neoagent 2.4.1-beta.45 → 2.4.1-beta.47

package/.env.example

@@ -2,6 +2,18 @@
 # Core runtime
 ########################################
 
+# Admin dashboard credentials — set during `neoagent setup`.
+# Access the dashboard at http://localhost:<PORT>/admin
+# Run `neoagent admin` to display these credentials at any time.
+ADMIN_USERNAME=admin
+ADMIN_PASSWORD=
+
+# Admin API key for programmatic access to /admin/api/* endpoints.
+# Use: Authorization: Bearer <key>
+# Generate or rotate via the admin dashboard → Access → Generate key.
+# Leave blank to disable API key auth (dashboard session auth still works).
+ADMIN_API_KEY=
+
 PORT=3333
 NODE_ENV=production
 # Auto-generated on first start or setup if left blank.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neoagent",
-  "version": "2.4.1-beta.45",
+  "version": "2.4.1-beta.47",
   "description": "Proactive personal AI agent with no limits",
   "license": "AGPL-3.0-only",
   "main": "server/index.js",

package/server/admin/access.js

@@ -0,0 +1,198 @@
+'use strict';
+
+// ── Access Settings ────────────────────────────────────────────────────────
+
+let _revealedKey = null; // holds the API key shown after rotation (one-time)
+let _revealTimer  = null;
+
+async function loadAccess() {
+  const el = document.getElementById('access-content');
+  if (!el) return;
+  try {
+    const data = await api('/admin/api/settings').then((r) => r.json());
+    renderAccess(el, data);
+  } catch (err) {
+    if (err.message !== 'unauthorized') el.innerHTML = '<div class="empty">Failed to load settings</div>';
+  }
+}
+
+function renderAccess(el, { signupEnabled, apiKeyConfigured, apiKeyHint }) {
+  el.innerHTML = `
+    <!-- Signup -->
+    <div class="card">
+      <div class="card-title">User Signups</div>
+      <div class="access-row">
+        <div>
+          <div class="access-label">Allow new registrations</div>
+          <div class="access-desc">
+            When disabled, only existing users can log in. The first account can always be created regardless of this setting.
+          </div>
+        </div>
+        <label class="toggle" aria-label="Toggle signups">
+          <input type="checkbox" id="signup-toggle" ${signupEnabled ? 'checked' : ''}
+            onchange="setSignup(this.checked)">
+          <span class="toggle-track"></span>
+          <span class="toggle-thumb"></span>
+        </label>
+      </div>
+      <div id="signup-status" class="access-status"></div>
+    </div>
+
+    <!-- API key -->
+    <div class="card">
+      <div class="card-title">Admin API Key</div>
+      <div class="access-row">
+        <div>
+          <div class="access-label">Programmatic access</div>
+          <div class="access-desc">
+            Use <code>Authorization: Bearer &lt;key&gt;</code> to authenticate against any <code>/admin/api/*</code> endpoint from scripts or automation — without a browser session.
+          </div>
+        </div>
+        <span class="badge ${apiKeyConfigured ? 'badge-ok' : 'badge-idle'}">
+          ${apiKeyConfigured ? 'configured' : 'not set'}
+        </span>
+      </div>
+
+      ${apiKeyConfigured ? `
+        <div class="access-hint-row">
+          <code class="api-key-hint">${esc(apiKeyHint)}</code>
+          <span style="font-size:11px;color:var(--text-muted);">stored in .env — rotate to reveal</span>
+        </div>` : ''}
+
+      <div id="key-reveal-wrap" style="display:none;">
+        <div class="key-reveal-box">
+          <div style="font-size:11px;color:var(--text-muted);margin-bottom:6px;">
+            New API key — copy it now. It will not be shown again.
+          </div>
+          <div style="display:flex;align-items:center;gap:8px;">
+            <code id="key-reveal-value" class="api-key-full"></code>
+            <button class="btn btn-ghost" style="padding:5px 10px;font-size:11px;flex-shrink:0;"
+              onclick="copyApiKey()">Copy</button>
+          </div>
+          <div style="margin-top:8px;font-size:11px;color:var(--text-muted);" id="key-reveal-timer"></div>
+        </div>
+      </div>
+
+      <div class="access-actions">
