33 lines
2.0 KiB
Markdown
33 lines
2.0 KiB
Markdown
|
# Minimal admin panel — 14 October 2026
|
|||
|
|
|
|||
|
|
Implemented `/admin` with human administrator sign-in, paged credential metadata,
|
|||
|
|
project-scoped issuance, one-time secret display, confirmed revocation and latest
|
|||
|
|
50 credential-management events. The activity log excludes runtime/agent logs.
|
|||
|
|
|
|||
|
|
Baseline: application, tests, web and schema directories were already untracked;
|
|||
|
|
the agent submodule and several architecture documents were already dirty. No commit
|
|||
|
|
was made and unrelated changes were preserved. The shared operation catalog and
|
|||
|
|
bundled agent contract/hash were refreshed for the four new HTTP operations.
|
|||
|
|
|
|||
|
|
PASS:
|
|||
|
|
|
|||
|
|
- `scripts/python-tool pytest -q`: 179 tests.
|
|||
|
|
- `npm --prefix web run check`: TypeScript, ESLint, 17 frontend tests.
|
|||
|
|
- `npm --prefix web run build`: production bundle.
|
|||
|
|
- Ruff check and format check, mypy, module boundary checker.
|
|||
|
|
- API tests: viewer/mixed-agent denial, no authentication, CSRF/origin, body limit,
|
|||
|
|
duplicate IDs, secret-free lists/events, self-revocation rejection, durable audit,
|
|||
|
|
revocation invalidates bearer authentication and existing browser sessions.
|
|||
|
|
- Shared preview using disposable data: sign-in, credential/project/event reads,
|
|||
|
|
credential creation (201), one-time secret displayed. No operator keys modified.
|
|||
|
|
- Live web `/admin` loads at `https://msi.tail0b014a.ts.net:10000/admin`; at a requested
|
|||
|
|
390×844 viewport the preview reported 391×845 and no document horizontal overflow.
|
|||
|
|
- Local API restarted through PM2; health succeeds and unauthenticated admin reads
|
|||
|
|
return authentication errors.
|
|||
|
|
|
|||
|
|
LIMITED: the shared preview routed successive calls between multiple clients and
|
|||
|
|
repeatedly lost the signed-in state or failed snapshot calls. Full browser revocation,
|
|||
|
|
keyboard walkthrough and authenticated responsive screenshot inspection remain
|
|||
|
|
unverified. Component/API tests cover creation, confirmation, CSRF and revocation;
|
|||
|
|
component tests cover reconnect after session expiry. No screen-reader or axe audit
|
|||
|
|
was performed. The temporary fixture server was stopped after verification.
|