palaryn 0.1.0

package/dist/tests/unit/admin.test.js

@@ -0,0 +1,698 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const supertest_1 = __importDefault(require("supertest"));
+const express_1 = __importDefault(require("express"));
+const admin_1 = require("../../src/admin");
+const gateway_1 = require("../../src/server/gateway");
+// ---------------------------------------------------------------------------
+// Test config factory
+// ---------------------------------------------------------------------------
+function createTestConfig() {
+    return {
+        port: 0,
+        host: '127.0.0.1',
+        auth: {
+            enabled: false,
+            api_keys: {
+                'test-key-001': { workspace_id: 'ws_test', description: 'Test key' },
+                'test-key-002': { workspace_id: 'ws_other', description: 'Other key', revoked: true },
+            },
+        },
+        policy: {
+            pack_path: './policy-packs/dev_fast.yaml',
+            default_effect: 'DENY',
+            hot_reload: false,
+        },
+        dlp: {
+            enabled: true,
+            scan_args: true,
+            scan_output: true,
+            secrets_detection: true,
+            pii_detection: true,
+            default_redaction_method: 'mask',
+        },
+        budget: {
+            task_budget_usd: 2.0,
+            user_daily_budget_usd: 50.0,
+            user_monthly_budget_usd: 500.0,
+            workspace_daily_budget_usd: 200.0,
+            workspace_monthly_budget_usd: 5000.0,
+            max_steps_per_task: 50,
+            max_retries_per_call: 3,
+            max_wall_clock_ms: 300000,
+        },
+        audit: {
+            enabled: true,
+            log_dir: '',
+            console_output: false,
+            retention_days: 30,
+        },
+        executor: {
+            http: {
+                timeout_ms: 5000,
+                max_retries: 1,
+                backoff_base_ms: 100,
+            },
+            cache: {
+                enabled: true,
+                ttl_ms: 60000,
+            },
+        },
+        approval: {
+            enabled: true,
+            token_secret: 'test-admin-secret',
+            default_ttl_seconds: 3600,
+        },
+        rate_limit: {
+            enabled: false,
+            actor_max_per_window: 100,
+            workspace_max_per_window: 500,
+            window_ms: 60000,
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Setup: create an Express app with just the admin router
+// ---------------------------------------------------------------------------
+let app;
+let gateway;
+let config;
+beforeEach(() => {
+    config = createTestConfig();
+    gateway = new gateway_1.Gateway(config);
+    app = (0, express_1.default)();
+    app.use(express_1.default.json());
+    const adminRouter = (0, admin_1.createAdminRouter)(gateway, config);
+    app.use('/admin', adminRouter);
+});
+afterEach(() => {
+    gateway.shutdown();
+});
+// ---------------------------------------------------------------------------
+// Helper: create a pending approval via the Gateway
+// ---------------------------------------------------------------------------
+function createPendingApproval() {
+    const approvalManager = gateway.getApprovalManager();
+    const { approval } = approvalManager.createApproval({
+        tool_call_id: 'tc-test-001',
+        task_id: 'task-test-001',
+        workspace_id: 'ws_test',
+        actor: { id: 'user-1', type: 'user' },
+        tool: { name: 'http.request', version: '1.0', capability: 'write' },
+        args: { method: 'POST', url: 'https://api.example.com/data' },
+        source: { platform: 'test' },
+        timestamp: new Date().toISOString(),
+    }, 'admin', 'Requires admin approval');
+    return approval.approval_id;
+}
+// ---------------------------------------------------------------------------
+// Helper: extract CSRF token from HTML response
+// ---------------------------------------------------------------------------
+function extractCSRFToken(html) {
+    const match = html.match(/name="_csrf"\s+value="([^"]+)"/);
+    return match ? match[1] : '';
+}
+// ---------------------------------------------------------------------------
+// Helper: add some audit events via the Gateway
+// ---------------------------------------------------------------------------
+function seedAuditEvents() {
+    const auditLogger = gateway.getAuditLogger();
+    auditLogger.log({
+        event_type: 'TOOL_CALL_RECEIVED',
+        tool_call_id: 'tc-1',
