@x12i/memorix-forensics

Memorix Forensics is a pure UI layer for investigating a single Memorix record end-to-end. It has no data tier of its own: it reads object types, records, and full snapshots live from memorix-explorer-api, the read-only Memorix consumption API.

Memorix Forensics never touches a database directly. All reads go through the Explorer API.

The flow

1. Pick an object type — search a typeahead of the Memorix object types (assets, subnets, vulnerabilities-groups, users, …).
2. Search for a record — free-text search and browse a paginated list of records within that type.
3. Investigate the record — a tabbed inspector over the record's full snapshot: overview, relationships, data, analytics, enrichment, insights, discovery, analysis, associated, system, raw.

Every step is deep-linkable, so a specific record can be opened directly (#/investigate/<objectType>/<recordId>) without going through the picker or search steps first.

Core features

• Object-type picker: typeahead over Memorix Catalox object types.
• Record search: text search + pagination over any object type's records.
• Snapshot inspector: data / analytics / enrichment / insights / associated buckets for one record, with per-associated-property drill-down.
• Record view modes: after opening a record, switch between the current snapshot inspector and a grouped mind map. Mind-map branches can be expanded/collapsed, and selecting any node opens a details sidebar with Focus plus back/forward focus navigation. Descriptor-backed naming management belongs in the separate operations/admin tool tracked in MRX-CR-010. The current mind map is one-hop over the opened snapshot's associated arrays; recursive paths such as asset -> subnet -> zone are tracked in MRX-CR-011.

Architecture

memorix-explorer-api                                Memorix Forensics (browser)
  /api/explorer/object-types      ─►  src/api.js  ─►  ObjectTypePicker.vue (pick a type)
  /api/explorer/records/collection ─►  src/api.js  ─►  RecordSearch.vue (search/list)
  /api/explorer/snapshots/:type/:id ─►  src/api.js  ─►  InvestigateReactWrapper.vue
                                                          └─►  src/components/investigate/* (React island)
  /api/auth/* (Authix gate)       ─►  src/auth/authStore.js

Memorix Forensics keeps no domain data. These read-only routes are served by memorix-explorer-api.

Authentication

memorix-explorer-api exposes the same Authix gate as the other Memorix UIs. Memorix Forensics presents a login view (password or SSO, matching AUTHIX_AUTH_MODE) and relies on the httpOnly session cookie — no tokens are stored in the browser. In development the Vite /api proxy makes both the record routes and the auth cookie same-origin.

When the Explorer API runs without an Authix service configured (AUTHIX_AUTH_MODE=disabled, the default), the gate renders a synthetic local session and the API stays open — convenient for local development.

Local development

Vue 3 + React + Vite.

1. Start memorix-explorer-api on port 5181 (with a valid .env):

cd ../memorix-explorer-api
npm install
npm run dev

2. Start Memorix Forensics (proxies /api → 127.0.0.1:5181):

npm install
npm run dev
# → http://127.0.0.1:5175

Log in through the gate (or pass straight through when auth is disabled), pick an object type, search for a record, and dive in.

Configuration

| Variable | Default | Purpose | |----------|---------|---------| | VITE_DEV_PORT | 5175 | Memorix Forensics dev server port | | EXPLORER_API_PORT / PORT | 5181 | explorer-api port the /api proxy targets (read from the local .env, matching explorer-api's own EXPLORER_API_PORT → PORT → 5181 order) | | VITE_EXPLORER_API_URL | /api/explorer | Override the record/metadata base (e.g. absolute URL when not using the proxy; requires CORS on explorer-api) | | VITE_AUTH_API_URL | /api/auth | Override the Authix auth base |

Build

npm run build