miravo 0.4.0 → 0.6.0

package/src/lib/admin-server.ts

@@ -6,11 +6,35 @@ import type {
   EventLogQuery,
   EventLogResult,
   InstanceDetail,
+  Manifest,
   ModelSchema,
   TemplateRun,
 } from "@miravo/core";
-import type { CatalogTemplate, CommandResult, EngineCommand, LoggedEvent } from "@miravo/shared";
-import { EngineCommandSchema } from "@miravo/shared";
+import type {
+  CatalogModel,
+  CatalogTemplate,
+  CatalogTemplateDetail,
+  CommandResult,
+  ConsoleBootstrapResponse,
+  EngineCommand,
+  LoggedEvent,
+  RuntimeSnapshot,
+} from "@miravo/shared";
+import { handleAuthStatus, handleLogin, handleLogout, handlePasswordChange } from "./admin-auth.ts";
+import { handlePlatformRoute } from "./admin-platform-routes.ts";
+import type { HealthResponseBody } from "./admin-responses.ts";
+import {
+  buildHealthBody,
+  checkContentType,
+  jsonResponse,
+  livenessStatus,
+  parseCommandRequest,
+  plainResponse,
+  readinessStatus,
+  yamlResponse,
+} from "./admin-responses.ts";
+import type { SessionStore } from "./session-store.ts";
+import { extractSessionId } from "./session-store.ts";
 import type { WSClientData } from "./ws-hub.ts";
 import { ALL_CHANNELS, WSHub } from "./ws-hub.ts";
 
@@ -22,6 +46,8 @@ const VALID_EVENT_TYPES: ReadonlySet<string> = new Set<LoggedEvent["type"]>([
   "instance:created",
   "instance:removed",
   "engine:state-changed",
+  "platform:resource",
+  "platform:operation",
 ]);
 
 interface AdminEngine {
@@ -42,6 +68,7 @@ interface AdminEngine {
   getModelSchema(name: string): ModelSchema | undefined;
   getEventLog(query?: EventLogQuery): EventLogResult;
   getRunningTemplates(): readonly TemplateRun[];
+  getManifest(): Manifest;
 }
 
 /** Network binding configuration. */
@@ -59,8 +86,20 @@ interface AdminServerProtocolOptions {
 /** WebSocket streaming configuration. When provided, enables the /ws endpoint. */
 interface AdminServerWSOptions {
   readonly bus: import("@miravo/core").EventBus;
-  readonly getEngineState: () => import("@miravo/shared").EngineRunState;
-  readonly getTickInfo: () => { tick: number; simulationTime: number; instanceCount: number };
+}
+
+/** Authentication configuration for the admin server. */
+interface AdminServerAuth {
+  /** Verify a plaintext password against the stored hash. */
+  readonly verifyPassword: (password: string) => Promise<boolean>;
+  /** True when the effective password is the literal default "admin". */
+  readonly isDefaultPassword: boolean;
+  /** Server-side session store. */
+  readonly sessionStore: SessionStore;
+  /** Change the admin password (verifies old, hashes + persists new). */
+  readonly changePassword: (oldPassword: string, newPassword: string) => Promise<void>;
+  /** When true, all requests are treated as authenticated. No session required. */
+  readonly anonymousMode?: boolean;
 }
 