+        task_id: 'task-1',
+        workspace_id: 'ws_test',
+        actor_id: 'user-1',
+        tool_name: 'http.request',
+        metadata: {},
+    });
+    auditLogger.log({
+        event_type: 'POLICY_DECIDED',
+        tool_call_id: 'tc-1',
+        task_id: 'task-1',
+        workspace_id: 'ws_test',
+        actor_id: 'user-1',
+        tool_name: 'http.request',
+        metadata: { decision: 'allow' },
+    });
+    auditLogger.log({
+        event_type: 'TOOL_EXECUTED',
+        tool_call_id: 'tc-1',
+        task_id: 'task-1',
+        workspace_id: 'ws_test',
+        actor_id: 'user-1',
+        tool_name: 'http.request',
+        metadata: { status: 'ok', duration_ms: 42 },
+    });
+}
+// ===========================================================================
+// Dashboard
+// ===========================================================================
+describe('Admin Dashboard', () => {
+    test('GET /admin returns 200 with HTML containing "Palaryn Admin"', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Palaryn Admin');
+        expect(res.text).toContain('Dashboard');
+        expect(res.text).toContain('Total Requests');
+    });
+    test('GET /admin shows correct stats', async () => {
+        seedAuditEvents();
+        const res = await (0, supertest_1.default)(app).get('/admin');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Total Requests');
+        // 1 TOOL_CALL_RECEIVED event
+        expect(res.text).toContain('>1<');
+    });
+    test('GET /admin shows recent events table when events exist', async () => {
+        seedAuditEvents();
+        const res = await (0, supertest_1.default)(app).get('/admin');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Recent Events');
+        expect(res.text).toContain('TOOL_EXECUTED');
+        expect(res.text).toContain('http.request');
+    });
+});
+// ===========================================================================
+// Approvals
+// ===========================================================================
+describe('Admin Approvals', () => {
+    test('GET /admin/approvals returns 200 with approvals table', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/approvals');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Palaryn Admin');
+        expect(res.text).toContain('Approvals');
+    });
+    test('GET /admin/approvals shows pending approvals', async () => {
+        createPendingApproval();
+        const res = await (0, supertest_1.default)(app).get('/admin/approvals');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('pending');
+        expect(res.text).toContain('http.request');
+        expect(res.text).toContain('Approve');
+        expect(res.text).toContain('Deny');
+    });
+    test('GET /admin/approvals shows "No pending approvals" when empty', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/approvals');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('No pending approvals');
+    });
+    test('POST /admin/approvals/:id/approve returns redirect', async () => {
+        const approvalId = createPendingApproval();
+        const getRes = await (0, supertest_1.default)(app).get('/admin/approvals');
+        const csrfToken = extractCSRFToken(getRes.text);
+        const res = await (0, supertest_1.default)(app)
+            .post(`/admin/approvals/${approvalId}/approve`)
+            .type('form')
+            .send({ _csrf: csrfToken });
+        expect(res.status).toBe(302);
+        expect(res.headers.location).toBe('/admin/approvals');
+    });
+    test('POST /admin/approvals/:id/approve resolves the approval', async () => {
+        const approvalId = createPendingApproval();
+        const getRes = await (0, supertest_1.default)(app).get('/admin/approvals');
+        const csrfToken = extractCSRFToken(getRes.text);
+        await (0, supertest_1.default)(app)
+            .post(`/admin/approvals/${approvalId}/approve`)
+            .type('form')
+            .send({ _csrf: csrfToken });
+        const approval = gateway.getApprovalManager().getApproval(approvalId);
+        expect(approval).not.toBeNull();
+        expect(approval.status).toBe('approved');
+    });
+    test('POST /admin/approvals/:id/deny returns redirect', async () => {
+        const approvalId = createPendingApproval();
+        const getRes = await (0, supertest_1.default)(app).get('/admin/approvals');
+        const csrfToken = extractCSRFToken(getRes.text);
+        const res = await (0, supertest_1.default)(app)
+            .post(`/admin/approvals/${approvalId}/deny`)
