@app-vitals/agent-admin 0.0.0-stage → 0.1.0

package/Dockerfile

@@ -0,0 +1,43 @@
+# Admin service image (ghcr.io/app-vitals/agent-admin)
+#
+# Build from the repository root:  docker build -f admin/Dockerfile .
+
+FROM oven/bun:1-slim AS deps
+
+WORKDIR /app
+
+COPY package.json bunfig.toml bun.lock* ./
+COPY admin/package.json ./admin/
+COPY admin/prisma ./admin/prisma/
+COPY admin/prisma.config.ts ./admin/
+COPY runtime/package.json ./runtime/
+COPY lib/package.json ./lib/
+COPY patches/ ./patches/
+
+RUN if [ -f bun.lock ]; then bun install --frozen-lockfile; else bun install; fi
+
+FROM oven/bun:1-slim AS production
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+ENV NODE_ENV=production
+
+COPY --from=deps /app/node_modules ./node_modules
+COPY --from=deps /app/admin/node_modules ./admin/node_modules
+COPY --from=deps /app/lib/node_modules ./lib/node_modules
+
+# .dockerignore keeps node_modules, .git and build output out of the context.
+COPY . .
+
+# The generated Prisma client is not committed.
+RUN cd admin && bunx prisma generate --schema=prisma/schema
+
+EXPOSE 3000
+
+USER 1000
+
+ENTRYPOINT ["bun", "run", "admin/src/main.ts"]

package/README.md

@@ -1,3 +1,73 @@
-# Temporary Holding Version
+# Shipwright Admin Service
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The admin service provides a web UI and CRUD API for managing Shipwright agents — env vars, cron jobs, tokens, tools, and plugins. It also exposes the runtime API used by deployed agents to fetch their configuration.
+
+The HTTP server is implemented in `admin/src/main.ts`, which composes the admin UI, admin CRUD API, and agent runtime API into a single Hono app running on port 3000.
+
+## Running Locally
+
+```bash
+# From repo root — install all workspace deps
+bun install
+
+# Export required env vars (see Environment Variables table below)
+export DATABASE_URL_SHIPWRIGHT_ADMIN=postgresql://...
+export SHIPWRIGHT_SESSION_SECRET=...
+# ... (remaining vars)
+
+# Run the admin server
+bun run admin/src/main.ts
+```
+
+The service listens on `http://localhost:3000` by default. Visit `/admin` for the UI.
+
+## Environment Variables
+
+| Variable | Required | Description |
+|---|---|---|
+| `DATABASE_URL_SHIPWRIGHT_ADMIN` | Yes | PostgreSQL connection string for the admin Prisma schema |
+| `SHIPWRIGHT_SESSION_SECRET` | Yes | JWT cookie secret for admin UI sessions |
+| `GOOGLE_CLIENT_ID` | Yes | Google OAuth 2.0 client ID for admin UI login |
+| `GOOGLE_CLIENT_SECRET` | Yes | Google OAuth 2.0 client secret |
+| `SHIPWRIGHT_ADMIN_ALLOWED_EMAILS` | Yes | Comma-separated list of emails permitted to log in |
+| `SHIPWRIGHT_ADMIN_APP_BASE_URL` | Yes | Public base URL used for OAuth redirect (defaults to `http://localhost:3000`) |
+| `SHIPWRIGHT_ADMIN_API_KEYS` | No | Comma-separated `name:token:scope` tuples for bearer token auth. Scope is `*`, an agent id, `platform.read` or `platform.ops` (no colons in scopes) — see [docs/agent-api.md](../docs/agent-api.md) |
+| `SHIPWRIGHT_ENCRYPTION_KEY` | Recommended | 64-char hex key for AES-256-GCM encryption of stored secrets |
+| `PORT` | No | HTTP server port (defaults to `3000`) |
+
+## Database
+
+The admin service uses its own PostgreSQL database. Run migrations before starting:
+
+```bash
+export DATABASE_URL_SHIPWRIGHT_ADMIN=postgres://...
+cd admin && bunx prisma migrate deploy --schema=prisma/schema
+```
+
+## Building the Docker Image
+
+Build from the repo root (the Dockerfile uses the full monorepo context):
+
+```bash
+docker build -f admin/Dockerfile -t shipwright-admin .