 interface AdminServerOptions {
@@ -69,12 +108,33 @@ interface AdminServerOptions {
   readonly protocols: AdminServerProtocolOptions;
   /** WebSocket streaming. When provided, enables /ws endpoint. */
   readonly ws?: AdminServerWSOptions | undefined;
-  /** Bearer token for mutation endpoints. When set, POST /commands requires Authorization header. */
-  readonly adminToken?: string | undefined;
+  /** Authentication configuration. */
+  readonly auth: AdminServerAuth;
+  /** Event log for platform operation tracking. */
+  readonly eventLog?: import("@miravo/core").EventLog | undefined;
   /** Path to console static assets directory. When set, serves the SPA at non-API routes. */
   readonly consoleDir?: string | undefined;
   /** Template catalog provider for GET /catalog/templates. */
   readonly getCatalog?: (() => readonly CatalogTemplate[]) | undefined;
+  /** Model catalog provider for GET /catalog/models. */
+  readonly getCatalogModels?: (() => Promise<readonly CatalogModel[]>) | undefined;
+  /** Model schema from YAML for GET /catalog/models/:name. */
+  readonly getCatalogModelSchema?: ((name: string) => Promise<ModelSchema | null>) | undefined;
+  /** Raw YAML text for GET /catalog/models/:name/yaml. */
+  readonly getModelYaml?: ((name: string) => Promise<string | null>) | undefined;
+  /** LE Digital Twin JSON for GET /catalog/models/:name/le-dt.json. */
+  readonly getLeDtJson?: ((name: string) => Promise<string | null>) | undefined;
+  /** Template detail with topology for GET /catalog/templates/:id. */
+  readonly getTemplateDetail?: ((id: string) => Promise<CatalogTemplateDetail | null>) | undefined;
+  /** Full LE export (JSON + CSV) for GET /catalog/templates/:id/le-template.json and /le-tags.csv. */
+  readonly getLeExport?:
+    | ((
+        id: string,
+        opts: { host: string; protocol: import("@miravo/shared").ProtocolName | undefined },
+      ) => Promise<{ templateJson: string; tagsCSV: string } | null>)
+    | undefined;
+  /** Raw YAML text for GET /catalog/templates/:id/yaml. */
+  readonly getTemplateYaml?: ((id: string) => Promise<string | null>) | undefined;
   /** Simulation name for daemon identity verification via /readyz. */
   readonly simulationName?: string | undefined;
   /** Run ID for daemon identity verification via /readyz. */
@@ -83,175 +143,12 @@ interface AdminServerOptions {
   readonly requestShutdown?: ((reason: string) => void) | undefined;
 }
 
-interface AdminServerStatus {
-  readonly status: "ok" | "fail";
-  readonly reason?: string;
-}
-
 interface AdminServerHandle {
   readonly endpoint: string;
   readonly wsHub: WSHub | null;
   stop(): void;
 }
 