+            .type('form')
+            .send({ _csrf: csrfToken });
+        expect(res.status).toBe(302);
+        expect(res.headers.location).toBe('/admin/approvals');
+    });
+    test('POST /admin/approvals/:id/deny resolves the approval as denied', async () => {
+        const approvalId = createPendingApproval();
+        const getRes = await (0, supertest_1.default)(app).get('/admin/approvals');
+        const csrfToken = extractCSRFToken(getRes.text);
+        await (0, supertest_1.default)(app)
+            .post(`/admin/approvals/${approvalId}/deny`)
+            .type('form')
+            .send({ _csrf: csrfToken });
+        const approval = gateway.getApprovalManager().getApproval(approvalId);
+        expect(approval).not.toBeNull();
+        expect(approval.status).toBe('denied');
+    });
+    test('POST /admin/approvals/:id/approve with invalid id still redirects', async () => {
+        // Create a real approval so the page renders forms with CSRF tokens
+        createPendingApproval();
+        const getRes = await (0, supertest_1.default)(app).get('/admin/approvals');
+        const csrfToken = extractCSRFToken(getRes.text);
+        const res = await (0, supertest_1.default)(app)
+            .post('/admin/approvals/nonexistent/approve')
+            .type('form')
+            .send({ _csrf: csrfToken });
+        expect(res.status).toBe(302);
+        expect(res.headers.location).toBe('/admin/approvals');
+    });
+    test('POST /admin/approvals/:id/approve without CSRF token returns 403', async () => {
+        const approvalId = createPendingApproval();
+        const res = await (0, supertest_1.default)(app)
+            .post(`/admin/approvals/${approvalId}/approve`)
+            .send('');
+        expect(res.status).toBe(403);
+        expect(res.text).toContain('Invalid or missing CSRF token');
+    });
+});
+// ===========================================================================
+// Policies
+// ===========================================================================
+describe('Admin Policies', () => {
+    test('GET /admin/policies returns 200 with policy content', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/policies');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Palaryn Admin');
+        expect(res.text).toContain('Policies');
+        expect(res.text).toContain('Active Policy Pack');
+        expect(res.text).toContain('Validate Policy');
+    });
+    test('GET /admin/policies shows the loaded policy pack name', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/policies');
+        expect(res.status).toBe(200);
+        // The dev_fast.yaml policy pack has a name field
+        const policy = gateway.getCurrentPolicy();
+        expect(res.text).toContain(policy.name);
+    });
+    test('POST /admin/policies/validate returns result for valid policy', async () => {
+        const getRes = await (0, supertest_1.default)(app).get('/admin/policies');
+        const csrfToken = extractCSRFToken(getRes.text);
+        const validPolicy = JSON.stringify({
+            name: 'test-policy',
+            version: '1.0',
+            rules: [
+                {
+                    name: 'allow-all',
+                    effect: 'ALLOW',
+                    priority: 100,
+                    conditions: {},
+                },
+            ],
+        });
+        const res = await (0, supertest_1.default)(app)
+            .post('/admin/policies/validate')
+            .type('form')
+            .send({ _csrf: csrfToken, policy_json: validPolicy });
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Policy is valid');
+    });
+    test('POST /admin/policies/validate returns errors for invalid policy', async () => {
+        const getRes = await (0, supertest_1.default)(app).get('/admin/policies');
+        const csrfToken = extractCSRFToken(getRes.text);
+        const invalidPolicy = JSON.stringify({
+            name: '',
+            version: '',
+            rules: [],
+        });
+        const res = await (0, supertest_1.default)(app)
+            .post('/admin/policies/validate')
+            .type('form')
+            .send({ _csrf: csrfToken, policy_json: invalidPolicy });
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Validation errors');
+    });
+    test('POST /admin/policies/validate handles malformed JSON', async () => {
+        const getRes = await (0, supertest_1.default)(app).get('/admin/policies');
+        const csrfToken = extractCSRFToken(getRes.text);