+```
+
+Run the image:
+
+```bash
+docker run \
+  -e DATABASE_URL_SHIPWRIGHT_ADMIN=postgres://... \
+  -e SHIPWRIGHT_SESSION_SECRET=... \
+  -e GOOGLE_CLIENT_ID=... \
+  -e GOOGLE_CLIENT_SECRET=... \
+  -e SHIPWRIGHT_ADMIN_ALLOWED_EMAILS=admin@example.com \
+  -e SHIPWRIGHT_ADMIN_APP_BASE_URL=https://admin.example.com \
+  -p 3000:3000 \
+  shipwright-admin
+```
+
+## Deployment
+
+A GKE Deployment + Service manifest is provided at [`admin/deploy/deployment.yaml`](./deploy/deployment.yaml).
+
+It expects a Kubernetes Secret named `shipwright-admin-secret` containing all required env vars. See the comments at the top of the manifest for setup instructions.

package/e2e/agents-page.e2e.ts

@@ -0,0 +1,338 @@
+/**
+ * admin/e2e/agents-page.e2e.ts
+ * Admin UI — Agents Page E2E Tests (ADM-3.2)
+ *
+ * Tests the agent detail page at GET /admin/agents/:id, covering:
+ *   1.  Unauthenticated GET /admin/agents → redirects to /admin/login
+ *   2.  Authenticated → page title contains agent name
+ *   3.  Authenticated → h1 contains agent name
+ *   4.  Authenticated → agent card shows agent name "Test Agent"
+ *   5.  Env var key "SLACK_BOT_TOKEN" is visible
+ *   6.  Env var value is masked (••••••••), raw secret not present in page
+ *   7.  Cron job schedule "0 9 * * 1" is visible
+ *   8.  Cron job prompt is visible
+ *   9.  Token label "Production token" is visible
+ *   10. Env var add form is present (action contains /envs)
+ *   11. Add cron form is present (action contains /crons)
+ *   12. Token form is present (action contains /tokens)
+ *   13. Mobile viewport (375px) — no horizontal overflow
+ *
+ * Architecture:
+ *   - Spawns admin/e2e/test-server.ts via Bun as a child process.
+ *   - Uses hono/jwt sign() to mint valid session cookies directly.
+ *   - No real DB or OAuth flow is initiated.
+ */
+
+import { type ChildProcess, spawn } from "node:child_process";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { type BrowserContext, type Page, expect, test } from "@playwright/test";
+import { sign } from "hono/jwt";
+
+// ─── Constants ────────────────────────────────────────────────────────────────
+
+const PORT = 3491;
+const BASE_URL = `http://localhost:${PORT}`;
+const SESSION_SECRET = "e2e-admin-test-secret-32chars!!!";
+const SESSION_COOKIE = "admin_session";
+const AGENT_ID = "agent-e2e-1";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+// ─── Server lifecycle ─────────────────────────────────────────────────────────
+
+let serverProcess: ChildProcess | null = null;
+
+async function waitForServer(url: string, maxWaitMs: number): Promise<void> {
+  const start = Date.now();
+  while (Date.now() - start < maxWaitMs) {
+    try {
+      const res = await fetch(url);
+      if (res.status < 500) return;
+    } catch {
+      // Not ready yet
+    }
+    await new Promise((r) => setTimeout(r, 300));
+  }
+  throw new Error(`Server at ${url} did not start within ${maxWaitMs}ms`);
+}
+
+test.beforeAll(async () => {
+  const serverScript = resolve(__dirname, "test-server.ts");
+
+  serverProcess = spawn("bun", ["run", serverScript], {
+    env: {
+      ...process.env,
+      ADMIN_E2E_PORT: String(PORT),
+      ADMIN_E2E_SESSION_SECRET: SESSION_SECRET,
+    },
+    stdio: "pipe",
+    cwd: resolve(__dirname, "../.."),
+  });
+
+  serverProcess.stderr?.on("data", (data: Buffer) => {
+    const msg = data.toString();
+    if (msg.trim()) console.error("[admin-e2e-agents-server]", msg.trim());
+  });
+
+  serverProcess.stdout?.on("data", (data: Buffer) => {
+    const msg = data.toString();
+    if (msg.trim()) console.log("[admin-e2e-agents-server]", msg.trim());
+  });
+
+  await waitForServer(`${BASE_URL}/health`, 15_000);
+});
+
+test.afterAll(() => {
+  if (serverProcess) {
+    serverProcess.kill("SIGTERM");
+    serverProcess = null;
+  }
+});
+
+// ─── Session cookie helper ────────────────────────────────────────────────────
+
+async function mintSession(
+  userId = "google-sub-e2e",
+  email = "admin@example.com",
+): Promise<string> {
+  const nowSec = Math.floor(Date.now() / 1000);
+  return sign(
+    { userId, email, isAdmin: true, iat: nowSec, exp: nowSec + 3600 },
+    SESSION_SECRET,
+    "HS256",
+  );
+}
+
+// ─── Helper: load agent detail page with auth ─────────────────────────────────
+
+async function loadAgentDetailPage(
+  page: Page,
+  context: BrowserContext,
+): Promise<void> {