-interface HealthResponseBody {
-  readonly status: "ok" | "fail";
-  readonly simulationState: EngineCoreMetrics["state"];
-  readonly tickCount: number;
-  readonly mqttEnabled: boolean;
-  readonly mqttConnected: boolean | null;
-  readonly opcuaEnabled: boolean;
-  readonly opcuaConnected: boolean | null;
-  readonly stalled: boolean;
-  readonly reason?: string;
-  readonly simulationName?: string;
-  readonly runId?: string;
-}
-
-interface AdminErrorResponse {
-  readonly message: string;
-  readonly error: string;
-}
-
-function jsonResponse(body: unknown, status: number): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: {
-      "content-type": "application/json; charset=utf-8",
-      "cache-control": "no-store",
-    },
-  });
-}
-
-function plainResponse(body: string, status: number, allow?: string): Response {
-  return new Response(body, {
-    status,
-    headers: {
-      "content-type": "text/plain; charset=utf-8",
-      "cache-control": "no-store",
-      ...(allow ? { allow } : {}),
-    },
-  });
-}
-
-function livenessStatus(input: {
-  readonly core: EngineCoreMetrics;
-  readonly stalled: boolean;
-}): AdminServerStatus {
-  if (input.core.state === "stopped") {
-    return { status: "fail", reason: 'engine state is "stopped"' };
-  }
-  if (input.stalled) {
-    return { status: "fail", reason: "tick loop stalled" };
-  }
-  return { status: "ok" };
-}
-
-function readinessStatus(input: {
-  readonly core: EngineCoreMetrics;
-  readonly stalled: boolean;
-  readonly mqttEnabled: boolean;
-  readonly mqttConnected: boolean;
-  readonly opcuaEnabled: boolean;
-  readonly opcuaConnected: boolean;
-}): AdminServerStatus {
-  if (input.core.state !== "running") {
-    return { status: "fail", reason: `engine state is "${input.core.state}"` };
-  }
-  if (input.stalled) {
-    return { status: "fail", reason: "tick loop stalled" };
-  }
-  if (input.mqttEnabled && !input.mqttConnected) {
-    return { status: "fail", reason: "mqtt disconnected" };
-  }
-  if (input.opcuaEnabled && !input.opcuaConnected) {
-    return { status: "fail", reason: "opcua disconnected" };
-  }
-  return { status: "ok" };
-}
-
-function commandValidationErrorResponse(
-  commandType: string,
-  correlationId: string | undefined,
-  issues: string,
-): Response {
-  return jsonResponse(
-    {
-      success: false,
-      command: commandType,
-      correlationId,
-      message: `Command validation failed: ${issues}`,
-      error:
-        "Check the command shape. Required: { type, ...fields }. See documentation for valid command types.",
-    },
-    400,
-  );
-}
-
-function extractCorrelationId(payload: unknown): string | undefined {
-  if (typeof payload !== "object" || payload === null) {
-    return undefined;
-  }
-  const maybeCorrelationId = (payload as Record<string, unknown>)["correlationId"];
-  return typeof maybeCorrelationId === "string" ? maybeCorrelationId : undefined;
-}
-
-function extractCommandType(payload: unknown): string {
-  if (typeof payload !== "object" || payload === null) {
-    return "unknown";
-  }
-  const maybeType = (payload as Record<string, unknown>)["type"];
-  return typeof maybeType === "string" ? maybeType : "unknown";
-}
-
-function buildHealthBody(input: {
-  readonly metrics: { readonly core: EngineCoreMetrics };
-  readonly stalled: boolean;
-  readonly mqttEnabled: boolean;
-  readonly mqttConnected: boolean;
-  readonly opcuaEnabled: boolean;
-  readonly opcuaConnected: boolean;
-}): Omit<HealthResponseBody, "status" | "reason"> {
-  return {
-    simulationState: input.metrics.core.state,
-    tickCount: input.metrics.core.tickCount,
-    mqttEnabled: input.mqttEnabled,
-    mqttConnected: input.mqttEnabled ? input.mqttConnected : null,
-    opcuaEnabled: input.opcuaEnabled,
-    opcuaConnected: input.opcuaEnabled ? input.opcuaConnected : null,
-    stalled: input.stalled,
-  };
-}
-
-async function parseCommandRequest(request: Request): Promise<Response | EngineCommand> {
-  let payload: unknown;
-  try {
-    payload = await request.json();
-  } catch {
-    return jsonResponse(
-      {
-        message: "Invalid JSON in command request body.",
-        error: 'Send a valid JSON object. Example: {"type":"pause"}',
-      } satisfies AdminErrorResponse,
-      400,
-    );
-  }
-
-  const validation = EngineCommandSchema.safeParse(payload);
-  if (!validation.success) {
-    const issues = validation.error.issues
-      .map((issue) => `${issue.path.join(".")}: ${issue.message}`)
-      .join("; ");
-    return commandValidationErrorResponse(
-      extractCommandType(payload),
-      extractCorrelationId(payload),
-      issues,
-    );
-  }
-
-  return validation.data;
-}
-
 /**
  * Start the Miravo admin HTTP server.
  *
@@ -266,73 +163,42 @@ function startAdminServer(options: AdminServerOptions): AdminServerHandle {
   const { host, port } = options.network;
   const { getLastTickProgressAt } = options.protocols;
 
-  const adminToken = options.adminToken;
-  const isLoopback = host === "127.0.0.1" || host === "localhost" || host === "::1";
-  const isWildcard = host === "0.0.0.0" || host === "::";
-
-  /** Check bearer token on mutation endpoints. Returns error Response or null if OK. */
-  function checkAuth(request: Request): Response | null {
-    if (!adminToken) return null;
-    const authHeader = request.headers.get("authorization");
-    if (authHeader === `Bearer ${adminToken}`) return null;
-    return jsonResponse(
-      { message: "Unauthorized.", error: "Provide a valid Authorization: Bearer <token> header." },
-      401,
-    );
-  }
+  const { auth } = options;
 
-  /** Require an admin token for remote mutation endpoints. */
-  function checkRemoteMutationAuthConfigured(): Response | null {
-    if (isLoopback || adminToken) return null;
-    return jsonResponse(
-      {
-        message: "Mutation endpoints require authentication.",
-        error: "Set MIRAVO_ADMIN_TOKEN when binding to a non-loopback address.",
-      },
-      403,
-    );
+  function getSession(request: Request) {
+    const sessionId = extractSessionId(request);
+    return sessionId ? auth.sessionStore.validate(sessionId) : null;
   }
 