+        const res = await (0, supertest_1.default)(app)
+            .post('/admin/policies/validate')
+            .type('form')
+            .send({ _csrf: csrfToken, policy_json: '{not valid json' });
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Validation errors');
+    });
+    test('POST /admin/policies/validate without CSRF token returns 403', async () => {
+        const res = await (0, supertest_1.default)(app)
+            .post('/admin/policies/validate')
+            .type('form')
+            .send({ policy_json: '{}' });
+        expect(res.status).toBe(403);
+        expect(res.text).toContain('Invalid or missing CSRF token');
+    });
+    test('GET /admin/policies shows reload button', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/policies');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Reload from Disk');
+        expect(res.text).toContain('/admin/policies/reload');
+    });
+    test('POST /admin/policies/reload reloads policy and redirects', async () => {
+        const getRes = await (0, supertest_1.default)(app).get('/admin/policies');
+        const csrfToken = extractCSRFToken(getRes.text);
+        const res = await (0, supertest_1.default)(app)
+            .post('/admin/policies/reload')
+            .type('form')
+            .send({ _csrf: csrfToken });
+        expect(res.status).toBe(302);
+        expect(res.headers.location).toContain('/admin/policies?reloaded=1');
+        expect(res.headers.location).toContain('rules%20active');
+    });
+    test('POST /admin/policies/reload without CSRF token returns 403', async () => {
+        const res = await (0, supertest_1.default)(app)
+            .post('/admin/policies/reload')
+            .type('form')
+            .send({});
+        expect(res.status).toBe(403);
+        expect(res.text).toContain('Invalid or missing CSRF token');
+    });
+});
+// ===========================================================================
+// Budgets
+// ===========================================================================
+describe('Admin Budgets', () => {
+    test('GET /admin/budgets returns 200', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/budgets');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Palaryn Admin');
+        expect(res.text).toContain('Budgets');
+    });
+    test('GET /admin/budgets shows configured budget limits', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/budgets');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Task Budget');
+        expect(res.text).toContain('User Daily Budget');
+        expect(res.text).toContain('User Monthly Budget');
+        expect(res.text).toContain('Workspace Daily Budget');
+        expect(res.text).toContain('Workspace Monthly Budget');
+    });
+    test('GET /admin/budgets shows budget limit values', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/budgets');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('$2.00'); // task_budget_usd
+        expect(res.text).toContain('$50.00'); // user_daily_budget_usd
+        expect(res.text).toContain('$500.00'); // user_monthly_budget_usd
+    });
+});
+// ===========================================================================
+// Traces
+// ===========================================================================
+describe('Admin Traces', () => {
+    test('GET /admin/traces returns 200', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/traces');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Palaryn Admin');
+        expect(res.text).toContain('Traces');
+        expect(res.text).toContain('Search Traces');
+    });
+    test('GET /admin/traces shows "No trace data" when empty', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/traces');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('No trace data available');
+    });
+    test('GET /admin/traces shows task IDs when events exist', async () => {
+        seedAuditEvents();
+        const res = await (0, supertest_1.default)(app).get('/admin/traces');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('task-1');
+    });
+    test('GET /admin/traces with task_id query redirects to detail', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/traces?task_id=task-1');
+        expect(res.status).toBe(302);
+        expect(res.headers.location).toBe('/admin/traces/task-1');
+    });
+    test('GET /admin/traces/:task_id returns trace detail', async () => {
+        seedAuditEvents();
+        const res = await (0, supertest_1.default)(app).get('/admin/traces/task-1');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('task-1');
