@app-vitals/agent-admin 0.0.0-stage → 0.1.0

package/src/push-toggle.ts

@@ -0,0 +1,135 @@
+/**
+ * admin/src/push-toggle.ts
+ * The push-notification toggle fragment spliced into the chat thread page.
+ *
+ * SINGLE EARLY GATE (acceptance criterion 6): when push is disabled server-side
+ * (VAPID not fully configured → no public key threaded here), this returns "" —
+ * so the thread page degrades to EXACTLY the CFB-3.2 page with no toggle and no
+ * partial remnants. Client-side unsupported/denied states are handled inside
+ * the fragment's own script, which keeps the button hidden or shows static
+ * guidance rather than a broken control.
+ *
+ * The client script (acceptance criterion 5):
+ *   - Requests Notification permission ONLY inside the button's click handler,
+ *     never on load.
+ *   - If permission is already 'denied', it NEVER calls requestPermission()
+ *     again — it shows static "enable in browser settings" guidance instead.
+ *   - On iOS Safari that is NOT standalone, PushManager is undefined not
+ *     because push is unsupported but because the app isn't installed — so it
+ *     shows "Add to Home Screen" education, not an error (iOS honesty).
+ *   - Subscribes via navigator.serviceWorker.ready → pushManager.subscribe.
+ */
+
+interface PushToggleArgs {
+  pushEnabled: boolean;
+  vapidPublicKey: string;
+  agentId: string;
+  threadId: string;
+}
+
+export function renderPushToggle(args: PushToggleArgs): string {
+  // The single early gate. No public key (partial/absent VAPID) → no toggle.
+  if (!args.pushEnabled || !args.vapidPublicKey) return "";
+
+  const subscribeUrl = `/admin/chat/${encodeURIComponent(
+    args.agentId,
+  )}/push/subscribe`;
+  const unsubscribeUrl = `/admin/chat/${encodeURIComponent(
+    args.agentId,
+  )}/push/unsubscribe`;
+
+  return `
+<div class="push-toggle" id="push-toggle" style="margin:8px 0;font-size:13px">
+  <button type="button" id="push-toggle-btn" class="btn btn-secondary" style="display:none">Enable notifications</button>
+  <span id="push-toggle-status" style="color:#6b7280"></span>
+</div>
+<script>
+(function() {
+  var VAPID_PUBLIC_KEY = ${JSON.stringify(args.vapidPublicKey)};
+  var SUBSCRIBE_URL = ${JSON.stringify(subscribeUrl)};
+  var UNSUBSCRIBE_URL = ${JSON.stringify(unsubscribeUrl)};
+  var btn = document.getElementById('push-toggle-btn');
+  var status = document.getElementById('push-toggle-status');
+  if (!btn || !status) return;
+
+  function setStatus(text) { status.textContent = text; }
+
+  function urlBase64ToUint8Array(base64String) {
+    var padding = '='.repeat((4 - (base64String.length % 4)) % 4);
+    var base64 = (base64String + padding).replace(/-/g, '+').replace(/_/g, '/');
+    var raw = atob(base64);
+    var out = new Uint8Array(raw.length);
+    for (var i = 0; i < raw.length; i++) out[i] = raw.charCodeAt(i);
+    return out;
+  }
+
+  var isIOS = /iP(hone|ad|od)/.test(navigator.userAgent);
+  var isStandalone = window.matchMedia('(display-mode: standalone)').matches
+    || window.navigator.standalone === true;
+
+  // iOS honesty: PushManager is undefined in a Safari TAB but defined in an
+  // installed Home Screen app. Do NOT conflate 'unsupported' with 'not yet
+  // installed' — on iOS-and-not-standalone show install education, not an error.
+  if (!('serviceWorker' in navigator) || !('PushManager' in window)) {
+    if (isIOS && !isStandalone) {
+      setStatus('To get notifications, use Share → Add to Home Screen, then open the app.');
+    } else {
+      setStatus('Notifications are not supported in this browser.');
+    }
+    return;
+  }
+
+  // Already denied: NEVER re-prompt (AC 5). Show static guidance only.
+  if (Notification.permission === 'denied') {
+    setStatus('Notifications are blocked. Enable them for this site in your browser settings.');
+    return;
+  }
+
+  btn.style.display = 'inline-block';
+  setStatus('');
+
+  // Permission is requested ONLY here, inside the click handler (AC 5).
+  btn.addEventListener('click', function() {
+    if (Notification.permission === 'denied') {
+      setStatus('Notifications are blocked. Enable them for this site in your browser settings.');
+      return;
+    }
+    btn.disabled = true;
+    Notification.requestPermission().then(function(perm) {
+      if (perm !== 'granted') {
+        btn.disabled = false;
+        if (perm === 'denied') {
+          setStatus('Notifications are blocked. Enable them for this site in your browser settings.');
+        } else {
+          setStatus('');
+        }
+        return;
+      }
+      return navigator.serviceWorker.ready.then(function(reg) {
+        return reg.pushManager.subscribe({
+          userVisibleOnly: true,
+          applicationServerKey: urlBase64ToUint8Array(VAPID_PUBLIC_KEY),
+        });
+      }).then(function(subscription) {
+        var json = subscription.toJSON();
+        return fetch(SUBSCRIBE_URL, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            endpoint: subscription.endpoint,
+            p256dh: json.keys && json.keys.p256dh,
+            auth: json.keys && json.keys.auth,
+          }),
+        });
+      }).then(function() {
+        setStatus('Notifications enabled.');
+        btn.textContent = 'Notifications on';
+      });
+    }).catch(function() {
+      btn.disabled = false;
+      setStatus('');
+    });
+  });
+})();
+</script>`;
+}

