@app-vitals/agent-admin 0.9.0 → 0.9.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@app-vitals/agent-admin",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/app-vitals/agent.git",
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "0.135.0",
-    "@app-vitals/agent-lib": "0.9.0",
+    "@app-vitals/agent-lib": "0.9.1",
     "@hono/zod-openapi": "^1.0.0",
     "@prisma/adapter-pg": "^7.10.0",
     "@prisma/client": "^7.10.0",

package/src/admin-local-agent.smoke.test.ts

@@ -388,9 +388,13 @@ describe("admin UI — new local agent create flow", () => {
 
   it("GET /admin/agents/new — unauthenticated redirects to /admin/login", async () => {
     const app = createAdminUIApp(makeMockDeps());
-    const res = await app.request("/admin/agents/new");
+    const res = await app.request("/admin/agents/new", {
+      headers: { Accept: "text/html" },
+    });
     expect(res.status).toBe(302);
-    expect(res.headers.get("Location")).toBe("/admin/login");
+    expect(res.headers.get("Location")).toBe(
+      "/admin/login?returnTo=%2Fadmin%2Fagents%2Fnew",
+    );
   });
 
   // ── POST /admin/agents ────────────────────────────────────────────────────

package/src/admin-ui-pages.ts

@@ -3059,8 +3059,15 @@ export function renderChatThreadPage(
   }
 
   function poll() {
-    fetch(messagesJsonUrl)
-      .then(function(r) { return r.json(); })
+    fetch(messagesJsonUrl, { headers: { 'Accept': 'application/json' } })
+      .then(function(r) {
+        if (r.status === 401) {
+          stopPolling();
+          window.location.href = '/admin/login?returnTo=' + encodeURIComponent(location.pathname + location.search);
+          return { messages: [] };
+        }
+        return r.json();
+      })
       .then(function(data) {
         var msgs = data.messages || [];
 
@@ -3246,8 +3253,14 @@ export function renderChatThreadPage(
     // POST multipart to the upload endpoint
     fetch(uploadUrl, {
       method: 'POST',
+      headers: { 'Accept': 'application/json' },
       body: fd
     }).then(function(r) {
+      if (r.status === 401) {
+        stopAll();
+        window.location.href = '/admin/login?returnTo=' + encodeURIComponent(location.pathname + location.search);
+        return;
+      }
       if (!r.ok) {
         return r.json().then(function(data) {
           stopAll();

package/src/admin-ui-push-test.ts

@@ -83,9 +83,13 @@ export function renderPushTestControl(): string {
     btn.addEventListener('click', function() {
       btn.disabled = true;
       status.textContent = 'Sending…';
-      fetch(${JSON.stringify(PUSH_TEST_PATH)}, { method: 'POST', credentials: 'same-origin' })
+      fetch(${JSON.stringify(PUSH_TEST_PATH)}, { method: 'POST', credentials: 'same-origin', headers: { 'Accept': 'application/json' } })
         .then(function(res) { return res.json().then(function(body) { return { status: res.status, body: body }; }); })
         .then(function(r) {
+          if (r.status === 401) {
+            window.location.href = '/admin/login?returnTo=' + encodeURIComponent(location.pathname + location.search);
+            return;
+          }
           if (r.status !== 200 || !r.body || !r.body.ok) {
             status.textContent = 'Push is not enabled on this server.';
           } else if (r.body.delivered === 0) {

package/src/admin-ui.smoke.test.ts

@@ -40,18 +40,81 @@ const TYPE = TYPE_MANIFEST.metadata.name;
 // ─── Auth redirect tests ──────────────────────────────────────────────────────
 
 describe("admin UI — unauthenticated redirects", () => {
-  it("unauthenticated GET /admin/agents redirects to /admin/login", async () => {
+  const NAV = { "Sec-Fetch-Mode": "navigate" };
+
+  it("unauthenticated GET /admin/agents redirects to /admin/login with returnTo", async () => {
     const app = createAdminUIApp(makeMockDeps());
-    const res = await app.request("/admin/agents");
+    const res = await app.request("/admin/agents", { headers: NAV });
     expect(res.status).toBe(302);
-    expect(res.headers.get("Location")).toBe("/admin/login");
+    expect(res.headers.get("Location")).toBe(
+      "/admin/login?returnTo=%2Fadmin%2Fagents",
+    );
   });
 