+  const token = await mintSession();
+  await context.addCookies([
+    {
+      name: SESSION_COOKIE,
+      value: token,
+      domain: "localhost",
+      path: "/",
+      httpOnly: true,
+      sameSite: "Lax",
+    },
+  ]);
+  await page.goto(`${BASE_URL}/admin/agents/${AGENT_ID}`);
+}
+
+// ─── 1. Unauthenticated redirect ──────────────────────────────────────────────
+
+test.describe("GET /admin/agents — unauthenticated", () => {
+  test("redirects to /admin/login when no session cookie", async ({ page }) => {
+    await page.goto(`${BASE_URL}/admin/agents`);
+    await expect(page).toHaveURL(/\/admin\/login/);
+  });
+});
+
+// ─── 2–13. Authenticated tests ────────────────────────────────────────────────
+
+test.describe("GET /admin/agents/:id — authenticated", () => {
+  test("page title contains agent name", async ({ page, context }) => {
+    await loadAgentDetailPage(page, context);
+    await expect(page).toHaveTitle(/Test Agent/);
+  });
+
+  test("h1 contains agent name", async ({ page, context }) => {
+    await loadAgentDetailPage(page, context);
+    await expect(page.locator("h1")).toContainText("Test Agent");
+  });
+
+  test('agent name "Test Agent" is visible on the page', async ({
+    page,
+    context,
+  }) => {
+    await loadAgentDetailPage(page, context);
+    await expect(page.locator("body")).toContainText("Test Agent");
+  });
+
+  test('env var key "SLACK_BOT_TOKEN" is visible', async ({
+    page,
+    context,
+  }) => {
+    await loadAgentDetailPage(page, context);
+    await expect(page.locator("body")).toContainText("SLACK_BOT_TOKEN");
+  });
+
+  test("env var value is masked — shows •••••••• and not the raw secret", async ({
+    page,
+    context,
+  }) => {
+    await loadAgentDetailPage(page, context);
+    const body = await page.locator("body").textContent();
+    expect(body).toContain("••••••••");
+    expect(body).not.toContain("xoxb-secret-value");
+  });
+
+  test('cron job schedule "0 9 * * 1" is visible', async ({
+    page,
+    context,
+  }) => {
+    await loadAgentDetailPage(page, context);
+    await expect(page.locator("body")).toContainText("0 9 * * 1");
+  });
+
+  test("cron job prompt is visible", async ({ page, context }) => {
+    await loadAgentDetailPage(page, context);
+    await expect(page.locator("body")).toContainText("Send the weekly standup");
+  });
+
+  test('token label "Production token" is visible', async ({
+    page,
+    context,
+  }) => {
+    await loadAgentDetailPage(page, context);
+    await expect(page.locator("body")).toContainText("Production token");
+  });
+
+  test("env var add form is present (action contains /envs)", async ({
+    page,
+    context,
+  }) => {
+    await loadAgentDetailPage(page, context);
+    const envForm = page.locator('form[action*="/envs"]').first();
+    await expect(envForm).toBeAttached();
+  });
+
+  test("add cron form is present (action contains /crons)", async ({
+    page,
+    context,
+  }) => {
+    await loadAgentDetailPage(page, context);
+    const cronForm = page.locator('form[action*="/crons"]').first();
+    await expect(cronForm).toBeAttached();
+  });
+
+  test("token form is present (action contains /tokens)", async ({
+    page,
+    context,
+  }) => {
+    await loadAgentDetailPage(page, context);
+    const tokenForm = page.locator('form[action*="/tokens"]').first();
+    await expect(tokenForm).toBeAttached();
+  });
+
+  test("mobile viewport (375px) — page renders without horizontal overflow", async ({
+    page,
+    context,
+  }) => {
+    await page.setViewportSize({ width: 375, height: 812 });
+    await loadAgentDetailPage(page, context);
+
+    const docScrollWidth = await page.evaluate(
+      () => document.documentElement.scrollWidth,
+    );
+    const innerWidth = await page.evaluate(() => window.innerWidth);
+    expect(docScrollWidth).toBeLessThanOrEqual(innerWidth + 1);
+  });
+
+  test("specialty name is visible on the detail page", async ({
+    page,
+    context,
+  }) => {
+    await loadAgentDetailPage(page, context);
+    await expect(page.locator("body")).toContainText("coding");
+  });
+
+  // CFB-3.1: .data-table .btn must stay at its current ~36px height at mobile
+  // widths — the mobile-wide .btn min-height:44px rule must not cascade
+  // through to buttons inside a .data-table (e.g. the env-var "Delete"
+  // button), or the tasks/PRs/env tables would become absurdly tall.
