@taskforcehq/taskforce 0.3.305 → 0.3.307

package/dist/server/routes/admin.js

@@ -7,6 +7,7 @@
  *
  * Routes registered here:
  *   GET/POST  /api/platform/plans
+ *   GET       /api/platform/onboarding-plan-options
  *   GET/POST  /api/platform/plans/:planId/versions
  *   GET       /api/platform/features
  *   GET/PATCH /api/platform/plans/:planId/versions/:versionId/features
@@ -23,6 +24,8 @@
  *   GET/POST  /api/taskforce/admin/email-settings
  *   GET       /api/taskforce/admin/email-settings/health
  *   POST      /api/taskforce/admin/email-settings/test
+ *   GET/POST  /api/taskforce/admin/auth-provider-settings
+ *   GET       /api/taskforce/admin/auth-provider-settings/health
  *   GET/POST  /api/taskforce/admin/system-settings
  *   GET/POST  /api/taskforce/admin/object-storage-settings
  *   GET       /api/taskforce/admin/object-storage-telemetry
@@ -68,6 +71,7 @@ import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFro
 import { buildCloudMcpRuntimeAuth, resolveErrorStatusCode } from './shared.js';
 import { buildAuthBehavior, buildSiteBehavior, getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl, } from './authSupport.js';
 import { applyWorkspaceRepair, scanWorkspaceRepair } from '../../sync/workspaceRepair.js';
+import { testMintAppleClientSecret } from '../auth/providers/appleClientSecret.js';
 // === SECTION: Registration ===
 export function registerAdminRoutes(deps) {
     const { addRoute, core, context, requestWorkspaceId, requestUserId, requestRole, requestHeader, requestRuntimeMode, ensureAppAccess, ensureAdminRole, ensureCloudPlanData, requireCloudRuntime, resolveAuthenticatedUserId, resolveAdminRequestActor, auditAdminAction, resolveEffectiveObjectStorageConfig, getObjectStorageClient, taskAssetStore, normalizeDocumentPathInput, ensureWithinDir, getAssetMetadata, markAssetDeleted, clearAssetDeleted, removeAssetMetadata, getStorageTelemetry, appendStorageTelemetry, getStorageIntegrityHistory, appendStorageIntegrityHistory, getDocumentPurgeHistory, appendDocumentPurgeHistory, getCollaborationTelemetry, isCollaborationPolicyEnabled, normalizeMcpOauthScopeString, MCP_TOKEN_SCOPE_VALUES, MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS, MCP_WRITE_RATE_LIMIT_ENABLED, MCP_WRITE_RATE_LIMIT_ACTOR_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WORKSPACE_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WINDOW_MS, } = deps;
@@ -75,6 +79,26 @@ export function registerAdminRoutes(deps) {
     const workspaceAssetStore = typeof core.getDatabaseAdapter === 'function' && typeof core.getTenantId === 'function'
         ? new WorkspaceAssetStore(core.getDatabaseAdapter(), core.getTenantId())
         : null;
+    const isAiProfileAvatarStorageKey = (storageKey, workspaceId) => {
+        const normalized = String(storageKey || '').replace(/\\/g, '/');
+        return normalized.startsWith(`workspaces/${workspaceId}/assets/images/ai-profiles/`)
+            && normalized.includes('/avatar/');
+    };
+    const listReferencedAiProfileAvatarStorageKeys = (workspaceId) => {
+        const referenced = new Set();
+        const profiles = typeof core.listAiProfiles === 'function'
+            ? core.listAiProfiles(workspaceId, { includeArchived: true })
+            : [];
+        for (const profile of Array.isArray(profiles) ? profiles : []) {
+            for (const value of [profile?.avatarUrl, profile?.avatarSourceUrl]) {
+                const storageKey = normalizeDocumentPathInput(value);
+                if (!storageKey || !isAiProfileAvatarStorageKey(storageKey, workspaceId))
+                    continue;
+                referenced.add(storageKey);
+            }
+        }
+        return referenced;
+    };
     // === SECTION: Email helpers ===
     const resolveEffectiveVirusScanSettings = () => {
         const settings = core.getGlobalSettings().objectStorage || {};
@@ -91,11 +115,15 @@ export function registerAdminRoutes(deps) {
     };
     // === SECTION: MCP helpers ===
     const MCP_CONNECTION_TEST_TIMEOUT_MS = 5000;
-    const writeMcpHttpError = (res, statusCode, message) => {
+    const writeMcpHttpError = (res, statusCode, message, data) => {
         res.writeHead(statusCode, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             jsonrpc: '2.0',
-            error: { code: -32000, message },
+            error: {
+                code: -32000,
+                message,
