@thinkai/tai-api-contract 2.194.0 → 2.195.0

package/openapi/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: ThinkAI API
-  version: 2.194.0
+  version: 2.195.0
   description: >
     Contract surface for the AI Driven SDLC backend used by ThinkAI.
     Workspace-scoped routes use `/workspaces/{workspaceId}/...`.
@@ -1757,6 +1757,59 @@ paths:
               schema:
                 $ref: "#/components/schemas/PlatformBannerViewDto"
 
+  /admin/jobs-session:
+    post:
+      tags: [PlatformAdmin]
+      summary: Mint HttpOnly cookie for /admin/jobs dashboard access
+      operationId: adminCreateJobsSession
+      description: >
+        Platform admins only. Copies the caller's Bearer JWT into an HttpOnly
+        `tai_admin_jobs` cookie (`Path=/admin/`, `SameSite=Lax`, `Secure` when HTTPS/prod,
+        `Max-Age` 1 hour) so browser navigations and admin-SPA iframes can authenticate to
+        `/admin/jobs*` without an `Authorization` header on every request.
+
+        Requires a Bearer JWT from an email on `PLATFORM_ADMIN_EMAILS`. The cookie is only
+        accepted as a Bearer substitute on `/admin/jobs*` paths by the API auth preHandler.
+        The mounted `@pg-boss/dashboard` HTML surface is not part of this contract.
+      responses:
+        "204":
+          description: "Session cookie set (Set-Cookie with tai_admin_jobs)."
+          headers:
+            Set-Cookie:
+              schema:
+                type: string
+              description: >
+                HttpOnly jobs session cookie with the caller's JWT value,
+                Path=/admin/, SameSite=Lax, Max-Age=3600, Secure when applicable.
+        "401":
+          description: Missing or non-Bearer Authorization (no JWT to put in the cookie).
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorMessageDto"
+              example:
+                error: Unauthorized
+                code: unauthorized
+        "403":
+          description: Caller is not a platform admin.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorMessageDto"
+              example:
+                error: Forbidden
+                code: forbidden
+        "503":
+          description: >
+            Jobs dashboard unavailable (`JOBS_PG_BOSS_ENABLED=false` or readiness DB URL missing).
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorMessageDto"
+              example:
+                error: Jobs dashboard unavailable
+                code: jobs_dashboard_unavailable
+
   /admin/platform/banner:
     get:
       tags: [PlatformAdmin]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thinkai/tai-api-contract",
-  "version": "2.194.0",
+  "version": "2.195.0",
   "private": false,
   "type": "module",
   "main": "dist/index.js",

package/src/generated/openapi.ts

@@ -465,6 +465,27 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/admin/jobs-session": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mint HttpOnly cookie for /admin/jobs dashboard access
+         * @description Platform admins only. Copies the caller's Bearer JWT into an HttpOnly `tai_admin_jobs` cookie (`Path=/admin/`, `SameSite=Lax`, `Secure` when HTTPS/prod, `Max-Age` 1 hour) so browser navigations and admin-SPA iframes can authenticate to `/admin/jobs*` without an `Authorization` header on every request.
+         *     Requires a Bearer JWT from an email on `PLATFORM_ADMIN_EMAILS`. The cookie is only accepted as a Bearer substitute on `/admin/jobs*` paths by the API auth preHandler. The mounted `@pg-boss/dashboard` HTML surface is not part of this contract.
+         */
+        post: operations["adminCreateJobsSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/admin/platform/banner": {
         parameters: {
             query?: never;
@@ -15389,6 +15410,71 @@ export interface operations {
             };
         };
     };
+    adminCreateJobsSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Session cookie set (Set-Cookie with tai_admin_jobs). */
+            204: {
+                headers: {
+                    /** @description HttpOnly jobs session cookie with the caller's JWT value, Path=/admin/, SameSite=Lax, Max-Age=3600, Secure when applicable. */
+                    "Set-Cookie"?: string;
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Missing or non-Bearer Authorization (no JWT to put in the cookie). */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Unauthorized",
+                     *       "code": "unauthorized"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Caller is not a platform admin. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Forbidden",
+                     *       "code": "forbidden"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+            /** @description Jobs dashboard unavailable (`JOBS_PG_BOSS_ENABLED=false` or readiness DB URL missing). */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    /**
+                     * @example {
+                     *       "error": "Jobs dashboard unavailable",
+                     *       "code": "jobs_dashboard_unavailable"
+                     *     }
+                     */
+                    "application/json": components["schemas"]["ErrorMessageDto"];
+                };
+            };
+        };
+    };
     adminGetPlatformBanner: {
         parameters: {
             query?: never;