This commit finalizes Phase 4 of the Event & Session Overhaul:
1. Implements session pause logic across PostgreSQL schema, Valkey cache, and `auth_forward.ts` edge check (`is_paused`).
2. Implements non-destructive operational endpoints (`/api/events/:id/rotate-pin`, `/api/events/:id/expand`, `/api/events/:id/attendees`) with Zero-Trust Ownership verification.
3. Upgrades existing `end` and `extend` endpoints in `events.ts` to utilize robust Zero-Trust Ownership queries (created_by OR isGlobalAdmin).
4. Creates `EventAttendeesDrawer.tsx` to handle live participant inspection and individual session controls (Pause, Revoke).
5. Updates `EventCockpitDeck.tsx` and `SessionsScript.tsx` to mount and drive the new controls via vanilla JavaScript, respecting zero-framework guidelines.
6. Ensures `deno fmt`, `deno task lint`, `deno task check` and `deno test` execute successfully against the new schema and API guards.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Created a detailed Markdown task specification in `tasks/new/` for Phase 4 of the event system overhaul, outlining the database updates for session pausing, API endpoints for live controls, and UI enhancements for the attendee slide-out drawer based on provided architectural guidance.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Moved `EventCockpitDeck` below main header in `SessionsPage.tsx`
- Refactored `WorkshopDrawer.tsx` to strictly use a 2-state display toggle (`#eventCreateState` and `#eventHandoffState`)
- Added `aria-label`s to copy buttons for accessibility
- Configured `#status-banner` with `role="status"` and `aria-live="polite"`
- Fixed mobile title text wrapping on `#createdEventTitle`
- Fixed script emoji injection logic to prevent double emojis
- Added JS reset logic in `closeDelegateDrawer` to restore drawer states and clear form data
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Adds UI links for joining with PIN in Login and Register pages.
- Normalizes event slugs to lowercase (preserving hyphens) and event PINs to strip all hyphens/spaces to handle raw inputs.
- Implements a pre-check rate limit pattern (`isRateLimited`) to safely enforce a max of 5 failed attempts per IP window (60s) without rate-limiting successful authentications.
- Achieves NAT-safe idempotency in `POST /api/join` by extracting and reusing active event guest sessions instead of blindly incrementing claimed seats on every request.
- Integrates complete test suite coverage for these new constraints.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Allowed guest accounts to be evaluated in `forward-auth`
- Validated `guest` account's `customScopes` and rejected ungranted access
- Added Array parameterization and `UNION` query in `getDashboardApps`
- Mapped `customScopes` to `getDashboardApps` in the UI route `/dashboard`
- Wired web and CLI joins in `events.ts` to `auditWrapper.auditLog` using correct schema (`event.id`, `{slug, method}`)
- Added `auditWrapper.auditLog` unit test validations in `events.test.ts`
- Added guest session scope unit tests in `forward_auth.test.ts`
- Moved Markdown tasks logic from `tasks/new/` to `tasks/complete/`
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Generates a planning task file in `tasks/new/` detailing the architecture, requirements, and steps for Phase 3 of the Event & Session Overhaul, specifically addressing the page hierarchy, the 2-state drawer machine, and layout bugs.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Adds a new task specification in `tasks/new/` documenting the plan for Phase 2 Event Overhaul,
including PIN discovery, input normalization, rate limiting, and NAT-safe idempotent re-entry
for event joins.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Adds the task definition markdown file `2026-0826.01.jul.story.events.phase-1-guest-ingress-1400.md` detailing the architectural scope and plan for enabling Traefik ForwardAuth guest ingress, bridging custom scopes to the Launchpad UI via UNION query, and wiring event claim audit logs using event.id.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Add Section 3.5 to AGENTS.md for agent orchestration and tool autonomy
- Add Section E to tasks/GUIDELINES.md with pre-review summary gate
- Update tasks/do.md dispatch template with DRY positive acceptance criteria
- Align task lifecycle state machine to keep in-flight work in tasks/new/
- Extracted `PasskeyTable` and `WebAuthnScript` into `ui/components/auth/`.