+                ...(data ? { data } : {}),
+            },
             id: null,
         }));
     };
@@ -390,6 +418,8 @@ export function registerAdminRoutes(deps) {
                 authenticatedViaOAuth: oauthAuth || null,
                 userId: null,
                 ...bootstrap,
+                aiProfileToken: bootstrap.aiProfileToken || oauthAuth?.aiProfileToken || null,
+                aiProfileName: bootstrap.aiProfileName || oauthAuth?.aiProfileName || null,
             };
         }
         core.addMcpAuditLog({
@@ -502,6 +532,7 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const authScopes = auth.authenticatedViaToken?.scopes || auth.authenticatedViaOAuth?.scopes || [];
+        const requestId = String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID();
         const deniedToolName = findDeniedCloudMcpToolName(body, authScopes);
         if (deniedToolName) {
             core.addMcpAuditLog({
@@ -511,7 +542,7 @@ export function registerAdminRoutes(deps) {
                 tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
                 toolName: deniedToolName,
                 details: {
-                    requestId: String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID(),
+                    requestId,
                     ip: req.socket?.remoteAddress || null,
                     userAgent: requestHeader(req, 'user-agent', '') || null,
                     outcome: 'deny',
@@ -524,11 +555,13 @@ export function registerAdminRoutes(deps) {
         }
         if (!applyCloudMcpWriteRateLimit(req, res, auth, body))
             return;
+        let runtime = null;
         try {
-            const runtime = createTaskforceMcpServer({
+            runtime = createTaskforceMcpServer({
                 projectRoot: core.getPaths().projectRoot,
                 tenantId: core.getTenantId(),
                 workspaceId: auth.workspaceId,
+                core,
                 serverName: 'taskforce-cloud',
                 logStartup: false,
                 runtimeMode: 'cloud',
@@ -536,7 +569,7 @@ export function registerAdminRoutes(deps) {
                     req,
                     auth,
                     requestHeader,
-                    requestId: String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID(),
+                    requestId,
                     authScopes,
                 }),
             });
@@ -553,8 +586,27 @@ export function registerAdminRoutes(deps) {
             recordCloudMcpCredentialUsage(req, auth.authenticatedViaToken, auth.authenticatedViaOAuth);
         }
         catch (error) {
+            console.error('[Taskforce MCP] Cloud transport request failed:', {
+                requestId,
+                kind: 'tool_transport_failure',
+                message: error instanceof Error ? error.message : String(error),
+            });
             if (!res.headersSent) {
-                writeMcpHttpError(res, 500, 'Internal server error.');
+                writeMcpHttpError(res, 500, 'MCP transport failure.', {
+                    kind: 'tool_transport_failure',
+                    retryable: true,
+                    requestId,
+                });
+            }
+        }
+        finally {
+            if (runtime) {
+                try {
+                    await runtime.server.close();
+                }
+                catch (closeError) {
+                    console.warn('[Taskforce MCP] Cloud transport cleanup failed:', closeError);
+                }
             }
         }
     };
@@ -571,6 +623,18 @@ export function registerAdminRoutes(deps) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: true, plans }));
     });
+    addRoute('GET', '/api/platform/onboarding-plan-options', async (req, res) => {
+        if (!ensureCloudPlanData(req, res))
+            return;
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: system admin role required.' }));
+            return;
+        }
+        const options = core.listOnboardingPlanOptions();
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true, options }));
+    });
     addRoute('POST', '/api/platform/plans', async (req, res) => {
         if (!ensureCloudPlanData(req, res))
             return;
@@ -580,10 +644,19 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const body = await parseJsonBody(req);
+        const description = body?.description === undefined || body?.description === null