+        <button class="btn btn-ghost" onclick="rotateApiKey(this)">
+          ${apiKeyConfigured ? 'Rotate key' : 'Generate key'}
+        </button>
+        ${apiKeyConfigured ? `
+          <button class="btn btn-danger" onclick="revokeApiKey(this)">Revoke key</button>` : ''}
+      </div>
+      <div id="apikey-status" class="access-status"></div>
+    </div>`;
+
+  // If we rotated in this page load, re-show the key
+  if (_revealedKey) showReveal(_revealedKey);
+}
+
+async function setSignup(enabled) {
+  const statusEl = document.getElementById('signup-status');
+  if (statusEl) statusEl.textContent = '';
+  try {
+    const res = await api('/admin/api/settings/signup', {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ enabled }),
+    });
+    if (res.ok) {
+      showStatus('signup-status', enabled ? 'Signups enabled.' : 'Signups disabled.', false);
+    } else {
+      const b = await res.json().catch(() => ({}));
+      showStatus('signup-status', b.error || 'Failed to update', true);
+      // Revert the toggle
+      const toggle = document.getElementById('signup-toggle');
+      if (toggle) toggle.checked = !enabled;
+    }
+  } catch (err) {
+    if (err.message !== 'unauthorized') showStatus('signup-status', 'Network error', true);
+    const toggle = document.getElementById('signup-toggle');
+    if (toggle) toggle.checked = !enabled;
+  }
+}
+
+async function rotateApiKey(btn) {
+  if (!confirm(
+    'Rotate admin API key?\n\n' +
+    'The current key will stop working immediately.\n' +
+    'Any scripts using it must be updated.\n\n' +
+    'The new key will be shown once — copy it before leaving.'
+  )) return;
+  btn.disabled = true;
+  btn.textContent = 'Rotating…';
+  try {
+    const res = await api('/admin/api/settings/apikey/rotate', { method: 'POST' });
+    const data = await res.json();
+    if (res.ok && data.apiKey) {
+      _revealedKey = data.apiKey;
+      await loadAccess(); // re-render to show badge + hint
+    } else {
+      showStatus('apikey-status', data.error || 'Failed to rotate', true);
+      btn.disabled = false;
+      btn.textContent = 'Rotate key';
+    }
+  } catch (err) {
+    if (err.message !== 'unauthorized') showStatus('apikey-status', 'Network error', true);
+    btn.disabled = false;
+    btn.textContent = 'Rotate key';
+  }
+}
+
+async function revokeApiKey(btn) {
+  if (!confirm('Revoke admin API key?\n\nAll programmatic access using this key will stop immediately.')) return;
+  btn.disabled = true;
+  btn.textContent = 'Revoking…';
+  _revealedKey = null;
+  try {
+    const res = await api('/admin/api/settings/apikey', { method: 'DELETE' });
+    if (res.ok) {
+      await loadAccess();
+    } else {
+      const b = await res.json().catch(() => ({}));
+      showStatus('apikey-status', b.error || 'Failed', true);
+      btn.disabled = false;
+      btn.textContent = 'Revoke key';
+    }
+  } catch (err) {
+    if (err.message !== 'unauthorized') showStatus('apikey-status', 'Network error', true);
+    btn.disabled = false;
+    btn.textContent = 'Revoke key';
+  }
+}
+
+function copyApiKey() {
+  if (_revealedKey) navigator.clipboard.writeText(_revealedKey).catch(() => {});
+}
+
+function showReveal(key) {
+  const wrap  = document.getElementById('key-reveal-wrap');
+  const value = document.getElementById('key-reveal-value');
+  if (!wrap || !value) return;
+  value.textContent = key;
+  wrap.style.display = 'block';
+  // Auto-clear after 120 seconds
+  clearTimeout(_revealTimer);
+  let secs = 120;
+  const timerEl = document.getElementById('key-reveal-timer');
+  const tick = () => {
+    if (!timerEl) return;
+    if (secs <= 0) {
+      wrap.style.display = 'none';
+      _revealedKey = null;
+      return;
+    }
+    timerEl.textContent = `Hides in ${secs}s`;
+    secs--;
+    _revealTimer = setTimeout(tick, 1000);
+  };
+  tick();
+}
+
+function showStatus(id, msg, isError) {
+  const el = document.getElementById(id);
+  if (!el) return;
+  el.textContent = msg;
+  el.style.color = isError ? 'var(--danger)' : 'var(--success)';
+  setTimeout(() => { if (el) el.textContent = ''; }, 4000);
+}

