Generates a planning task file in `tasks/new/` detailing the architecture, requirements, and steps for Phase 3 of the Event & Session Overhaul, specifically addressing the page hierarchy, the 2-state drawer machine, and layout bugs.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
feat(ui): decompose Admin UI with separate Drawers and Scripts
Completes the phase 2 of the UI decomposition roadmap for the Admin pages by extracting the drawer components and client-side SSR JSX scripts into modular files.
- Extracted forms (`AppDrawer`, `InviteDrawer`, `RoleEditorDrawer`, `GrantDrawer`) to `ui/components/admin/drawers/`.
- Extracted scripts (`AdminAppsScript`, `AdminInvitesScript`, `AdminRolesScript`, `AdminUserDetailsScript`) to `ui/components/admin/`.
- Updated `AdminAppsPage.tsx`, `AdminInvitesPage.tsx`, `AdminRolesPage.tsx`, and `AdminUserDetailsPage.tsx` to use the components.
- Add Section 3.5 to AGENTS.md for agent orchestration and tool autonomy
- Add Section E to tasks/GUIDELINES.md with pre-review summary gate
- Update tasks/do.md dispatch template with DRY positive acceptance criteria
- Align task lifecycle state machine to keep in-flight work in tasks/new/
Refactor WebAuthn UI Components & Deduplicate Bip39 Assets
Phase 3 of the UI decomposition task. I successfully decomposed the WebAuthn client scripts out of the main page components (`PasskeysPage.tsx` and `RegisterPage.tsx`), and I also deduplicated the wordlist asset by removing the duplicate copy under `ui/public/ui/utils/` and pointing all imports to the correct location.
- Extracted `PasskeyTable` and `WebAuthnScript` into `ui/components/auth/`.
- Refactored `PasskeysPage.tsx` and `RegisterPage.tsx` to use the new components instead of inline scripts and HTML.
- Deleted the duplicate `ui/public/ui/utils/bip39_wordlist.ts` and `ui/public/ui/utils/bip39.ts`.
- Updated all import references to use `ui/utils/bip39_wordlist.ts` and `/public/utils/bip39.ts`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Extract Navbar, MobileNav, and UserMenu from AuthenticatedLayout.tsx.
Extract SessionTable, SessionDeck, and SessionsScript from SessionsPage.tsx.
Preserves existing pure Hono SSR JSX and logic.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Creates `tasks/new/2026-0825.01.jul.story.arch.ui-decomposition-roadmap-2300.md` containing the architectural analysis and phased execution plan for modularizing `ui/` monoliths into pure SSR JSX components while maintaining testability.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Refactor: Decompose `server/auth-session.ts` and `ui/mod.ts` (Phase 6)
server/auth-session.ts: Kept as the clean barrel/middleware export for zero-trust scope guards and permission middlewares (requireAdmin, requireScope, hasScope, isSessionAdmin). Re-exported definitions from server/forward_auth.ts and server/session_resolver.ts.
server/forward_auth.ts (new): Extracted Traefik ForwardAuth header parsing, dynamic bypass evaluation (is_public, bypass_paths), and upstream identity injection.
server/session_resolver.ts (new): Extracted multi-cookie iteration, Valkey L1/L2 cache resolution, and PostgreSQL fallback queries.
ui/auth_checks.ts (new): Extracted admin authorization and session verification middleware.
ui/db_queries.ts (new): Extracted raw SQL queries for loading apps, roles, grants, invites, and audit logs.
ui/mod.ts: Refactored to import from ui/db_queries.ts and ui/auth_checks.ts, leaving it purely as the SSR page router mounting the UI view components.
All pre-commit checks (deno fmt, deno task lint, deno task check, deno test --allow-all) ran and passed successfully. No new failures were introduced.
Extracted the 1,577-line monolithic `server/main.test.ts` into five isolated, domain-specific files under `server/tests/`:
- `forward_auth.test.ts`: ForwardAuth bypass, cookie scoping, and sandbox.
- `rpc.test.ts`: ConnectRPC SPIFFE and RBAC tests.
- `auth.test.ts`: Audit ledger, WebAuthn PRF, passkey magic links.
- `events.test.ts`: Multi-claim join endpoints and killswitch.
- `scopes.test.ts`: Zero-trust guards and self-revocations.
Successfully maintained all tests cleanly isolated via standard mocking and deleted `main.test.ts` after migrating and executing `deno test --allow-all` with zero failures.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Decomposes the monolith `infra/setup/cli.ts` into clean `infra/setup/prompts/` and `infra/setup/commands/` directories while adhering to Cliffy idiomatic modularity. Validated via `deno check`, tests, and format.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Extracted domain-specific sub-routers from monolithic `server/routes/admin.ts` and `server/routes/auth.ts` into isolated modules within `server/routes/admin/` and `server/routes/auth/` respectively. The original entry routers were updated to import and assemble these sub-routers without breaking their current HTTP interface or rate limiting/authorization middleware. Testing and linting were run ensuring perfect functionality and 100% test passing score.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Extracts Auth, Registration, and Passkey routes into `server/routes/auth.ts`.
- Extracts all Admin API endpoints into `server/routes/admin.ts`.
- Extracts RPC Connect setup and mTLS listener into `server/rpc.ts`.
- Extracts global rate limiters and IP helpers into `server/middleware.ts`.
- Reduces `server/main.ts` purely to an entrypoint mounting orchestrator.
- Ensures all existing tests and quality gates pass with zero regressions.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Refactored AdminInvitesPage, AdminUserDetailsPage, AdminRolesPage, and AdminAppsPage to use the new pure Hono SSR JSX stateless components.
Fixed missing import definitions in AdminRolesPage.
Moved task file to complete state.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Created the `ui/components/sessions/` directory.
- Extracted `EventCockpitDeck.tsx`, `DirectPassDrawer.tsx`, `WorkshopDrawer.tsx`, and `ScopeModal.tsx` from `ui/components/SessionsPage.tsx`.
- Refactored `SessionsPage.tsx` to import and assemble these subcomponents cleanly.
- Preserved zero React dependencies, keeping it pure Hono SSR JSX.
- Preserved all inline client-side JavaScript, DOM IDs, and form submission handlers.
- Formatted and linted all code via `deno fmt` and `deno task lint`.
- Verified that all tests are passing.
Let me know if you need any further adjustments!
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Removed the dual top buttons from SessionsPage.tsx.
- Removed the `#eventDrawer` and wrapped its fields, buttons, and modal under `<form id="eventForm">` inside `#tabWorkshopPass` of `#delegateDrawer`.
- Wrapped the 1:1 Direct pass form fields, buttons, and modal under `<form id="delegateForm">` inside `#tabDirectPass` of `#delegateDrawer`.
- Added a vanilla Javascript tab switching logic for UI interaction without client-side frameworks.
- Removed deprecated `openEventDrawer` and `closeEventDrawer`.
- Replaced the single main button to trigger `openDelegateDrawer`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Drafts a task specification file `tasks/new/2026-0825.01.jul.story.protocol.universal-agent-framework-1945.md` outlining the extraction of the multi-agent orchestration workflow from Auth-Yes into a clean, reusable, repository-agnostic blueprint. This specification adheres to `tasks/GUIDELINES.md` and covers both a foundational architecture guide and a drop-in scaffolding template bundle.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