+        expect(res.text).toContain('TOOL_CALL_RECEIVED');
+        expect(res.text).toContain('POLICY_DECIDED');
+        expect(res.text).toContain('TOOL_EXECUTED');
+    });
+    test('GET /admin/traces/:task_id shows "No events found" for unknown task', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/traces/nonexistent');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('No events found for this task');
+    });
+    test('GET /admin/traces/:task_id includes back link', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/traces/task-1');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Back to Traces');
+        expect(res.text).toContain('/admin/traces');
+    });
+});
+// ===========================================================================
+// API Keys
+// ===========================================================================
+describe('Admin API Keys', () => {
+    test('GET /admin/api-keys returns 200', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/api-keys');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Palaryn Admin');
+        expect(res.text).toContain('API Keys');
+    });
+    test('GET /admin/api-keys shows existing keys', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/api-keys');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('ws_test');
+        expect(res.text).toContain('Test key');
+        expect(res.text).toContain('ws_other');
+    });
+    test('GET /admin/api-keys shows revoked status', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/api-keys');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('revoked');
+        expect(res.text).toContain('active');
+    });
+    test('GET /admin/api-keys shows create form', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/api-keys');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Create New API Key');
+        expect(res.text).toContain('Workspace ID');
+    });
+    test('POST /admin/api-keys creates a key and redirects with created key', async () => {
+        const getRes = await (0, supertest_1.default)(app).get('/admin/api-keys');
+        const csrfToken = extractCSRFToken(getRes.text);
+        const keysBefore = Object.keys(config.auth.api_keys).length;
+        const res = await (0, supertest_1.default)(app)
+            .post('/admin/api-keys')
+            .type('form')
+            .send({ _csrf: csrfToken, workspace_id: 'ws_new', description: 'New test key' });
+        expect(res.status).toBe(302);
+        expect(res.headers.location).toMatch(/^\/admin\/api-keys\?created=key-/);
+        const keysAfter = Object.keys(config.auth.api_keys).length;
+        expect(keysAfter).toBe(keysBefore + 1);
+        // Find the new key
+        const newKey = Object.entries(config.auth.api_keys).find(([, v]) => v.workspace_id === 'ws_new' && v.description === 'New test key');
+        expect(newKey).toBeDefined();
+        expect(newKey[0]).toMatch(/^key-/);
+        expect(newKey[1].created_at).toBeDefined();
+    });
+    test('GET /admin/api-keys?created=key-xxx shows the new key alert', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/api-keys?created=key-abc123test');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('key-abc123test');
+        expect(res.text).toContain('Copy this key now');
+    });
+    test('POST /admin/api-keys/:key/revoke revokes and redirects', async () => {
+        const getRes = await (0, supertest_1.default)(app).get('/admin/api-keys');
+        const csrfToken = extractCSRFToken(getRes.text);
+        const res = await (0, supertest_1.default)(app)
+            .post('/admin/api-keys/test-key-001/revoke')
+            .type('form')
+            .send({ _csrf: csrfToken });
+        expect(res.status).toBe(302);
+        expect(res.headers.location).toBe('/admin/api-keys');
+        expect(config.auth.api_keys['test-key-001'].revoked).toBe(true);
+    });
+    test('POST /admin/api-keys/:key/revoke with unknown key still redirects', async () => {
+        const getRes = await (0, supertest_1.default)(app).get('/admin/api-keys');
+        const csrfToken = extractCSRFToken(getRes.text);
+        const res = await (0, supertest_1.default)(app)
+            .post('/admin/api-keys/nonexistent-key/revoke')
+            .type('form')
+            .send({ _csrf: csrfToken });
+        expect(res.status).toBe(302);
+        expect(res.headers.location).toBe('/admin/api-keys');
+    });
+    test('POST /admin/api-keys without CSRF token returns 403', async () => {