package/src/push-toggle.unit.test.ts

@@ -0,0 +1,78 @@
+/**
+ * admin/src/push-toggle.unit.test.ts
+ * Unit tests for the push-toggle fragment rendered into the chat thread page.
+ *
+ * AC 5: the toggle requests permission ONLY inside a click handler; a denied
+ *       state shows guidance and never re-prompts.
+ * AC 6: when push is disabled server-side the fragment is EXACTLY "" — the page
+ *       degrades to the CFB-3.2 page with no toggle and no remnants.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { renderPushToggle } from "./push-toggle.ts";
+
+describe("renderPushToggle — server-side gate (AC 6)", () => {
+  it("renders nothing when push is disabled server-side", () => {
+    expect(
+      renderPushToggle({
+        pushEnabled: false,
+        vapidPublicKey: "",
+        agentId: "a",
+        threadId: "t",
+      }),
+    ).toBe("");
+  });
+
+  it("renders nothing when the vapid public key is missing even if flagged enabled", () => {
+    expect(
+      renderPushToggle({
+        pushEnabled: true,
+        vapidPublicKey: "",
+        agentId: "a",
+        threadId: "t",
+      }),
+    ).toBe("");
+  });
+});
+
+describe("renderPushToggle — enabled", () => {
+  const html = renderPushToggle({
+    pushEnabled: true,
+    vapidPublicKey: "BPUBLICKEY",
+    agentId: "agt_1",
+    threadId: "thr_1",
+  });
+
+  it("embeds the vapid public key for pushManager.subscribe", () => {
+    expect(html).toContain("BPUBLICKEY");
+    expect(html).toContain("pushManager");
+  });
+
+  it("requests permission ONLY inside a click handler, never on load (AC 5)", () => {
+    // requestPermission must be lexically inside an addEventListener('click').
+    const clickIdx = html.indexOf("addEventListener('click'");
+    const permIdx = html.indexOf("Notification.requestPermission");
+    expect(clickIdx).toBeGreaterThan(-1);
+    expect(permIdx).toBeGreaterThan(clickIdx);
+    // It must NOT be called on page load.
+    expect(html).not.toContain("requestPermission();\n"); // no bare top-level call
+  });
+
+  it("guards against re-prompting when permission is already denied (AC 5)", () => {
+    expect(html).toContain("'denied'");
+    // Guidance text for the denied state.
+    expect(html.toLowerCase()).toContain("browser settings");
+  });
+
+  it("distinguishes iOS not-yet-installed from unsupported (iOS honesty)", () => {
+    expect(html).toContain("standalone");
+    expect(html.toLowerCase()).toContain("add to home screen");
+  });
+
+  it("only touches pushManager after serviceWorker.ready", () => {
+    const readyIdx = html.indexOf("serviceWorker.ready");
+    const subIdx = html.indexOf("pushManager.subscribe");
+    expect(readyIdx).toBeGreaterThan(-1);
+    expect(subIdx).toBeGreaterThan(readyIdx);
+  });
+});

