@app-vitals/agent-admin 0.0.1 → 0.1.0

package/src/server.smoke.test.ts

@@ -0,0 +1,273 @@
+/**
+ * admin/src/server.smoke.test.ts
+ * Thin composition smoke test for admin/src/server.ts — the Hono entrypoint
+ * barrel.
+ *
+ * Confirms createAdminUIApp + createAdminApp + createAgentRuntimeApp (all
+ * imported via the server.ts barrel) are reachable once mounted together the
+ * same way main.ts's startServer() composes them. Deliberately does NOT
+ * assert on any sub-app's route behavior — that's covered by
+ * admin-ui.smoke.test.ts, agents-api.smoke.test.ts, and api.smoke.test.ts.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { Hono } from "hono";
+import {
+  createAdminApp,
+  createAdminUIApp,
+  createAgentRuntimeApp,
+} from "./server.ts";
+
+const SESSION_SECRET = "test-server-smoke-session-secret!!";
+
+const notImplemented = () => {
+  throw new Error("not implemented — smoke test only exercises routing");
+};
+
+// Shared stub prisma satisfying every prisma-shaped field the three deps
+// interfaces require (agent, agentEnv, agentPlugin, agentMember). Unauthenticated
+// requests never reach a handler that calls these, so throwing is safe.
+const stubPrisma = {
+  agent: {
+    findMany: notImplemented,
+    findUnique: notImplemented,
+    create: notImplemented,
+    update: notImplemented,
+    delete: notImplemented,
+  },
+  agentEnv: { findMany: notImplemented },
+  agentPlugin: { findMany: notImplemented },
+  agentMember: {
+    findMany: notImplemented,
+    findUnique: notImplemented,
+    create: notImplemented,
+    deleteMany: notImplemented,
+  },
+} as never;
+
+const stubAgentTokenService = { validate: notImplemented } as never;
+
+function buildComposedApp() {
+  const root = new Hono();
+
+  const runtimeApp = createAgentRuntimeApp({
+    agentEnvService: { getConfigBundle: notImplemented },
+    agentCronJobService: {
+      list: notImplemented,
+      listWithRunSummary: notImplemented,
+    },
+    agentService: { getById: notImplemented },
+    agentPluginService: { listEnabled: notImplemented },
+    agentPhaseMethodologyService: { list: notImplemented },
+    sessionSecret: SESSION_SECRET,
+    agentTokenService: stubAgentTokenService,
+  });
+  root.route("/agents", runtimeApp);
+
+  const adminApiApp = createAdminApp({
+    agentService: {
+      create: notImplemented,
+      delete: notImplemented,
+      list: notImplemented,
+      getSummary: notImplemented,
+      getDetail: notImplemented,
+      exists: notImplemented,
+      updateSelfHosted: notImplemented,
+      updateFields: notImplemented,
+      runTransaction: notImplemented,
+    },
+    specialtyRegistry: {
+      getManifest: notImplemented,
+      tryGetManifest: notImplemented,
+      listTypes: notImplemented,
+    },
+    agentEnvService: {
+      upsert: notImplemented,
+      patch: notImplemented,
+      getByAgentId: notImplemented,
+      deleteKey: notImplemented,
+    },
+    agentCronJobService: {
+      list: notImplemented,
+      listWithRunSummary: notImplemented,
+      create: notImplemented,
+      update: notImplemented,
+      delete: notImplemented,
+      reconcileSystemCrons: notImplemented,
+      get: notImplemented,
+      setEnabled: notImplemented,
+      updatePreCheck: notImplemented,
+    },
+    agentCronRunService: {
+      create: notImplemented,
+      list: notImplemented,
+      patch: notImplemented,
+    },
+    agentCronRunStatsService: {
+      query: notImplemented,
+      outcomes: notImplemented,
+    },
+    agentToolService: {
+      list: notImplemented,
+      add: notImplemented,
+      remove: notImplemented,
+      toggle: notImplemented,
+    },
+    agentTokenService: {
+      create: notImplemented,
+      listForAgent: notImplemented,
+      revoke: notImplemented,
+      validate: notImplemented,
+    },
+    agentPluginService: {
+      list: notImplemented,
+      add: notImplemented,
+      remove: notImplemented,
+      removeByName: notImplemented,
+    },
+    agentMemberService: {
+      add: notImplemented,
+      listByAgentId: notImplemented,
+      exists: async () => false,
+      listByEmail: async () => [],
+    },
