@taskforcehq/taskforce 0.3.305 → 0.3.306

package/dist/server/index.test.js

@@ -1,6 +1,42 @@
 import { describe, expect, it, vi } from 'vitest';
-import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, isBillingWebhookPath, rewriteProxySetCookieForLocalHost, resolveEffectiveRequestUserId, resolveAuthorizedWorkspaceAccess, shouldRewriteProxySetCookieDomain, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
+import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, configureHttpServerTimeouts, isBillingWebhookPath, rewriteProxySetCookieForLocalHost, resolveHttpServerTimeoutSettings, resolveEffectiveRequestUserId, resolveAuthorizedWorkspaceAccess, resolveDisabledAccessError, shouldApplyReadOnlyMutationGuard, shouldRewriteProxySetCookieDomain, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
 describe('server index helper policies', () => {
+    it('uses proxy-friendly HTTP server timeouts by default', () => {
+        const settings = resolveHttpServerTimeoutSettings({});
+        expect(settings.keepAliveTimeoutMs).toBe(65_000);
+        expect(settings.headersTimeoutMs).toBe(70_000);
+        expect(settings.requestTimeoutMs).toBe(120_000);
+    });
+    it('keeps headers timeout above keep-alive timeout for reverse proxies', () => {
+        const settings = resolveHttpServerTimeoutSettings({
+            TASKFORCE_HTTP_KEEP_ALIVE_TIMEOUT_MS: '80000',
+            TASKFORCE_HTTP_HEADERS_TIMEOUT_MS: '1000',
+            TASKFORCE_HTTP_REQUEST_TIMEOUT_MS: '150000'
+        });
+        expect(settings.keepAliveTimeoutMs).toBe(80_000);
+        expect(settings.headersTimeoutMs).toBe(85_000);
+        expect(settings.requestTimeoutMs).toBe(150_000);
+    });
+    it('applies resolved HTTP server timeouts to the Node server', () => {
+        const server = {
+            keepAliveTimeout: 0,
+            headersTimeout: 0,
+            requestTimeout: 0
+        };
+        const settings = configureHttpServerTimeouts(server, {
+            TASKFORCE_HTTP_KEEP_ALIVE_TIMEOUT_MS: '61000',
+            TASKFORCE_HTTP_HEADERS_TIMEOUT_MS: '66000',
+            TASKFORCE_HTTP_REQUEST_TIMEOUT_MS: '90000'
+        });
+        expect(settings).toEqual({
+            keepAliveTimeoutMs: 61_000,
+            headersTimeoutMs: 66_000,
+            requestTimeoutMs: 90_000
+        });
+        expect(server.keepAliveTimeout).toBe(61_000);
+        expect(server.headersTimeout).toBe(66_000);
+        expect(server.requestTimeout).toBe(90_000);
+    });
     it('adds webhook path to auth exclusions without duplicates', () => {
         const base = ['/api/taskforce/health', '/api/taskforce/auth'];
         const next = ensureBillingWebhookAuthExclusion(base);
@@ -82,6 +118,12 @@ describe('shouldProxyCloudPath', () => {
         expect(shouldProxyCloudPath('/api/taskforce/sync/workspace/pull')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/sync/workspace/push')).toBe(true);
     });
+    it('proxies cloud-owned user avatar context paths only', () => {
+        expect(shouldProxyCloudPath('/api/taskforce/context/users%2Fuser-1%2Fprofile%2Favatar%2Favatar.webp')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/context/users/user-1/profile/avatar/avatar.webp')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/context/workspaces%2Fworkspace-1%2Fassets%2Fimages%2Fasset.png')).toBe(false);
+        expect(shouldProxyCloudPath('/api/taskforce/context/users%2Fuser-1%2Fexports%2Favatar.webp')).toBe(false);
+    });
     it('proxies admin, billing, and auth routes', () => {
         expect(shouldProxyCloudPath('/api/taskforce/admin/users')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/billing/plans')).toBe(true);
@@ -91,6 +133,11 @@ describe('shouldProxyCloudPath', () => {
         expect(shouldProxyCloudPath('/api/taskforce/public/site-config')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/public/site-config-script')).toBe(true);
     });
+    it('keeps AI profile workspace mutations local so workspace sync owns replication', () => {
+        expect(shouldProxyCloudPath('/api/taskforce/workspace/ai-profiles/avatar')).toBe(false);
+        expect(shouldProxyCloudPath('/api/taskforce/workspace/ai-profiles/archive')).toBe(false);
