@app-vitals/agent-admin 0.0.0-stage → 0.1.0

package/src/clock.ts

@@ -0,0 +1,47 @@
+/**
+ * agent/src/runtime/clock.ts
+ * Clock interface and production implementation for injectable time.
+ *
+ * Any code that needs the current time should accept a `Clock` via dependency
+ * injection rather than calling `new Date()` or `Date.now()` directly.
+ * This makes time-dependent logic trivially testable and deterministic.
+ */
+
+// ─── Interface ────────────────────────────────────────────────────────────────
+
+export interface Clock {
+  /** Returns the current time as a Date. */
+  now(): Date;
+}
+
+// ─── SystemClock ──────────────────────────────────────────────────────────────
+
+/**
+ * Production clock — delegates to the real system time.
+ *
+ * @example
+ * const clock = SystemClock();
+ * clock.now(); // → current wall-clock time
+ */
+export function SystemClock(): Clock {
+  return {
+    now(): Date {
+      return new Date();
+    },
+  };
+}
+
+/**
+ * Fixed-time clock for deterministic testing.
+ *
+ * @example
+ * const clock = FixedClock(new Date("2024-01-01T00:00:00Z"));
+ * clock.now(); // → always 2024-01-01T00:00:00.000Z
+ */
+export function FixedClock(date: Date): Clock {
+  return {
+    now(): Date {
+      return new Date(date);
+    },
+  };
+}

package/src/coding-task-store-provisioning-client.integration.test.ts

@@ -0,0 +1,372 @@
+/**
+ * admin/src/coding-task-store-provisioning-client.integration.test.ts
+ * Integration tests for HttpTaskStoreProvisioningClient against recorded
+ * task-store token API fixtures.
+ *
+ * Drives the client through an INJECTED fetchFn that replays canned Responses
+ * from a cassette keyed by scenario — no live API server, no global.fetch
+ * override, no mock.module(). Mirrors the pattern in
+ * kubernetes-client.integration.test.ts.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import {
+  HttpTaskStoreProvisioningClient,
+  NoopTaskStoreProvisioningClient,
+} from "./coding-task-store-provisioning-client.ts";
+
+// ─── Cassette ───────────────────────────────────────────────────────────────
+
+interface CassetteEntry {
+  status: number;
+  body: unknown;
+}
+
+const CASSETTE_PATH = new URL(
+  "./fixtures/task-store-provisioning-cassette.json",
+  import.meta.url,
+).pathname;
+
+const cassette: Record<string, CassetteEntry> = JSON.parse(
+  readFileSync(CASSETTE_PATH, "utf-8"),
+);
+
+interface RecordedRequest {
+  url: string;
+  method: string;
+  headers: Headers;
+  body?: string;
+}
+
+/**
+ * Build an injected fetchFn that returns the cassette entry for `key`.
+ * Records the last request so tests can assert URL/method/headers/body.
+ */
+function cassetteFetch(key: string): {
+  fetchFn: typeof fetch;
+  lastRequest: () => RecordedRequest;
+} {
+  let last: RecordedRequest | undefined;
+  const entry = cassette[key];
+  if (!entry) throw new Error(`cassette key not found: ${key}`);
+
+  const fetchFn = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = typeof input === "string" ? input : input.toString();
+    last = {
+      url,
+      method: init?.method ?? "GET",
+      headers: new Headers(init?.headers),
+      body: typeof init?.body === "string" ? init.body : undefined,
+    };
+    return new Response(JSON.stringify(entry.body), {
+      status: entry.status,
+      statusText: `status-${entry.status}`,
+      headers: { "Content-Type": "application/json" },
+    });
+  }) as typeof fetch;
+
+  return {
+    fetchFn,
+    lastRequest: () => {
+      if (!last) throw new Error("fetchFn was not called");
+      return last;
+    },
+  };
+}
+
+/**
+ * Build an injected fetchFn that resolves each request from `cassette[key]`
+ * based on the request's method + URL (a simple router), and records every
+ * request made — needed for tests that drive multiple calls (e.g. list then
+ * revoke several matches) against a single client instance.
+ *
+ * `routes` maps "METHOD path" (path relative to baseUrl, e.g. "GET /tokens"
+ * or "DELETE /tokens/tok_abc123") to a cassette key.