+    agentChatTokenService: {
+      upsertDailyByModel: notImplemented,
+      queryStats: notImplemented,
+    },
+    agentGitHubInstallationsService: {
+      push: notImplemented,
+      get: notImplemented,
+    },
+    prisma: stubPrisma,
+    provisioner: {
+      canProvision: false,
+      provision: notImplemented,
+      deprovision: notImplemented,
+      reconcile: notImplemented,
+    },
+    serviceIntegrations: [
+      {
+        name: "task-store",
+        listTokensForAgent: notImplemented,
+        revokeToken: notImplemented,
+      },
+    ],
+    chatService: {
+      listTokensForAgent: notImplemented,
+      revokeToken: notImplemented,
+      deleteThreadsForAgent: notImplemented,
+    },
+    slack: { deleteApp: notImplemented },
+    decrypt: notImplemented,
+    sessionSecret: SESSION_SECRET,
+  });
+  root.route("/", adminApiApp);
+
+  const adminUIApp = createAdminUIApp({
+    prisma: stubPrisma,
+    agentEnvService: {
+      getByAgentId: notImplemented,
+      upsert: notImplemented,
+      patch: notImplemented,
+      deleteKey: notImplemented,
+      getConfigBundle: notImplemented,
+    },
+    agentCronJobService: {
+      list: notImplemented,
+      listWithRunSummary: notImplemented,
+      create: notImplemented,
+      update: notImplemented,
+      setEnabled: notImplemented,
+      delete: notImplemented,
+      get: notImplemented,
+      reconcileSystemCrons: notImplemented,
+    },
+    agentToolService: {
+      list: notImplemented,
+      add: notImplemented,
+      toggle: notImplemented,
+      remove: notImplemented,
+    },
+    agentTokenService: {
+      listForAgent: notImplemented,
+      create: notImplemented,
+      revoke: notImplemented,
+    },
+    agentPluginService: { list: notImplemented, add: notImplemented },
+    agentMemberService: {
+      listByEmail: notImplemented,
+      exists: notImplemented,
+      add: notImplemented,
+      remove: notImplemented,
+      listByAgentId: notImplemented,
+    },
+    agentService: {
+      listAll: notImplemented,
+      listByIds: notImplemented,
+      searchByName: notImplemented,
+      listOptions: notImplemented,
+      create: notImplemented,
+      delete: notImplemented,
+      getDetail: notImplemented,
+      updateFields: notImplemented,
+    },
+    provisioner: {
+      canProvision: false,
+      provision: notImplemented,
+      deprovision: notImplemented,
+      reconcile: notImplemented,
+    },
+    serviceIntegrations: [
+      {
+        name: "task-store",
+        listTokensForAgent: notImplemented,
+        revokeToken: notImplemented,
+      },
+    ],
+    chatService: {
+      listTokensForAgent: notImplemented,
+      revokeToken: notImplemented,
+      deleteThreadsForAgent: notImplemented,
+    },
+    slack: { deleteApp: notImplemented },
+    decrypt: notImplemented,
+    sessionSecret: SESSION_SECRET,
+    googleClient: { exchangeCode: notImplemented, getUserInfo: notImplemented },
+    googleClientId: "test-google-client-id",
+    googleClientSecret: "test-google-client-secret",
+    adminAllowedEmails: ["admin@example.com"],
+    slackClient: {
+      createAppManifest: notImplemented,
+      updateAppManifest: notImplemented,
+      exchangeOAuthCode: notImplemented,
+      authTest: notImplemented,
+    },
+    githubAppClient: {
+      exchangeManifestCode: notImplemented,
+    },
+    appBaseUrl: "http://localhost:3000",
+  });
+  root.route("/", adminUIApp);
+
+  return root;
+}
+
+describe("server.ts composed app mounts correctly", () => {
+  const app = buildComposedApp();
+
+  it("mounts createAdminUIApp — GET /admin/login is reachable (public route)", async () => {
+    const res = await app.request("/admin/login");
+    expect(res.status).toBe(200);
+  });
+
+  it("mounts createAgentRuntimeApp under /agents — GET /agents/:id/config requires auth", async () => {
+    const res = await app.request("/agents/agent-test-123/config");
+    expect(res.status).toBe(401);
+  });
+
+  it("mounts createAdminApp — GET /agents (admin CRUD API) requires auth", async () => {
+    const res = await app.request("/agents");
+    expect(res.status).toBe(401);
+  });
+});

