# UI Dashboard Design: Fraud Investigator LiveView

Version: 1.0 | Date: 2026-05-21

All UI in gateway_web using Phoenix LiveView + Tailwind CSS.
Mirrors Jube's web interface features with equivalent Elixir implementation.

---

## 1. LiveView Page Inventory

| Route                          | LiveView Module                    | Jube Equivalent            |
|-------------------------------|------------------------------------|----------------------------|
| /admin/fraud                  | FraudDashboardLive                 | Landing / Activity Watcher |
| /admin/fraud/scores           | ScoreExplorerLive                  | Exhaustive Score Model     |
| /admin/fraud/scores/:id       | ScoreDetailLive                    | Transaction drill-down     |
| /admin/fraud/cases            | CaseManagementLive.Index           | Case Management Listing    |
| /admin/fraud/cases/:id        | CaseManagementLive.Show            | Case detail + actions      |
| /admin/fraud/rules            | RulesBuilderLive.Index             | Rule Builder               |
| /admin/fraud/rules/new        | RulesBuilderLive.Form              | Rule Builder editor        |
| /admin/fraud/rules/:id/edit   | RulesBuilderLive.Form              | Rule Builder editor        |
| /admin/fraud/models           | ModelTrainingLive.Index            | Exhaustive Training        |
| /admin/fraud/models/:id       | ModelTrainingLive.Show             | Model performance charts   |
| /admin/fraud/sanctions        | SanctionsLive.Index                | Manual Sanctions           |
| /admin/fraud/sanctions/upload | SanctionsLive.Upload               | Sanctions bulk upload      |
| /admin/fraud/features         | FeatureExplorerLive                | Variable Statistics        |
| /admin/fraud/reprocess        | ReprocessingLive                   | Reprocessing console       |
| /admin/fraud/settings         | FraudSettingsLive                  | Activation Watcher config  |

---

## 2. FraudDashboardLive — Real-Time Operations Dashboard

LiveView with real-time updates via Phoenix.PubSub subscription to "risk:scores".

Sections:
  [A] Summary Cards (last 1h):
      Total Transactions | Declined | Under Review | Fraud Rate % | Avg Score

  [B] Live Score Feed (auto-updates, most recent 50):
      Columns: Time | Tenant | Card BIN | Amount | Decision | Score | Fired Rules
      Color coding: red=DECLINE, amber=REVIEW, green=APPROVE
      Click row → ScoreDetailLive

  [C] Decision Distribution Chart (last 24h, updates every 60s):
      Stacked bar: APPROVE / REVIEW / DECLINE per hour

  [D] Top Triggered Rules (last 1h):
      Rule name | Count | % of total

  [E] Entity Velocity Alerts:
      Entities with velocity spike > 2σ from baseline (refreshes every 5m)

Implementation:
  handle_info({:risk_score_event, score}, socket) → stream :scores
  PubSub.subscribe("risk:scores:#{tenant_id}")

---

## 3. ScoreExplorerLive — Transaction Score Browser

Full-text and faceted search across risk_scores.

Filters:
  Date range | Decision | Score range | Tenant | Card BIN | Merchant ID | Fired rule

Columns:
  Transaction Ref | Created At | Decision | Score | Fired Rules | Label | Case Status

Actions:
  Open Case | Mark as Reviewed | Export CSV

Pagination: cursor-based (created_at DESC, id DESC) for performance.

Score detail panel (slide-in):
  Feature snapshot table: Feature | Value | Threshold | Fired?
  Explainability: which features contributed most to score
  Timeline: all transactions for same card token (last 30d)

---

## 4. CaseManagementLive — Investigator Workflow

Mirrors Jube's Case Management screen.

4a. Index (list view):
  Columns: Case Ref | Opened | Status | Priority | Decision | Score | Assigned To
  Filters: Status | Priority | Assigned To | Date range
  Bulk actions: Assign | Close | Export

4b. Show (case detail):
  Header: Case Ref | Status | Priority | Score | Decision
  Tab: Transaction Detail
    Full feature snapshot, fired rules, ML score breakdown
  Tab: Card History
    All risk_scores for this card_token (30d), scores plotted on timeline
  Tab: Audit Trail
    All risk_case_events (status changes, notes, label received)
  Tab: Related Transactions
    Other transactions matching same merchant or IP (± 15 minutes)

  Actions:
    Change Status | Assign | Add Note | Mark as Fraud | Mark as False Positive | Close

Implementation:
  Uses Ecto transactions to update risk_cases + insert risk_case_events atomically.
  PubSub broadcast "case:updated:#{case_id}" for real-time multi-investigator sync.

