server/openapi.json, server/README.md, and the Postman collection used what
turned out to be real customer names/phone numbers and a real Midtrans
webhook notification (copied during earlier debugging) as documentation
examples instead of fabricated placeholder data. Replaced with clearly
synthetic values (Budi Santoso, DEMO-MERCHANT-*, placeholder UUIDs/signature).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- server/logviewer.html: readable log viewer at GET /api/logs/view — level
filter chips, free-text search, and click-to-trace (clicking any field value
re-filters to every line sharing it, e.g. an order_id or request id across
its whole lifecycle). GET /api/logs/files/:filename now redirects browser
navigation here instead of returning raw JSON (Accept: application/json
still gets the JSON body).
- server/openapi.json + server/api-docs.html: OpenAPI 3.0 spec and a Scalar
reference page served at GET /openapi.json and GET /docs. Scalar is loaded
from a version-pinned CDN URL with a Subresource Integrity hash rather than
installed as a dependency.
- Generalize requireLogBasicAuth -> requireAdminAuth since the same HTTP Basic
Auth credentials now gate /api/logs*, /openapi.json, and /docs alike.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Tengku Achmad