+        const res = await (0, supertest_1.default)(app)
+            .post('/admin/api-keys')
+            .type('form')
+            .send({ workspace_id: 'ws_new', description: 'New test key' });
+        expect(res.status).toBe(403);
+        expect(res.text).toContain('Invalid or missing CSRF token');
+    });
+});
+// ===========================================================================
+// Error Boundaries
+// ===========================================================================
+describe('Admin Error Boundaries', () => {
+    test('GET /admin returns 500 with error page when gateway throws', async () => {
+        // Force getAuditLogger to throw
+        const origMethod = gateway.getAuditLogger;
+        gateway.getAuditLogger = () => { throw new Error('Audit logger broken'); };
+        const res = await (0, supertest_1.default)(app).get('/admin');
+        expect(res.status).toBe(500);
+        expect(res.text).toContain('Failed to load dashboard');
+        expect(res.text).toContain('Audit logger broken');
+        // Restore
+        gateway.getAuditLogger = origMethod;
+    });
+    test('GET /admin/approvals returns 500 with error page when gateway throws', async () => {
+        const origMethod = gateway.getPendingApprovals;
+        gateway.getPendingApprovals = () => { throw new Error('Approvals broken'); };
+        const res = await (0, supertest_1.default)(app).get('/admin/approvals');
+        expect(res.status).toBe(500);
+        expect(res.text).toContain('Failed to load approvals');
+        expect(res.text).toContain('Approvals broken');
+        gateway.getPendingApprovals = origMethod;
+    });
+    test('GET /admin/policies returns 500 with error page when gateway throws', async () => {
+        const origMethod = gateway.getCurrentPolicy;
+        gateway.getCurrentPolicy = () => { throw new Error('Policy broken'); };
+        const res = await (0, supertest_1.default)(app).get('/admin/policies');
+        expect(res.status).toBe(500);
+        expect(res.text).toContain('Failed to load policies');
+        expect(res.text).toContain('Policy broken');
+        gateway.getCurrentPolicy = origMethod;
+    });
+    test('GET /admin/budgets returns 500 with error page when gateway throws', async () => {
+        const origMethod = gateway.getBudgetManager;
+        gateway.getBudgetManager = () => { throw new Error('Budget broken'); };
+        const res = await (0, supertest_1.default)(app).get('/admin/budgets');
+        expect(res.status).toBe(500);
+        expect(res.text).toContain('Failed to load budgets');
+        expect(res.text).toContain('Budget broken');
+        gateway.getBudgetManager = origMethod;
+    });
+    test('GET /admin/traces returns 500 with error page when gateway throws', async () => {
+        const origMethod = gateway.getAuditLogger;
+        gateway.getAuditLogger = () => { throw new Error('Traces broken'); };
+        const res = await (0, supertest_1.default)(app).get('/admin/traces');
+        expect(res.status).toBe(500);
+        expect(res.text).toContain('Failed to load traces');
+        expect(res.text).toContain('Traces broken');
+        gateway.getAuditLogger = origMethod;
+    });
+    test('GET /admin/traces/:task_id returns 500 with error page when gateway throws', async () => {
+        const origMethod = gateway.getTaskTrace;
+        gateway.getTaskTrace = () => { throw new Error('Trace detail broken'); };
+        const res = await (0, supertest_1.default)(app).get('/admin/traces/task-1');
+        expect(res.status).toBe(500);
+        expect(res.text).toContain('Failed to load trace detail');
+        expect(res.text).toContain('Trace detail broken');
+        gateway.getTaskTrace = origMethod;
+    });
+});
+// ===========================================================================
+// Traces Pagination
+// ===========================================================================
+describe('Admin Traces Pagination', () => {
+    function seedManyTraces(count) {
+        const auditLogger = gateway.getAuditLogger();
+        for (let i = 0; i < count; i++) {
+            auditLogger.log({
+                event_type: 'TOOL_CALL_RECEIVED',
+                tool_call_id: `tc-page-${i}`,
+                task_id: `task-page-${i}`,
+                workspace_id: 'ws_test',
+                actor_id: 'user-1',
+                tool_name: 'http.request',
+                metadata: {},
+            });
+        }
+    }