+  test("at 375px, a .data-table .btn (env var Delete button) stays near its current ~36px height, not 44px", async ({
+    page,
+    context,
+  }) => {
+    await page.setViewportSize({ width: 375, height: 812 });
+    await loadAgentDetailPage(page, context);
+
+    // Env Vars now lives inside a collapsed accordion group (AGA-1.1) —
+    // expand it before asserting on the visibility of anything inside.
+    await page
+      .locator("#env-vars")
+      .locator("xpath=ancestor::details[contains(@class, 'group')]")
+      .first()
+      .evaluate((details) => {
+        (details as HTMLDetailsElement).open = true;
+      });
+
+    const deleteBtn = page
+      .locator("#env-vars .data-table .btn", { hasText: "Delete" })
+      .first();
+    await expect(deleteBtn).toBeVisible();
+
+    const height = await deleteBtn.evaluate(
+      (el) => el.getBoundingClientRect().height,
+    );
+    expect(height).toBeLessThan(44);
+    expect(height).toBeGreaterThan(0);
+  });
+});
+
+// ─── New-specialty picker (ATS-4.1) ──────────────────────────────────────────
+
+async function loadNewAgentPage(
+  page: Page,
+  context: BrowserContext,
+): Promise<void> {
+  const token = await mintSession();
+  await context.addCookies([
+    {
+      name: SESSION_COOKIE,
+      value: token,
+      domain: "localhost",
+      path: "/",
+      httpOnly: true,
+      sameSite: "Lax",
+    },
+  ]);
+  await page.goto(`${BASE_URL}/admin/agents/new`);
+}
+
+test.describe("GET /admin/agents/new — type picker", () => {
+  test("a required select[name=type] is present", async ({ page, context }) => {
+    await loadNewAgentPage(page, context);
+    const typeSelect = page.locator('select[name="type"]');
+    await expect(typeSelect).toBeAttached();
+    await expect(typeSelect).toHaveAttribute("required", "");
+  });
+
+  test('the select lists "Coding Agent" (value coding)', async ({
+    page,
+    context,
+  }) => {
+    await loadNewAgentPage(page, context);
+    const codingOption = page.locator(
+      'select[name="type"] option[value="coding"]',
+    );
+    await expect(codingOption).toBeAttached();
+    await expect(codingOption).toHaveText("Coding Agent");
+  });
+});
+
+test.describe("POST /admin/agents — create-with-type journey", () => {
+  test("filling the form (incl. type) and submitting lands on the new agent's detail page showing its type", async ({
+    page,
+    context,
+  }) => {
+    await loadNewAgentPage(page, context);
+
+    await page.fill('input[name="name"]', "My New Coding Agent");
+    await page.selectOption('select[name="type"]', "coding");
+    // Scoped to the new-agent form specifically — the page also has a
+    // "Sign out" button[type="submit"] in the toolbar, and an unscoped
+    // selector matches that one first (it's earlier in the DOM), which
+    // logs the session out instead of submitting this form.
+    await page.click('form[action="/admin/agents"] button[type="submit"]');
+
+    await page.waitForURL(/\/admin\/agents\/[^/]+$/);
+    await expect(page.locator("body")).toContainText("coding");
+  });
+});

package/e2e/chat-degraded.e2e.ts

@@ -0,0 +1,153 @@
+/**
+ * admin/e2e/chat-degraded.e2e.ts
+ * Admin UI — Chat Degraded Mode E2E Tests (CFB-2.3)
+ *
+ * Proves that `chatClient` is a genuinely injectable dependency of the test
+ * server, not a hardcoded mock — and that the three other chat e2e suites
+ * (chat-page.e2e.ts, chat-thread-page.e2e.ts, chat-progress.e2e.ts) are
+ * exercising the real chat UI rather than silently passing against a
+ * degraded fallback page.
+ *
+ * When the server is spawned with ADMIN_E2E_CHAT_CLIENT_ABSENT=1, test-server.ts
+ * builds AdminUIDeps with chatClient: undefined, which is the same condition
+ * production hits when SHIPWRIGHT_CHAT_SERVICE_URL /
+ * SHIPWRIGHT_CHAT_SERVICE_ADMIN_TOKEN are unset. Both /admin/chat and the
+ * per-thread route must then render the "Chat service not configured." alert
+ * instead of the real thread list / message UI.