+            ? body?.description
+            : String(body.description);
+        if (typeof description === 'string' && description.trim().length > 240) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Plan description must be 240 characters or fewer.', code: 'PLAN_DESCRIPTION_TOO_LONG' }));
+            return;
+        }
         try {
             const plan = core.upsertPlanCatalog({
                 planId: body?.planId,
                 displayName: body?.displayName,
+                description,
                 status: body?.status,
                 initialMode: body?.initialMode,
                 initialTrialDays: body?.initialTrialDays === undefined ? undefined : Number(body?.initialTrialDays),
@@ -639,6 +712,62 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: String(error?.message || 'Unable to list feature catalog'), code: error?.code }));
         }
     });
+    addRoute('PATCH', '/api/platform/features/:featureKey', async (req, res, params) => {
+        if (!ensureCloudPlanData(req, res))
+            return;
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: system admin role required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const featureKey = String(params.featureKey || '').trim();
+        const publicLabel = body?.publicLabel === undefined || body?.publicLabel === null
+            ? body?.publicLabel
+            : String(body.publicLabel);
+        const publicDescription = body?.publicDescription === undefined || body?.publicDescription === null
+            ? body?.publicDescription
+            : String(body.publicDescription);
+        const publicDisplayOrder = body?.publicDisplayOrder === undefined || body?.publicDisplayOrder === null || body?.publicDisplayOrder === ''
+            ? null
+            : Math.max(0, Math.floor(Number(body.publicDisplayOrder)));
+        if (typeof publicLabel === 'string' && publicLabel.trim().length > 120) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Public label must be 120 characters or fewer.', code: 'PLAN_FEATURE_PUBLIC_LABEL_TOO_LONG' }));
+            return;
+        }
+        if (typeof publicDescription === 'string' && publicDescription.trim().length > 280) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Public description must be 280 characters or fewer.', code: 'PLAN_FEATURE_PUBLIC_DESCRIPTION_TOO_LONG' }));
+            return;
+        }
+        if (publicDisplayOrder !== null && !Number.isFinite(publicDisplayOrder)) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Public display order must be a non-negative number.', code: 'PLAN_FEATURE_PUBLIC_DISPLAY_ORDER_INVALID' }));
+            return;
+        }
+        try {
+            const feature = core.updatePlanFeatureCatalogMarketingCopy({
+                featureKey,
+                publicLabel,
+                publicDescription,
+                publicDisplayOrder
+            });
+            auditAdminAction(req, 'platform-plan-feature-catalog-updated', {
+                featureKey,
+                publicLabel: feature.publicLabel ?? null,
+                publicDescription: feature.publicDescription ?? null,
+                publicDisplayOrder: feature.publicDisplayOrder ?? null
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, feature }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: String(error?.message || 'Unable to update feature catalog entry'), code: error?.code }));
+        }
+    });
     addRoute('POST', '/api/platform/plans/:planId/versions', async (req, res, params) => {
         if (!ensureCloudPlanData(req, res))
             return;
@@ -855,9 +984,23 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ error: 'Forbidden: system admin role required.' }));
             return;
         }
-        const users = core.listSystemUsers();
+        const reqUrl = new URL(req.url || '/api/taskforce/admin/system-users', 'http://localhost');
+        const query = String(reqUrl.searchParams.get('q') || '').trim();
+        const sort = reqUrl.searchParams.get('sort') === 'oldest' ? 'oldest' : 'newest';
+        const limitRaw = Number(reqUrl.searchParams.get('limit') || '50');
+        const offsetRaw = Number(reqUrl.searchParams.get('offset') || '0');
+        const limit = Number.isFinite(limitRaw) ? Math.max(1, Math.min(200, Math.floor(limitRaw))) : 50;
+        const offset = Number.isFinite(offsetRaw) ? Math.max(0, Math.floor(offsetRaw)) : 0;