package/src/server.ts

@@ -0,0 +1,50 @@
+/**
+ * admin/src/server.ts
+ * Shipwright admin service — Hono entrypoint.
+ *
+ * Mounts:
+ *   - Admin UI routes at /admin/* (server-rendered)
+ *   - Admin CRUD API at /agents/:id/* (JSON)
+ *   - Agent runtime API at /agents/* (JSON, internal)
+ */
+
+export { createAdminUIApp } from "./admin-ui.ts";
+export type { AdminUIDeps } from "./admin-ui.ts";
+export { createAdminApp } from "./agents-api.ts";
+export type { AdminDeps } from "./agents-api.ts";
+export { createAgentRuntimeApp } from "./api.ts";
+export type {
+  AgentRuntimeDeps,
+  AgentConfigResponse,
+  AgentPlugin,
+} from "./api.ts";
+export { AgentEnvService } from "./agent-envs.ts";
+export type { AgentEnvBundle, AgentEnvEntry } from "./agent-envs.ts";
+export { AgentCronJobService } from "./agent-cron-jobs.ts";
+export type {
+  AgentCronJob,
+  CreateAgentCronJobInput,
+} from "./agent-cron-jobs.ts";
+export { AgentToolService } from "./agent-tools.ts";
+export type { AgentTool } from "./agent-tools.ts";
+export { AgentTokenService } from "./agent-tokens.ts";
+export type { AgentToken, AgentTokenValidated } from "./agent-tokens.ts";
+export { AgentPluginService } from "./agent-plugins.ts";
+export type { AgentPlugin as AgentPluginRecord } from "./agent-plugins.ts";
+export { makeTokenCrypto, identityCrypto } from "./token-crypto.ts";
+export type { TokenCrypto } from "./token-crypto.ts";
+export {
+  ApiError,
+  NotFoundError,
+  ConflictError,
+  BadRequestError,
+  ForbiddenError,
+  UnprocessableEntityError,
+  BadGatewayError,
+} from "./errors.ts";
+export { HttpSlackProvisioningClient } from "./slack-provisioning-client.ts";
+export type { SlackProvisioningClient } from "./slack-provisioning-client.ts";
+export { HttpGoogleAuthClient } from "./google-auth-client.ts";
+export type { GoogleAuthClient } from "./google-auth-client.ts";
+export { PrismaClient } from "../prisma/client/client.ts";
+export { createAdminPrismaClient } from "./prisma-client.ts";

package/src/service-integration.ts

@@ -0,0 +1,67 @@
+/**
+ * admin/src/service-integration.ts
+ *
+ * The seam for optional per-agent service integrations in agent provisioning.
+ *
+ * An integration is an external service (task-store today) for which the
+ * provisioner mints a per-agent token on create, stores it in the agent Secret
+ * under `secretKey`, and injects `tokenEnv` (secretKeyRef) + `urlEnv` (plain
+ * value) into the agent Deployment; agent deletion revokes every token scoped
+ * to the agent. Integrations are supplied by the composition root through
+ * AdminExtension.serviceIntegrations(env) — the platform never names one.
+ *
+ * Chat-service stays a built-in platform integration (it has extra thread
+ * cleanup on delete) and is handled alongside, not through this list.
+ *
+ * Ordering contract: extension integrations are processed in list order and
+ * ALWAYS before the built-in chat-service integration — minting, Secret keys,
+ * Deployment env entries, rollback revocation and deletion steps all follow
+ * that order. (This reproduces the original task-store-before-chat order.)
+ */
+
+/** Token operations a service exposes to the provisioner and deletion flow. */
+export interface ServiceTokenClient {
+  /** Mint a per-agent token; `id` is needed to revoke it on rollback. */
+  mintToken(
+    label: string,
+    agentId?: string,
+  ): Promise<{ id: string; rawToken: string }>;
+  /** Revoke a previously-minted token. Idempotent (already-gone is a no-op). */
+  revokeToken(id: string): Promise<void>;
+  /** List the ids of every token scoped to `agentId` (for deletion cleanup). */
+  listTokensForAgent(agentId: string): Promise<{ id: string }[]>;
+}
+
+/** How an integration shows up in the agent Secret and Deployment. */
+export interface ServiceEnvSpec {
+  /** Env var carrying the per-agent token (secretKeyRef into the agent Secret). */
+  tokenEnv: string;
+  /** Env var carrying the service base URL (plain value). */
+  urlEnv: string;
+  /** Key within the agent Secret under which the token is stored. */
+  secretKey: string;
+  /** In-cluster base URL. Absent = integration not configured for provisioning. */
+  url?: string;
+}
+
+export interface ServiceIntegration extends ServiceTokenClient, ServiceEnvSpec {
+  /** Stable name; deletion reports the step as `${name}-tokens`. */
+  name: string;
+}
+
+/** The subset of an integration the deletion flow needs. */
+export type DeletionServiceIntegration = Pick<
+  ServiceIntegration,
+  "name" | "listTokensForAgent" | "revokeToken"
+>;
+
+/**
+ * The integrations the provisioner should actively wire (mint + env): those
+ * with a URL. Unconfigured integrations are kept in the full list so deletion
+ * still runs (and reports) their step, matching the former no-op client.
+ */
+export function provisionableIntegrations(
+  integrations: readonly ServiceIntegration[] | undefined,
+): ServiceIntegration[] {
+  return (integrations ?? []).filter((i) => Boolean(i.url));
+}

