v0.32.2

src/admin/preferences_columns.rs

@@ -75,21 +75,15 @@ const STREAM_LIST_SORT_COLUMNS: &[&str] = &[
     "maxConnections",
     "idleTimeout",
 ];
-const DASHBOARD_WIDGETS: &[&str] = &[
-    "requests",
-    "active",
-    "bandwidth",
-    "errors",
-    "cache",
-    "memory",
-    "websocket",
-    "http2",
-    "http3",
-    "tls",
-    "http_protocol",
-    "websocket_protocol",
-    "stream_overview",
-    "stream_traffic",
-    "stream_sessions",
-    "stream_backend_health",
-];
+// The same JSON registry is embedded into the authenticated admin JS bundle.
+// No independent allowlist is maintained by the browser or backend.
+#[derive(serde::Deserialize)]
+struct DashboardWidgetDefinition {
+    id: String,
+    default_hidden: bool,
+}
+static DASHBOARD_WIDGETS: std::sync::LazyLock<Vec<DashboardWidgetDefinition>> =
+    std::sync::LazyLock::new(|| {
+        serde_json::from_str(include_str!("web/dashboard-widgets.json"))
+            .expect("invalid bundled Overview Cards registry")
+    });