+        expect(shouldProxyCloudPath('/api/taskforce/workspace/ai-profiles/merge')).toBe(false);
+    });
 });
 describe('proxy cookie helpers', () => {
     it('rewrites mismatched cookie domains for non-loopback local hosts', () => {
@@ -126,7 +173,8 @@ describe('resolveAuthorizedWorkspaceAccess', () => {
             userId: 'user-1',
             workspaceId: 'workspace-personal',
             role: 'member',
-            systemRole: 'user'
+            systemRole: 'user',
+            identityId: null
         }, 'workspace-team');
         expect(core.resolveUserAccess).toHaveBeenCalledWith('user-1', 'workspace-team', 'member');
         expect(next.workspaceId).toBe('workspace-team');
@@ -154,12 +202,67 @@ describe('resolveAuthorizedWorkspaceAccess', () => {
             userId: 'user-1',
             workspaceId: 'workspace-personal',
             role: 'member',
-            systemRole: 'user'
+            systemRole: 'user',
+            identityId: null
         }, 'workspace-team');
         expect(core.resolveUserAccess).toHaveBeenNthCalledWith(1, 'user-1', 'workspace-team', 'member');
         expect(core.resolveUserAccess).toHaveBeenNthCalledWith(2, 'user-1', 'workspace-personal', 'member');
         expect(next.workspaceId).toBe('workspace-personal');
     });
+    it('preserves account and workspace disabled scopes separately', () => {
+        const core = {
+            resolveUserAccess: vi.fn((userId, workspaceId, role) => ({
+                userId,
+                workspaceId,
+                role,
+                permissionMode: 'read-write',
+                disabled: true,
+                accountDisabled: false,
+                workspaceDisabled: true,
+                betaAccess: true
+            })),
+            getSystemRole: vi.fn(() => 'user')
+        };
+        const next = resolveAuthorizedWorkspaceAccess(core, {
+            authenticated: true,
+            sessionId: 'session-1',
+            userId: 'user-1',
+            workspaceId: 'workspace-shared',
+            role: 'member',
+            systemRole: 'user',
+            identityId: null
+        }, 'workspace-shared');
+        expect(next.disabled).toBe(true);
+        expect(next.accountDisabled).toBe(false);
+        expect(next.workspaceDisabled).toBe(true);
+    });
+});
+describe('resolveDisabledAccessError', () => {
+    it('blocks globally disabled accounts outside auth routes', () => {
+        expect(resolveDisabledAccessError({ disabled: true, accountDisabled: true }, '/api/taskforce/workspaces')).toBe('Forbidden: user account is disabled.');
+        expect(resolveDisabledAccessError({ disabled: true, accountDisabled: true }, '/api/taskforce/auth/session')).toBeNull();
+    });
+    it('allows workspace-disabled sessions to reach recovery routes only', () => {
+        const access = { disabled: true, accountDisabled: false, workspaceDisabled: true };
+        expect(resolveDisabledAccessError(access, '/api/taskforce/workspaces')).toBeNull();
+        expect(resolveDisabledAccessError(access, '/api/taskforce/session/workspace')).toBeNull();
+        expect(resolveDisabledAccessError(access, '/api/taskforce/tasks')).toBe('Forbidden: workspace access is not active for this user.');
+    });
+});
+describe('shouldApplyReadOnlyMutationGuard', () => {
+    it('guards ordinary Taskforce mutations', () => {
+        expect(shouldApplyReadOnlyMutationGuard('POST', '/api/taskforce/tasks')).toBe(true);
+        expect(shouldApplyReadOnlyMutationGuard('PATCH', '/api/taskforce/task/task-1')).toBe(true);
+        expect(shouldApplyReadOnlyMutationGuard('DELETE', '/api/taskforce/task/task-1')).toBe(true);
+    });
+    it('allows session workspace switching through route-level access validation', () => {
+        expect(shouldApplyReadOnlyMutationGuard('POST', '/api/taskforce/session/workspace')).toBe(false);
+    });
+    it('does not guard non-mutations, auth routes, or health checks', () => {
+        expect(shouldApplyReadOnlyMutationGuard('GET', '/api/taskforce/tasks')).toBe(false);
+        expect(shouldApplyReadOnlyMutationGuard('POST', '/api/taskforce/auth/login')).toBe(false);
+        expect(shouldApplyReadOnlyMutationGuard('POST', '/api/taskforce/health')).toBe(false);