---

## 5. RulesBuilderLive — Activation Rule Editor

Mirrors Jube's Rule Builder / Rule Coder.

Form fields:
  Name | Description | Entity Type | Feature Key (searchable dropdown)
  Operator (>, >=, <, <=, ==, in) | Threshold Value | Decision | Priority | Active

Feature Key selector:
  Dropdown of all risk_entity_models for this tenant.
  Shows full feature name: "Card | 1h | Number of failed transactions"
  Auto-populates entity_type from selection.

Live preview:
  Shows last 100 transactions that would have triggered this rule.
  Updates on every field change (debounced 500ms).

Rule list:
  Sorted by priority. Drag-to-reorder (LiveView JS hook).
  Toggle active/inactive without leaving page.

---

## 6. ModelTrainingLive — ML Model Lifecycle

Mirrors Jube's Exhaustive Adaptation training UI.

6a. Index:
  Table of all risk_model_versions (status, metrics, deployed_at).
  Actions: Train New | Deploy | Retire | View Details

6b. Train New form:
  Feature set selector (multi-select from risk_entity_models)
  Algorithm: MLP (Axon) | Isolation Forest (Scholar) | Logistic Regression | Ensemble
  Date range for training data
  Hyperparameters (collapsible advanced section)
  "Start Training" → triggers Oban MwRisk.ModelTrainer job

6c. Model Detail:
  Training progress (live, streamed via PubSub from training Oban worker)
  Performance charts (AUC-ROC, learning curve, confusion matrix)
  Variable importance bar chart
  Score distribution histogram
  K-S statistic chart (Jube's ExhaustiveScoreModelTesting equivalent)
  Deploy / Retire buttons

---

## 7. SanctionsLive — Watchlist Manager

Mirrors Jube's Manual Sanctions screen.

7a. Index:
  Table: Name | List Type | Entity Type | Country | Added Date | Active
  Search: full-text search on name_normalized
  Filters: List Type | Entity Type | Active

7b. Add Single Entry:
  Name | Aliases (multi-value) | List Type | Entity Type | Country

7c. Bulk Upload:
  CSV upload → Broadway parser → bulk insert to risk_sanctions_list
  Shows parse errors inline.

7d. Match Tester:
  Input a name → shows all sanctions list entries within Levenshtein distance ≤ 3.
  Displays match score (0–100).

---

## 8. FeatureExplorerLive — Variable Statistics

Mirrors Jube's Variable Statistics dashboard.

Sections:
  [A] Feature Health Table:
      Feature Key | Avg Value (24h) | p50 | p95 | p99 | Count | Missing %
      Click → feature time-series chart (hourly avg, last 7d)

  [B] Feature Correlation Matrix:
      Heatmap of Pearson correlation between top 20 features
      (computed by FeaturePrecalcWorker, cached in risk_model_versions.metrics)

  [C] Velocity Spike Detection:
      Features with current value > 2× 30d rolling average
      Useful for detecting coordinated attacks or data quality issues

---

## 9. ReprocessingLive — History Replay Console

Replays historical transactions through updated model/rules. Mirrors Jube's Reprocessing.

Form:
  Date range | Tenant | Use model version (dropdown) | Sample % (1–100)
  "Preview" (dry run, shows count) | "Start Reprocessing"

Status:
  Progress bar (live stream from Oban job via PubSub)
  Results: original decision vs new decision, count of changes
  Export diff CSV

---

## 10. Navigation & Access Control

All fraud routes require:
  - Authenticated admin session (mw_auth.SessionPlug)
  - Role: "fraud_analyst" or "fraud_admin" or "compliance"

Role permissions:
  fraud_analyst:  view scores, manage cases, view rules (no edit)
  fraud_admin:    full access to rules, models, settings
  compliance:     view only + export + case management
  super_admin:    all tabs + tenant switching (landlord concept)

New RBAC roles added to mw_auth:
  "fraud_analyst", "fraud_admin", "compliance"