-  /**
-   * Require Content-Type: application/json on mutation endpoints.
-   * This forces cross-origin requests through a CORS preflight (since application/json
-   * is not a CORS-safe content type), which blocks form CSRF and no-cors fetch attacks.
-   */
-  function checkContentType(request: Request): Response | null {
-    const ct = request.headers.get("content-type");
-    if (ct && ct.split(";")[0]?.trim() === "application/json") return null;
-    return jsonResponse(
-      {
-        message: "Unsupported Media Type.",
-        error: "Content-Type must be application/json.",
-      },
-      415,
-    );
-  }
-
-  /** Check Origin header on mutation endpoints for non-loopback binds. Returns error Response or null if OK. */
-  function checkOrigin(request: Request): Response | null {
-    // Loopback and wildcard binds skip Origin checking — wildcard (0.0.0.0)
-    // accepts connections from any interface, so we can't match a specific host.
-    if (isLoopback || isWildcard) return null;
-    const origin = request.headers.get("origin");
-    if (!origin) return null; // No origin = non-browser client, allow
-    try {
-      const originHost = new URL(origin).hostname;
-      if (originHost === host || originHost === "localhost" || originHost === "127.0.0.1")
-        return null;
-    } catch {
-      // Malformed origin
+  /** Validate session cookie. Returns error Response or null if OK. */
+  function checkSession(request: Request): Response | null {
+    if (options.auth.anonymousMode) return null;
+    const session = getSession(request);
+    if (!session) {
+      const sessionId = extractSessionId(request);
+      if (!sessionId) {
+        return jsonResponse(
+          { message: "Unauthorized.", error: "Valid session required. Log in at /auth/login." },
+          401,
+        );
+      }
+      return jsonResponse(
+        { message: "Session expired.", error: "Log in again at /auth/login." },
+        401,
+      );
     }
-    return jsonResponse({ message: "Forbidden.", error: "Origin not allowed." }, 403);
+    return null;
   }
 
   // Create WebSocket hub if ws config is provided
   const wsHub = options.ws
     ? new WSHub({
         bus: options.ws.bus,
-        getEngineState: options.ws.getEngineState,
-        getTickInfo: options.ws.getTickInfo,
+        snapshotSource: {
+          getState: () => engine.getState(),
+          getMetrics: () => engine.getMetrics(),
+          getRunningTemplates: () => engine.getRunningTemplates(),
+        },
       })
     : null;
 
@@ -355,8 +221,8 @@ function startAdminServer(options: AdminServerOptions): AdminServerHandle {
         if (!wsHub) {
           return plainResponse("WebSocket not available", 503);
         }
-        const originBlock = checkOrigin(request);
-        if (originBlock) return originBlock;
+        const sessionBlock = checkSession(request);
+        if (sessionBlock) return sessionBlock;
         const upgraded = server.upgrade(request, {
           // WSClientData — Bun's untyped websocket generic requires the cast
           data: { channels: new Set(ALL_CHANNELS) } as unknown as undefined,
@@ -377,6 +243,8 @@ function startAdminServer(options: AdminServerOptions): AdminServerHandle {
         const metrics = engine.getMetrics();
 
         if (pathname === "/metrics") {
+          const metricsAuth = checkSession(request);
+          if (metricsAuth) return metricsAuth;
           return jsonResponse(metrics, 200);
         }
 
@@ -448,21 +316,65 @@ function startAdminServer(options: AdminServerOptions): AdminServerHandle {
         if (request.method !== "GET") {
           return plainResponse("Method Not Allowed", 405, "GET");
         }
+        const stateAuth = checkSession(request);
+        if (stateAuth) return stateAuth;
         return jsonResponse(engine.getState(), 200);
       }
 