+    });
 });
 describe('resolveEffectiveRequestUserId', () => {
     it('prefers the authenticated access user when present', () => {

package/dist/server/routes/admin.d.ts

@@ -7,6 +7,7 @@
  *
  * Routes registered here:
  *   GET/POST  /api/platform/plans
+ *   GET       /api/platform/onboarding-plan-options
  *   GET/POST  /api/platform/plans/:planId/versions
  *   GET       /api/platform/features
  *   GET/PATCH /api/platform/plans/:planId/versions/:versionId/features
@@ -23,6 +24,8 @@
  *   GET/POST  /api/taskforce/admin/email-settings
  *   GET       /api/taskforce/admin/email-settings/health
  *   POST      /api/taskforce/admin/email-settings/test
+ *   GET/POST  /api/taskforce/admin/auth-provider-settings
+ *   GET       /api/taskforce/admin/auth-provider-settings/health
  *   GET/POST  /api/taskforce/admin/system-settings
  *   GET/POST  /api/taskforce/admin/object-storage-settings
  *   GET       /api/taskforce/admin/object-storage-telemetry

package/dist/server/routes/admin.js

@@ -7,6 +7,7 @@
  *
  * Routes registered here:
  *   GET/POST  /api/platform/plans
+ *   GET       /api/platform/onboarding-plan-options
  *   GET/POST  /api/platform/plans/:planId/versions
  *   GET       /api/platform/features
  *   GET/PATCH /api/platform/plans/:planId/versions/:versionId/features
@@ -23,6 +24,8 @@
  *   GET/POST  /api/taskforce/admin/email-settings
  *   GET       /api/taskforce/admin/email-settings/health
  *   POST      /api/taskforce/admin/email-settings/test
+ *   GET/POST  /api/taskforce/admin/auth-provider-settings
+ *   GET       /api/taskforce/admin/auth-provider-settings/health
  *   GET/POST  /api/taskforce/admin/system-settings
  *   GET/POST  /api/taskforce/admin/object-storage-settings
  *   GET       /api/taskforce/admin/object-storage-telemetry
@@ -68,6 +71,7 @@ import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFro
 import { buildCloudMcpRuntimeAuth, resolveErrorStatusCode } from './shared.js';
 import { buildAuthBehavior, buildSiteBehavior, getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl, } from './authSupport.js';
 import { applyWorkspaceRepair, scanWorkspaceRepair } from '../../sync/workspaceRepair.js';
+import { testMintAppleClientSecret } from '../auth/providers/appleClientSecret.js';
 // === SECTION: Registration ===
 export function registerAdminRoutes(deps) {
     const { addRoute, core, context, requestWorkspaceId, requestUserId, requestRole, requestHeader, requestRuntimeMode, ensureAppAccess, ensureAdminRole, ensureCloudPlanData, requireCloudRuntime, resolveAuthenticatedUserId, resolveAdminRequestActor, auditAdminAction, resolveEffectiveObjectStorageConfig, getObjectStorageClient, taskAssetStore, normalizeDocumentPathInput, ensureWithinDir, getAssetMetadata, markAssetDeleted, clearAssetDeleted, removeAssetMetadata, getStorageTelemetry, appendStorageTelemetry, getStorageIntegrityHistory, appendStorageIntegrityHistory, getDocumentPurgeHistory, appendDocumentPurgeHistory, getCollaborationTelemetry, isCollaborationPolicyEnabled, normalizeMcpOauthScopeString, MCP_TOKEN_SCOPE_VALUES, MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS, MCP_WRITE_RATE_LIMIT_ENABLED, MCP_WRITE_RATE_LIMIT_ACTOR_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WORKSPACE_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WINDOW_MS, } = deps;
@@ -571,6 +575,18 @@ export function registerAdminRoutes(deps) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: true, plans }));
     });
+    addRoute('GET', '/api/platform/onboarding-plan-options', async (req, res) => {
+        if (!ensureCloudPlanData(req, res))
+            return;
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: system admin role required.' }));
+            return;
+        }
+        const options = core.listOnboardingPlanOptions();
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true, options }));
+    });
     addRoute('POST', '/api/platform/plans', async (req, res) => {
         if (!ensureCloudPlanData(req, res))
             return;
@@ -580,10 +596,19 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const body = await parseJsonBody(req);
