the server embeds — over a database in your browser tab rather than a server's: fenecdb compiled to WebAssembly, on a worker of the tab, seeded with products, orders and a week of events. Nothing is sent anywhere. Rows, the query editor, the schema and the live rows work there as they do here; the query editor lists examples to run.

Keys

Tenants

On a tenant node or a router, the top bar picks the tenant: those the token's tenant claim names, or the node's or router's list where the token may read it. Otherwise type the tenant when you connect.

fenec-server --dir tenants --http 127.0.0.1:8081 --admin-token "$ADMIN" --studio
fenec-shard --listen 127.0.0.1:8090 --directory shard.fenec --studio

Security

The studio is a new surface, not a new authority. Treat it as you would the server's own port: keep it on a private network, or behind your own sign-in and TLS.