+        const total = core.countSystemUsers({ query });
+        const users = core.listSystemUsers({ query, sort, limit, offset });
         res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ users }));
+        res.end(JSON.stringify({
+            users,
+            total,
+            limit,
+            offset,
+            hasMore: offset + users.length < total
+        }));
     });
     // GET /api/taskforce/admin/audit-logs - Read recent admin audit events
     addRoute('GET', '/api/taskforce/admin/audit-logs', async (req, res) => {
@@ -1136,8 +1279,10 @@ export function registerAdminRoutes(deps) {
         }
         const globalSettings = core.getGlobalSettings();
         const authSettings = globalSettings.auth || {};
-        const billingSettings = globalSettings.billing || {};
+        const siteSettings = globalSettings.site || {};
+        const onboardingPolicy = core.getOnboardingPolicy();
         const effective = buildAuthBehavior(core);
+        const effectiveSite = buildSiteBehavior(core);
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             settings: {
@@ -1147,14 +1292,14 @@ export function registerAdminRoutes(deps) {
                 ...(typeof authSettings.authRateLimitEnabled === 'boolean' ? { authRateLimitEnabled: authSettings.authRateLimitEnabled } : {}),
                 ...(typeof authSettings.authRateLimitMaxRequests === 'number' ? { authRateLimitMaxRequests: authSettings.authRateLimitMaxRequests } : {}),
                 ...(typeof authSettings.authRateLimitWindowMs === 'number' ? { authRateLimitWindowMs: authSettings.authRateLimitWindowMs } : {}),
-                ...((billingSettings.onboardingPolicy?.mode === 'require_plan_selection'
-                    || billingSettings.onboardingPolicy?.mode === 'auto_grant_free'
-                    || billingSettings.onboardingPolicy?.mode === 'auto_start_trial')
-                    ? { onboardingPolicyMode: billingSettings.onboardingPolicy.mode }
-                    : {}),
-                ...(typeof billingSettings.onboardingPolicy?.planVersionId === 'string' || billingSettings.onboardingPolicy?.planVersionId === null
-                    ? { onboardingPlanVersionId: billingSettings.onboardingPolicy?.planVersionId ?? null }
-                    : {})
+                ...(typeof siteSettings.showRunTaskforceLocally === 'boolean' ? { showRunTaskforceLocally: siteSettings.showRunTaskforceLocally } : {}),
+                ...(typeof siteSettings.pricingPageEnabled === 'boolean' ? { pricingPageEnabled: siteSettings.pricingPageEnabled } : {}),
+                ...(typeof siteSettings.animatedBackgroundEnabled === 'boolean' ? { animatedBackgroundEnabled: siteSettings.animatedBackgroundEnabled } : {}),
+                ...(siteSettings.siteTheme === 'light' || siteSettings.siteTheme === 'dark' ? { siteTheme: siteSettings.siteTheme } : {}),
+                ...(typeof siteSettings.pricingPageTitle === 'string' ? { pricingPageTitle: siteSettings.pricingPageTitle } : {}),
+                ...(typeof siteSettings.pricingPageDescription === 'string' ? { pricingPageDescription: siteSettings.pricingPageDescription } : {}),
+                onboardingPolicyMode: onboardingPolicy.mode,
+                onboardingPlanId: onboardingPolicy.planId
             },
             status: {
                 allowSelfRegistration: effective.allowSelfRegistration,
@@ -1163,8 +1308,14 @@ export function registerAdminRoutes(deps) {
                 authRateLimitEnabled: effective.authRateLimitEnabled,
                 authRateLimitMaxRequests: effective.authRateLimitMaxRequests,
                 authRateLimitWindowMs: effective.authRateLimitWindowMs,
+                showRunTaskforceLocally: effectiveSite.showRunTaskforceLocally,
+                pricingPageEnabled: effectiveSite.pricingPageEnabled,
+                animatedBackgroundEnabled: effectiveSite.animatedBackgroundEnabled,
+                siteTheme: effectiveSite.siteTheme,
+                pricingPageTitle: effectiveSite.pricingPageTitle,
+                pricingPageDescription: effectiveSite.pricingPageDescription,
                 onboardingPolicyMode: effective.onboardingPolicyMode,
-                onboardingPlanVersionId: effective.onboardingPlanVersionId
+                onboardingPlanId: effective.onboardingPlanId
             }
         }));
     });
@@ -1184,11 +1335,27 @@ export function registerAdminRoutes(deps) {