+      if (pathname === "/bootstrap") {
+        if (request.method !== "GET") {
+          return plainResponse("Method Not Allowed", 405, "GET");
+        }
+        if (options.auth.anonymousMode) {
+          const runtime: RuntimeSnapshot = wsHub
+            ? wsHub.buildRuntimeSnapshot()
+            : (JSON.parse(
+                JSON.stringify({
+                  state: engine.getState(),
+                  metrics: engine.getMetrics(),
+                  runningTemplates: engine.getRunningTemplates(),
+                  revision: 0,
+                }),
+              ) as RuntimeSnapshot);
+          return jsonResponse(
+            {
+              authenticated: true,
+              username: "anonymous",
+              runtime,
+            } satisfies ConsoleBootstrapResponse,
+            200,
+          );
+        }
+        const session = getSession(request);
+        if (!session) {
+          return jsonResponse({ authenticated: false } satisfies ConsoleBootstrapResponse, 200);
+        }
+        const runtime: RuntimeSnapshot = wsHub
+          ? wsHub.buildRuntimeSnapshot()
+          : (JSON.parse(
+              JSON.stringify({
+                state: engine.getState(),
+                metrics: engine.getMetrics(),
+                runningTemplates: engine.getRunningTemplates(),
+                revision: 0,
+              }),
+            ) as RuntimeSnapshot);
+        const body: ConsoleBootstrapResponse = {
+          authenticated: true,
+          username: session.username,
+          runtime,
+        };
+        return jsonResponse(body, 200);
+      }
+
       if (pathname === "/commands") {
         if (request.method !== "POST") {
           return plainResponse("Method Not Allowed", 405, "POST");
         }
-        const authConfigBlock = checkRemoteMutationAuthConfigured();
-        if (authConfigBlock) return authConfigBlock;
+        const cmdAuth = checkSession(request);
+        if (cmdAuth) return cmdAuth;
         const ctBlock = checkContentType(request);
         if (ctBlock) return ctBlock;
-        const originBlock = checkOrigin(request);
-        if (originBlock) return originBlock;
-        const authBlock = checkAuth(request);
-        if (authBlock) return authBlock;
         const commandOrError = await parseCommandRequest(request);
         if (commandOrError instanceof Response) {
           return commandOrError;
@@ -484,14 +396,10 @@ function startAdminServer(options: AdminServerOptions): AdminServerHandle {
             501,
           );
         }
-        const authConfigBlock = checkRemoteMutationAuthConfigured();
-        if (authConfigBlock) return authConfigBlock;
+        const shutdownAuth = checkSession(request);
+        if (shutdownAuth) return shutdownAuth;
         const shutdownCtBlock = checkContentType(request);
         if (shutdownCtBlock) return shutdownCtBlock;
-        const originBlock = checkOrigin(request);
-        if (originBlock) return originBlock;
-        const authBlock = checkAuth(request);
-        if (authBlock) return authBlock;
 
         let reason = "remote shutdown request";
         try {
@@ -517,6 +425,8 @@ function startAdminServer(options: AdminServerOptions): AdminServerHandle {
         if (request.method !== "GET") {
           return plainResponse("Method Not Allowed", 405, "GET");
         }
+        const instanceAuth = checkSession(request);
+        if (instanceAuth) return instanceAuth;
         const instanceId = pathname.slice("/instances/".length);
         if (!instanceId) {
           return jsonResponse(
@@ -539,6 +449,8 @@ function startAdminServer(options: AdminServerOptions): AdminServerHandle {
         if (request.method !== "GET") {
           return plainResponse("Method Not Allowed", 405, "GET");
         }
+        const modelAuth = checkSession(request);
+        if (modelAuth) return modelAuth;
         const modelName = pathname.slice("/models/".length);
         if (!modelName) {
           return jsonResponse({ message: "Missing model name.", error: "Use /models/{name}" }, 400);
@@ -558,6 +470,8 @@ function startAdminServer(options: AdminServerOptions): AdminServerHandle {
         if (request.method !== "GET") {
           return plainResponse("Method Not Allowed", 405, "GET");
         }
+        const eventsAuth = checkSession(request);
+        if (eventsAuth) return eventsAuth;
         const typeParam = url.searchParams.get("type");
         if (typeParam && !VALID_EVENT_TYPES.has(typeParam)) {
           return jsonResponse(
@@ -583,11 +497,197 @@ function startAdminServer(options: AdminServerOptions): AdminServerHandle {
         return jsonResponse(engine.getEventLog(query), 200);
       }
 