+ */
+function multiCassetteFetch(routes: Record<string, string>): {
+  fetchFn: typeof fetch;
+  requests: () => RecordedRequest[];
+} {
+  const requests: RecordedRequest[] = [];
+
+  const fetchFn = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = typeof input === "string" ? input : input.toString();
+    const method = init?.method ?? "GET";
+    const path = url.replace("https://task-store.example.com", "");
+    const routeKey = `${method} ${path}`;
+    const cassetteKey = routes[routeKey];
+    if (!cassetteKey) {
+      throw new Error(`no route configured for: ${routeKey}`);
+    }
+    const entry = cassette[cassetteKey];
+    if (!entry) throw new Error(`cassette key not found: ${cassetteKey}`);
+
+    requests.push({
+      url,
+      method,
+      headers: new Headers(init?.headers),
+      body: typeof init?.body === "string" ? init.body : undefined,
+    });
+
+    return new Response(JSON.stringify(entry.body), {
+      status: entry.status,
+      statusText: `status-${entry.status}`,
+      headers: { "Content-Type": "application/json" },
+    });
+  }) as typeof fetch;
+
+  return { fetchFn, requests: () => requests };
+}
+
+function makeMultiClient(routes: Record<string, string>): {
+  client: HttpTaskStoreProvisioningClient;
+  requests: () => RecordedRequest[];
+} {
+  const { fetchFn, requests } = multiCassetteFetch(routes);
+  const client = new HttpTaskStoreProvisioningClient(
+    "https://task-store.example.com",
+    "admin-token-xyz",
+    { fetchFn },
+  );
+  return { client, requests };
+}
+
+function makeClient(key: string): {
+  client: HttpTaskStoreProvisioningClient;
+  lastRequest: () => RecordedRequest;
+} {
+  const { fetchFn, lastRequest } = cassetteFetch(key);
+  const client = new HttpTaskStoreProvisioningClient(
+    "https://task-store.example.com",
+    "admin-token-xyz",
+    { fetchFn },
+  );
+  return { client, lastRequest };
+}
+
+// ─── mintToken ───────────────────────────────────────────────────────────────
+
+describe("HttpTaskStoreProvisioningClient — mintToken", () => {
+  it("POSTs to /tokens with Bearer auth and returns id/rawToken", async () => {
+    const { client, lastRequest } = makeClient("mintToken_success");
+    const result = await client.mintToken("agent-abc label");
+
+    const req = lastRequest();
+    expect(req.method).toBe("POST");
+    expect(req.url).toBe("https://task-store.example.com/tokens");
+    expect(req.headers.get("authorization")).toBe("Bearer admin-token-xyz");
+    expect(req.headers.get("content-type")).toBe("application/json");
+    expect(JSON.parse(req.body ?? "{}")).toEqual({ label: "agent-abc label" });
+    expect(result).toEqual({
+      id: "tok_abc123",
+      rawToken: "sts_raw_test_token_value",
+    });
+  });
+
+  it("includes agentId in the body when provided", async () => {
+    const { client, lastRequest } = makeClient(
+      "mintToken_success_with_agentId",
+    );
+    const result = await client.mintToken("agent-scoped label", "agent-123");
+
+    const req = lastRequest();
+    expect(JSON.parse(req.body ?? "{}")).toEqual({
+      label: "agent-scoped label",
+      agentId: "agent-123",
+    });
+    expect(result.id).toBe("tok_def456");
+  });
+
+  it("throws on a non-ok response", async () => {
+    const { client } = makeClient("mintToken_500");
+    await expect(client.mintToken("label")).rejects.toThrow(
+      /task-store POST \/tokens failed: 500/,
+    );
+  });
+});
+
+// ─── revokeToken ─────────────────────────────────────────────────────────────
+
+describe("HttpTaskStoreProvisioningClient — revokeToken", () => {
+  it("DELETEs /tokens/:id with Bearer auth", async () => {
+    const { client, lastRequest } = makeClient("revokeToken_success");
+    await client.revokeToken("tok_abc123");
+
+    const req = lastRequest();
+    expect(req.method).toBe("DELETE");