                     : {}),
                 ...(typeof siteSettings.pricingPageEnabled === 'boolean'
                     ? { pricingPageEnabled: siteSettings.pricingPageEnabled }
+                    : {}),
+                ...(typeof siteSettings.animatedBackgroundEnabled === 'boolean'
+                    ? { animatedBackgroundEnabled: siteSettings.animatedBackgroundEnabled }
+                    : {}),
+                ...(siteSettings.siteTheme === 'light' || siteSettings.siteTheme === 'dark'
+                    ? { siteTheme: siteSettings.siteTheme }
+                    : {}),
+                ...(typeof siteSettings.pricingPageTitle === 'string'
+                    ? { pricingPageTitle: siteSettings.pricingPageTitle }
+                    : {}),
+                ...(typeof siteSettings.pricingPageDescription === 'string'
+                    ? { pricingPageDescription: siteSettings.pricingPageDescription }
                     : {})
             },
             status: {
                 showRunTaskforceLocally: siteBehavior.showRunTaskforceLocally,
-                pricingPageEnabled: siteBehavior.pricingPageEnabled
+                pricingPageEnabled: siteBehavior.pricingPageEnabled,
+                animatedBackgroundEnabled: siteBehavior.animatedBackgroundEnabled,
+                siteTheme: siteBehavior.siteTheme,
+                pricingPageTitle: siteBehavior.pricingPageTitle,
+                pricingPageDescription: siteBehavior.pricingPageDescription
             }
         }));
     };
@@ -1359,9 +1526,11 @@ export function registerAdminRoutes(deps) {
         }
         const reqUrl = new URL(req.url || '/api/taskforce/admin/orphaned-assets', 'http://localhost');
         const workspaceId = String(reqUrl.searchParams.get('workspaceId') || requestWorkspaceId(req) || '').trim();
+        const aiProfileAvatarStorageKeys = listReferencedAiProfileAvatarStorageKeys(workspaceId);
         const assets = workspaceAssetStore.listAllByWorkspace(workspaceId, {
             includeDeleted: false
-        }).filter((asset) => workspaceAssetStore.listLinksForAsset(asset.assetId, workspaceId).every((link) => !!link.deletedAt))
+        }).filter((asset) => (!aiProfileAvatarStorageKeys.has(asset.storageKey)
+            && workspaceAssetStore.listLinksForAsset(asset.assetId, workspaceId).every((link) => !!link.deletedAt)))
             .map((asset) => ({
             assetId: asset.assetId,
             workspaceId: asset.workspaceId,
@@ -1440,6 +1609,11 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ error: 'Asset not found.' }));
             return;
         }
+        if (listReferencedAiProfileAvatarStorageKeys(workspaceId).has(asset.storageKey)) {
+            res.writeHead(409, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Asset is still referenced by an AI profile avatar.' }));
+            return;
+        }
         const objectStorageClient = getObjectStorageClient();
         const { basePath } = core.getPaths();
         try {
@@ -1471,7 +1645,8 @@ export function registerAdminRoutes(deps) {
             workspaceAssetStore.deleteLink({
                 workspaceId,
                 assetId,
-                taskId: link.taskId,
+                targetType: link.targetType,
+                targetId: link.targetId,
                 role: link.role
             });
         }
@@ -1796,20 +1971,59 @@ export function registerAdminRoutes(deps) {
             : body?.onboardingPolicyMode === 'require_plan_selection'
                 ? 'require_plan_selection'
                 : currentOnboardingPolicy.mode;
-        const onboardingPlanVersionId = typeof body?.onboardingPlanVersionId === 'string'
-            ? body.onboardingPlanVersionId.trim() || null
-            : body?.onboardingPlanVersionId === null
+        const onboardingPlanId = typeof body?.onboardingPlanId === 'string'
+            ? body.onboardingPlanId.trim().toLowerCase() || null
+            : body?.onboardingPlanId === null
                 ? null
-                : currentOnboardingPolicy.planVersionId;
+                : currentOnboardingPolicy.planId;
+        const pricingPageTitle = typeof body?.pricingPageTitle === 'string'
+            ? body.pricingPageTitle.trim()
+            : undefined;
+        const pricingPageDescription = typeof body?.pricingPageDescription === 'string'
+            ? body.pricingPageDescription.trim()
+            : undefined;