+        const description = body?.description === undefined || body?.description === null
+            ? body?.description
+            : String(body.description);
+        if (typeof description === 'string' && description.trim().length > 240) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Plan description must be 240 characters or fewer.', code: 'PLAN_DESCRIPTION_TOO_LONG' }));
+            return;
+        }
         try {
             const plan = core.upsertPlanCatalog({
                 planId: body?.planId,
                 displayName: body?.displayName,
+                description,
                 status: body?.status,
                 initialMode: body?.initialMode,
                 initialTrialDays: body?.initialTrialDays === undefined ? undefined : Number(body?.initialTrialDays),
@@ -639,6 +664,62 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: String(error?.message || 'Unable to list feature catalog'), code: error?.code }));
         }
     });
+    addRoute('PATCH', '/api/platform/features/:featureKey', async (req, res, params) => {
+        if (!ensureCloudPlanData(req, res))
+            return;
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: system admin role required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const featureKey = String(params.featureKey || '').trim();
+        const publicLabel = body?.publicLabel === undefined || body?.publicLabel === null
+            ? body?.publicLabel
+            : String(body.publicLabel);
+        const publicDescription = body?.publicDescription === undefined || body?.publicDescription === null
+            ? body?.publicDescription
+            : String(body.publicDescription);
+        const publicDisplayOrder = body?.publicDisplayOrder === undefined || body?.publicDisplayOrder === null || body?.publicDisplayOrder === ''
+            ? null
+            : Math.max(0, Math.floor(Number(body.publicDisplayOrder)));
+        if (typeof publicLabel === 'string' && publicLabel.trim().length > 120) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Public label must be 120 characters or fewer.', code: 'PLAN_FEATURE_PUBLIC_LABEL_TOO_LONG' }));
+            return;
+        }
+        if (typeof publicDescription === 'string' && publicDescription.trim().length > 280) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Public description must be 280 characters or fewer.', code: 'PLAN_FEATURE_PUBLIC_DESCRIPTION_TOO_LONG' }));
+            return;
+        }
+        if (publicDisplayOrder !== null && !Number.isFinite(publicDisplayOrder)) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Public display order must be a non-negative number.', code: 'PLAN_FEATURE_PUBLIC_DISPLAY_ORDER_INVALID' }));
+            return;
+        }
+        try {
+            const feature = core.updatePlanFeatureCatalogMarketingCopy({
+                featureKey,
+                publicLabel,
+                publicDescription,
+                publicDisplayOrder
+            });
+            auditAdminAction(req, 'platform-plan-feature-catalog-updated', {
+                featureKey,
+                publicLabel: feature.publicLabel ?? null,
+                publicDescription: feature.publicDescription ?? null,
+                publicDisplayOrder: feature.publicDisplayOrder ?? null
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, feature }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: String(error?.message || 'Unable to update feature catalog entry'), code: error?.code }));
+        }
+    });
     addRoute('POST', '/api/platform/plans/:planId/versions', async (req, res, params) => {
         if (!ensureCloudPlanData(req, res))
             return;
@@ -855,9 +936,23 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ error: 'Forbidden: system admin role required.' }));
             return;
         }
-        const users = core.listSystemUsers();
+        const reqUrl = new URL(req.url || '/api/taskforce/admin/system-users', 'http://localhost');
+        const query = String(reqUrl.searchParams.get('q') || '').trim();
+        const sort = reqUrl.searchParams.get('sort') === 'oldest' ? 'oldest' : 'newest';
+        const limitRaw = Number(reqUrl.searchParams.get('limit') || '50');