+    expect(req.url).toBe("https://task-store.example.com/tokens/tok_abc123");
+    expect(req.headers.get("authorization")).toBe("Bearer admin-token-xyz");
+  });
+
+  it("treats 404 as success (already revoked / not found is not an error)", async () => {
+    const { client } = makeClient("revokeToken_404");
+    await expect(client.revokeToken("tok_missing")).resolves.toBeUndefined();
+  });
+
+  it("throws on a non-ok, non-404 response", async () => {
+    const { client } = makeClient("revokeToken_500");
+    await expect(client.revokeToken("tok_abc123")).rejects.toThrow(
+      /task-store DELETE \/tokens\/tok_abc123 failed: 500/,
+    );
+  });
+});
+
+// ─── listTokensForAgent ────────────────────────────────────────────────────────
+
+describe("HttpTaskStoreProvisioningClient — listTokensForAgent", () => {
+  it("GETs /tokens with Bearer auth and filters client-side by agentId", async () => {
+    const { client, lastRequest } = makeClient("listTokens_mixedAgents");
+    const result = await client.listTokensForAgent("agent-1");
+
+    const req = lastRequest();
+    expect(req.method).toBe("GET");
+    expect(req.url).toBe("https://task-store.example.com/tokens");
+    expect(req.headers.get("authorization")).toBe("Bearer admin-token-xyz");
+
+    // Only tokens with agentId === "agent-1" — includes the already-revoked
+    // one (revocation state is irrelevant to listing/filtering).
+    expect(result).toEqual([
+      { id: "tok_agent1_a" },
+      { id: "tok_agent1_b" },
+      { id: "tok_agent1_revoked" },
+    ]);
+  });
+
+  it("excludes tokens with a different agentId and tokens with no agentId", async () => {
+    const { client } = makeClient("listTokens_mixedAgents");
+    const result = await client.listTokensForAgent("agent-2");
+    expect(result).toEqual([{ id: "tok_agent2_a" }]);
+  });
+
+  it("returns an empty array when no tokens match", async () => {
+    const { client } = makeClient("listTokens_noMatches");
+    const result = await client.listTokensForAgent("agent-1");
+    expect(result).toEqual([]);
+  });
+
+  it("returns an empty array when the token list itself is empty", async () => {
+    const { client } = makeClient("listTokens_empty");
+    const result = await client.listTokensForAgent("agent-1");
+    expect(result).toEqual([]);
+  });
+
+  it("throws on a non-ok response", async () => {
+    const { client } = makeClient("listTokens_500");
+    await expect(client.listTokensForAgent("agent-1")).rejects.toThrow(
+      /task-store GET \/tokens failed: 500/,
+    );
+  });
+});
+
+// ─── listTokensForAgent + revokeToken orchestration (caller-driven) ──────────
+
+describe("listTokensForAgent + revokeToken — agent token cleanup flow", () => {
+  it("revokes every token matching the agent (multiple matches)", async () => {
+    const { client, requests } = makeMultiClient({
+      "GET /tokens": "listTokens_mixedAgents",
+      "DELETE /tokens/tok_agent1_a": "revokeToken_success",
+      "DELETE /tokens/tok_agent1_b": "revokeToken_success",
+      "DELETE /tokens/tok_agent1_revoked": "revokeToken_success",
+    });
+
+    const matches = await client.listTokensForAgent("agent-1");
+    expect(matches).toEqual([
+      { id: "tok_agent1_a" },
+      { id: "tok_agent1_b" },
+      { id: "tok_agent1_revoked" },
+    ]);
+
+    for (const { id } of matches) {
+      await client.revokeToken(id);
+    }
+
+    const made = requests();
+    expect(made).toHaveLength(4);
+    expect(made[0].method).toBe("GET");
+    expect(made[0].url).toBe("https://task-store.example.com/tokens");
+    expect(made.slice(1).map((r) => r.method)).toEqual([
+      "DELETE",
+      "DELETE",
+      "DELETE",
+    ]);
+
+    // Every request only ever touches /tokens paths — never /tasks. This is
+    // the client-side guarantee that no Task/assignee mutation occurs: this
+    // client has no method that can call anything but the tokens endpoint.