+    test('GET /admin/traces with pagination params returns paginated results', async () => {
+        seedManyTraces(5);
+        const res = await (0, supertest_1.default)(app).get('/admin/traces?page=1&limit=2');
+        expect(res.status).toBe(200);
+        // Should show "Page 1 of 3"
+        expect(res.text).toContain('Page 1 of 3');
+        expect(res.text).toContain('(5 total)');
+        expect(res.text).toContain('Next');
+    });
+    test('GET /admin/traces page 2 shows next set of tasks', async () => {
+        seedManyTraces(5);
+        const res = await (0, supertest_1.default)(app).get('/admin/traces?page=2&limit=2');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Page 2 of 3');
+        expect(res.text).toContain('Previous');
+        expect(res.text).toContain('Next');
+    });
+    test('GET /admin/traces last page disables Next button', async () => {
+        seedManyTraces(5);
+        const res = await (0, supertest_1.default)(app).get('/admin/traces?page=3&limit=2');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('Page 3 of 3');
+        expect(res.text).toContain('Previous');
+    });
+    test('GET /admin/traces defaults to page=1 limit=50', async () => {
+        seedManyTraces(3);
+        const res = await (0, supertest_1.default)(app).get('/admin/traces');
+        expect(res.status).toBe(200);
+        // Should show all 3 tasks on one page (no pagination controls since totalPages=1)
+        expect(res.text).toContain('task-page-0');
+        expect(res.text).toContain('task-page-1');
+        expect(res.text).toContain('task-page-2');
+    });
+    test('GET /admin/traces with no data shows no pagination', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin/traces?page=1&limit=2');
+        expect(res.status).toBe(200);
+        expect(res.text).toContain('No trace data available');
+        expect(res.text).not.toContain('Page 1 of');
+    });
+});
+// ===========================================================================
+// Budget Spending
+// ===========================================================================
+describe('Admin Budget Spending', () => {
+    test('GET /admin/budgets shows actual spending after recording costs', async () => {
+        // Record some spending via the budget manager
+        const budgetManager = gateway.getBudgetManager();
+        const toolCall = {
+            tool_call_id: 'tc-spend-1',
+            task_id: 'task-spend-1',
+            workspace_id: 'ws_test',
+            actor: { id: 'user-spend', type: 'user' },
+            tool: { name: 'http.request', version: '1.0', capability: 'read' },
+            args: { method: 'GET', url: 'https://example.com' },
+            source: { platform: 'test' },
+            timestamp: new Date().toISOString(),
+        };
+        // Record a cost to populate spending
+        budgetManager.check(toolCall); // creates task state
+        budgetManager.record(toolCall, 0.05);
+        const res = await (0, supertest_1.default)(app).get('/admin/budgets');
+        expect(res.status).toBe(200);
+        // Should show the actual spent amount, not $0.0000
+        expect(res.text).toContain('$0.0500');
+    });
+});
+// ===========================================================================
+// Navigation
+// ===========================================================================
+describe('Admin Navigation', () => {
+    test('All pages include sidebar navigation', async () => {
+        const pages = ['/admin', '/admin/approvals', '/admin/policies', '/admin/budgets', '/admin/traces', '/admin/api-keys'];
+        for (const page of pages) {
+            const res = await (0, supertest_1.default)(app).get(page);
+            expect(res.status).toBe(200);
+            expect(res.text).toContain('class="sidebar"');
+            expect(res.text).toContain('href="/admin"');
+            expect(res.text).toContain('href="/admin/approvals"');
+            expect(res.text).toContain('href="/admin/policies"');
+            expect(res.text).toContain('href="/admin/budgets"');
+            expect(res.text).toContain('href="/admin/traces"');
+            expect(res.text).toContain('href="/admin/api-keys"');
+        }
+    });
+    test('Active nav is highlighted on each page', async () => {
+        const res = await (0, supertest_1.default)(app).get('/admin');
+        expect(res.status).toBe(200);
+        // The Dashboard link should have the active class
+        expect(res.text).toContain('href="/admin" class="active"');
+    });
+});
+//# sourceMappingURL=admin.test.js.map