+        const offsetRaw = Number(reqUrl.searchParams.get('offset') || '0');
+        const limit = Number.isFinite(limitRaw) ? Math.max(1, Math.min(200, Math.floor(limitRaw))) : 50;
+        const offset = Number.isFinite(offsetRaw) ? Math.max(0, Math.floor(offsetRaw)) : 0;
+        const total = core.countSystemUsers({ query });
+        const users = core.listSystemUsers({ query, sort, limit, offset });
         res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ users }));
+        res.end(JSON.stringify({
+            users,
+            total,
+            limit,
+            offset,
+            hasMore: offset + users.length < total
+        }));
     });
     // GET /api/taskforce/admin/audit-logs - Read recent admin audit events
     addRoute('GET', '/api/taskforce/admin/audit-logs', async (req, res) => {
@@ -1136,7 +1231,7 @@ export function registerAdminRoutes(deps) {
         }
         const globalSettings = core.getGlobalSettings();
         const authSettings = globalSettings.auth || {};
-        const billingSettings = globalSettings.billing || {};
+        const onboardingPolicy = core.getOnboardingPolicy();
         const effective = buildAuthBehavior(core);
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
@@ -1147,14 +1242,8 @@ export function registerAdminRoutes(deps) {
                 ...(typeof authSettings.authRateLimitEnabled === 'boolean' ? { authRateLimitEnabled: authSettings.authRateLimitEnabled } : {}),
                 ...(typeof authSettings.authRateLimitMaxRequests === 'number' ? { authRateLimitMaxRequests: authSettings.authRateLimitMaxRequests } : {}),
                 ...(typeof authSettings.authRateLimitWindowMs === 'number' ? { authRateLimitWindowMs: authSettings.authRateLimitWindowMs } : {}),
-                ...((billingSettings.onboardingPolicy?.mode === 'require_plan_selection'
-                    || billingSettings.onboardingPolicy?.mode === 'auto_grant_free'
-                    || billingSettings.onboardingPolicy?.mode === 'auto_start_trial')
-                    ? { onboardingPolicyMode: billingSettings.onboardingPolicy.mode }
-                    : {}),
-                ...(typeof billingSettings.onboardingPolicy?.planVersionId === 'string' || billingSettings.onboardingPolicy?.planVersionId === null
-                    ? { onboardingPlanVersionId: billingSettings.onboardingPolicy?.planVersionId ?? null }
-                    : {})
+                onboardingPolicyMode: onboardingPolicy.mode,
+                onboardingPlanId: onboardingPolicy.planId
             },
             status: {
                 allowSelfRegistration: effective.allowSelfRegistration,
@@ -1164,7 +1253,7 @@ export function registerAdminRoutes(deps) {
                 authRateLimitMaxRequests: effective.authRateLimitMaxRequests,
                 authRateLimitWindowMs: effective.authRateLimitWindowMs,
                 onboardingPolicyMode: effective.onboardingPolicyMode,
-                onboardingPlanVersionId: effective.onboardingPlanVersionId
+                onboardingPlanId: effective.onboardingPlanId
             }
         }));
     });
@@ -1471,7 +1560,8 @@ export function registerAdminRoutes(deps) {
             workspaceAssetStore.deleteLink({
                 workspaceId,
                 assetId,
-                taskId: link.taskId,
+                targetType: link.targetType,
+                targetId: link.targetId,
                 role: link.role
             });
         }
@@ -1796,14 +1886,14 @@ export function registerAdminRoutes(deps) {
             : body?.onboardingPolicyMode === 'require_plan_selection'
                 ? 'require_plan_selection'
                 : currentOnboardingPolicy.mode;
-        const onboardingPlanVersionId = typeof body?.onboardingPlanVersionId === 'string'
-            ? body.onboardingPlanVersionId.trim() || null
-            : body?.onboardingPlanVersionId === null
+        const onboardingPlanId = typeof body?.onboardingPlanId === 'string'
+            ? body.onboardingPlanId.trim().toLowerCase() || null
+            : body?.onboardingPlanId === null
                 ? null
-                : currentOnboardingPolicy.planVersionId;
+                : currentOnboardingPolicy.planId;