-  it("unauthenticated GET /admin/agents/:id redirects to /admin/login", async () => {
+  it("unauthenticated GET /admin/agents/:id redirects to /admin/login with returnTo", async () => {
     const app = createAdminUIApp(makeMockDeps());
-    const res = await app.request(`/admin/agents/${AGENT_ID}`);
+    const res = await app.request(`/admin/agents/${AGENT_ID}`, {
+      headers: { Accept: "text/html,application/xhtml+xml" },
+    });
     expect(res.status).toBe(302);
-    expect(res.headers.get("Location")).toBe("/admin/login");
+    expect(res.headers.get("Location")).toBe(
+      `/admin/login?returnTo=${encodeURIComponent(`/admin/agents/${AGENT_ID}`)}`,
+    );
+  });
+
+  it("navigation redirect preserves the query string in returnTo", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const res = await app.request("/admin/agents?x=1&y=2", { headers: NAV });
+    expect(res.headers.get("Location")).toBe(
+      `/admin/login?returnTo=${encodeURIComponent("/admin/agents?x=1&y=2")}`,
+    );
+  });
+
+  it("unauthenticated fetch-style request gets 401 signed_out JSON", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const res = await app.request("/admin/agents", {
+      headers: { Accept: "application/json", "Sec-Fetch-Mode": "cors" },
+    });
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
+  });
+
+  it("request with no navigation hints gets 401 signed_out JSON", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const res = await app.request("/admin/agents");
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
+  });
+
+  it("unauthenticated POST fetch gets 401 signed_out JSON", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const res = await app.request("/admin/agents", { method: "POST" });
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
+  });
+
+  it("returnTo is never an open redirect (protocol-relative path dropped)", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const res = await app.request("//evil.com/x", { headers: NAV });
+    expect(res.headers.get("Location") ?? "").not.toContain("evil.com");
+  });
+});
+
+describe("admin UI — GET /admin/session.json", () => {
+  it("returns 200 {signedIn:true} with a valid session", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const res = await app.request("/admin/session.json", {
+      headers: { Cookie: `admin_session=${await makeSessionCookie()}` },
+    });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ signedIn: true });
+  });
+
+  it("returns 401 without a session", async () => {
+    const app = createAdminUIApp(makeMockDeps());
+    const res = await app.request("/admin/session.json");
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
   });
 });
 

package/src/admin-ui.ts

@@ -516,6 +516,28 @@ async function getSessionUser(
 
 // ─── Auth middleware ──────────────────────────────────────────────────────────
 
+/**
+ * Accepts a `returnTo` value only when it is a same-origin relative path:
+ * must start with a single "/", so protocol-relative (//evil.com), absolute
+ * (https://evil.com) and backslash-smuggled (/\\evil.com) values are dropped.
+ */
+export function validateReturnTo(
+  raw: string | undefined | null,
+): string | undefined {
+  return raw?.startsWith("/") && !raw.startsWith("//") && !raw.includes("\\")
+    ? raw
+    : undefined;
+}
+
+/** True for browser page navigations (as opposed to fetch/XHR calls). */
+function isNavigationRequest(c: Context): boolean {
+  if (c.req.header("Sec-Fetch-Mode") === "navigate") return true;
+  return (
+    c.req.method === "GET" &&
+    (c.req.header("Accept") ?? "").includes("text/html")
+  );
+}
+
 export function createUIAuthMiddleware(
   sessionSecret: string,
 ): MiddlewareHandler<AdminUIEnv> {
@@ -525,7 +547,20 @@ export function createUIAuthMiddleware(
       ? await getSessionUser(sessionToken, sessionSecret)
       : null;
     if (!user) {
-      return c.redirect("/admin/login", 302);
+      if (!isNavigationRequest(c)) {
+        return c.json({ error: "signed_out" }, 401);
+      }
+      const url = new URL(c.req.url);
+      const returnTo =
+        c.req.method === "GET"
+          ? validateReturnTo(url.pathname + url.search)
+          : undefined;
+      return c.redirect(
+        returnTo
+          ? `/admin/login?returnTo=${encodeURIComponent(returnTo)}`
+          : "/admin/login",
+        302,
+      );
     }
     c.set("userEmail", user.email);
     c.set("isAdmin", user.isAdmin);
@@ -862,10 +897,7 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
       path: "/",
     });
     // Redirect to returnTo if it's a valid same-origin relative path, otherwise default.
-    const destination =
-      returnTo?.startsWith("/") && !returnTo.startsWith("//")
-        ? returnTo
-        : "/admin/agents";
+    const destination = validateReturnTo(returnTo) ?? "/admin/agents";
     return c.redirect(destination, 302);
   }
 