+    for (const r of made) {
+      expect(r.url).toMatch(
+        /^https:\/\/task-store\.example\.com\/tokens(\/|$)/,
+      );
+      expect(r.url).not.toContain("/tasks");
+    }
+  });
+
+  it("is a no-op when zero tokens match the agent", async () => {
+    const { client, requests } = makeMultiClient({
+      "GET /tokens": "listTokens_noMatches",
+    });
+
+    const matches = await client.listTokensForAgent("agent-does-not-exist");
+    expect(matches).toEqual([]);
+
+    for (const { id } of matches) {
+      await client.revokeToken(id);
+    }
+
+    expect(requests()).toHaveLength(1);
+    expect(requests()[0].method).toBe("GET");
+  });
+
+  it("re-revoking an already-revoked token does not throw", async () => {
+    const { client, requests } = makeMultiClient({
+      "GET /tokens": "listTokens_mixedAgents",
+      // tok_agent1_revoked is already revoked server-side; task-store's
+      // revoke() is idempotent, so this still returns success (200/204),
+      // not a 404 or 500.
+      "DELETE /tokens/tok_agent1_revoked": "revokeToken_success",
+      "DELETE /tokens/tok_agent1_a": "revokeToken_success",
+      "DELETE /tokens/tok_agent1_b": "revokeToken_success",
+    });
+
+    const matches = await client.listTokensForAgent("agent-1");
+    const revokedMatch = matches.find((m) => m.id === "tok_agent1_revoked");
+    expect(revokedMatch).toBeDefined();
+
+    await expect(
+      client.revokeToken("tok_agent1_revoked"),
+    ).resolves.toBeUndefined();
+
+    const made = requests();
+    expect(made.some((r) => r.url.endsWith("/tokens/tok_agent1_revoked"))).toBe(
+      true,
+    );
+  });
+});
+
+// ─── NoopTaskStoreProvisioningClient ─────────────────────────────────────────
+
+describe("NoopTaskStoreProvisioningClient", () => {
+  it("mintToken returns empty id/rawToken", async () => {
+    const client = new NoopTaskStoreProvisioningClient();
+    const result = await client.mintToken("label");
+    expect(result).toEqual({ id: "", rawToken: "" });
+  });
+
+  it("mintToken accepts an agentId without erroring", async () => {
+    const client = new NoopTaskStoreProvisioningClient();
+    const result = await client.mintToken("label", "agent-1");
+    expect(result).toEqual({ id: "", rawToken: "" });
+  });
+
+  it("revokeToken resolves without error", async () => {
+    const client = new NoopTaskStoreProvisioningClient();
+    await expect(client.revokeToken("any-id")).resolves.toBeUndefined();
+  });
+
+  it("listTokensForAgent returns an empty array with no-op behavior", async () => {
+    const client = new NoopTaskStoreProvisioningClient();
+    const result = await client.listTokensForAgent("agent-1");
+    expect(result).toEqual([]);
+  });
+});

package/src/coding-task-store-provisioning-client.ts

@@ -0,0 +1,156 @@
+/**
+ * admin/src/coding-task-store-provisioning-client.ts
+ *
+ * Thin interface + implementations for minting/revoking per-agent task-store
+ * tokens during agent provisioning.
+ *
+ * The interface is the DI boundary. Tests inject a stub; production wires in
+ * HttpTaskStoreProvisioningClient (or skips task-store wiring entirely by
+ * omitting the client from KubernetesAgentProvisionerConfig).
+ */
+
+import type { components } from "@app-vitals/agent-lib/task-store-types";
+
+// ─── Interface ───────────────────────────────────────────────────────────────
+
+export interface TaskStoreProvisioningClient {
+  /**
+   * Mint a new task-store token. Returns the token `id` (needed to revoke it
+   * on rollback) and the `rawToken` (stored in the agent Secret and later used
+   * by the agent to authenticate with the task store).
+   *
+   * Pass `agentId` to create a scoped agent token — the task store will scope
+   * all reads and writes to tasks assigned to this agent. Omit for admin tokens.
+   */
+  mintToken(
+    label: string,
+    agentId?: string,
+  ): Promise<{ id: string; rawToken: string }>;
+
+  /**
+   * Revoke a previously-minted task-store token. Called as part of the rollback
+   * path when Deployment creation fails after the token was minted, and as
+   * part of agent-deletion credential cleanup.