         const validation = core.validateOnboardingPolicy({
             mode: onboardingPolicyMode,
-            planVersionId: onboardingPlanVersionId
+            planId: onboardingPlanId
         });
         if (!validation.valid) {
             res.writeHead(400, { 'Content-Type': 'application/json' });
@@ -1824,7 +1914,7 @@ export function registerAdminRoutes(deps) {
             billing: {
                 onboardingPolicy: {
                     mode: onboardingPolicyMode,
-                    planVersionId: onboardingPlanVersionId ?? null
+                    planId: onboardingPlanId ?? null
                 }
             }
         });
@@ -1914,6 +2004,169 @@ export function registerAdminRoutes(deps) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: true, provider: result.provider, messageId: result.messageId || null }));
     });
+    // === SECTION: Admin auth provider settings ===
+    // GET /api/taskforce/admin/auth-provider-settings - Read OAuth provider config (secrets masked)
+    addRoute('GET', '/api/taskforce/admin/auth-provider-settings', async (req, res) => {
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: admin role required.' }));
+            return;
+        }
+        if (context.authConfig?.runtimeMode !== 'cloud') {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                status: {
+                    google: { enabled: false, clientId: '', hasClientSecret: false, ready: false },
+                    github: { enabled: false, clientId: '', hasClientSecret: false, ready: false },
+                    apple: { enabled: false, servicesId: '', teamId: '', keyId: '', hasPrivateKeyPem: false, ready: false }
+                }
+            }));
+            return;
+        }
+        const providers = core.getGlobalSettings().oauthProviders || {};
+        const g = providers.google || {};
+        const gh = providers.github || {};
+        const ap = providers.apple || {};
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            status: {
+                google: {
+                    enabled: g.enabled === true,
+                    clientId: String(g.clientId || ''),
+                    hasClientSecret: typeof g.clientSecret === 'string' && g.clientSecret.trim().length > 0,
+                    ready: g.enabled === true && Boolean(g.clientId) && typeof g.clientSecret === 'string' && g.clientSecret.trim().length > 0
+                },
+                github: {
+                    enabled: gh.enabled === true,
+                    clientId: String(gh.clientId || ''),
+                    hasClientSecret: typeof gh.clientSecret === 'string' && gh.clientSecret.trim().length > 0,
+                    ready: gh.enabled === true && Boolean(gh.clientId) && typeof gh.clientSecret === 'string' && gh.clientSecret.trim().length > 0
+                },
+                apple: {
+                    enabled: ap.enabled === true,
+                    servicesId: String(ap.servicesId || ''),
+                    teamId: String(ap.teamId || ''),
+                    keyId: String(ap.keyId || ''),
+                    hasPrivateKeyPem: typeof ap.privateKeyPem === 'string' && ap.privateKeyPem.trim().length > 0,
+                    ready: ap.enabled === true && Boolean(ap.servicesId) && Boolean(ap.teamId) && Boolean(ap.keyId)
+                        && typeof ap.privateKeyPem === 'string' && ap.privateKeyPem.trim().length > 0
+                }
+            }
+        }));
+    });
+    // GET /api/taskforce/admin/auth-provider-settings/health - Per-provider readiness check
+    addRoute('GET', '/api/taskforce/admin/auth-provider-settings/health', async (req, res) => {
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: admin role required.' }));
+            return;
+        }
+        const providers = core.getGlobalSettings().oauthProviders || {};
+        const g = providers.google || {};
+        const gh = providers.github || {};
+        const ap = providers.apple || {};
+        const googleReady = g.enabled === true && Boolean(g.clientId) && typeof g.clientSecret === 'string' && g.clientSecret.trim().length > 0;
+        const googleReason = !g.enabled
+            ? 'Provider disabled.'