@@ -881,10 +913,7 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
     const nonce = crypto.randomUUID();
 
     const rawReturnTo = c.req.query("returnTo");
-    const returnTo =
-      rawReturnTo?.startsWith("/") && !rawReturnTo.startsWith("//")
-        ? rawReturnTo
-        : undefined;
+    const returnTo = validateReturnTo(rawReturnTo);
 
     const oauthState = JSON.stringify({ nonce, returnTo });
     setCookie(c, OAUTH_STATE_COOKIE, oauthState, {
@@ -1000,6 +1029,12 @@ export function createAdminUIApp(deps: AdminUIDeps): Hono<AdminUIEnv> {
     }
   });
 
+  // Cheap signed-in probe for client JS (a 401 {error:"signed_out"} from
+  // requireAuth means the session is gone).
+  app.get("/admin/session.json", requireAuth, (c) =>
+    c.json({ signedIn: true }),
+  );
+
   app.get("/admin/login", (c) => {
     const error = c.req.query("error") ?? undefined;
     const returnTo = c.req.query("returnTo") ?? undefined;

package/src/chat.smoke.test.ts

@@ -413,9 +413,13 @@ function makeBaseDeps(overrides?: Partial<AdminUIDeps>): AdminUIDeps {
 describe("GET /admin/chat — auth gate", () => {
   it("returns 302 redirect to login without session cookie", async () => {
     const app = createAdminUIApp(makeBaseDeps());
-    const res = await app.request("/admin/chat");
+    const res = await app.request("/admin/chat", {
+      headers: { Accept: "text/html" },
+    });
     expect(res.status).toBe(302);
-    expect(res.headers.get("location")).toContain("/admin/login");
+    expect(res.headers.get("location")).toBe(
+      "/admin/login?returnTo=%2Fadmin%2Fchat",
+    );
   });
 });
 
@@ -616,14 +620,15 @@ describe("GET /admin/chat/:agentId/threads/:threadId — thread detail", () => {
     sessionCookie = await makeSessionCookie();
   });
 
-  it("returns 401 without session cookie", async () => {
+  it("redirects navigations to login with returnTo without session cookie", async () => {
     const chatClient = makeMockChatClient();
     const app = createAdminUIApp(makeBaseDeps({ chatClient }));
     const res = await app.request(
       `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}`,
+      { headers: { "Sec-Fetch-Mode": "navigate" } },
     );
     expect(res.status).toBe(302);
-    expect(res.headers.get("location")).toContain("/admin/login");
+    expect(res.headers.get("location")).toContain("/admin/login?returnTo=");
   });
 
   it("returns 200 with messages when chatClient present", async () => {
@@ -1026,14 +1031,14 @@ describe("GET /admin/chat/:agentId/threads/:threadId/messages.json", () => {
     sessionCookie = await makeSessionCookie();
   });
 
