tajniak81andClaude Opus 4.8
33595c99e8
The fleet lived as a tab inside the Logbook, which buried it, and every
drone had to be typed in by hand — model, serial and firmware copied off
an airframe the app was already talking to.
Promote it to its own nav section above Logbook, and let a connecting
drone register itself. The Fly App already forwarded model, serial and
firmware upstream; the hub was keeping only the model. It now carries the
identity through to DeviceState, and the Web App offers it to a new
POST /api/drones/auto, which upserts keyed by serial. The auto path only
writes what the aircraft is authoritative about (model, both firmware
versions) and never touches what the pilot curates.
Serial and the firmware versions resolve on their own schedules after
connect — the serial in seconds, the aircraft firmware sometimes a minute
later — so nothing along the path treats an absent value as a cleared one,
and a later event filling firmware in still reaches the server. The auto
call rides every telemetry frame, so the client remembers the identity
tuple it last sent and only a change goes out; a 4xx is the server's
settled answer and is not retried, or one drone connected for an hour
would mean one request per frame for an hour.
New fields on drones: firmware, controller_firmware, and registration for
the FAA/CAA aircraft number — distinct from operator_number, which stays
the EU operator ID. Controller firmware is the remote controller's own
version, read from its component; the flight controller's version is a
different quantity and stays off this field (see 002e484). name becomes
optional and is now the pilot's custom name: auto-added drones arrive
unnamed, so the API serves a computed displayName (name, else model +
serial) for the fleet table, the flight picker and the CSV export. A
unique index on serial is what keeps the find-then-create path from
forking a drone's history across two records.
The schema is applied to the remote PocketBase; the migration is here for
fresh deployments, which the remote does not read.
Verified against a simulated device over the real socket with identity
resolving late: one record from four events, both firmware versions
filled, curated fields intact across re-registration, and a drone deleted
while connected coming back on the next frame.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
PocketBase — PilotVault schema
PilotVault adds an organizations collection and three fields to the users
auth collection:
preferences(JSON) — each user's settings blob. Written with the user's own token, so PocketBase's default owner-only update rule (@request.auth.id = id) is all the authorization needed.role(select:superadmin|admin|user) — the user-rights level. A superadmin spans every organization; an admin is scoped to their own organization (may manage its users and admins, but not superadmins); a user has no management rights. Missing/empty is treated asuser.organization(relation →organizations, maxSelect 1, optional) — which org the user belongs to. Nullable: a user may belong to no organization.
The organizations collection is a plain base collection with a unique
name. It is reached only through the API Server's superuser service account
(its API rules stay locked to superusers), the same way user management works.
User + org management requires a service account
Listing/creating/deleting users and organizations is done by the API Server
using a superuser service account (POCKETBASE_ADMIN_EMAIL /
POCKETBASE_ADMIN_PASSWORD), but only after verifying the caller's own token
resolves to a manager role (admin for user management, superadmin for org
management). This is the single place the server uses elevated PocketBase
credentials; without the env vars, the /api/users and /api/orgs endpoints
return 503 and the rest is unaffected.
Preferences never need the service account — they use the caller's own token.
Add the schema
Pick one of the following.
Option A — migration (recommended)
Copy the migration files into your PocketBase deployment's pb_migrations/
directory and restart PocketBase (migrations run automatically on boot; they
target the PocketBase v0.22+/v0.23 JS migration API). They are idempotent, so
they are safe even if the schema was already provisioned live:
pb_migrations/1720300000_add_users_preferences.jspb_migrations/1720300100_add_users_role.jspb_migrations/1720300200_add_organizations.jspb_migrations/1720300300_add_users_organization.jspb_migrations/1720300400_extend_users_role_superadmin.jspb_migrations/1720300500_seed_orgs_and_users.js— seeds the PilotVault org + baseline accounts
Option B — Admin UI (any version)
- Open the PocketBase Admin UI → Collections → New collection
organizations(base); add a text fieldname(required) with a unique index. - Collections →
users→ New field. Add JSON fieldpreferences, not required, max size ~5 MB. - Add Select field
role, valuessuperadmin,admin,user, max select 1. - Add Relation field
organization→organizations, max select 1, not required, cascade delete off. - Save.
Verify
With a normal user token you should be able to round-trip the field:
# 1) log in (PocketBase directly, or via the API Server /api/auth/login)
TOKEN=... # the "token" from the auth response
# 2) save
curl -X PATCH "$PB_URL/api/collections/users/records/$USER_ID" \
-H "Authorization: $TOKEN" -H "Content-Type: application/json" \
-d '{"preferences":{"fontSize":"lg","themeMode":"dark"}}'
# 3) read back
curl "$PB_URL/api/collections/users/auth-refresh" -X POST -H "Authorization: $TOKEN"
In the app the round-trip is: browser → GET/PUT /bff/preferences → API Server
GET/PUT /api/preferences → PocketBase user record.