+            : !g.clientId ? 'Missing Client ID.'
+                : !googleReady ? 'Missing Client Secret.'
+                    : null;
+        const githubReady = gh.enabled === true && Boolean(gh.clientId) && typeof gh.clientSecret === 'string' && gh.clientSecret.trim().length > 0;
+        const githubReason = !gh.enabled
+            ? 'Provider disabled.'
+            : !gh.clientId ? 'Missing Client ID.'
+                : !githubReady ? 'Missing Client Secret.'
+                    : null;
+        const appleBaseReady = ap.enabled === true && Boolean(ap.servicesId) && Boolean(ap.teamId) && Boolean(ap.keyId)
+            && typeof ap.privateKeyPem === 'string' && ap.privateKeyPem.trim().length > 0;
+        let appleSecretMintOk;
+        let appleReason = null;
+        if (!ap.enabled) {
+            appleReason = 'Provider disabled.';
+        }
+        else if (!ap.servicesId || !ap.teamId || !ap.keyId) {
+            appleReason = 'Missing Services ID, Team ID, or Key ID.';
+        }
+        else if (!appleBaseReady) {
+            appleReason = 'Missing private key PEM.';
+        }
+        else {
+            // Attempt a test-mint to verify the key is valid
+            const mintResult = testMintAppleClientSecret({
+                teamId: ap.teamId,
+                servicesId: ap.servicesId,
+                keyId: ap.keyId,
+                privateKeyPem: ap.privateKeyPem
+            });
+            appleSecretMintOk = mintResult.ok;
+            if (!mintResult.ok) {
+                appleReason = `Client-secret JWT mint failed: ${mintResult.error}`;
+            }
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            health: {
+                google: { enabled: g.enabled === true, ready: googleReady, reason: googleReason },
+                github: { enabled: gh.enabled === true, ready: githubReady, reason: githubReason },
+                apple: {
+                    enabled: ap.enabled === true,
+                    ready: appleBaseReady && appleSecretMintOk !== false,
+                    reason: appleReason,
+                    ...(typeof appleSecretMintOk === 'boolean' ? { secretMintOk: appleSecretMintOk } : {})
+                }
+            }
+        }));
+    });
+    // POST /api/taskforce/admin/auth-provider-settings - Save OAuth provider config (including secrets)
+    addRoute('POST', '/api/taskforce/admin/auth-provider-settings', async (req, res) => {
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: admin role required.' }));
+            return;
+        }
+        if (!requireCloudRuntime(res, 'Auth provider settings'))
+            return;
+        const body = await parseJsonBody(req);
+        const update = {};
+        if (body?.google && typeof body.google === 'object') {
+            const g = body.google;
+            update.google = {
+                ...(typeof g.enabled === 'boolean' ? { enabled: g.enabled } : {}),
+                ...(typeof g.clientId === 'string' ? { clientId: g.clientId } : {}),
+                ...(typeof g.clientSecret === 'string' ? { clientSecret: g.clientSecret } : {})
+            };
+        }
+        if (body?.github && typeof body.github === 'object') {
+            const gh = body.github;
+            update.github = {
+                ...(typeof gh.enabled === 'boolean' ? { enabled: gh.enabled } : {}),
+                ...(typeof gh.clientId === 'string' ? { clientId: gh.clientId } : {}),
+                ...(typeof gh.clientSecret === 'string' ? { clientSecret: gh.clientSecret } : {})
+            };
+        }
+        if (body?.apple && typeof body.apple === 'object') {
