Dashboards AI assistant

A third way to build a widget's query is to describe it in plain language. POST /api/dashboards/ai/suggest takes {db, prompt}, sends the model a schema description (table/column names, types, PK/NOT NULL, and suggested relationships only — not a single row of real data), gets back one SELECT with an explanation, then runs it through EXPLAIN and a preview — the same pipeline Smart Export already uses.

curl -X POST $URL/api/dashboards/ai/suggest -H "X-Token: $TOK" -d '{
  "db": "shop",
  "prompt": "Monthly revenue for the last year"
}'

{
  "sql": "SELECT strftime('%Y-%m', created_at) AS month, SUM(amount) AS revenue FROM orders WHERE created_at >= ... GROUP BY month",
  "explain": "Sums amount by month over the last 12 months",
  "plan": "...",
  "preview": [ ... ]
}

It uses the same provider already configured for AI Chat and Smart Export (a global preset — see "AI setup: providers and presets"); there's no separate key to set up for dashboards.

The model proposes, it doesn't decide

The prompt asks the model to return only a SELECT — but a prompt is a hint, not a security boundary. The real guardrail is the same parser-level read-only guard the other three query sources go through: whatever the model returns, including the result of a prompt injection or a hallucination, gets validated and can only run via ExecReadOnlySQL. If the LLM "decides" to return DELETE instead of SELECT, that guard rejects it before anything executes, rather than silently failing somewhere deeper.

POST /api/dashboards/ai/validate runs an already-written SQL string — your own, or an edited version of the model's answer — through the same chain (validate → EXPLAIN → preview) without a new call to the LLM.