package/src/service-integration.unit.test.ts

@@ -0,0 +1,129 @@
+import { describe, expect, it } from "bun:test";
+import { deleteAgentFully } from "./agent-deletion.ts";
+import { buildAgentDeploymentManifest } from "./agent-manifest.ts";
+import {
+  provisionableIntegrations,
+  type ServiceIntegration,
+} from "./service-integration.ts";
+
+function integration(
+  name: string,
+  url: string | undefined,
+  log: string[] = [],
+): ServiceIntegration {
+  return {
+    name,
+    url,
+    tokenEnv: `SVC_${name.toUpperCase()}_TOKEN`,
+    urlEnv: `SVC_${name.toUpperCase()}_URL`,
+    secretKey: `${name}-token`,
+    mintToken: async () => ({ id: `${name}-id`, rawToken: `${name}-raw` }),
+    revokeToken: async (id) => {
+      log.push(`revoke:${id}`);
+    },
+    listTokensForAgent: async () => [{ id: `${name}-id` }],
+  };
+}
+
+describe("provisionableIntegrations", () => {
+  it("returns [] for undefined or empty input", () => {
+    expect(provisionableIntegrations(undefined)).toEqual([]);
+    expect(provisionableIntegrations([])).toEqual([]);
+  });
+
+  it("keeps list order", () => {
+    const list = [integration("b", "http://b"), integration("a", "http://a")];
+    expect(provisionableIntegrations(list).map((i) => i.name)).toEqual([
+      "b",
+      "a",
+    ]);
+  });
+
+  it("drops integrations without a url (optionality)", () => {
+    const list = [
+      integration("a", "http://a"),
+      integration("b", undefined),
+      integration("c", ""),
+    ];
+    expect(provisionableIntegrations(list).map((i) => i.name)).toEqual(["a"]);
+  });
+});
+
+describe("service integrations in the Deployment manifest", () => {
+  const base = {
+    agentId: "agent-1",
+    namespace: "ns",
+    image: "img",
+    imageTag: "t",
+    apiUrl: "http://api",
+    secretName: "agent-1-token",
+    pvcName: "agent-1-home",
+  };
+
+  it("emits token then url env per integration, in list order, before chat", () => {
+    const d = buildAgentDeploymentManifest({
+      ...base,
+      serviceIntegrations: [
+        integration("a", "http://a"),
+        integration("b", "http://b"),
+      ],
+      chatServiceUrl: "http://chat",
+    });
+    const names = (d.spec.template.spec.containers[0].env ?? []).map(
+      (e) => e.name,
+    );
+    expect(names.slice(6)).toEqual([
+      "SVC_A_TOKEN",
+      "SVC_A_URL",
+      "SVC_B_TOKEN",
+      "SVC_B_URL",
+      "SHIPWRIGHT_CHAT_SERVICE_TOKEN",
+      "SHIPWRIGHT_CHAT_SERVICE_URL",
+    ]);
+  });
+
+  it("omits an integration without a url", () => {
+    const d = buildAgentDeploymentManifest({
+      ...base,
+      serviceIntegrations: [integration("a", undefined)],
+    });
+    const names = (d.spec.template.spec.containers[0].env ?? []).map(
+      (e) => e.name,
+    );
+    expect(names).toHaveLength(6);
+  });
+});
+
+describe("service integrations in agent deletion", () => {
+  it("runs one name-tokens step per integration, in order, before chat", async () => {
+    const log: string[] = [];
+    const result = await deleteAgentFully("agent-1", {
+      prisma: {
+        agent: {
+          findUnique: async () => ({ id: "agent-1", name: "agent-1" }),
+          delete: async () => ({}),
+        },
+        agentEnv: { findMany: async () => [] },
+      } as never,
+      provisioner: { deprovision: async () => {} } as never,
+      serviceIntegrations: [
+        integration("a", "http://a", log),
+        integration("b", undefined, log),
+      ],
+      chatService: {
+        listTokensForAgent: async () => [],
+        revokeToken: async () => {},
+        deleteThreadsForAgent: async () => ({ deleted: 0 }),
+      },
+      slack: { deleteApp: async () => {} },
+      decrypt: (v) => v,
+    });
+    expect(result.completed).toEqual([
+      "k8s",
+      "a-tokens",
+      "b-tokens",
+      "chat-service-tokens-and-threads",
+    ]);
+    expect(log).toEqual(["revoke:a-id", "revoke:b-id"]);
+  });
+});