package/src/pwa-https-gating.smoke.test.ts

@@ -0,0 +1,229 @@
+/**
+ * admin/src/pwa-https-gating.smoke.test.ts
+ * Confirms the manifest <link> and SW-registration <script> tags are
+ * emitted site-wide only when appBaseUrl is https — home-lab operators on
+ * plain HTTP must not see a broken manifest/SW registration attempt.
+ * Exercised via a real rendered page (the login page, which needs no auth)
+ * through app.request(), matching the Hono smoke-test convention.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { AdminUIDeps } from "./admin-ui.ts";
+import { createAdminUIApp } from "./admin-ui.ts";
+import { PWA_ICONS } from "./pwa.ts";
+
+const PNG_1X1 = Buffer.from(
+  "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=",
+  "base64",
+);
+
+function makeFixtureIconsDir(): string {
+  const dir = mkdtempSync(join(tmpdir(), "pwa-icons-gate-"));
+  const iconsDir = join(dir, "icons");
+  mkdirSync(iconsDir, { recursive: true });
+  for (const icon of PWA_ICONS) {
+    writeFileSync(join(iconsDir, icon.filename), PNG_1X1);
+  }
+  return dir;
+}
+
+function makeMinimalDeps(overrides: Partial<AdminUIDeps>): AdminUIDeps {
+  return {
+    prisma: {
+      agent: {
+        findMany: async () => [],
+        findUnique: async () => null,
+        create: async () => {
+          throw new Error("not implemented");
+        },
+        update: async () => {
+          throw new Error("not implemented");
+        },
+        delete: async () => {
+          throw new Error("not implemented");
+        },
+      },
+      agentEnv: { findMany: async () => [] },
+      agentPlugin: { findMany: async () => [] },
+      agentMember: {
+        findMany: async () => [],
+        findUnique: async () => null,
+        create: async () => {
+          throw new Error("not implemented");
+        },
+        deleteMany: async () => ({ count: 0 }),
+      },
+    },
+    agentEnvService: {
+      getByAgentId: async () => null,
+      upsert: async () => {},
+      patch: async () => {},
+      deleteKey: async () => {},
+      getConfigBundle: async () => null,
+    },
+    agentCronJobService: {
+      list: async () => [],
+      listWithRunSummary: async () => [],
+      get: async () => {
+        throw new Error("not implemented");
+      },
+      create: async () => {
+        throw new Error("not implemented");
+      },
+      setEnabled: async () => {
+        throw new Error("not implemented");
+      },
+      update: async () => {
+        throw new Error("not implemented");
+      },
+      delete: async () => {},
+      reconcileSystemCrons: async () => ({
+        created: 0,
+        updated: 0,
+        deleted: 0,
+      }),
+    },
+    agentToolService: {
+      list: async () => [],
+      add: async () => {
+        throw new Error("not implemented");
+      },
+      toggle: async () => {
+        throw new Error("not implemented");
+      },
+      remove: async () => {},
+    },
+    agentTokenService: {
+      listForAgent: async () => [],
+      create: async () => {
+        throw new Error("not implemented");
+      },
+      revoke: async () => {
+        throw new Error("not implemented");
+      },
+    },
+    agentPluginService: {
+      list: async () => [],
+      add: async () => {
+        throw new Error("not implemented");
+      },
+    },
+    agentMemberService: {
+      listByEmail: async () => [],
+      exists: async () => false,
+      add: async () => {
+        throw new Error("not implemented");
+      },
+      remove: async () => {},
+      listByAgentId: async () => [],
+    },
+    agentService: {
+      listAll: async () => [],
+      listByIds: async () => [],
+      searchByName: async () => [],
+      listOptions: async () => [],
+      create: async () => {
+        throw new Error("not implemented");
+      },
+      delete: async () => {},
+      getDetail: async () => null,
+      updateFields: async () => {
+        throw new Error("not implemented");
+      },
+    },
+    provisioner: {
+      canProvision: false,
+      provision: async () => {
+        throw new Error("not implemented");
+      },
+      deprovision: async () => {},
+      reconcile: async () => ({
+        recreated: [],
+        migrated: [],
+        noOwner: [],
+        dryRun: false,
+        updated: [],
+        orphans: [],
+        failed: [],
+      }),
+    },
+    serviceIntegrations: [
+      {
+        name: "task-store",
+        listTokensForAgent: async () => [],
+        revokeToken: async () => {},
+      },
+    ],
+    chatService: {
+      listTokensForAgent: async () => [],
+      revokeToken: async () => {},
+      deleteThreadsForAgent: async () => ({ deleted: 0 }),
+    },
+    slack: { deleteApp: async () => {} },
+    decrypt: (value: string) => value,
+    sessionSecret: "test-admin-session-secret-32-bytes!",
+    googleClient: {
+      exchangeCode: async () => ({
+        accessToken: "t",
+        refreshToken: "r",
+        expiresIn: 3600,
+      }),
+      getUserInfo: async () => ({
+        sub: "s",
+        email: "a@example.com",
+        email_verified: true,
+        name: "A",
+      }),
+    },
+    googleClientId: "gcid",
+    googleClientSecret: "gcsecret",
+    adminAllowedEmails: ["admin@example.com"],
+    slackClient: {
+      createAppManifest: async () => {
+        throw new Error("not implemented");
+      },
+      updateAppManifest: async () => {},
+      exchangeOAuthCode: async () => ({ botToken: "xoxb" }),
+      authTest: async () => ({ userId: "U0AALR8M69X" }),
+    },
+    githubAppClient: {
+      exchangeManifestCode: async () => {
+        throw new Error("not implemented");
+      },
+    },
+    appBaseUrl: "https://example.com",
+    ...overrides,
+  };
+}
+
+describe("PWA head tags — HTTPS gating, applied site-wide via html()", () => {
+  it("emits the manifest link + SW registration script when appBaseUrl is https", async () => {
+    const app = createAdminUIApp(
+      makeMinimalDeps({
+        appBaseUrl: "https://admin.example.com",
+        pwaAssetsDir: makeFixtureIconsDir(),
+      }),
+    );
+    const res = await app.request("/admin/login");
+    const body = await res.text();
+    expect(body).toContain('rel="manifest"');
+    expect(body).toContain("/admin/manifest.webmanifest");
+    expect(body).toContain("serviceWorker");
+  });
+
+  it("omits the manifest link + SW registration script when appBaseUrl is plain http (home-lab)", async () => {
+    const app = createAdminUIApp(
+      makeMinimalDeps({
+        appBaseUrl: "http://localhost:3001",
+        pwaAssetsDir: makeFixtureIconsDir(),
+      }),
+    );
+    const res = await app.request("/admin/login");
+    const body = await res.text();
+    expect(body).not.toContain('rel="manifest"');
+    expect(body).not.toContain("serviceWorker");
+  });
+});