+ *
+ * Architecture mirrors chat-progress.e2e.ts: spawns admin/e2e/test-server.ts
+ * via Bun as a child process, mints session cookies via hono/jwt.
+ */
+
+import { type ChildProcess, spawn } from "node:child_process";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { type BrowserContext, expect, test } from "@playwright/test";
+import { sign } from "hono/jwt";
+
+// ─── Constants ────────────────────────────────────────────────────────────────
+
+const PORT = 3495;
+const BASE_URL = `http://localhost:${PORT}`;
+const SESSION_SECRET = "e2e-admin-test-secret-32chars!!!";
+const SESSION_COOKIE = "admin_session";
+const AGENT_ID = "agent-e2e-1";
+// Matches MOCK_CHAT_THREAD.id in test-server.ts.
+const THREAD_ID = "thread-e2e-1";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+// ─── Server lifecycle ─────────────────────────────────────────────────────────
+
+let serverProcess: ChildProcess | null = null;
+
+async function waitForServer(url: string, maxWaitMs: number): Promise<void> {
+  const start = Date.now();
+  while (Date.now() - start < maxWaitMs) {
+    try {
+      const res = await fetch(url);
+      if (res.status < 500) return;
+    } catch {
+      // Not ready yet
+    }
+    await new Promise((r) => setTimeout(r, 300));
+  }
+  throw new Error(`Server at ${url} did not start within ${maxWaitMs}ms`);
+}
+
+test.beforeAll(async () => {
+  const serverScript = resolve(__dirname, "test-server.ts");
+
+  serverProcess = spawn("bun", ["run", serverScript], {
+    env: {
+      ...process.env,
+      ADMIN_E2E_PORT: String(PORT),
+      ADMIN_E2E_SESSION_SECRET: SESSION_SECRET,
+      // Configure this spawned server to run with no chatClient at all, so
+      // the /admin/chat* routes fall back to degraded-mode rendering.
+      ADMIN_E2E_CHAT_CLIENT_ABSENT: "1",
+    },
+    stdio: "pipe",
+    cwd: resolve(__dirname, "../.."),
+  });
+
+  serverProcess.stderr?.on("data", (data: Buffer) => {
+    const msg = data.toString();
+    if (msg.trim()) console.error("[admin-e2e-chat-degraded-server]", msg.trim());
+  });
+
+  serverProcess.stdout?.on("data", (data: Buffer) => {
+    const msg = data.toString();
+    if (msg.trim()) console.log("[admin-e2e-chat-degraded-server]", msg.trim());
+  });
+
+  await waitForServer(`${BASE_URL}/health`, 15_000);
+});
+
+test.afterAll(() => {
+  if (serverProcess) {
+    serverProcess.kill("SIGTERM");
+    serverProcess = null;
+  }
+});
+
+// ─── Session cookie helper ────────────────────────────────────────────────────
+
+async function mintSession(
+  userId = "google-sub-e2e",
+  email = "admin@example.com",
+): Promise<string> {
+  const nowSec = Math.floor(Date.now() / 1000);
+  return sign(
+    { userId, email, isAdmin: true, iat: nowSec, exp: nowSec + 3600 },
+    SESSION_SECRET,
+    "HS256",
+  );
+}
+
+async function authenticate(context: BrowserContext): Promise<void> {
+  const token = await mintSession();
+  await context.addCookies([
+    {
+      name: SESSION_COOKIE,
+      value: token,
+      domain: "localhost",
+      path: "/",
+      httpOnly: true,
+      sameSite: "Lax",
+    },
+  ]);
+}
+
+// ─── Tests ────────────────────────────────────────────────────────────────────
+
+test.describe("GET /admin/chat* — CFB-2.3 degraded mode (chatClient absent)", () => {
+  test("the chat list page renders the degraded alert instead of the thread list", async ({
+    page,
+    context,
+  }) => {
+    await authenticate(context);
+    await page.goto(`${BASE_URL}/admin/chat?agentId=${AGENT_ID}`);
+
+    await expect(page.locator(".alert.alert-error")).toContainText(
+      "Chat service not configured.",
+    );
+    await expect(page.locator(".thread-pane-list")).toHaveCount(0);
+  });
+
+  test("the thread detail page renders the degraded alert instead of the message UI", async ({
+    page,
+    context,
+  }) => {
+    await authenticate(context);
+    await page.goto(
+      `${BASE_URL}/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+    );
+
+    await expect(page.locator(".alert.alert-error")).toContainText(
+      "Chat service not configured.",
+    );
+    await expect(page.locator("#live-status-bubble")).toHaveCount(0);
+    await expect(page.locator("#messages-container")).toHaveCount(0);
+  });
+});