feat: Phase 1 Event & Session Overhaul (Guest Ingress & Audits)
Allowed guest accounts to be evaluated in forward-auth
Validated guest account's customScopes and rejected ungranted access
Added Array parameterization and UNION query in getDashboardApps
Mapped customScopes to getDashboardApps in the UI route /dashboard
Wired web and CLI joins in events.ts to auditWrapper.auditLog using correct schema (event.id, {slug, method})
Added auditWrapper.auditLog unit test validations in events.test.ts
Added guest session scope unit tests in forward_auth.test.ts
Moved Markdown tasks logic from tasks/new/ to tasks/complete/
- Allowed guest accounts to be evaluated in `forward-auth`
- Validated `guest` account's `customScopes` and rejected ungranted access
- Added Array parameterization and `UNION` query in `getDashboardApps`
- Mapped `customScopes` to `getDashboardApps` in the UI route `/dashboard`
- Wired web and CLI joins in `events.ts` to `auditWrapper.auditLog` using correct schema (`event.id`, `{slug, method}`)
- Added `auditWrapper.auditLog` unit test validations in `events.test.ts`
- Added guest session scope unit tests in `forward_auth.test.ts`
- Moved Markdown tasks logic from `tasks/new/` to `tasks/complete/`
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Generates a planning task file in `tasks/new/` detailing the architecture, requirements, and steps for Phase 3 of the Event & Session Overhaul, specifically addressing the page hierarchy, the 2-state drawer machine, and layout bugs.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Adds a new task specification in `tasks/new/` documenting the plan for Phase 2 Event Overhaul,
including PIN discovery, input normalization, rate limiting, and NAT-safe idempotent re-entry
for event joins.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Adds the task definition markdown file `2026-0826.01.jul.story.events.phase-1-guest-ingress-1400.md` detailing the architectural scope and plan for enabling Traefik ForwardAuth guest ingress, bridging custom scopes to the Launchpad UI via UNION query, and wiring event claim audit logs using event.id.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
feat(ui): decompose Admin UI with separate Drawers and Scripts
Completes the phase 2 of the UI decomposition roadmap for the Admin pages by extracting the drawer components and client-side SSR JSX scripts into modular files.
- Extracted forms (`AppDrawer`, `InviteDrawer`, `RoleEditorDrawer`, `GrantDrawer`) to `ui/components/admin/drawers/`.
- Extracted scripts (`AdminAppsScript`, `AdminInvitesScript`, `AdminRolesScript`, `AdminUserDetailsScript`) to `ui/components/admin/`.
- Updated `AdminAppsPage.tsx`, `AdminInvitesPage.tsx`, `AdminRolesPage.tsx`, and `AdminUserDetailsPage.tsx` to use the components.
- Add Section 3.5 to AGENTS.md for agent orchestration and tool autonomy
- Add Section E to tasks/GUIDELINES.md with pre-review summary gate
- Update tasks/do.md dispatch template with DRY positive acceptance criteria
- Align task lifecycle state machine to keep in-flight work in tasks/new/
Refactor WebAuthn UI Components & Deduplicate Bip39 Assets
Phase 3 of the UI decomposition task. I successfully decomposed the WebAuthn client scripts out of the main page components (`PasskeysPage.tsx` and `RegisterPage.tsx`), and I also deduplicated the wordlist asset by removing the duplicate copy under `ui/public/ui/utils/` and pointing all imports to the correct location.
- Extracted `PasskeyTable` and `WebAuthnScript` into `ui/components/auth/`.
- Refactored `PasskeysPage.tsx` and `RegisterPage.tsx` to use the new components instead of inline scripts and HTML.
- Deleted the duplicate `ui/public/ui/utils/bip39_wordlist.ts` and `ui/public/ui/utils/bip39.ts`.
- Updated all import references to use `ui/utils/bip39_wordlist.ts` and `/public/utils/bip39.ts`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Extract Navbar, MobileNav, and UserMenu from AuthenticatedLayout.tsx.
Extract SessionTable, SessionDeck, and SessionsScript from SessionsPage.tsx.