package/server/admin/admin.js

@@ -16,7 +16,7 @@ function showPage(page, btn) {
   if (btn) btn.classList.add('active');
   currentPage = page;
 
-  const loaders = { overview: loadHealth, logs: loadLogs, updates: loadVersion, config: loadConfig, providers: loadProviders };
+  const loaders = { overview: loadHealth, logs: loadLogs, updates: loadVersion, config: loadConfig, providers: loadProviders, analytics: loadAnalytics, users: loadUsers, sql: loadSql, access: loadAccess };
   loaders[page]?.();
 }
 
@@ -37,7 +37,7 @@ async function api(path, opts = {}) {
 }
 
 function esc(str) {
-  return String(str ?? '').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
+  return String(str ?? '').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
 }
 
 function fmtTime(iso) {

package/server/admin/analytics.js

@@ -0,0 +1,128 @@
+'use strict';
+
+// ── Analytics ─────────────────────────────────────────────────────────────
+
+async function loadAnalytics() {
+  const el = document.getElementById('analytics-content');
+  if (!el) return;
+  el.innerHTML = '<div class="empty"><span class="spinner"></span></div>';
+  try {
+    const data = await api('/admin/api/analytics').then((r) => r.json());
+    renderAnalytics(el, data);
+    setTs('analytics-ts', 'Updated');
+  } catch (err) {
+    if (err.message !== 'unauthorized') el.innerHTML = '<div class="empty">Failed to load analytics</div>';
+  }
+}
+
+function renderAnalytics(el, { stats, topUsers, recentRuns }) {
+  const s = stats || {};
+  el.innerHTML = `
+    <div class="stat-grid">
+      <div class="stat-card">
+        <div class="stat-value">${fmtNum(s.totalUsers)}</div>
+        <div class="stat-label">Total Users</div>
+      </div>
+      <div class="stat-card">
+        <div class="stat-value">${fmtNum(s.activeToday)}</div>
+        <div class="stat-label">Active Today</div>
+      </div>
+      <div class="stat-card">
+        <div class="stat-value">${fmtNum(s.newThisWeek)}</div>
+        <div class="stat-label">New This Week</div>
+      </div>
+      <div class="stat-card">
+        <div class="stat-value">${fmtNum(s.totalRuns)}</div>
+        <div class="stat-label">Total Runs</div>
+      </div>
+      <div class="stat-card">
+        <div class="stat-value">${fmtNum(s.runsToday)}</div>
+        <div class="stat-label">Runs Today</div>
+      </div>
+      <div class="stat-card">
+        <div class="stat-value">${fmtTokens(s.totalTokens)}</div>
+        <div class="stat-label">Total Tokens</div>
+      </div>
+      <div class="stat-card">
+        <div class="stat-value">${fmtNum(s.activeSessions)}</div>
+        <div class="stat-label">Active Sessions</div>
+      </div>
+      <div class="stat-card">
+        <div class="stat-value">${fmtBytes(s.totalStorage)}</div>
+        <div class="stat-label">Artifact Storage</div>
+      </div>
+    </div>
+
+    ${renderTopUsers(topUsers || [])}
+    ${renderRecentRuns(recentRuns || [])}
+  `;
+}
+
+function renderTopUsers(users) {
+  if (!users.length) return '';
+  const maxRuns = Math.max(...users.map((u) => u.runs), 1);
+  return `
+    <div class="card" style="margin-top:20px;">
+      <div class="card-title">Top Users by Runs</div>
+      <table class="analytics-table">
+        <thead><tr>
+          <th>User</th><th>Runs</th><th>Tokens</th><th>Storage</th><th>Activity</th>
+        </tr></thead>
+        <tbody>${users.map((u) => `
+          <tr>
+            <td><span class="user-avatar">${esc((u.display_name || u.username || '?')[0]).toUpperCase()}</span> ${esc(u.display_name || u.username)}</td>
+            <td>${fmtNum(u.runs)}</td>
+            <td>${fmtTokens(u.tokens)}</td>
+            <td>${fmtBytes(u.storage)}</td>
+            <td>
+              <div class="mini-bar"><div class="mini-bar-fill" style="width:${Math.round((u.runs / maxRuns) * 100)}%"></div></div>
+            </td>
+          </tr>`).join('')}
+        </tbody>
+      </table>
+    </div>`;
+}
+
+function renderRecentRuns(runs) {
+  if (!runs.length) return '';
+  return `
+    <div class="card" style="margin-top:16px;">
+      <div class="card-title">Recent Runs</div>
+      <table class="analytics-table">
+        <thead><tr>
+          <th>User</th><th>Title</th><th>Status</th><th>Tokens</th><th>Started</th>
+        </tr></thead>
+        <tbody>${runs.map((r) => `
+          <tr>
+            <td>${esc(r.username)}</td>
+            <td class="cell-truncate">${esc(r.title || '(untitled)')}</td>
+            <td><span class="run-badge run-${esc(r.status)}">${esc(r.status)}</span></td>
+            <td>${fmtTokens(r.total_tokens)}</td>
+            <td>${fmtTime(r.created_at)}</td>
+          </tr>`).join('')}
+        </tbody>
+      </table>
+    </div>`;
+}
+
+// ── Shared number helpers (also used by other modules) ────────────────────
+
+function fmtNum(n) {
+  if (n == null) return '—';
+  return Number(n).toLocaleString();
+}
+
+function fmtTokens(n) {
+  if (!n) return '0';
+  if (n >= 1_000_000) return (n / 1_000_000).toFixed(1) + 'M';
+  if (n >= 1_000)     return (n / 1_000).toFixed(1) + 'K';
+  return String(n);
+}
+
+function fmtBytes(n) {
+  if (!n) return '0 B';
+  if (n >= 1_073_741_824) return (n / 1_073_741_824).toFixed(1) + ' GB';
+  if (n >= 1_048_576)     return (n / 1_048_576).toFixed(1) + ' MB';
+  if (n >= 1_024)         return (n / 1_024).toFixed(1) + ' KB';
+  return n + ' B';
+}