+            const ap = body.apple;
+            update.apple = {
+                ...(typeof ap.enabled === 'boolean' ? { enabled: ap.enabled } : {}),
+                ...(typeof ap.servicesId === 'string' ? { servicesId: ap.servicesId } : {}),
+                ...(typeof ap.teamId === 'string' ? { teamId: ap.teamId } : {}),
+                ...(typeof ap.keyId === 'string' ? { keyId: ap.keyId } : {}),
+                ...(typeof ap.privateKeyPem === 'string' ? { privateKeyPem: ap.privateKeyPem } : {})
+            };
+        }
+        if (Object.keys(update).length === 0) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No provider settings provided.' }));
+            return;
+        }
+        core.updateGlobalSettings({ oauthProviders: update });
+        auditAdminAction(req, 'auth-provider-settings.update', {
+            providers: Object.keys(update)
+        });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true }));
+    });
     // === SECTION: Cloud MCP HTTP transport ===
     addRoute('POST', '/mcp', async (req, res) => { await handleCloudMcpRequest(req, res); });
     addRoute('POST', '/mcp/', async (req, res) => { await handleCloudMcpRequest(req, res); });

package/dist/server/routes/auth.d.ts

@@ -6,9 +6,20 @@
  *
  * Routes registered here:
  *   GET  /api/taskforce/auth/runtime-config
+ *   GET  /api/taskforce/auth/providers
+ *   GET  /api/taskforce/auth/oauth/:provider/start
+ *   GET  /api/taskforce/auth/oauth/:provider/callback
+ *   POST /api/taskforce/auth/oauth/apple/callback
+ *   GET  /api/taskforce/account/login-methods
+ *   DELETE /api/taskforce/account/login-methods/:provider
+ *   POST /api/taskforce/account/login-methods/password
  *   GET  /api/taskforce/auth/session
  *   GET  /api/taskforce/auth/admin-session
  *   POST /api/taskforce/auth/profile
+ *   POST /api/taskforce/auth/profile/avatar/init
+ *   POST /api/taskforce/auth/profile/avatar/upload
+ *   POST /api/taskforce/auth/profile/avatar/finalize
+ *   POST /api/taskforce/auth/profile/avatar/discard
  *   POST /api/taskforce/auth/login
  *   POST /api/taskforce/auth/register
  *   POST /api/taskforce/auth/verify-email/request
@@ -26,6 +37,7 @@
  *   GET  /api/taskforce/account/plan-preview
  *   GET  /api/taskforce/auth/workspace-members
  *   GET  /api/taskforce/workspace/assignee-options
+ *   POST /api/taskforce/workspace/ai-profiles/avatar
  *   GET  /api/taskforce/admin/users
  *   POST /api/taskforce/admin/users/invite
  *   PATCH /api/taskforce/admin/users/:id/role
@@ -46,13 +58,14 @@ export interface AuthRouteDependencies {
     context: RouteContext;
     requestWorkspaceId: (req: IncomingMessage) => string;
     requestUserId: (req: IncomingMessage) => string;
+    resolveAuthenticatedUserId: (req: IncomingMessage) => string;
     requestRole: (req: IncomingMessage) => string;
     ensureAppAccess: (req: IncomingMessage, res: ServerResponse) => boolean;
     ensureAuthenticatedUser: (req: IncomingMessage) => boolean;
-    ensureWorkspaceAdminRole: (req: IncomingMessage) => boolean;
+    ensureWorkspaceAdminRole: (req: IncomingMessage, workspaceIdOverride?: string | null) => boolean;
     ensureCloudPlanData: (req: IncomingMessage, res: ServerResponse) => boolean;
     requireCloudRuntime: (res: ServerResponse, feature: string) => boolean;
-    auditAuthAction: (req: IncomingMessage, action: string, details: Record<string, unknown>) => void;
+    auditAuthAction: (req: IncomingMessage, action: string, details: Record<string, unknown>, workspaceIdOverride?: string | null) => void;
     resolveAdminRequestActor: (req: IncomingMessage) => {
         authenticated: boolean;
         userId: string;