+      // GET /catalog/models
+      if (pathname === "/catalog/models") {
+        if (request.method !== "GET") return plainResponse("Method Not Allowed", 405, "GET");
+        const auth = checkSession(request);
+        if (auth) return auth;
+        const models = options.getCatalogModels ? await options.getCatalogModels() : [];
+        return jsonResponse(models, 200);
+      }
+
+      // GET /catalog/models/:name/le-dt.json
+      if (pathname.startsWith("/catalog/models/") && pathname.endsWith("/le-dt.json")) {
+        if (request.method !== "GET") return plainResponse("Method Not Allowed", 405, "GET");
+        const auth = checkSession(request);
+        if (auth) return auth;
+        const name = decodeURIComponent(
+          pathname.slice("/catalog/models/".length, -"/le-dt.json".length),
+        );
+        if (
+          !name ||
+          name.includes("/") ||
+          name.includes("\\") ||
+          name.includes("..") ||
+          !options.getLeDtJson
+        )
+          return jsonResponse({ message: "Not found.", error: "Model not found." }, 404);
+        const leDtJson = await options.getLeDtJson(name);
+        if (!leDtJson)
+          return jsonResponse(
+            { message: `Model "${name}" not found.`, error: "Check the model name." },
+            404,
+          );
+        return jsonResponse(JSON.parse(leDtJson), 200);
+      }
+
+      // GET /catalog/models/:name/yaml
+      if (pathname.startsWith("/catalog/models/") && pathname.endsWith("/yaml")) {
+        if (request.method !== "GET") return plainResponse("Method Not Allowed", 405, "GET");
+        const auth = checkSession(request);
+        if (auth) return auth;
+        const name = decodeURIComponent(pathname.slice("/catalog/models/".length, -"/yaml".length));
+        if (
+          !name ||
+          name.includes("/") ||
+          name.includes("\\") ||
+          name.includes("..") ||
+          !options.getModelYaml
+        )
+          return jsonResponse({ message: "Not found.", error: "Model not found." }, 404);
+        const yaml = await options.getModelYaml(name);
+        if (!yaml)
+          return jsonResponse(
+            { message: `Model "${name}" not found.`, error: "Check the model name." },
+            404,
+          );
+        return yamlResponse(yaml, 200);
+      }
+
+      // GET /catalog/models/:name (schema)
+      if (pathname.startsWith("/catalog/models/")) {
+        if (request.method !== "GET") return plainResponse("Method Not Allowed", 405, "GET");
+        const auth = checkSession(request);
+        if (auth) return auth;
+        const name = decodeURIComponent(pathname.slice("/catalog/models/".length));
+        if (
+          !name ||
+          name.includes("/") ||
+          name.includes("\\") ||
+          name.includes("..") ||
+          !options.getCatalogModelSchema
+        )
+          return jsonResponse({ message: "Not found.", error: "Model not found." }, 404);
+        const schema = await options.getCatalogModelSchema(name);
+        if (!schema)
+          return jsonResponse(
+            { message: `Model "${name}" not found.`, error: "Check the model name." },
+            404,
+          );
+        return jsonResponse(schema, 200);
+      }
+
+      // GET /catalog/templates/:id/le-template.json and /le-tags.csv
+      if (
+        pathname.startsWith("/catalog/templates/") &&
+        (pathname.endsWith("/le-template.json") || pathname.endsWith("/le-tags.csv"))
+      ) {
+        if (request.method !== "GET") return plainResponse("Method Not Allowed", 405, "GET");
+        const auth = checkSession(request);
+        if (auth) return auth;
+        const isJson = pathname.endsWith("/le-template.json");
+        const suffix = isJson ? "/le-template.json" : "/le-tags.csv";
+        const id = decodeURIComponent(pathname.slice("/catalog/templates/".length, -suffix.length));
+        const host = url.searchParams.get("host")?.trim() ?? "";
+        const protocolParam = url.searchParams.get("protocol") ?? undefined;
+        if (
+          !id ||
+          id.includes("/") ||
+          id.includes("\\") ||
+          id.includes("..") ||
+          !options.getLeExport
+        )
+          return jsonResponse({ message: "Not found.", error: "Template not found." }, 404);
+        if (!host) {
+          return jsonResponse(
+            {
+              message: "Missing host query parameter.",
+              error: "Provide ?host=<hostname-or-ip> reachable from Litmus Edge.",
+            },
+            400,
+          );
+        }
+        const result = await options.getLeExport(id, {
+          host,
+          protocol: protocolParam as import("@miravo/shared").ProtocolName | undefined,
+        });
+        if (!result)
+          return jsonResponse(
+            { message: `Template "${id}" not found.`, error: "Check the template ID." },
+            404,
+          );
+        return isJson
+          ? new Response(result.templateJson, {
+              status: 200,
+              headers: {
+                "content-type": "application/json",
+                "content-disposition": `attachment; filename="${id}.le-template.json"`,
+              },
+            })
+          : new Response(result.tagsCSV, {
+              status: 200,
+              headers: {
+                "content-type": "text/csv",
+                "content-disposition": `attachment; filename="${id}-tags.csv"`,
+              },
+            });
+      }
+
+      // GET /catalog/templates/:id/yaml
+      if (pathname.startsWith("/catalog/templates/") && pathname.endsWith("/yaml")) {
+        if (request.method !== "GET") return plainResponse("Method Not Allowed", 405, "GET");
+        const auth = checkSession(request);
+        if (auth) return auth;
+        const id = decodeURIComponent(
+          pathname.slice("/catalog/templates/".length, -"/yaml".length),
+        );
+        if (
+          !id ||
+          id.includes("/") ||
+          id.includes("\\") ||
+          id.includes("..") ||
+          !options.getTemplateYaml
+        )
+          return jsonResponse({ message: "Not found.", error: "Template not found." }, 404);
+        const yaml = await options.getTemplateYaml(id);
+        if (!yaml)
+          return jsonResponse(
+            { message: `Template "${id}" not found.`, error: "Check the template ID." },
+            404,
+          );
+        return yamlResponse(yaml, 200);
+      }
+
+      // GET /catalog/templates/:id (detail with topology)
+      if (pathname.startsWith("/catalog/templates/") && pathname !== "/catalog/templates") {
+        if (request.method !== "GET") return plainResponse("Method Not Allowed", 405, "GET");
+        const auth = checkSession(request);
+        if (auth) return auth;
+        const id = decodeURIComponent(pathname.slice("/catalog/templates/".length));
+        if (
+          !id ||
+          id.includes("/") ||
+          id.includes("\\") ||
+          id.includes("..") ||
+          !options.getTemplateDetail
+        )
+          return jsonResponse({ message: "Not found.", error: "Template not found." }, 404);
+        const detail = await options.getTemplateDetail(id);
+        if (!detail)
+          return jsonResponse(
+            { message: `Template "${id}" not found.`, error: "Check the template ID." },
+            404,
+          );
+        return jsonResponse(detail, 200);
+      }
+
       // GET /catalog/templates
       if (pathname === "/catalog/templates") {
         if (request.method !== "GET") {
           return plainResponse("Method Not Allowed", 405, "GET");
         }
+        const catalogAuth = checkSession(request);
+        if (catalogAuth) return catalogAuth;
         const catalog = options.getCatalog ? options.getCatalog() : [];
         return jsonResponse(catalog, 200);
       }
@@ -597,9 +697,55 @@ function startAdminServer(options: AdminServerOptions): AdminServerHandle {
         if (request.method !== "GET") {
           return plainResponse("Method Not Allowed", 405, "GET");
         }
+        const rtAuth = checkSession(request);
+        if (rtAuth) return rtAuth;
         return jsonResponse(engine.getRunningTemplates(), 200);
       }
 
