The LiveView half of the dashboard overview — the data and the message handling that back PhoenixKitWeb.Components.Core.DashboardOverview.

Used by /admin (PhoenixKitWeb.Live.Dashboard), whose operator half the overview is. The deprecated /dashboard (PhoenixKitWeb.Live.Dashboard.Index) is a separate page and does NOT use this.

Gate the DATA, not only the markup

Hiding a card in HEEx is cosmetic — the operator aggregates would still have run. assign_scope_gates/1 therefore decides FIRST and works SECOND: a visitor who may not see the statistics causes

• no Roles.get_extended_stats/0, Sessions.get_session_stats/0 or Presence.get_presence_stats/0,
• no migration-version read,
• and no Events.subscribe_to_* at all,

and the six statistics assigns are set to nil.

One gate site, re-run on every scope change

Every scope-derived assign on this page — :can_access_admin_area?, the six card gates, :show_statistics, the six statistics assigns — is computed in assign_scope_gates/1 and NOWHERE else. Mount calls it through assign_overview/3; a mid-session permission change calls it through phoenix_kit_scope_changed/1, the callback use injects and PhoenixKitWeb.Users.Auth's scope-refresh hook invokes right after it reassigns :phoenix_kit_current_scope. A gate added to that function is therefore recomputed for free, and cannot be the one that gets forgotten.

This matters because /admin is the guaranteed landing: a visitor is NOT evicted from it when their rights change, so the page has to survive the change in place. Without recomputation a revoked operator kept a card pointing at a page that now rejects them, beside a sidebar (which re-derives every render) that disagreed.

The statistics subscriptions move in both directions with the gate: sync_statistics_subscription/2 subscribes a visitor who gains the rights mid-session and unsubscribes one who loses them. An unsubscribe, not just a hidden card — a hidden card still costs three aggregates per broadcast. PhoenixKit.Admin.Events had no unsubscribe counterpart before this page needed one; it does now (unsubscribe_from_stats/0 and friends), because PhoenixKit runs its own PubSub instance and a caller cannot reach Phoenix.PubSub.unsubscribe/2 for it.

refresh_statistics/1 re-derives the verdict from the CURRENT scope rather than trusting :show_statistics, because phx-click events are client-supplied — the button being hidden is not a guarantee that the event cannot arrive.

Visibility rules

The card rule is derived, never restated: the card and the page it links to ask the same function, so "a card is visible iff the visitor can open it" holds by construction. The statistics have no destination LiveView to derive from, so they use the role-agnostic "can reach everything" check — the same posture the unmapped-admin-view fallback takes.

Usage

use PhoenixKitWeb.Live.Dashboard.Overview

def mount(_params, session, socket) do
  {:ok, Overview.assign_overview(socket, session, Routes.path("/admin"))}
end

use injects three things: handle_event("refresh_stats", …), ONE handle_info/2 clause guarded by is_overview_message/1, and the phoenix_kit_scope_changed/1 callback described above.

That single guarded clause replaced nine shape-matched ones deliberately. A socket can still be handed a message from a topic it has just left — the unsubscribe and the broadcast race — and it will also see any FUTURE arity of a message it does subscribe to. Nine exact-shape clauses turn either into an unmatched handle_info and a crashed LiveView. The guard matches on the message TAG alone and apply_statistics_message/2 ends in a catch-all, so an in-flight or reshaped message is a no-op rather than a crash — and, because that function re-checks the gate first, never an operator query on behalf of someone who just lost the permission.

The guard is deliberately narrow: it names ten tags and nothing else, so a host LiveView keeps full control of every other message. It does mean any additional handle_event/handle_info clauses must be defined together with these (Elixir warns when clauses of one function are not grouped, and mix precommit compiles with --warnings-as-errors).

The attrs are passed to the component one by one rather than via a Map.take/2 spread: an explicit attr keeps LiveView's change tracking, so a presence update re-sends only the tile that changed instead of the whole overview.