-  it("returns 302 to login without session cookie", async () => {
+  it("returns 401 signed_out without session cookie", async () => {
     const chatClient = makeMockChatClient();
     const app = createAdminUIApp(makeBaseDeps({ chatClient }));
     const res = await app.request(
       `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages.json`,
     );
-    expect(res.status).toBe(302);
-    expect(res.headers.get("location")).toContain("/admin/login");
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
   });
 
   it("returns 200 JSON with messages array when chatClient present", async () => {
@@ -1148,7 +1153,7 @@ describe("POST /admin/chat/:agentId/threads/:threadId/messages.json", () => {
     sessionCookie = await makeSessionCookie();
   });
 
-  it("returns 302 to login without session cookie", async () => {
+  it("returns 401 signed_out without session cookie", async () => {
     const chatClient = makeMockChatClient();
     const app = createAdminUIApp(makeBaseDeps({ chatClient }));
     const res = await app.request(
@@ -1159,8 +1164,8 @@ describe("POST /admin/chat/:agentId/threads/:threadId/messages.json", () => {
         body: JSON.stringify({ body: "test message" }),
       },
     );
-    expect(res.status).toBe(302);
-    expect(res.headers.get("location")).toContain("/admin/login");
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
   });
 
   it("returns 200 JSON with message when chatClient present", async () => {
@@ -1237,7 +1242,7 @@ describe("POST /admin/chat/:agentId/threads/:threadId/messages/upload", () => {
     sessionCookie = await makeSessionCookie();
   });
 
-  it("returns 302 to login without session cookie", async () => {
+  it("returns 401 signed_out without session cookie", async () => {
     const chatClient = makeMockChatClient();
     const app = createAdminUIApp(makeBaseDeps({ chatClient }));
     const res = await app.request(
@@ -1248,8 +1253,8 @@ describe("POST /admin/chat/:agentId/threads/:threadId/messages/upload", () => {
         body: "body=test+message",
       },
     );
-    expect(res.status).toBe(302);
-    expect(res.headers.get("location")).toContain("/admin/login");
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
   });
 
   it("returns 201 JSON with message when chatClient present", async () => {
@@ -1368,14 +1373,14 @@ describe("GET /admin/chat/:agentId/threads/:threadId/messages/:messageId/attachm
     sessionCookie = await makeSessionCookie();
   });
 
-  it("returns 302 to login without session cookie", async () => {
+  it("returns 401 signed_out without session cookie", async () => {
     const chatClient = makeMockChatClient();
     const app = createAdminUIApp(makeBaseDeps({ chatClient }));
     const res = await app.request(
       `/admin/chat/${AGENT_ID}/threads/${THREAD_ID}/messages/msg-1/attachment`,
     );
-    expect(res.status).toBe(302);
-    expect(res.headers.get("location")).toContain("/admin/login");
+    expect(res.status).toBe(401);
+    expect(await res.json()).toEqual({ error: "signed_out" });
   });
 
   it("streams bytes with an audio/* Content-Type for a .webm attachment", async () => {

package/src/push-toggle.ts

@@ -114,14 +114,18 @@ export function renderPushToggle(args: PushToggleArgs): string {
         var json = subscription.toJSON();
         return fetch(SUBSCRIBE_URL, {
           method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
+          headers: { 'Content-Type': 'application/json', 'Accept': 'application/json' },
           body: JSON.stringify({
             endpoint: subscription.endpoint,
             p256dh: json.keys && json.keys.p256dh,
             auth: json.keys && json.keys.auth,
           }),
         });
-      }).then(function() {
+      }).then(function(res) {
+        if (res && res.status === 401) {
+          window.location.href = '/admin/login?returnTo=' + encodeURIComponent(location.pathname + location.search);
+          return;
+        }
         setStatus('Notifications enabled.');
         btn.textContent = 'Notifications on';
       });

package/src/pwa.ts

@@ -115,6 +115,7 @@ export function buildManifest(
 const NON_NAVIGABLE_EXACT_PATHS: readonly string[] = [
   "/admin/manifest.webmanifest",
   "/admin/sw.js",
+  "/admin/session.json",
   "/admin/offline.html",
   "/admin/login",
   "/admin/logout",