- Refactored `PasskeysPage.tsx` and `RegisterPage.tsx` to use the new components instead of inline scripts and HTML.
- Deleted the duplicate `ui/public/ui/utils/bip39_wordlist.ts` and `ui/public/ui/utils/bip39.ts`.
- Updated all import references to use `ui/utils/bip39_wordlist.ts` and `/public/utils/bip39.ts`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Creates `tasks/new/2026-0825.01.jul.story.arch.ui-decomposition-roadmap-2300.md` containing the architectural analysis and phased execution plan for modularizing `ui/` monoliths into pure SSR JSX components while maintaining testability.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Extracted the 1,577-line monolithic `server/main.test.ts` into five isolated, domain-specific files under `server/tests/`:
- `forward_auth.test.ts`: ForwardAuth bypass, cookie scoping, and sandbox.
- `rpc.test.ts`: ConnectRPC SPIFFE and RBAC tests.
- `auth.test.ts`: Audit ledger, WebAuthn PRF, passkey magic links.
- `events.test.ts`: Multi-claim join endpoints and killswitch.
- `scopes.test.ts`: Zero-trust guards and self-revocations.
Successfully maintained all tests cleanly isolated via standard mocking and deleted `main.test.ts` after migrating and executing `deno test --allow-all` with zero failures.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Decomposes the monolith `infra/setup/cli.ts` into clean `infra/setup/prompts/` and `infra/setup/commands/` directories while adhering to Cliffy idiomatic modularity. Validated via `deno check`, tests, and format.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Extracts Auth, Registration, and Passkey routes into `server/routes/auth.ts`.
- Extracts all Admin API endpoints into `server/routes/admin.ts`.
- Extracts RPC Connect setup and mTLS listener into `server/rpc.ts`.
- Extracts global rate limiters and IP helpers into `server/middleware.ts`.
- Reduces `server/main.ts` purely to an entrypoint mounting orchestrator.
- Ensures all existing tests and quality gates pass with zero regressions.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Refactored AdminInvitesPage, AdminUserDetailsPage, AdminRolesPage, and AdminAppsPage to use the new pure Hono SSR JSX stateless components.
Fixed missing import definitions in AdminRolesPage.
Moved task file to complete state.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Removed the dual top buttons from SessionsPage.tsx.
- Removed the `#eventDrawer` and wrapped its fields, buttons, and modal under `<form id="eventForm">` inside `#tabWorkshopPass` of `#delegateDrawer`.
- Wrapped the 1:1 Direct pass form fields, buttons, and modal under `<form id="delegateForm">` inside `#tabDirectPass` of `#delegateDrawer`.
- Added a vanilla Javascript tab switching logic for UI interaction without client-side frameworks.
- Removed deprecated `openEventDrawer` and `closeEventDrawer`.
- Replaced the single main button to trigger `openDelegateDrawer`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Drafts a task specification file `tasks/new/2026-0825.01.jul.story.protocol.universal-agent-framework-1945.md` outlining the extraction of the multi-agent orchestration workflow from Auth-Yes into a clean, reusable, repository-agnostic blueprint. This specification adheres to `tasks/GUIDELINES.md` and covers both a foundational architecture guide and a drop-in scaffolding template bundle.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Create a system analysis task plan in `tasks/new/` detailing how to redesign
the Sessions management page's header and unified drawer, strictly adhering to
the Auth-Yes SSR JSX standards and vanilla JS implementations.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Drafts a comprehensive task specification for implementing zero-trust
scope guards on internal API routes and SSR UI pages, as requested.
The file adheres strictly to the repository's Kanban and Markdown
metadata guidelines.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Implements the GET /pass?token=... endpoint for validating session tokens, resolving the correct target application domain dynamically, and routing users seamlessly using ephemeral 1-click magic links.
Also updates the Sessions Hub UI hand-off modal to display the 1-Click Magic Link and adds full test coverage.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