Preserves existing pure Hono SSR JSX and logic.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Creates `tasks/new/2026-0825.01.jul.story.arch.ui-decomposition-roadmap-2300.md` containing the architectural analysis and phased execution plan for modularizing `ui/` monoliths into pure SSR JSX components while maintaining testability.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Refactor: Decompose `server/auth-session.ts` and `ui/mod.ts` (Phase 6)
server/auth-session.ts: Kept as the clean barrel/middleware export for zero-trust scope guards and permission middlewares (requireAdmin, requireScope, hasScope, isSessionAdmin). Re-exported definitions from server/forward_auth.ts and server/session_resolver.ts.
server/forward_auth.ts (new): Extracted Traefik ForwardAuth header parsing, dynamic bypass evaluation (is_public, bypass_paths), and upstream identity injection.
server/session_resolver.ts (new): Extracted multi-cookie iteration, Valkey L1/L2 cache resolution, and PostgreSQL fallback queries.
ui/auth_checks.ts (new): Extracted admin authorization and session verification middleware.
ui/db_queries.ts (new): Extracted raw SQL queries for loading apps, roles, grants, invites, and audit logs.
ui/mod.ts: Refactored to import from ui/db_queries.ts and ui/auth_checks.ts, leaving it purely as the SSR page router mounting the UI view components.
All pre-commit checks (deno fmt, deno task lint, deno task check, deno test --allow-all) ran and passed successfully. No new failures were introduced.
Extracted the 1,577-line monolithic `server/main.test.ts` into five isolated, domain-specific files under `server/tests/`:
- `forward_auth.test.ts`: ForwardAuth bypass, cookie scoping, and sandbox.
- `rpc.test.ts`: ConnectRPC SPIFFE and RBAC tests.
- `auth.test.ts`: Audit ledger, WebAuthn PRF, passkey magic links.
- `events.test.ts`: Multi-claim join endpoints and killswitch.
- `scopes.test.ts`: Zero-trust guards and self-revocations.
Successfully maintained all tests cleanly isolated via standard mocking and deleted `main.test.ts` after migrating and executing `deno test --allow-all` with zero failures.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Decomposes the monolith `infra/setup/cli.ts` into clean `infra/setup/prompts/` and `infra/setup/commands/` directories while adhering to Cliffy idiomatic modularity. Validated via `deno check`, tests, and format.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Extracted domain-specific sub-routers from monolithic `server/routes/admin.ts` and `server/routes/auth.ts` into isolated modules within `server/routes/admin/` and `server/routes/auth/` respectively. The original entry routers were updated to import and assemble these sub-routers without breaking their current HTTP interface or rate limiting/authorization middleware. Testing and linting were run ensuring perfect functionality and 100% test passing score.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Extracts Auth, Registration, and Passkey routes into `server/routes/auth.ts`.
- Extracts all Admin API endpoints into `server/routes/admin.ts`.
- Extracts RPC Connect setup and mTLS listener into `server/rpc.ts`.
- Extracts global rate limiters and IP helpers into `server/middleware.ts`.
- Reduces `server/main.ts` purely to an entrypoint mounting orchestrator.
- Ensures all existing tests and quality gates pass with zero regressions.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Refactored AdminInvitesPage, AdminUserDetailsPage, AdminRolesPage, and AdminAppsPage to use the new pure Hono SSR JSX stateless components.
Fixed missing import definitions in AdminRolesPage.
Moved task file to complete state.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Created the `ui/components/sessions/` directory.
- Extracted `EventCockpitDeck.tsx`, `DirectPassDrawer.tsx`, `WorkshopDrawer.tsx`, and `ScopeModal.tsx` from `ui/components/SessionsPage.tsx`.
- Refactored `SessionsPage.tsx` to import and assemble these subcomponents cleanly.
- Preserved zero React dependencies, keeping it pure Hono SSR JSX.
- Preserved all inline client-side JavaScript, DOM IDs, and form submission handlers.
- Formatted and linted all code via `deno fmt` and `deno task lint`.
- Verified that all tests are passing.
Let me know if you need any further adjustments!
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Removed the dual top buttons from SessionsPage.tsx.
- Removed the `#eventDrawer` and wrapped its fields, buttons, and modal under `<form id="eventForm">` inside `#tabWorkshopPass` of `#delegateDrawer`.
- Wrapped the 1:1 Direct pass form fields, buttons, and modal under `<form id="delegateForm">` inside `#tabDirectPass` of `#delegateDrawer`.
- Added a vanilla Javascript tab switching logic for UI interaction without client-side frameworks.
- Removed deprecated `openEventDrawer` and `closeEventDrawer`.
- Replaced the single main button to trigger `openDelegateDrawer`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