+        const siteTheme = body?.siteTheme === 'light' || body?.siteTheme === 'dark'
+            ? body.siteTheme
+            : undefined;
+        if (pricingPageTitle !== undefined && pricingPageTitle.length > 120) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Pricing page title must be 120 characters or fewer.', code: 'PRICING_PAGE_TITLE_TOO_LONG' }));
+            return;
+        }
+        if (pricingPageDescription !== undefined && pricingPageDescription.length > 280) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Pricing page description must be 280 characters or fewer.', code: 'PRICING_PAGE_DESCRIPTION_TOO_LONG' }));
+            return;
+        }
         const validation = core.validateOnboardingPolicy({
             mode: onboardingPolicyMode,
-            planVersionId: onboardingPlanVersionId
+            planId: onboardingPlanId
         });
         if (!validation.valid) {
             res.writeHead(400, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: validation.message || 'Invalid onboarding policy.', code: validation.code, details: validation.details }));
             return;
         }
+        const siteSettingsUpdate = {
+            ...(typeof body?.showRunTaskforceLocally === 'boolean'
+                ? { showRunTaskforceLocally: body.showRunTaskforceLocally }
+                : {}),
+            ...(typeof body?.pricingPageEnabled === 'boolean'
+                ? { pricingPageEnabled: body.pricingPageEnabled }
+                : {}),
+            ...(typeof body?.animatedBackgroundEnabled === 'boolean'
+                ? { animatedBackgroundEnabled: body.animatedBackgroundEnabled }
+                : {}),
+            ...(siteTheme !== undefined
+                ? { siteTheme }
+                : {}),
+            ...(pricingPageTitle !== undefined
+                ? { pricingPageTitle }
+                : {}),
+            ...(pricingPageDescription !== undefined
+                ? { pricingPageDescription }
+                : {})
+        };
         core.updateGlobalSettings({
             auth: {
                 ...(typeof body?.allowSelfRegistration === 'boolean' ? { allowSelfRegistration: body.allowSelfRegistration } : {}),
@@ -1824,9 +2038,12 @@ export function registerAdminRoutes(deps) {
             billing: {
                 onboardingPolicy: {
                     mode: onboardingPolicyMode,
-                    planVersionId: onboardingPlanVersionId ?? null
+                    planId: onboardingPlanId ?? null
                 }
-            }
+            },
+            ...(Object.keys(siteSettingsUpdate).length > 0
+                ? { site: siteSettingsUpdate }
+                : {})
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: true }));
@@ -1838,6 +2055,25 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const body = await parseJsonBody(req);
+        const pricingPageTitle = typeof body?.pricingPageTitle === 'string'
+            ? body.pricingPageTitle.trim()
+            : undefined;
+        const pricingPageDescription = typeof body?.pricingPageDescription === 'string'
+            ? body.pricingPageDescription.trim()
+            : undefined;
+        const siteTheme = body?.siteTheme === 'light' || body?.siteTheme === 'dark'
+            ? body.siteTheme
+            : undefined;
+        if (pricingPageTitle !== undefined && pricingPageTitle.length > 120) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Pricing page title must be 120 characters or fewer.', code: 'PRICING_PAGE_TITLE_TOO_LONG' }));
+            return;
+        }
+        if (pricingPageDescription !== undefined && pricingPageDescription.length > 280) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Pricing page description must be 280 characters or fewer.', code: 'PRICING_PAGE_DESCRIPTION_TOO_LONG' }));
+            return;
+        }
         core.updateGlobalSettings({
             site: {
                 ...(typeof body?.showRunTaskforceLocally === 'boolean'
@@ -1845,6 +2081,18 @@ export function registerAdminRoutes(deps) {
                     : {}),
                 ...(typeof body?.pricingPageEnabled === 'boolean'
                     ? { pricingPageEnabled: body.pricingPageEnabled }
+                    : {}),
+                ...(typeof body?.animatedBackgroundEnabled === 'boolean'
+                    ? { animatedBackgroundEnabled: body.animatedBackgroundEnabled }
+                    : {}),