+      // GET /manifest
+      if (pathname === "/manifest") {
+        if (request.method !== "GET") {
+          return plainResponse("Method Not Allowed", 405, "GET");
+        }
+        const manifestAuth = checkSession(request);
+        if (manifestAuth) return manifestAuth;
+        return jsonResponse(engine.getManifest(), 200);
+      }
+
+      // --- Auth routes ---
+
+      if (pathname === "/auth/login" && request.method === "POST") {
+        return handleLogin(request, auth);
+      }
+
+      if (pathname === "/auth/logout" && request.method === "POST") {
+        return handleLogout(request, auth);
+      }
+
+      if (pathname === "/auth/password" && request.method === "PUT") {
+        const pwAuth = checkSession(request);
+        if (pwAuth) return pwAuth;
+        return handlePasswordChange(request, auth);
+      }
+
+      if (pathname === "/auth/status") {
+        if (request.method !== "GET") {
+          return plainResponse("Method Not Allowed", 405, "GET");
+        }
+        return handleAuthStatus(request, auth);
+      }
+
+      // --- Platform routes (LE apply/cleanup) ---
+      if (pathname.startsWith("/platforms/")) {
+        const platformResponse = await handlePlatformRoute(
+          pathname,
+          request,
+          checkSession,
+          options.eventLog,
+        );
+        if (platformResponse) return platformResponse;
+      }
+
       // --- Console static file serving ---
       if (consoleIndexFile && consoleDir) {
         if (pathname !== "/") {
@@ -641,18 +787,11 @@ function startAdminServer(options: AdminServerOptions): AdminServerHandle {
     endpoint: `http://${host}:${server.port}`,
     wsHub,
     stop() {
+      auth.sessionStore.clear();
       wsHub?.close();
       server.stop(true);
     },
   };
 }
 
-export type {
-  AdminEngine,
-  AdminServerHandle,
-  AdminServerNetworkOptions,
-  AdminServerOptions,
-  AdminServerProtocolOptions,
-  AdminServerWSOptions,
-};
 export { startAdminServer };