package/src/pwa-icons.unit.test.ts

@@ -0,0 +1,41 @@
+/**
+ * admin/src/pwa-icons.unit.test.ts
+ * Content assertions on the six committed PWA icon PNGs generated by
+ * scripts/build-pwa-icons.ts and checked in under admin/pwa-assets/icons/.
+ * Verifies real bytes on disk — not the generation script itself.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { join } from "node:path";
+import { PWA_ICONS, PWA_ASSETS_DIR } from "./pwa.ts";
+
+const PNG_MAGIC = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+const MAX_ICON_BYTES = 60 * 1024;
+
+describe("committed PWA icons", () => {
+  it("declares exactly six icons", () => {
+    expect(PWA_ICONS.length).toBe(6);
+  });
+
+  for (const icon of PWA_ICONS) {
+    describe(icon.filename, () => {
+      it("exists on disk", async () => {
+        const file = Bun.file(join(PWA_ASSETS_DIR, "icons", icon.filename));
+        expect(await file.exists()).toBe(true);
+      });
+
+      it("starts with the PNG magic bytes", async () => {
+        const file = Bun.file(join(PWA_ASSETS_DIR, "icons", icon.filename));
+        const bytes = new Uint8Array(await file.arrayBuffer());
+        const header = Buffer.from(bytes.subarray(0, 8));
+        expect(header.equals(PNG_MAGIC)).toBe(true);
+      });
+
+      it("is under 60KB", async () => {
+        const file = Bun.file(join(PWA_ASSETS_DIR, "icons", icon.filename));
+        expect(file.size).toBeGreaterThan(0);
+        expect(file.size).toBeLessThan(MAX_ICON_BYTES);
+      });
+    });
+  }
+});