+                ...(siteTheme !== undefined
+                    ? { siteTheme }
+                    : {}),
+                ...(pricingPageTitle !== undefined
+                    ? { pricingPageTitle }
+                    : {}),
+                ...(pricingPageDescription !== undefined
+                    ? { pricingPageDescription }
                     : {})
             }
         });
@@ -1914,6 +2162,169 @@ export function registerAdminRoutes(deps) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: true, provider: result.provider, messageId: result.messageId || null }));
     });
+    // === SECTION: Admin auth provider settings ===
+    // GET /api/taskforce/admin/auth-provider-settings - Read OAuth provider config (secrets masked)
+    addRoute('GET', '/api/taskforce/admin/auth-provider-settings', async (req, res) => {
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: admin role required.' }));
+            return;
+        }
+        if (context.authConfig?.runtimeMode !== 'cloud') {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                status: {
+                    google: { enabled: false, clientId: '', hasClientSecret: false, ready: false },
+                    github: { enabled: false, clientId: '', hasClientSecret: false, ready: false },
+                    apple: { enabled: false, servicesId: '', teamId: '', keyId: '', hasPrivateKeyPem: false, ready: false }
+                }
+            }));
+            return;
+        }
+        const providers = core.getGlobalSettings().oauthProviders || {};
+        const g = providers.google || {};
+        const gh = providers.github || {};
+        const ap = providers.apple || {};
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            status: {
+                google: {
+                    enabled: g.enabled === true,
+                    clientId: String(g.clientId || ''),
+                    hasClientSecret: typeof g.clientSecret === 'string' && g.clientSecret.trim().length > 0,
+                    ready: g.enabled === true && Boolean(g.clientId) && typeof g.clientSecret === 'string' && g.clientSecret.trim().length > 0
+                },
+                github: {
+                    enabled: gh.enabled === true,
+                    clientId: String(gh.clientId || ''),
+                    hasClientSecret: typeof gh.clientSecret === 'string' && gh.clientSecret.trim().length > 0,
+                    ready: gh.enabled === true && Boolean(gh.clientId) && typeof gh.clientSecret === 'string' && gh.clientSecret.trim().length > 0
+                },
+                apple: {
+                    enabled: ap.enabled === true,
+                    servicesId: String(ap.servicesId || ''),
+                    teamId: String(ap.teamId || ''),
+                    keyId: String(ap.keyId || ''),
+                    hasPrivateKeyPem: typeof ap.privateKeyPem === 'string' && ap.privateKeyPem.trim().length > 0,
+                    ready: ap.enabled === true && Boolean(ap.servicesId) && Boolean(ap.teamId) && Boolean(ap.keyId)
+                        && typeof ap.privateKeyPem === 'string' && ap.privateKeyPem.trim().length > 0
+                }
+            }
+        }));
+    });
+    // GET /api/taskforce/admin/auth-provider-settings/health - Per-provider readiness check
+    addRoute('GET', '/api/taskforce/admin/auth-provider-settings/health', async (req, res) => {
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: admin role required.' }));
+            return;
+        }
+        const providers = core.getGlobalSettings().oauthProviders || {};
+        const g = providers.google || {};
+        const gh = providers.github || {};
+        const ap = providers.apple || {};
+        const googleReady = g.enabled === true && Boolean(g.clientId) && typeof g.clientSecret === 'string' && g.clientSecret.trim().length > 0;
+        const googleReason = !g.enabled
+            ? 'Provider disabled.'
+            : !g.clientId ? 'Missing Client ID.'
+                : !googleReady ? 'Missing Client Secret.'
+                    : null;
+        const githubReady = gh.enabled === true && Boolean(gh.clientId) && typeof gh.clientSecret === 'string' && gh.clientSecret.trim().length > 0;
+        const githubReason = !gh.enabled
+            ? 'Provider disabled.'
+            : !gh.clientId ? 'Missing Client ID.'
+                : !githubReady ? 'Missing Client Secret.'