+   * Should be best-effort — callers do not propagate errors from this call.
+   */
+  revokeToken(id: string): Promise<void>;
+
+  /**
+   * List the ids of every task-store token scoped to `agentId`.
+   *
+   * task-store's GET /tokens has no server-side agentId filter — it returns
+   * every token in the store — so this fetches the full list and filters
+   * client-side. Intended to be paired with `revokeToken` by the caller (e.g.
+   * agent-deletion cleanup): list, then revoke each match.
+   */
+  listTokensForAgent(agentId: string): Promise<{ id: string }[]>;
+}
+
+// ─── HTTP implementation ──────────────────────────────────────────────────────
+
+/**
+ * Real HTTP client for the task-store token API.
+ *
+ * POST /tokens  → { id, rawToken, ... }
+ * DELETE /tokens/:id
+ *
+ * The admin token is passed via Bearer auth and is never stored in the Secret
+ * or handed to the agent — only the per-agent rawToken is.
+ */
+export class HttpTaskStoreProvisioningClient
+  implements TaskStoreProvisioningClient
+{
+  private readonly fetchFn: typeof fetch;
+
+  constructor(
+    private readonly baseUrl: string,
+    private readonly adminToken: string,
+    opts?: { fetchFn?: typeof fetch },
+  ) {
+    this.fetchFn = opts?.fetchFn ?? fetch;
+  }
+
+  async mintToken(
+    label: string,
+    agentId?: string,
+  ): Promise<{ id: string; rawToken: string }> {
+    const tokenBody: components["schemas"]["TokenBody"] = {
+      label,
+      ...(agentId ? { agentId } : {}),
+    };
+    const res = await this.fetchFn(`${this.baseUrl}/tokens`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${this.adminToken}`,
+      },
+      body: JSON.stringify(tokenBody),
+    });
+    if (!res.ok) {
+      throw new Error(
+        `task-store POST /tokens failed: ${res.status} ${res.statusText}`,
+      );
+    }
+    const body =
+      (await res.json()) as components["schemas"]["TaskTokenWithRaw"];
+    return { id: body.id, rawToken: body.rawToken };
+  }
+
+  async revokeToken(id: string): Promise<void> {
+    const res = await this.fetchFn(`${this.baseUrl}/tokens/${id}`, {
+      method: "DELETE",
+      headers: {
+        Authorization: `Bearer ${this.adminToken}`,
+      },
+    });
+    if (!res.ok && res.status !== 404) {
+      throw new Error(
+        `task-store DELETE /tokens/${id} failed: ${res.status} ${res.statusText}`,
+      );
+    }
+  }
+
+  async listTokensForAgent(agentId: string): Promise<{ id: string }[]> {
+    const res = await this.fetchFn(`${this.baseUrl}/tokens`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${this.adminToken}`,
+      },
+    });
+    if (!res.ok) {
+      throw new Error(
+        `task-store GET /tokens failed: ${res.status} ${res.statusText}`,
+      );
+    }
+    const tokens = (await res.json()) as components["schemas"]["TaskToken"][];
+    return tokens
+      .filter((token) => token.agentId === agentId)
+      .map((token) => ({ id: token.id }));
+  }
+}
+
+// ─── No-op implementation ─────────────────────────────────────────────────────
+
+/**
+ * No-op client used when SHIPWRIGHT_TASK_STORE_URL / SHIPWRIGHT_TASK_STORE_ADMIN_TOKEN
+ * are not configured. mintToken returns empty strings so callers can gate on
+ * the configured path without null-checking the return.
+ */
+export class NoopTaskStoreProvisioningClient
+  implements TaskStoreProvisioningClient
+{
+  async mintToken(
+    _label: string,
+    _agentId?: string,
+  ): Promise<{ id: string; rawToken: string }> {
+    return { id: "", rawToken: "" };
+  }
+
+  async revokeToken(_id: string): Promise<void> {
+    // intentionally a no-op
+  }
+
+  async listTokensForAgent(_agentId: string): Promise<{ id: string }[]> {
+    return [];
+  }
+}

package/src/crypto.ts

@@ -0,0 +1,83 @@
+/**
+ * agent/src/runtime/crypto.ts
+ * AES-256-GCM encryption for at-rest value storage.