+                    : null;
+        const appleBaseReady = ap.enabled === true && Boolean(ap.servicesId) && Boolean(ap.teamId) && Boolean(ap.keyId)
+            && typeof ap.privateKeyPem === 'string' && ap.privateKeyPem.trim().length > 0;
+        let appleSecretMintOk;
+        let appleReason = null;
+        if (!ap.enabled) {
+            appleReason = 'Provider disabled.';
+        }
+        else if (!ap.servicesId || !ap.teamId || !ap.keyId) {
+            appleReason = 'Missing Services ID, Team ID, or Key ID.';
+        }
+        else if (!appleBaseReady) {
+            appleReason = 'Missing private key PEM.';
+        }
+        else {
+            // Attempt a test-mint to verify the key is valid
+            const mintResult = testMintAppleClientSecret({
+                teamId: ap.teamId,
+                servicesId: ap.servicesId,
+                keyId: ap.keyId,
+                privateKeyPem: ap.privateKeyPem
+            });
+            appleSecretMintOk = mintResult.ok;
+            if (!mintResult.ok) {
+                appleReason = `Client-secret JWT mint failed: ${mintResult.error}`;
+            }
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            health: {
+                google: { enabled: g.enabled === true, ready: googleReady, reason: googleReason },
+                github: { enabled: gh.enabled === true, ready: githubReady, reason: githubReason },
+                apple: {
+                    enabled: ap.enabled === true,
+                    ready: appleBaseReady && appleSecretMintOk !== false,
+                    reason: appleReason,
+                    ...(typeof appleSecretMintOk === 'boolean' ? { secretMintOk: appleSecretMintOk } : {})
+                }
+            }
+        }));
+    });
+    // POST /api/taskforce/admin/auth-provider-settings - Save OAuth provider config (including secrets)
+    addRoute('POST', '/api/taskforce/admin/auth-provider-settings', async (req, res) => {
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: admin role required.' }));
+            return;
+        }
+        if (!requireCloudRuntime(res, 'Auth provider settings'))
+            return;
+        const body = await parseJsonBody(req);
+        const update = {};
+        if (body?.google && typeof body.google === 'object') {
+            const g = body.google;
+            update.google = {
+                ...(typeof g.enabled === 'boolean' ? { enabled: g.enabled } : {}),
+                ...(typeof g.clientId === 'string' ? { clientId: g.clientId } : {}),
+                ...(typeof g.clientSecret === 'string' ? { clientSecret: g.clientSecret } : {})
+            };
+        }
+        if (body?.github && typeof body.github === 'object') {
+            const gh = body.github;
+            update.github = {
+                ...(typeof gh.enabled === 'boolean' ? { enabled: gh.enabled } : {}),
+                ...(typeof gh.clientId === 'string' ? { clientId: gh.clientId } : {}),
+                ...(typeof gh.clientSecret === 'string' ? { clientSecret: gh.clientSecret } : {})
+            };
+        }
+        if (body?.apple && typeof body.apple === 'object') {
+            const ap = body.apple;
+            update.apple = {
+                ...(typeof ap.enabled === 'boolean' ? { enabled: ap.enabled } : {}),
+                ...(typeof ap.servicesId === 'string' ? { servicesId: ap.servicesId } : {}),
+                ...(typeof ap.teamId === 'string' ? { teamId: ap.teamId } : {}),
+                ...(typeof ap.keyId === 'string' ? { keyId: ap.keyId } : {}),
+                ...(typeof ap.privateKeyPem === 'string' ? { privateKeyPem: ap.privateKeyPem } : {})
+            };
+        }
+        if (Object.keys(update).length === 0) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No provider settings provided.' }));
+            return;
+        }
+        core.updateGlobalSettings({ oauthProviders: update });
+        auditAdminAction(req, 'auth-provider-settings.update', {
+            providers: Object.keys(update)
+        });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true }));
+    });
     // === SECTION: Cloud MCP HTTP transport ===
     addRoute('POST', '/mcp', async (req, res) => { await handleCloudMcpRequest(req, res); });
     addRoute('POST', '/mcp/', async (req, res) => { await handleCloudMcpRequest(req, res); });
@@ -2256,6 +2667,26 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: error.message, code: error?.code || 'MCP_TOKEN_REVOKE_FAILED' }));
         }
     });
+    addRoute('DELETE', '/api/taskforce/settings/mcp/tokens/:id', async (req, res, params) => {
+        if (!ensureAppAccess(req, res))
+            return;
+        const userId = resolveAuthenticatedUserId(req);
+        if (!userId || userId === 'anonymous') {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+            return;
+        }
+        try {
+            const deleted = core.deleteMcpAccessToken({ actorUserId: userId, workspaceId: requestWorkspaceId(req), tokenId: params.id });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, deleted }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: error.message, code: error?.code || 'MCP_TOKEN_DELETE_FAILED' }));
+        }
+    });
     addRoute('POST', '/api/taskforce/settings/mcp/tokens/:id/regenerate', async (req, res, params) => {
         if (!ensureAppAccess(req, res))
             return;