+ *
+ * Encrypted format: `iv:ciphertext:authTag` — all hex-encoded, colon-separated.
+ *
+ * Key must be a 32-byte value expressed as a 64-character hex string
+ * (e.g. SHIPWRIGHT_ENCRYPTION_KEY env var).
+ */
+
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+
+const ALGORITHM = "aes-256-gcm";
+const IV_BYTES = 12; // 96-bit IV — recommended for GCM
+
+/**
+ * True when `keyHex` is a 64-char hex string (32 bytes) usable as an AES-256-GCM
+ * key. Anything else — wrong length or non-hex characters — is rejected;
+ * `createCipheriv` would otherwise throw an opaque "Invalid key length" only at
+ * the first encrypt. Callers use this to fail fast with an actionable message.
+ */
+export function isValidKeyHex(keyHex: string): boolean {
+  return /^[0-9a-fA-F]{64}$/.test(keyHex);
+}
+
+/**
+ * Encrypts a plaintext string with AES-256-GCM.
+ *
+ * @param plaintext - The string to encrypt.
+ * @param keyHex   - 64-char hex string representing a 32-byte key.
+ * @returns Hex-encoded `iv:ciphertext:authTag`.
+ */
+export function encrypt(plaintext: string, keyHex: string): string {
+  const key = Buffer.from(keyHex, "hex");
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+
+  const ciphertext = Buffer.concat([
+    cipher.update(plaintext, "utf8"),
+    cipher.final(),
+  ]);
+
+  const authTag = cipher.getAuthTag();
+
+  return [
+    iv.toString("hex"),
+    ciphertext.toString("hex"),
+    authTag.toString("hex"),
+  ].join(":");
+}
+
+/**
+ * Decrypts a value produced by `encrypt()`.
+ *
+ * @param encrypted - Hex-encoded `iv:ciphertext:authTag` string.
+ * @param keyHex    - 64-char hex string representing a 32-byte key.
+ * @returns The original plaintext string.
+ * @throws If the format is invalid, the key is wrong, or the auth tag fails.
+ */
+export function decrypt(encrypted: string, keyHex: string): string {
+  const parts = encrypted.split(":");
+  if (parts.length !== 3) {
+    throw new Error(
+      `Invalid encrypted format: expected "iv:ciphertext:authTag", got ${parts.length} part(s)`,
+    );
+  }
+
+  const [ivHex, ciphertextHex, authTagHex] = parts as [string, string, string];
+  const key = Buffer.from(keyHex, "hex");
+  const iv = Buffer.from(ivHex, "hex");
+  const ciphertext = Buffer.from(ciphertextHex, "hex");
+  const authTag = Buffer.from(authTagHex, "hex");
+
+  const decipher = createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(authTag);
+
+  const decrypted = Buffer.concat([
+    decipher.update(ciphertext),
+    decipher.final(),
+  ]);
+
+  return decrypted.toString("utf8");
+}

package/src/dev-auth-guard.ts

@@ -0,0 +1,29 @@
+/**
+ * admin/src/dev-auth-guard.ts
+ *
+ * Guard for the dev auto-login route (/admin/dev-login).
+ *
+ * The dev-login endpoint is an unauthenticated local convenience and must never
+ * be reachable in a production deployment. This module exposes a PURE predicate
+ * over an injected env object (deterministically unit-testable, no process.env
+ * reads). Production is hard-blocked regardless of the ADMIN_DEV_AUTH flag.
+ */
+
+interface DevAuthGuardEnv {
+  ADMIN_DEV_AUTH?: string;
+  NODE_ENV?: string;
+}
+
+/**
+ * Returns true iff dev auto-login is allowed.
+ *
+ * Allowed iff:
+ *   - NODE_ENV !== "production"   (hard block in prod, ignores ADMIN_DEV_AUTH)
+ *   - ADMIN_DEV_AUTH === "true"
+ */
+export function isDevAuthAllowed(env: DevAuthGuardEnv): boolean {
+  if (env.NODE_ENV === "production") {
+    return false;
+  }
+  return env.ADMIN_DEV_AUTH === "true";
+}